diff options
| author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-05-04 12:41:41 +0000 |
|---|---|---|
| committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-05-04 12:41:41 +0000 |
| commit | 10ee2acdd26a7f1298c6f6d6b7af9b469fe29b87 (patch) | |
| tree | bdffd5d80c26cf4a7a518281a204be1ace85b4c1 /vendor/fiat-crypto/src | |
| parent | Releasing progress-linux version 1.70.0+dfsg1-9~progress7.99u1. (diff) | |
| download | rustc-10ee2acdd26a7f1298c6f6d6b7af9b469fe29b87.tar.xz rustc-10ee2acdd26a7f1298c6f6d6b7af9b469fe29b87.zip | |
Merging upstream version 1.70.0+dfsg2.
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'vendor/fiat-crypto/src')
25 files changed, 79829 insertions, 0 deletions
diff --git a/vendor/fiat-crypto/src/curve25519_32.rs b/vendor/fiat-crypto/src/curve25519_32.rs new file mode 100644 index 000000000..0a48a8a97 --- /dev/null +++ b/vendor/fiat-crypto/src/curve25519_32.rs @@ -0,0 +1,990 @@ +//! Autogenerated: 'src/ExtractionOCaml/unsaturated_solinas' --lang Rust --inline 25519 32 '(auto)' '2^255 - 19' carry_mul carry_square carry add sub opp selectznz to_bytes from_bytes relax carry_scmul121666 +//! curve description: 25519 +//! machine_wordsize = 32 (from "32") +//! requested operations: carry_mul, carry_square, carry, add, sub, opp, selectznz, to_bytes, from_bytes, relax, carry_scmul121666 +//! n = 10 (from "(auto)") +//! s-c = 2^255 - [(1, 19)] (from "2^255 - 19") +//! tight_bounds_multiplier = 1 (from "") +//! +//! Computed values: +//! carry_chain = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1] +//! eval z = z[0] + (z[1] << 26) + (z[2] << 51) + (z[3] << 77) + (z[4] << 102) + (z[5] << 128) + (z[6] << 153) + (z[7] << 179) + (z[8] << 204) + (z[9] << 230) +//! bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248) +//! balance = [0x7ffffda, 0x3fffffe, 0x7fffffe, 0x3fffffe, 0x7fffffe, 0x3fffffe, 0x7fffffe, 0x3fffffe, 0x7fffffe, 0x3fffffe] + +#![allow(unused_parens)] +#![allow(non_camel_case_types)] + +pub type fiat_25519_u1 = u8; +pub type fiat_25519_i1 = i8; +pub type fiat_25519_u2 = u8; +pub type fiat_25519_i2 = i8; + +/* The type fiat_25519_loose_field_element is a field element with loose bounds. */ +/* Bounds: [[0x0 ~> 0xc000000], [0x0 ~> 0x6000000], [0x0 ~> 0xc000000], [0x0 ~> 0x6000000], [0x0 ~> 0xc000000], [0x0 ~> 0x6000000], [0x0 ~> 0xc000000], [0x0 ~> 0x6000000], [0x0 ~> 0xc000000], [0x0 ~> 0x6000000]] */ +pub type fiat_25519_loose_field_element = [u32; 10]; + +/* The type fiat_25519_tight_field_element is a field element with tight bounds. */ +/* Bounds: [[0x0 ~> 0x4000000], [0x0 ~> 0x2000000], [0x0 ~> 0x4000000], [0x0 ~> 0x2000000], [0x0 ~> 0x4000000], [0x0 ~> 0x2000000], [0x0 ~> 0x4000000], [0x0 ~> 0x2000000], [0x0 ~> 0x4000000], [0x0 ~> 0x2000000]] */ +pub type fiat_25519_tight_field_element = [u32; 10]; + + +/// The function fiat_25519_addcarryx_u26 is an addition with carry. +/// +/// Postconditions: +/// out1 = (arg1 + arg2 + arg3) mod 2^26 +/// out2 = ⌊(arg1 + arg2 + arg3) / 2^26⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0x3ffffff] +/// arg3: [0x0 ~> 0x3ffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0x3ffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_25519_addcarryx_u26(out1: &mut u32, out2: &mut fiat_25519_u1, arg1: fiat_25519_u1, arg2: u32, arg3: u32) -> () { + let x1: u32 = (((arg1 as u32) + arg2) + arg3); + let x2: u32 = (x1 & 0x3ffffff); + let x3: fiat_25519_u1 = ((x1 >> 26) as fiat_25519_u1); + *out1 = x2; + *out2 = x3; +} + +/// The function fiat_25519_subborrowx_u26 is a subtraction with borrow. +/// +/// Postconditions: +/// out1 = (-arg1 + arg2 + -arg3) mod 2^26 +/// out2 = -⌊(-arg1 + arg2 + -arg3) / 2^26⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0x3ffffff] +/// arg3: [0x0 ~> 0x3ffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0x3ffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_25519_subborrowx_u26(out1: &mut u32, out2: &mut fiat_25519_u1, arg1: fiat_25519_u1, arg2: u32, arg3: u32) -> () { + let x1: i32 = ((((((arg2 as i64) - (arg1 as i64)) as i32) as i64) - (arg3 as i64)) as i32); + let x2: fiat_25519_i1 = ((x1 >> 26) as fiat_25519_i1); + let x3: u32 = (((x1 as i64) & (0x3ffffff as i64)) as u32); + *out1 = x3; + *out2 = (((0x0 as fiat_25519_i2) - (x2 as fiat_25519_i2)) as fiat_25519_u1); +} + +/// The function fiat_25519_addcarryx_u25 is an addition with carry. +/// +/// Postconditions: +/// out1 = (arg1 + arg2 + arg3) mod 2^25 +/// out2 = ⌊(arg1 + arg2 + arg3) / 2^25⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0x1ffffff] +/// arg3: [0x0 ~> 0x1ffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0x1ffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_25519_addcarryx_u25(out1: &mut u32, out2: &mut fiat_25519_u1, arg1: fiat_25519_u1, arg2: u32, arg3: u32) -> () { + let x1: u32 = (((arg1 as u32) + arg2) + arg3); + let x2: u32 = (x1 & 0x1ffffff); + let x3: fiat_25519_u1 = ((x1 >> 25) as fiat_25519_u1); + *out1 = x2; + *out2 = x3; +} + +/// The function fiat_25519_subborrowx_u25 is a subtraction with borrow. +/// +/// Postconditions: +/// out1 = (-arg1 + arg2 + -arg3) mod 2^25 +/// out2 = -⌊(-arg1 + arg2 + -arg3) / 2^25⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0x1ffffff] +/// arg3: [0x0 ~> 0x1ffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0x1ffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_25519_subborrowx_u25(out1: &mut u32, out2: &mut fiat_25519_u1, arg1: fiat_25519_u1, arg2: u32, arg3: u32) -> () { + let x1: i32 = ((((((arg2 as i64) - (arg1 as i64)) as i32) as i64) - (arg3 as i64)) as i32); + let x2: fiat_25519_i1 = ((x1 >> 25) as fiat_25519_i1); + let x3: u32 = (((x1 as i64) & (0x1ffffff as i64)) as u32); + *out1 = x3; + *out2 = (((0x0 as fiat_25519_i2) - (x2 as fiat_25519_i2)) as fiat_25519_u1); +} + +/// The function fiat_25519_cmovznz_u32 is a single-word conditional move. +/// +/// Postconditions: +/// out1 = (if arg1 = 0 then arg2 else arg3) +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffff] +/// arg3: [0x0 ~> 0xffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +#[inline] +pub fn fiat_25519_cmovznz_u32(out1: &mut u32, arg1: fiat_25519_u1, arg2: u32, arg3: u32) -> () { + let x1: fiat_25519_u1 = (!(!arg1)); + let x2: u32 = ((((((0x0 as fiat_25519_i2) - (x1 as fiat_25519_i2)) as fiat_25519_i1) as i64) & (0xffffffff as i64)) as u32); + let x3: u32 = ((x2 & arg3) | ((!x2) & arg2)); + *out1 = x3; +} + +/// The function fiat_25519_carry_mul multiplies two field elements and reduces the result. +/// +/// Postconditions: +/// eval out1 mod m = (eval arg1 * eval arg2) mod m +/// +#[inline] +pub fn fiat_25519_carry_mul(out1: &mut fiat_25519_tight_field_element, arg1: &fiat_25519_loose_field_element, arg2: &fiat_25519_loose_field_element) -> () { + let x1: u64 = (((arg1[9]) as u64) * (((arg2[9]) * 0x26) as u64)); + let x2: u64 = (((arg1[9]) as u64) * (((arg2[8]) * 0x13) as u64)); + let x3: u64 = (((arg1[9]) as u64) * (((arg2[7]) * 0x26) as u64)); + let x4: u64 = (((arg1[9]) as u64) * (((arg2[6]) * 0x13) as u64)); + let x5: u64 = (((arg1[9]) as u64) * (((arg2[5]) * 0x26) as u64)); + let x6: u64 = (((arg1[9]) as u64) * (((arg2[4]) * 0x13) as u64)); + let x7: u64 = (((arg1[9]) as u64) * (((arg2[3]) * 0x26) as u64)); + let x8: u64 = (((arg1[9]) as u64) * (((arg2[2]) * 0x13) as u64)); + let x9: u64 = (((arg1[9]) as u64) * (((arg2[1]) * 0x26) as u64)); + let x10: u64 = (((arg1[8]) as u64) * (((arg2[9]) * 0x13) as u64)); + let x11: u64 = (((arg1[8]) as u64) * (((arg2[8]) * 0x13) as u64)); + let x12: u64 = (((arg1[8]) as u64) * (((arg2[7]) * 0x13) as u64)); + let x13: u64 = (((arg1[8]) as u64) * (((arg2[6]) * 0x13) as u64)); + let x14: u64 = (((arg1[8]) as u64) * (((arg2[5]) * 0x13) as u64)); + let x15: u64 = (((arg1[8]) as u64) * (((arg2[4]) * 0x13) as u64)); + let x16: u64 = (((arg1[8]) as u64) * (((arg2[3]) * 0x13) as u64)); + let x17: u64 = (((arg1[8]) as u64) * (((arg2[2]) * 0x13) as u64)); + let x18: u64 = (((arg1[7]) as u64) * (((arg2[9]) * 0x26) as u64)); + let x19: u64 = (((arg1[7]) as u64) * (((arg2[8]) * 0x13) as u64)); + let x20: u64 = (((arg1[7]) as u64) * (((arg2[7]) * 0x26) as u64)); + let x21: u64 = (((arg1[7]) as u64) * (((arg2[6]) * 0x13) as u64)); + let x22: u64 = (((arg1[7]) as u64) * (((arg2[5]) * 0x26) as u64)); + let x23: u64 = (((arg1[7]) as u64) * (((arg2[4]) * 0x13) as u64)); + let x24: u64 = (((arg1[7]) as u64) * (((arg2[3]) * 0x26) as u64)); + let x25: u64 = (((arg1[6]) as u64) * (((arg2[9]) * 0x13) as u64)); + let x26: u64 = (((arg1[6]) as u64) * (((arg2[8]) * 0x13) as u64)); + let x27: u64 = (((arg1[6]) as u64) * (((arg2[7]) * 0x13) as u64)); + let x28: u64 = (((arg1[6]) as u64) * (((arg2[6]) * 0x13) as u64)); + let x29: u64 = (((arg1[6]) as u64) * (((arg2[5]) * 0x13) as u64)); + let x30: u64 = (((arg1[6]) as u64) * (((arg2[4]) * 0x13) as u64)); + let x31: u64 = (((arg1[5]) as u64) * (((arg2[9]) * 0x26) as u64)); + let x32: u64 = (((arg1[5]) as u64) * (((arg2[8]) * 0x13) as u64)); + let x33: u64 = (((arg1[5]) as u64) * (((arg2[7]) * 0x26) as u64)); + let x34: u64 = (((arg1[5]) as u64) * (((arg2[6]) * 0x13) as u64)); + let x35: u64 = (((arg1[5]) as u64) * (((arg2[5]) * 0x26) as u64)); + let x36: u64 = (((arg1[4]) as u64) * (((arg2[9]) * 0x13) as u64)); + let x37: u64 = (((arg1[4]) as u64) * (((arg2[8]) * 0x13) as u64)); + let x38: u64 = (((arg1[4]) as u64) * (((arg2[7]) * 0x13) as u64)); + let x39: u64 = (((arg1[4]) as u64) * (((arg2[6]) * 0x13) as u64)); + let x40: u64 = (((arg1[3]) as u64) * (((arg2[9]) * 0x26) as u64)); + let x41: u64 = (((arg1[3]) as u64) * (((arg2[8]) * 0x13) as u64)); + let x42: u64 = (((arg1[3]) as u64) * (((arg2[7]) * 0x26) as u64)); + let x43: u64 = (((arg1[2]) as u64) * (((arg2[9]) * 0x13) as u64)); + let x44: u64 = (((arg1[2]) as u64) * (((arg2[8]) * 0x13) as u64)); + let x45: u64 = (((arg1[1]) as u64) * (((arg2[9]) * 0x26) as u64)); + let x46: u64 = (((arg1[9]) as u64) * ((arg2[0]) as u64)); + let x47: u64 = (((arg1[8]) as u64) * ((arg2[1]) as u64)); + let x48: u64 = (((arg1[8]) as u64) * ((arg2[0]) as u64)); + let x49: u64 = (((arg1[7]) as u64) * ((arg2[2]) as u64)); + let x50: u64 = (((arg1[7]) as u64) * (((arg2[1]) * 0x2) as u64)); + let x51: u64 = (((arg1[7]) as u64) * ((arg2[0]) as u64)); + let x52: u64 = (((arg1[6]) as u64) * ((arg2[3]) as u64)); + let x53: u64 = (((arg1[6]) as u64) * ((arg2[2]) as u64)); + let x54: u64 = (((arg1[6]) as u64) * ((arg2[1]) as u64)); + let x55: u64 = (((arg1[6]) as u64) * ((arg2[0]) as u64)); + let x56: u64 = (((arg1[5]) as u64) * ((arg2[4]) as u64)); + let x57: u64 = (((arg1[5]) as u64) * (((arg2[3]) * 0x2) as u64)); + let x58: u64 = (((arg1[5]) as u64) * ((arg2[2]) as u64)); + let x59: u64 = (((arg1[5]) as u64) * (((arg2[1]) * 0x2) as u64)); + let x60: u64 = (((arg1[5]) as u64) * ((arg2[0]) as u64)); + let x61: u64 = (((arg1[4]) as u64) * ((arg2[5]) as u64)); + let x62: u64 = (((arg1[4]) as u64) * ((arg2[4]) as u64)); + let x63: u64 = (((arg1[4]) as u64) * ((arg2[3]) as u64)); + let x64: u64 = (((arg1[4]) as u64) * ((arg2[2]) as u64)); + let x65: u64 = (((arg1[4]) as u64) * ((arg2[1]) as u64)); + let x66: u64 = (((arg1[4]) as u64) * ((arg2[0]) as u64)); + let x67: u64 = (((arg1[3]) as u64) * ((arg2[6]) as u64)); + let x68: u64 = (((arg1[3]) as u64) * (((arg2[5]) * 0x2) as u64)); + let x69: u64 = (((arg1[3]) as u64) * ((arg2[4]) as u64)); + let x70: u64 = (((arg1[3]) as u64) * (((arg2[3]) * 0x2) as u64)); + let x71: u64 = (((arg1[3]) as u64) * ((arg2[2]) as u64)); + let x72: u64 = (((arg1[3]) as u64) * (((arg2[1]) * 0x2) as u64)); + let x73: u64 = (((arg1[3]) as u64) * ((arg2[0]) as u64)); + let x74: u64 = (((arg1[2]) as u64) * ((arg2[7]) as u64)); + let x75: u64 = (((arg1[2]) as u64) * ((arg2[6]) as u64)); + let x76: u64 = (((arg1[2]) as u64) * ((arg2[5]) as u64)); + let x77: u64 = (((arg1[2]) as u64) * ((arg2[4]) as u64)); + let x78: u64 = (((arg1[2]) as u64) * ((arg2[3]) as u64)); + let x79: u64 = (((arg1[2]) as u64) * ((arg2[2]) as u64)); + let x80: u64 = (((arg1[2]) as u64) * ((arg2[1]) as u64)); + let x81: u64 = (((arg1[2]) as u64) * ((arg2[0]) as u64)); + let x82: u64 = (((arg1[1]) as u64) * ((arg2[8]) as u64)); + let x83: u64 = (((arg1[1]) as u64) * (((arg2[7]) * 0x2) as u64)); + let x84: u64 = (((arg1[1]) as u64) * ((arg2[6]) as u64)); + let x85: u64 = (((arg1[1]) as u64) * (((arg2[5]) * 0x2) as u64)); + let x86: u64 = (((arg1[1]) as u64) * ((arg2[4]) as u64)); + let x87: u64 = (((arg1[1]) as u64) * (((arg2[3]) * 0x2) as u64)); + let x88: u64 = (((arg1[1]) as u64) * ((arg2[2]) as u64)); + let x89: u64 = (((arg1[1]) as u64) * (((arg2[1]) * 0x2) as u64)); + let x90: u64 = (((arg1[1]) as u64) * ((arg2[0]) as u64)); + let x91: u64 = (((arg1[0]) as u64) * ((arg2[9]) as u64)); + let x92: u64 = (((arg1[0]) as u64) * ((arg2[8]) as u64)); + let x93: u64 = (((arg1[0]) as u64) * ((arg2[7]) as u64)); + let x94: u64 = (((arg1[0]) as u64) * ((arg2[6]) as u64)); + let x95: u64 = (((arg1[0]) as u64) * ((arg2[5]) as u64)); + let x96: u64 = (((arg1[0]) as u64) * ((arg2[4]) as u64)); + let x97: u64 = (((arg1[0]) as u64) * ((arg2[3]) as u64)); + let x98: u64 = (((arg1[0]) as u64) * ((arg2[2]) as u64)); + let x99: u64 = (((arg1[0]) as u64) * ((arg2[1]) as u64)); + let x100: u64 = (((arg1[0]) as u64) * ((arg2[0]) as u64)); + let x101: u64 = (x100 + (x45 + (x44 + (x42 + (x39 + (x35 + (x30 + (x24 + (x17 + x9))))))))); + let x102: u64 = (x101 >> 26); + let x103: u32 = ((x101 & (0x3ffffff as u64)) as u32); + let x104: u64 = (x91 + (x82 + (x74 + (x67 + (x61 + (x56 + (x52 + (x49 + (x47 + x46))))))))); + let x105: u64 = (x92 + (x83 + (x75 + (x68 + (x62 + (x57 + (x53 + (x50 + (x48 + x1))))))))); + let x106: u64 = (x93 + (x84 + (x76 + (x69 + (x63 + (x58 + (x54 + (x51 + (x10 + x2))))))))); + let x107: u64 = (x94 + (x85 + (x77 + (x70 + (x64 + (x59 + (x55 + (x18 + (x11 + x3))))))))); + let x108: u64 = (x95 + (x86 + (x78 + (x71 + (x65 + (x60 + (x25 + (x19 + (x12 + x4))))))))); + let x109: u64 = (x96 + (x87 + (x79 + (x72 + (x66 + (x31 + (x26 + (x20 + (x13 + x5))))))))); + let x110: u64 = (x97 + (x88 + (x80 + (x73 + (x36 + (x32 + (x27 + (x21 + (x14 + x6))))))))); + let x111: u64 = (x98 + (x89 + (x81 + (x40 + (x37 + (x33 + (x28 + (x22 + (x15 + x7))))))))); + let x112: u64 = (x99 + (x90 + (x43 + (x41 + (x38 + (x34 + (x29 + (x23 + (x16 + x8))))))))); + let x113: u64 = (x102 + x112); + let x114: u64 = (x113 >> 25); + let x115: u32 = ((x113 & (0x1ffffff as u64)) as u32); + let x116: u64 = (x114 + x111); + let x117: u64 = (x116 >> 26); + let x118: u32 = ((x116 & (0x3ffffff as u64)) as u32); + let x119: u64 = (x117 + x110); + let x120: u64 = (x119 >> 25); + let x121: u32 = ((x119 & (0x1ffffff as u64)) as u32); + let x122: u64 = (x120 + x109); + let x123: u64 = (x122 >> 26); + let x124: u32 = ((x122 & (0x3ffffff as u64)) as u32); + let x125: u64 = (x123 + x108); + let x126: u64 = (x125 >> 25); + let x127: u32 = ((x125 & (0x1ffffff as u64)) as u32); + let x128: u64 = (x126 + x107); + let x129: u64 = (x128 >> 26); + let x130: u32 = ((x128 & (0x3ffffff as u64)) as u32); + let x131: u64 = (x129 + x106); + let x132: u64 = (x131 >> 25); + let x133: u32 = ((x131 & (0x1ffffff as u64)) as u32); + let x134: u64 = (x132 + x105); + let x135: u64 = (x134 >> 26); + let x136: u32 = ((x134 & (0x3ffffff as u64)) as u32); + let x137: u64 = (x135 + x104); + let x138: u64 = (x137 >> 25); + let x139: u32 = ((x137 & (0x1ffffff as u64)) as u32); + let x140: u64 = (x138 * (0x13 as u64)); + let x141: u64 = ((x103 as u64) + x140); + let x142: u32 = ((x141 >> 26) as u32); + let x143: u32 = ((x141 & (0x3ffffff as u64)) as u32); + let x144: u32 = (x142 + x115); + let x145: fiat_25519_u1 = ((x144 >> 25) as fiat_25519_u1); + let x146: u32 = (x144 & 0x1ffffff); + let x147: u32 = ((x145 as u32) + x118); + out1[0] = x143; + out1[1] = x146; + out1[2] = x147; + out1[3] = x121; + out1[4] = x124; + out1[5] = x127; + out1[6] = x130; + out1[7] = x133; + out1[8] = x136; + out1[9] = x139; +} + +/// The function fiat_25519_carry_square squares a field element and reduces the result. +/// +/// Postconditions: +/// eval out1 mod m = (eval arg1 * eval arg1) mod m +/// +#[inline] +pub fn fiat_25519_carry_square(out1: &mut fiat_25519_tight_field_element, arg1: &fiat_25519_loose_field_element) -> () { + let x1: u32 = ((arg1[9]) * 0x13); + let x2: u32 = (x1 * 0x2); + let x3: u32 = ((arg1[9]) * 0x2); + let x4: u32 = ((arg1[8]) * 0x13); + let x5: u64 = ((x4 as u64) * (0x2 as u64)); + let x6: u32 = ((arg1[8]) * 0x2); + let x7: u32 = ((arg1[7]) * 0x13); + let x8: u32 = (x7 * 0x2); + let x9: u32 = ((arg1[7]) * 0x2); + let x10: u32 = ((arg1[6]) * 0x13); + let x11: u64 = ((x10 as u64) * (0x2 as u64)); + let x12: u32 = ((arg1[6]) * 0x2); + let x13: u32 = ((arg1[5]) * 0x13); + let x14: u32 = ((arg1[5]) * 0x2); + let x15: u32 = ((arg1[4]) * 0x2); + let x16: u32 = ((arg1[3]) * 0x2); + let x17: u32 = ((arg1[2]) * 0x2); + let x18: u32 = ((arg1[1]) * 0x2); + let x19: u64 = (((arg1[9]) as u64) * ((x1 * 0x2) as u64)); + let x20: u64 = (((arg1[8]) as u64) * (x2 as u64)); + let x21: u64 = (((arg1[8]) as u64) * (x4 as u64)); + let x22: u64 = (((arg1[7]) as u64) * ((x2 as u64) * (0x2 as u64))); + let x23: u64 = (((arg1[7]) as u64) * x5); + let x24: u64 = (((arg1[7]) as u64) * ((x7 * 0x2) as u64)); + let x25: u64 = (((arg1[6]) as u64) * (x2 as u64)); + let x26: u64 = (((arg1[6]) as u64) * x5); + let x27: u64 = (((arg1[6]) as u64) * (x8 as u64)); + let x28: u64 = (((arg1[6]) as u64) * (x10 as u64)); + let x29: u64 = (((arg1[5]) as u64) * ((x2 as u64) * (0x2 as u64))); + let x30: u64 = (((arg1[5]) as u64) * x5); + let x31: u64 = (((arg1[5]) as u64) * ((x8 as u64) * (0x2 as u64))); + let x32: u64 = (((arg1[5]) as u64) * x11); + let x33: u64 = (((arg1[5]) as u64) * ((x13 * 0x2) as u64)); + let x34: u64 = (((arg1[4]) as u64) * (x2 as u64)); + let x35: u64 = (((arg1[4]) as u64) * x5); + let x36: u64 = (((arg1[4]) as u64) * (x8 as u64)); + let x37: u64 = (((arg1[4]) as u64) * x11); + let x38: u64 = (((arg1[4]) as u64) * (x14 as u64)); + let x39: u64 = (((arg1[4]) as u64) * ((arg1[4]) as u64)); + let x40: u64 = (((arg1[3]) as u64) * ((x2 as u64) * (0x2 as u64))); + let x41: u64 = (((arg1[3]) as u64) * x5); + let x42: u64 = (((arg1[3]) as u64) * ((x8 as u64) * (0x2 as u64))); + let x43: u64 = (((arg1[3]) as u64) * (x12 as u64)); + let x44: u64 = (((arg1[3]) as u64) * ((x14 * 0x2) as u64)); + let x45: u64 = (((arg1[3]) as u64) * (x15 as u64)); + let x46: u64 = (((arg1[3]) as u64) * (((arg1[3]) * 0x2) as u64)); + let x47: u64 = (((arg1[2]) as u64) * (x2 as u64)); + let x48: u64 = (((arg1[2]) as u64) * x5); + let x49: u64 = (((arg1[2]) as u64) * (x9 as u64)); + let x50: u64 = (((arg1[2]) as u64) * (x12 as u64)); + let x51: u64 = (((arg1[2]) as u64) * (x14 as u64)); + let x52: u64 = (((arg1[2]) as u64) * (x15 as u64)); + let x53: u64 = (((arg1[2]) as u64) * (x16 as u64)); + let x54: u64 = (((arg1[2]) as u64) * ((arg1[2]) as u64)); + let x55: u64 = (((arg1[1]) as u64) * ((x2 as u64) * (0x2 as u64))); + let x56: u64 = (((arg1[1]) as u64) * (x6 as u64)); + let x57: u64 = (((arg1[1]) as u64) * ((x9 * 0x2) as u64)); + let x58: u64 = (((arg1[1]) as u64) * (x12 as u64)); + let x59: u64 = (((arg1[1]) as u64) * ((x14 * 0x2) as u64)); + let x60: u64 = (((arg1[1]) as u64) * (x15 as u64)); + let x61: u64 = (((arg1[1]) as u64) * ((x16 * 0x2) as u64)); + let x62: u64 = (((arg1[1]) as u64) * (x17 as u64)); + let x63: u64 = (((arg1[1]) as u64) * (((arg1[1]) * 0x2) as u64)); + let x64: u64 = (((arg1[0]) as u64) * (x3 as u64)); + let x65: u64 = (((arg1[0]) as u64) * (x6 as u64)); + let x66: u64 = (((arg1[0]) as u64) * (x9 as u64)); + let x67: u64 = (((arg1[0]) as u64) * (x12 as u64)); + let x68: u64 = (((arg1[0]) as u64) * (x14 as u64)); + let x69: u64 = (((arg1[0]) as u64) * (x15 as u64)); + let x70: u64 = (((arg1[0]) as u64) * (x16 as u64)); + let x71: u64 = (((arg1[0]) as u64) * (x17 as u64)); + let x72: u64 = (((arg1[0]) as u64) * (x18 as u64)); + let x73: u64 = (((arg1[0]) as u64) * ((arg1[0]) as u64)); + let x74: u64 = (x73 + (x55 + (x48 + (x42 + (x37 + x33))))); + let x75: u64 = (x74 >> 26); + let x76: u32 = ((x74 & (0x3ffffff as u64)) as u32); + let x77: u64 = (x64 + (x56 + (x49 + (x43 + x38)))); + let x78: u64 = (x65 + (x57 + (x50 + (x44 + (x39 + x19))))); + let x79: u64 = (x66 + (x58 + (x51 + (x45 + x20)))); + let x80: u64 = (x67 + (x59 + (x52 + (x46 + (x22 + x21))))); + let x81: u64 = (x68 + (x60 + (x53 + (x25 + x23)))); + let x82: u64 = (x69 + (x61 + (x54 + (x29 + (x26 + x24))))); + let x83: u64 = (x70 + (x62 + (x34 + (x30 + x27)))); + let x84: u64 = (x71 + (x63 + (x40 + (x35 + (x31 + x28))))); + let x85: u64 = (x72 + (x47 + (x41 + (x36 + x32)))); + let x86: u64 = (x75 + x85); + let x87: u64 = (x86 >> 25); + let x88: u32 = ((x86 & (0x1ffffff as u64)) as u32); + let x89: u64 = (x87 + x84); + let x90: u64 = (x89 >> 26); + let x91: u32 = ((x89 & (0x3ffffff as u64)) as u32); + let x92: u64 = (x90 + x83); + let x93: u64 = (x92 >> 25); + let x94: u32 = ((x92 & (0x1ffffff as u64)) as u32); + let x95: u64 = (x93 + x82); + let x96: u64 = (x95 >> 26); + let x97: u32 = ((x95 & (0x3ffffff as u64)) as u32); + let x98: u64 = (x96 + x81); + let x99: u64 = (x98 >> 25); + let x100: u32 = ((x98 & (0x1ffffff as u64)) as u32); + let x101: u64 = (x99 + x80); + let x102: u64 = (x101 >> 26); + let x103: u32 = ((x101 & (0x3ffffff as u64)) as u32); + let x104: u64 = (x102 + x79); + let x105: u64 = (x104 >> 25); + let x106: u32 = ((x104 & (0x1ffffff as u64)) as u32); + let x107: u64 = (x105 + x78); + let x108: u64 = (x107 >> 26); + let x109: u32 = ((x107 & (0x3ffffff as u64)) as u32); + let x110: u64 = (x108 + x77); + let x111: u64 = (x110 >> 25); + let x112: u32 = ((x110 & (0x1ffffff as u64)) as u32); + let x113: u64 = (x111 * (0x13 as u64)); + let x114: u64 = ((x76 as u64) + x113); + let x115: u32 = ((x114 >> 26) as u32); + let x116: u32 = ((x114 & (0x3ffffff as u64)) as u32); + let x117: u32 = (x115 + x88); + let x118: fiat_25519_u1 = ((x117 >> 25) as fiat_25519_u1); + let x119: u32 = (x117 & 0x1ffffff); + let x120: u32 = ((x118 as u32) + x91); + out1[0] = x116; + out1[1] = x119; + out1[2] = x120; + out1[3] = x94; + out1[4] = x97; + out1[5] = x100; + out1[6] = x103; + out1[7] = x106; + out1[8] = x109; + out1[9] = x112; +} + +/// The function fiat_25519_carry reduces a field element. +/// +/// Postconditions: +/// eval out1 mod m = eval arg1 mod m +/// +#[inline] +pub fn fiat_25519_carry(out1: &mut fiat_25519_tight_field_element, arg1: &fiat_25519_loose_field_element) -> () { + let x1: u32 = (arg1[0]); + let x2: u32 = ((x1 >> 26) + (arg1[1])); + let x3: u32 = ((x2 >> 25) + (arg1[2])); + let x4: u32 = ((x3 >> 26) + (arg1[3])); + let x5: u32 = ((x4 >> 25) + (arg1[4])); + let x6: u32 = ((x5 >> 26) + (arg1[5])); + let x7: u32 = ((x6 >> 25) + (arg1[6])); + let x8: u32 = ((x7 >> 26) + (arg1[7])); + let x9: u32 = ((x8 >> 25) + (arg1[8])); + let x10: u32 = ((x9 >> 26) + (arg1[9])); + let x11: u32 = ((x1 & 0x3ffffff) + ((x10 >> 25) * 0x13)); + let x12: u32 = ((((x11 >> 26) as fiat_25519_u1) as u32) + (x2 & 0x1ffffff)); + let x13: u32 = (x11 & 0x3ffffff); + let x14: u32 = (x12 & 0x1ffffff); + let x15: u32 = ((((x12 >> 25) as fiat_25519_u1) as u32) + (x3 & 0x3ffffff)); + let x16: u32 = (x4 & 0x1ffffff); + let x17: u32 = (x5 & 0x3ffffff); + let x18: u32 = (x6 & 0x1ffffff); + let x19: u32 = (x7 & 0x3ffffff); + let x20: u32 = (x8 & 0x1ffffff); + let x21: u32 = (x9 & 0x3ffffff); + let x22: u32 = (x10 & 0x1ffffff); + out1[0] = x13; + out1[1] = x14; + out1[2] = x15; + out1[3] = x16; + out1[4] = x17; + out1[5] = x18; + out1[6] = x19; + out1[7] = x20; + out1[8] = x21; + out1[9] = x22; +} + +/// The function fiat_25519_add adds two field elements. +/// +/// Postconditions: +/// eval out1 mod m = (eval arg1 + eval arg2) mod m +/// +#[inline] +pub fn fiat_25519_add(out1: &mut fiat_25519_loose_field_element, arg1: &fiat_25519_tight_field_element, arg2: &fiat_25519_tight_field_element) -> () { + let x1: u32 = ((arg1[0]) + (arg2[0])); + let x2: u32 = ((arg1[1]) + (arg2[1])); + let x3: u32 = ((arg1[2]) + (arg2[2])); + let x4: u32 = ((arg1[3]) + (arg2[3])); + let x5: u32 = ((arg1[4]) + (arg2[4])); + let x6: u32 = ((arg1[5]) + (arg2[5])); + let x7: u32 = ((arg1[6]) + (arg2[6])); + let x8: u32 = ((arg1[7]) + (arg2[7])); + let x9: u32 = ((arg1[8]) + (arg2[8])); + let x10: u32 = ((arg1[9]) + (arg2[9])); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; + out1[3] = x4; + out1[4] = x5; + out1[5] = x6; + out1[6] = x7; + out1[7] = x8; + out1[8] = x9; + out1[9] = x10; +} + +/// The function fiat_25519_sub subtracts two field elements. +/// +/// Postconditions: +/// eval out1 mod m = (eval arg1 - eval arg2) mod m +/// +#[inline] +pub fn fiat_25519_sub(out1: &mut fiat_25519_loose_field_element, arg1: &fiat_25519_tight_field_element, arg2: &fiat_25519_tight_field_element) -> () { + let x1: u32 = ((0x7ffffda + (arg1[0])) - (arg2[0])); + let x2: u32 = ((0x3fffffe + (arg1[1])) - (arg2[1])); + let x3: u32 = ((0x7fffffe + (arg1[2])) - (arg2[2])); + let x4: u32 = ((0x3fffffe + (arg1[3])) - (arg2[3])); + let x5: u32 = ((0x7fffffe + (arg1[4])) - (arg2[4])); + let x6: u32 = ((0x3fffffe + (arg1[5])) - (arg2[5])); + let x7: u32 = ((0x7fffffe + (arg1[6])) - (arg2[6])); + let x8: u32 = ((0x3fffffe + (arg1[7])) - (arg2[7])); + let x9: u32 = ((0x7fffffe + (arg1[8])) - (arg2[8])); + let x10: u32 = ((0x3fffffe + (arg1[9])) - (arg2[9])); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; + out1[3] = x4; + out1[4] = x5; + out1[5] = x6; + out1[6] = x7; + out1[7] = x8; + out1[8] = x9; + out1[9] = x10; +} + +/// The function fiat_25519_opp negates a field element. +/// +/// Postconditions: +/// eval out1 mod m = -eval arg1 mod m +/// +#[inline] +pub fn fiat_25519_opp(out1: &mut fiat_25519_loose_field_element, arg1: &fiat_25519_tight_field_element) -> () { + let x1: u32 = (0x7ffffda - (arg1[0])); + let x2: u32 = (0x3fffffe - (arg1[1])); + let x3: u32 = (0x7fffffe - (arg1[2])); + let x4: u32 = (0x3fffffe - (arg1[3])); + let x5: u32 = (0x7fffffe - (arg1[4])); + let x6: u32 = (0x3fffffe - (arg1[5])); + let x7: u32 = (0x7fffffe - (arg1[6])); + let x8: u32 = (0x3fffffe - (arg1[7])); + let x9: u32 = (0x7fffffe - (arg1[8])); + let x10: u32 = (0x3fffffe - (arg1[9])); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; + out1[3] = x4; + out1[4] = x5; + out1[5] = x6; + out1[6] = x7; + out1[7] = x8; + out1[8] = x9; + out1[9] = x10; +} + +/// The function fiat_25519_selectznz is a multi-limb conditional select. +/// +/// Postconditions: +/// out1 = (if arg1 = 0 then arg2 else arg3) +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// arg3: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +#[inline] +pub fn fiat_25519_selectznz(out1: &mut [u32; 10], arg1: fiat_25519_u1, arg2: &[u32; 10], arg3: &[u32; 10]) -> () { + let mut x1: u32 = 0; + fiat_25519_cmovznz_u32(&mut x1, arg1, (arg2[0]), (arg3[0])); + let mut x2: u32 = 0; + fiat_25519_cmovznz_u32(&mut x2, arg1, (arg2[1]), (arg3[1])); + let mut x3: u32 = 0; + fiat_25519_cmovznz_u32(&mut x3, arg1, (arg2[2]), (arg3[2])); + let mut x4: u32 = 0; + fiat_25519_cmovznz_u32(&mut x4, arg1, (arg2[3]), (arg3[3])); + let mut x5: u32 = 0; + fiat_25519_cmovznz_u32(&mut x5, arg1, (arg2[4]), (arg3[4])); + let mut x6: u32 = 0; + fiat_25519_cmovznz_u32(&mut x6, arg1, (arg2[5]), (arg3[5])); + let mut x7: u32 = 0; + fiat_25519_cmovznz_u32(&mut x7, arg1, (arg2[6]), (arg3[6])); + let mut x8: u32 = 0; + fiat_25519_cmovznz_u32(&mut x8, arg1, (arg2[7]), (arg3[7])); + let mut x9: u32 = 0; + fiat_25519_cmovznz_u32(&mut x9, arg1, (arg2[8]), (arg3[8])); + let mut x10: u32 = 0; + fiat_25519_cmovznz_u32(&mut x10, arg1, (arg2[9]), (arg3[9])); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; + out1[3] = x4; + out1[4] = x5; + out1[5] = x6; + out1[6] = x7; + out1[7] = x8; + out1[8] = x9; + out1[9] = x10; +} + +/// The function fiat_25519_to_bytes serializes a field element to bytes in little-endian order. +/// +/// Postconditions: +/// out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..31] +/// +/// Output Bounds: +/// out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0x7f]] +#[inline] +pub fn fiat_25519_to_bytes(out1: &mut [u8; 32], arg1: &fiat_25519_tight_field_element) -> () { + let mut x1: u32 = 0; + let mut x2: fiat_25519_u1 = 0; + fiat_25519_subborrowx_u26(&mut x1, &mut x2, 0x0, (arg1[0]), 0x3ffffed); + let mut x3: u32 = 0; + let mut x4: fiat_25519_u1 = 0; + fiat_25519_subborrowx_u25(&mut x3, &mut x4, x2, (arg1[1]), 0x1ffffff); + let mut x5: u32 = 0; + let mut x6: fiat_25519_u1 = 0; + fiat_25519_subborrowx_u26(&mut x5, &mut x6, x4, (arg1[2]), 0x3ffffff); + let mut x7: u32 = 0; + let mut x8: fiat_25519_u1 = 0; + fiat_25519_subborrowx_u25(&mut x7, &mut x8, x6, (arg1[3]), 0x1ffffff); + let mut x9: u32 = 0; + let mut x10: fiat_25519_u1 = 0; + fiat_25519_subborrowx_u26(&mut x9, &mut x10, x8, (arg1[4]), 0x3ffffff); + let mut x11: u32 = 0; + let mut x12: fiat_25519_u1 = 0; + fiat_25519_subborrowx_u25(&mut x11, &mut x12, x10, (arg1[5]), 0x1ffffff); + let mut x13: u32 = 0; + let mut x14: fiat_25519_u1 = 0; + fiat_25519_subborrowx_u26(&mut x13, &mut x14, x12, (arg1[6]), 0x3ffffff); + let mut x15: u32 = 0; + let mut x16: fiat_25519_u1 = 0; + fiat_25519_subborrowx_u25(&mut x15, &mut x16, x14, (arg1[7]), 0x1ffffff); + let mut x17: u32 = 0; + let mut x18: fiat_25519_u1 = 0; + fiat_25519_subborrowx_u26(&mut x17, &mut x18, x16, (arg1[8]), 0x3ffffff); + let mut x19: u32 = 0; + let mut x20: fiat_25519_u1 = 0; + fiat_25519_subborrowx_u25(&mut x19, &mut x20, x18, (arg1[9]), 0x1ffffff); + let mut x21: u32 = 0; + fiat_25519_cmovznz_u32(&mut x21, x20, (0x0 as u32), 0xffffffff); + let mut x22: u32 = 0; + let mut x23: fiat_25519_u1 = 0; + fiat_25519_addcarryx_u26(&mut x22, &mut x23, 0x0, x1, (x21 & 0x3ffffed)); + let mut x24: u32 = 0; + let mut x25: fiat_25519_u1 = 0; + fiat_25519_addcarryx_u25(&mut x24, &mut x25, x23, x3, (x21 & 0x1ffffff)); + let mut x26: u32 = 0; + let mut x27: fiat_25519_u1 = 0; + fiat_25519_addcarryx_u26(&mut x26, &mut x27, x25, x5, (x21 & 0x3ffffff)); + let mut x28: u32 = 0; + let mut x29: fiat_25519_u1 = 0; + fiat_25519_addcarryx_u25(&mut x28, &mut x29, x27, x7, (x21 & 0x1ffffff)); + let mut x30: u32 = 0; + let mut x31: fiat_25519_u1 = 0; + fiat_25519_addcarryx_u26(&mut x30, &mut x31, x29, x9, (x21 & 0x3ffffff)); + let mut x32: u32 = 0; + let mut x33: fiat_25519_u1 = 0; + fiat_25519_addcarryx_u25(&mut x32, &mut x33, x31, x11, (x21 & 0x1ffffff)); + let mut x34: u32 = 0; + let mut x35: fiat_25519_u1 = 0; + fiat_25519_addcarryx_u26(&mut x34, &mut x35, x33, x13, (x21 & 0x3ffffff)); + let mut x36: u32 = 0; + let mut x37: fiat_25519_u1 = 0; + fiat_25519_addcarryx_u25(&mut x36, &mut x37, x35, x15, (x21 & 0x1ffffff)); + let mut x38: u32 = 0; + let mut x39: fiat_25519_u1 = 0; + fiat_25519_addcarryx_u26(&mut x38, &mut x39, x37, x17, (x21 & 0x3ffffff)); + let mut x40: u32 = 0; + let mut x41: fiat_25519_u1 = 0; + fiat_25519_addcarryx_u25(&mut x40, &mut x41, x39, x19, (x21 & 0x1ffffff)); + let x42: u32 = (x40 << 6); + let x43: u32 = (x38 << 4); + let x44: u32 = (x36 << 3); + let x45: u32 = (x34 * (0x2 as u32)); + let x46: u32 = (x30 << 6); + let x47: u32 = (x28 << 5); + let x48: u32 = (x26 << 3); + let x49: u32 = (x24 << 2); + let x50: u8 = ((x22 & (0xff as u32)) as u8); + let x51: u32 = (x22 >> 8); + let x52: u8 = ((x51 & (0xff as u32)) as u8); + let x53: u32 = (x51 >> 8); + let x54: u8 = ((x53 & (0xff as u32)) as u8); + let x55: u8 = ((x53 >> 8) as u8); + let x56: u32 = (x49 + (x55 as u32)); + let x57: u8 = ((x56 & (0xff as u32)) as u8); + let x58: u32 = (x56 >> 8); + let x59: u8 = ((x58 & (0xff as u32)) as u8); + let x60: u32 = (x58 >> 8); + let x61: u8 = ((x60 & (0xff as u32)) as u8); + let x62: u8 = ((x60 >> 8) as u8); + let x63: u32 = (x48 + (x62 as u32)); + let x64: u8 = ((x63 & (0xff as u32)) as u8); + let x65: u32 = (x63 >> 8); + let x66: u8 = ((x65 & (0xff as u32)) as u8); + let x67: u32 = (x65 >> 8); + let x68: u8 = ((x67 & (0xff as u32)) as u8); + let x69: u8 = ((x67 >> 8) as u8); + let x70: u32 = (x47 + (x69 as u32)); + let x71: u8 = ((x70 & (0xff as u32)) as u8); + let x72: u32 = (x70 >> 8); + let x73: u8 = ((x72 & (0xff as u32)) as u8); + let x74: u32 = (x72 >> 8); + let x75: u8 = ((x74 & (0xff as u32)) as u8); + let x76: u8 = ((x74 >> 8) as u8); + let x77: u32 = (x46 + (x76 as u32)); + let x78: u8 = ((x77 & (0xff as u32)) as u8); + let x79: u32 = (x77 >> 8); + let x80: u8 = ((x79 & (0xff as u32)) as u8); + let x81: u32 = (x79 >> 8); + let x82: u8 = ((x81 & (0xff as u32)) as u8); + let x83: u8 = ((x81 >> 8) as u8); + let x84: u8 = ((x32 & (0xff as u32)) as u8); + let x85: u32 = (x32 >> 8); + let x86: u8 = ((x85 & (0xff as u32)) as u8); + let x87: u32 = (x85 >> 8); + let x88: u8 = ((x87 & (0xff as u32)) as u8); + let x89: fiat_25519_u1 = ((x87 >> 8) as fiat_25519_u1); + let x90: u32 = (x45 + (x89 as u32)); + let x91: u8 = ((x90 & (0xff as u32)) as u8); + let x92: u32 = (x90 >> 8); + let x93: u8 = ((x92 & (0xff as u32)) as u8); + let x94: u32 = (x92 >> 8); + let x95: u8 = ((x94 & (0xff as u32)) as u8); + let x96: u8 = ((x94 >> 8) as u8); + let x97: u32 = (x44 + (x96 as u32)); + let x98: u8 = ((x97 & (0xff as u32)) as u8); + let x99: u32 = (x97 >> 8); + let x100: u8 = ((x99 & (0xff as u32)) as u8); + let x101: u32 = (x99 >> 8); + let x102: u8 = ((x101 & (0xff as u32)) as u8); + let x103: u8 = ((x101 >> 8) as u8); + let x104: u32 = (x43 + (x103 as u32)); + let x105: u8 = ((x104 & (0xff as u32)) as u8); + let x106: u32 = (x104 >> 8); + let x107: u8 = ((x106 & (0xff as u32)) as u8); + let x108: u32 = (x106 >> 8); + let x109: u8 = ((x108 & (0xff as u32)) as u8); + let x110: u8 = ((x108 >> 8) as u8); + let x111: u32 = (x42 + (x110 as u32)); + let x112: u8 = ((x111 & (0xff as u32)) as u8); + let x113: u32 = (x111 >> 8); + let x114: u8 = ((x113 & (0xff as u32)) as u8); + let x115: u32 = (x113 >> 8); + let x116: u8 = ((x115 & (0xff as u32)) as u8); + let x117: u8 = ((x115 >> 8) as u8); + out1[0] = x50; + out1[1] = x52; + out1[2] = x54; + out1[3] = x57; + out1[4] = x59; + out1[5] = x61; + out1[6] = x64; + out1[7] = x66; + out1[8] = x68; + out1[9] = x71; + out1[10] = x73; + out1[11] = x75; + out1[12] = x78; + out1[13] = x80; + out1[14] = x82; + out1[15] = x83; + out1[16] = x84; + out1[17] = x86; + out1[18] = x88; + out1[19] = x91; + out1[20] = x93; + out1[21] = x95; + out1[22] = x98; + out1[23] = x100; + out1[24] = x102; + out1[25] = x105; + out1[26] = x107; + out1[27] = x109; + out1[28] = x112; + out1[29] = x114; + out1[30] = x116; + out1[31] = x117; +} + +/// The function fiat_25519_from_bytes deserializes a field element from bytes in little-endian order. +/// +/// Postconditions: +/// eval out1 mod m = bytes_eval arg1 mod m +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0x7f]] +#[inline] +pub fn fiat_25519_from_bytes(out1: &mut fiat_25519_tight_field_element, arg1: &[u8; 32]) -> () { + let x1: u32 = (((arg1[31]) as u32) << 18); + let x2: u32 = (((arg1[30]) as u32) << 10); + let x3: u32 = (((arg1[29]) as u32) << 2); + let x4: u32 = (((arg1[28]) as u32) << 20); + let x5: u32 = (((arg1[27]) as u32) << 12); + let x6: u32 = (((arg1[26]) as u32) << 4); + let x7: u32 = (((arg1[25]) as u32) << 21); + let x8: u32 = (((arg1[24]) as u32) << 13); + let x9: u32 = (((arg1[23]) as u32) << 5); + let x10: u32 = (((arg1[22]) as u32) << 23); + let x11: u32 = (((arg1[21]) as u32) << 15); + let x12: u32 = (((arg1[20]) as u32) << 7); + let x13: u32 = (((arg1[19]) as u32) << 24); + let x14: u32 = (((arg1[18]) as u32) << 16); + let x15: u32 = (((arg1[17]) as u32) << 8); + let x16: u8 = (arg1[16]); + let x17: u32 = (((arg1[15]) as u32) << 18); + let x18: u32 = (((arg1[14]) as u32) << 10); + let x19: u32 = (((arg1[13]) as u32) << 2); + let x20: u32 = (((arg1[12]) as u32) << 19); + let x21: u32 = (((arg1[11]) as u32) << 11); + let x22: u32 = (((arg1[10]) as u32) << 3); + let x23: u32 = (((arg1[9]) as u32) << 21); + let x24: u32 = (((arg1[8]) as u32) << 13); + let x25: u32 = (((arg1[7]) as u32) << 5); + let x26: u32 = (((arg1[6]) as u32) << 22); + let x27: u32 = (((arg1[5]) as u32) << 14); + let x28: u32 = (((arg1[4]) as u32) << 6); + let x29: u32 = (((arg1[3]) as u32) << 24); + let x30: u32 = (((arg1[2]) as u32) << 16); + let x31: u32 = (((arg1[1]) as u32) << 8); + let x32: u8 = (arg1[0]); + let x33: u32 = (x31 + (x32 as u32)); + let x34: u32 = (x30 + x33); + let x35: u32 = (x29 + x34); + let x36: u32 = (x35 & 0x3ffffff); + let x37: u8 = ((x35 >> 26) as u8); + let x38: u32 = (x28 + (x37 as u32)); + let x39: u32 = (x27 + x38); + let x40: u32 = (x26 + x39); + let x41: u32 = (x40 & 0x1ffffff); + let x42: u8 = ((x40 >> 25) as u8); + let x43: u32 = (x25 + (x42 as u32)); + let x44: u32 = (x24 + x43); + let x45: u32 = (x23 + x44); + let x46: u32 = (x45 & 0x3ffffff); + let x47: u8 = ((x45 >> 26) as u8); + let x48: u32 = (x22 + (x47 as u32)); + let x49: u32 = (x21 + x48); + let x50: u32 = (x20 + x49); + let x51: u32 = (x50 & 0x1ffffff); + let x52: u8 = ((x50 >> 25) as u8); + let x53: u32 = (x19 + (x52 as u32)); + let x54: u32 = (x18 + x53); + let x55: u32 = (x17 + x54); + let x56: u32 = (x15 + (x16 as u32)); + let x57: u32 = (x14 + x56); + let x58: u32 = (x13 + x57); + let x59: u32 = (x58 & 0x1ffffff); + let x60: u8 = ((x58 >> 25) as u8); + let x61: u32 = (x12 + (x60 as u32)); + let x62: u32 = (x11 + x61); + let x63: u32 = (x10 + x62); + let x64: u32 = (x63 & 0x3ffffff); + let x65: u8 = ((x63 >> 26) as u8); + let x66: u32 = (x9 + (x65 as u32)); + let x67: u32 = (x8 + x66); + let x68: u32 = (x7 + x67); + let x69: u32 = (x68 & 0x1ffffff); + let x70: u8 = ((x68 >> 25) as u8); + let x71: u32 = (x6 + (x70 as u32)); + let x72: u32 = (x5 + x71); + let x73: u32 = (x4 + x72); + let x74: u32 = (x73 & 0x3ffffff); + let x75: u8 = ((x73 >> 26) as u8); + let x76: u32 = (x3 + (x75 as u32)); + let x77: u32 = (x2 + x76); + let x78: u32 = (x1 + x77); + out1[0] = x36; + out1[1] = x41; + out1[2] = x46; + out1[3] = x51; + out1[4] = x55; + out1[5] = x59; + out1[6] = x64; + out1[7] = x69; + out1[8] = x74; + out1[9] = x78; +} + +/// The function fiat_25519_relax is the identity function converting from tight field elements to loose field elements. +/// +/// Postconditions: +/// out1 = arg1 +/// +#[inline] +pub fn fiat_25519_relax(out1: &mut fiat_25519_loose_field_element, arg1: &fiat_25519_tight_field_element) -> () { + let x1: u32 = (arg1[0]); + let x2: u32 = (arg1[1]); + let x3: u32 = (arg1[2]); + let x4: u32 = (arg1[3]); + let x5: u32 = (arg1[4]); + let x6: u32 = (arg1[5]); + let x7: u32 = (arg1[6]); + let x8: u32 = (arg1[7]); + let x9: u32 = (arg1[8]); + let x10: u32 = (arg1[9]); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; + out1[3] = x4; + out1[4] = x5; + out1[5] = x6; + out1[6] = x7; + out1[7] = x8; + out1[8] = x9; + out1[9] = x10; +} + +/// The function fiat_25519_carry_scmul_121666 multiplies a field element by 121666 and reduces the result. +/// +/// Postconditions: +/// eval out1 mod m = (121666 * eval arg1) mod m +/// +#[inline] +pub fn fiat_25519_carry_scmul_121666(out1: &mut fiat_25519_tight_field_element, arg1: &fiat_25519_loose_field_element) -> () { + let x1: u64 = ((0x1db42 as u64) * ((arg1[9]) as u64)); + let x2: u64 = ((0x1db42 as u64) * ((arg1[8]) as u64)); + let x3: u64 = ((0x1db42 as u64) * ((arg1[7]) as u64)); + let x4: u64 = ((0x1db42 as u64) * ((arg1[6]) as u64)); + let x5: u64 = ((0x1db42 as u64) * ((arg1[5]) as u64)); + let x6: u64 = ((0x1db42 as u64) * ((arg1[4]) as u64)); + let x7: u64 = ((0x1db42 as u64) * ((arg1[3]) as u64)); + let x8: u64 = ((0x1db42 as u64) * ((arg1[2]) as u64)); + let x9: u64 = ((0x1db42 as u64) * ((arg1[1]) as u64)); + let x10: u64 = ((0x1db42 as u64) * ((arg1[0]) as u64)); + let x11: u32 = ((x10 >> 26) as u32); + let x12: u32 = ((x10 & (0x3ffffff as u64)) as u32); + let x13: u64 = ((x11 as u64) + x9); + let x14: u32 = ((x13 >> 25) as u32); + let x15: u32 = ((x13 & (0x1ffffff as u64)) as u32); + let x16: u64 = ((x14 as u64) + x8); + let x17: u32 = ((x16 >> 26) as u32); + let x18: u32 = ((x16 & (0x3ffffff as u64)) as u32); + let x19: u64 = ((x17 as u64) + x7); + let x20: u32 = ((x19 >> 25) as u32); + let x21: u32 = ((x19 & (0x1ffffff as u64)) as u32); + let x22: u64 = ((x20 as u64) + x6); + let x23: u32 = ((x22 >> 26) as u32); + let x24: u32 = ((x22 & (0x3ffffff as u64)) as u32); + let x25: u64 = ((x23 as u64) + x5); + let x26: u32 = ((x25 >> 25) as u32); + let x27: u32 = ((x25 & (0x1ffffff as u64)) as u32); + let x28: u64 = ((x26 as u64) + x4); + let x29: u32 = ((x28 >> 26) as u32); + let x30: u32 = ((x28 & (0x3ffffff as u64)) as u32); + let x31: u64 = ((x29 as u64) + x3); + let x32: u32 = ((x31 >> 25) as u32); + let x33: u32 = ((x31 & (0x1ffffff as u64)) as u32); + let x34: u64 = ((x32 as u64) + x2); + let x35: u32 = ((x34 >> 26) as u32); + let x36: u32 = ((x34 & (0x3ffffff as u64)) as u32); + let x37: u64 = ((x35 as u64) + x1); + let x38: u32 = ((x37 >> 25) as u32); + let x39: u32 = ((x37 & (0x1ffffff as u64)) as u32); + let x40: u32 = (x38 * 0x13); + let x41: u32 = (x12 + x40); + let x42: fiat_25519_u1 = ((x41 >> 26) as fiat_25519_u1); + let x43: u32 = (x41 & 0x3ffffff); + let x44: u32 = ((x42 as u32) + x15); + let x45: fiat_25519_u1 = ((x44 >> 25) as fiat_25519_u1); + let x46: u32 = (x44 & 0x1ffffff); + let x47: u32 = ((x45 as u32) + x18); + out1[0] = x43; + out1[1] = x46; + out1[2] = x47; + out1[3] = x21; + out1[4] = x24; + out1[5] = x27; + out1[6] = x30; + out1[7] = x33; + out1[8] = x36; + out1[9] = x39; +} diff --git a/vendor/fiat-crypto/src/curve25519_64.rs b/vendor/fiat-crypto/src/curve25519_64.rs new file mode 100644 index 000000000..13a36c4f4 --- /dev/null +++ b/vendor/fiat-crypto/src/curve25519_64.rs @@ -0,0 +1,628 @@ +//! Autogenerated: 'src/ExtractionOCaml/unsaturated_solinas' --lang Rust --inline 25519 64 '(auto)' '2^255 - 19' carry_mul carry_square carry add sub opp selectznz to_bytes from_bytes relax carry_scmul121666 +//! curve description: 25519 +//! machine_wordsize = 64 (from "64") +//! requested operations: carry_mul, carry_square, carry, add, sub, opp, selectznz, to_bytes, from_bytes, relax, carry_scmul121666 +//! n = 5 (from "(auto)") +//! s-c = 2^255 - [(1, 19)] (from "2^255 - 19") +//! tight_bounds_multiplier = 1 (from "") +//! +//! Computed values: +//! carry_chain = [0, 1, 2, 3, 4, 0, 1] +//! eval z = z[0] + (z[1] << 51) + (z[2] << 102) + (z[3] << 153) + (z[4] << 204) +//! bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248) +//! balance = [0xfffffffffffda, 0xffffffffffffe, 0xffffffffffffe, 0xffffffffffffe, 0xffffffffffffe] + +#![allow(unused_parens)] +#![allow(non_camel_case_types)] + +pub type fiat_25519_u1 = u8; +pub type fiat_25519_i1 = i8; +pub type fiat_25519_u2 = u8; +pub type fiat_25519_i2 = i8; + +/* The type fiat_25519_loose_field_element is a field element with loose bounds. */ +/* Bounds: [[0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000], [0x0 ~> 0x18000000000000]] */ +pub type fiat_25519_loose_field_element = [u64; 5]; + +/* The type fiat_25519_tight_field_element is a field element with tight bounds. */ +/* Bounds: [[0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000], [0x0 ~> 0x8000000000000]] */ +pub type fiat_25519_tight_field_element = [u64; 5]; + + +/// The function fiat_25519_addcarryx_u51 is an addition with carry. +/// +/// Postconditions: +/// out1 = (arg1 + arg2 + arg3) mod 2^51 +/// out2 = ⌊(arg1 + arg2 + arg3) / 2^51⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0x7ffffffffffff] +/// arg3: [0x0 ~> 0x7ffffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0x7ffffffffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_25519_addcarryx_u51(out1: &mut u64, out2: &mut fiat_25519_u1, arg1: fiat_25519_u1, arg2: u64, arg3: u64) -> () { + let x1: u64 = (((arg1 as u64) + arg2) + arg3); + let x2: u64 = (x1 & 0x7ffffffffffff); + let x3: fiat_25519_u1 = ((x1 >> 51) as fiat_25519_u1); + *out1 = x2; + *out2 = x3; +} + +/// The function fiat_25519_subborrowx_u51 is a subtraction with borrow. +/// +/// Postconditions: +/// out1 = (-arg1 + arg2 + -arg3) mod 2^51 +/// out2 = -⌊(-arg1 + arg2 + -arg3) / 2^51⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0x7ffffffffffff] +/// arg3: [0x0 ~> 0x7ffffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0x7ffffffffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_25519_subborrowx_u51(out1: &mut u64, out2: &mut fiat_25519_u1, arg1: fiat_25519_u1, arg2: u64, arg3: u64) -> () { + let x1: i64 = ((((((arg2 as i128) - (arg1 as i128)) as i64) as i128) - (arg3 as i128)) as i64); + let x2: fiat_25519_i1 = ((x1 >> 51) as fiat_25519_i1); + let x3: u64 = (((x1 as i128) & (0x7ffffffffffff as i128)) as u64); + *out1 = x3; + *out2 = (((0x0 as fiat_25519_i2) - (x2 as fiat_25519_i2)) as fiat_25519_u1); +} + +/// The function fiat_25519_cmovznz_u64 is a single-word conditional move. +/// +/// Postconditions: +/// out1 = (if arg1 = 0 then arg2 else arg3) +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffffffffffff] +/// arg3: [0x0 ~> 0xffffffffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +#[inline] +pub fn fiat_25519_cmovznz_u64(out1: &mut u64, arg1: fiat_25519_u1, arg2: u64, arg3: u64) -> () { + let x1: fiat_25519_u1 = (!(!arg1)); + let x2: u64 = ((((((0x0 as fiat_25519_i2) - (x1 as fiat_25519_i2)) as fiat_25519_i1) as i128) & (0xffffffffffffffff as i128)) as u64); + let x3: u64 = ((x2 & arg3) | ((!x2) & arg2)); + *out1 = x3; +} + +/// The function fiat_25519_carry_mul multiplies two field elements and reduces the result. +/// +/// Postconditions: +/// eval out1 mod m = (eval arg1 * eval arg2) mod m +/// +#[inline] +pub fn fiat_25519_carry_mul(out1: &mut fiat_25519_tight_field_element, arg1: &fiat_25519_loose_field_element, arg2: &fiat_25519_loose_field_element) -> () { + let x1: u128 = (((arg1[4]) as u128) * (((arg2[4]) * 0x13) as u128)); + let x2: u128 = (((arg1[4]) as u128) * (((arg2[3]) * 0x13) as u128)); + let x3: u128 = (((arg1[4]) as u128) * (((arg2[2]) * 0x13) as u128)); + let x4: u128 = (((arg1[4]) as u128) * (((arg2[1]) * 0x13) as u128)); + let x5: u128 = (((arg1[3]) as u128) * (((arg2[4]) * 0x13) as u128)); + let x6: u128 = (((arg1[3]) as u128) * (((arg2[3]) * 0x13) as u128)); + let x7: u128 = (((arg1[3]) as u128) * (((arg2[2]) * 0x13) as u128)); + let x8: u128 = (((arg1[2]) as u128) * (((arg2[4]) * 0x13) as u128)); + let x9: u128 = (((arg1[2]) as u128) * (((arg2[3]) * 0x13) as u128)); + let x10: u128 = (((arg1[1]) as u128) * (((arg2[4]) * 0x13) as u128)); + let x11: u128 = (((arg1[4]) as u128) * ((arg2[0]) as u128)); + let x12: u128 = (((arg1[3]) as u128) * ((arg2[1]) as u128)); + let x13: u128 = (((arg1[3]) as u128) * ((arg2[0]) as u128)); + let x14: u128 = (((arg1[2]) as u128) * ((arg2[2]) as u128)); + let x15: u128 = (((arg1[2]) as u128) * ((arg2[1]) as u128)); + let x16: u128 = (((arg1[2]) as u128) * ((arg2[0]) as u128)); + let x17: u128 = (((arg1[1]) as u128) * ((arg2[3]) as u128)); + let x18: u128 = (((arg1[1]) as u128) * ((arg2[2]) as u128)); + let x19: u128 = (((arg1[1]) as u128) * ((arg2[1]) as u128)); + let x20: u128 = (((arg1[1]) as u128) * ((arg2[0]) as u128)); + let x21: u128 = (((arg1[0]) as u128) * ((arg2[4]) as u128)); + let x22: u128 = (((arg1[0]) as u128) * ((arg2[3]) as u128)); + let x23: u128 = (((arg1[0]) as u128) * ((arg2[2]) as u128)); + let x24: u128 = (((arg1[0]) as u128) * ((arg2[1]) as u128)); + let x25: u128 = (((arg1[0]) as u128) * ((arg2[0]) as u128)); + let x26: u128 = (x25 + (x10 + (x9 + (x7 + x4)))); + let x27: u64 = ((x26 >> 51) as u64); + let x28: u64 = ((x26 & (0x7ffffffffffff as u128)) as u64); + let x29: u128 = (x21 + (x17 + (x14 + (x12 + x11)))); + let x30: u128 = (x22 + (x18 + (x15 + (x13 + x1)))); + let x31: u128 = (x23 + (x19 + (x16 + (x5 + x2)))); + let x32: u128 = (x24 + (x20 + (x8 + (x6 + x3)))); + let x33: u128 = ((x27 as u128) + x32); + let x34: u64 = ((x33 >> 51) as u64); + let x35: u64 = ((x33 & (0x7ffffffffffff as u128)) as u64); + let x36: u128 = ((x34 as u128) + x31); + let x37: u64 = ((x36 >> 51) as u64); + let x38: u64 = ((x36 & (0x7ffffffffffff as u128)) as u64); + let x39: u128 = ((x37 as u128) + x30); + let x40: u64 = ((x39 >> 51) as u64); + let x41: u64 = ((x39 & (0x7ffffffffffff as u128)) as u64); + let x42: u128 = ((x40 as u128) + x29); + let x43: u64 = ((x42 >> 51) as u64); + let x44: u64 = ((x42 & (0x7ffffffffffff as u128)) as u64); + let x45: u64 = (x43 * 0x13); + let x46: u64 = (x28 + x45); + let x47: u64 = (x46 >> 51); + let x48: u64 = (x46 & 0x7ffffffffffff); + let x49: u64 = (x47 + x35); + let x50: fiat_25519_u1 = ((x49 >> 51) as fiat_25519_u1); + let x51: u64 = (x49 & 0x7ffffffffffff); + let x52: u64 = ((x50 as u64) + x38); + out1[0] = x48; + out1[1] = x51; + out1[2] = x52; + out1[3] = x41; + out1[4] = x44; +} + +/// The function fiat_25519_carry_square squares a field element and reduces the result. +/// +/// Postconditions: +/// eval out1 mod m = (eval arg1 * eval arg1) mod m +/// +#[inline] +pub fn fiat_25519_carry_square(out1: &mut fiat_25519_tight_field_element, arg1: &fiat_25519_loose_field_element) -> () { + let x1: u64 = ((arg1[4]) * 0x13); + let x2: u64 = (x1 * 0x2); + let x3: u64 = ((arg1[4]) * 0x2); + let x4: u64 = ((arg1[3]) * 0x13); + let x5: u64 = (x4 * 0x2); + let x6: u64 = ((arg1[3]) * 0x2); + let x7: u64 = ((arg1[2]) * 0x2); + let x8: u64 = ((arg1[1]) * 0x2); + let x9: u128 = (((arg1[4]) as u128) * (x1 as u128)); + let x10: u128 = (((arg1[3]) as u128) * (x2 as u128)); + let x11: u128 = (((arg1[3]) as u128) * (x4 as u128)); + let x12: u128 = (((arg1[2]) as u128) * (x2 as u128)); + let x13: u128 = (((arg1[2]) as u128) * (x5 as u128)); + let x14: u128 = (((arg1[2]) as u128) * ((arg1[2]) as u128)); + let x15: u128 = (((arg1[1]) as u128) * (x2 as u128)); + let x16: u128 = (((arg1[1]) as u128) * (x6 as u128)); + let x17: u128 = (((arg1[1]) as u128) * (x7 as u128)); + let x18: u128 = (((arg1[1]) as u128) * ((arg1[1]) as u128)); + let x19: u128 = (((arg1[0]) as u128) * (x3 as u128)); + let x20: u128 = (((arg1[0]) as u128) * (x6 as u128)); + let x21: u128 = (((arg1[0]) as u128) * (x7 as u128)); + let x22: u128 = (((arg1[0]) as u128) * (x8 as u128)); + let x23: u128 = (((arg1[0]) as u128) * ((arg1[0]) as u128)); + let x24: u128 = (x23 + (x15 + x13)); + let x25: u64 = ((x24 >> 51) as u64); + let x26: u64 = ((x24 & (0x7ffffffffffff as u128)) as u64); + let x27: u128 = (x19 + (x16 + x14)); + let x28: u128 = (x20 + (x17 + x9)); + let x29: u128 = (x21 + (x18 + x10)); + let x30: u128 = (x22 + (x12 + x11)); + let x31: u128 = ((x25 as u128) + x30); + let x32: u64 = ((x31 >> 51) as u64); + let x33: u64 = ((x31 & (0x7ffffffffffff as u128)) as u64); + let x34: u128 = ((x32 as u128) + x29); + let x35: u64 = ((x34 >> 51) as u64); + let x36: u64 = ((x34 & (0x7ffffffffffff as u128)) as u64); + let x37: u128 = ((x35 as u128) + x28); + let x38: u64 = ((x37 >> 51) as u64); + let x39: u64 = ((x37 & (0x7ffffffffffff as u128)) as u64); + let x40: u128 = ((x38 as u128) + x27); + let x41: u64 = ((x40 >> 51) as u64); + let x42: u64 = ((x40 & (0x7ffffffffffff as u128)) as u64); + let x43: u64 = (x41 * 0x13); + let x44: u64 = (x26 + x43); + let x45: u64 = (x44 >> 51); + let x46: u64 = (x44 & 0x7ffffffffffff); + let x47: u64 = (x45 + x33); + let x48: fiat_25519_u1 = ((x47 >> 51) as fiat_25519_u1); + let x49: u64 = (x47 & 0x7ffffffffffff); + let x50: u64 = ((x48 as u64) + x36); + out1[0] = x46; + out1[1] = x49; + out1[2] = x50; + out1[3] = x39; + out1[4] = x42; +} + +/// The function fiat_25519_carry reduces a field element. +/// +/// Postconditions: +/// eval out1 mod m = eval arg1 mod m +/// +#[inline] +pub fn fiat_25519_carry(out1: &mut fiat_25519_tight_field_element, arg1: &fiat_25519_loose_field_element) -> () { + let x1: u64 = (arg1[0]); + let x2: u64 = ((x1 >> 51) + (arg1[1])); + let x3: u64 = ((x2 >> 51) + (arg1[2])); + let x4: u64 = ((x3 >> 51) + (arg1[3])); + let x5: u64 = ((x4 >> 51) + (arg1[4])); + let x6: u64 = ((x1 & 0x7ffffffffffff) + ((x5 >> 51) * 0x13)); + let x7: u64 = ((((x6 >> 51) as fiat_25519_u1) as u64) + (x2 & 0x7ffffffffffff)); + let x8: u64 = (x6 & 0x7ffffffffffff); + let x9: u64 = (x7 & 0x7ffffffffffff); + let x10: u64 = ((((x7 >> 51) as fiat_25519_u1) as u64) + (x3 & 0x7ffffffffffff)); + let x11: u64 = (x4 & 0x7ffffffffffff); + let x12: u64 = (x5 & 0x7ffffffffffff); + out1[0] = x8; + out1[1] = x9; + out1[2] = x10; + out1[3] = x11; + out1[4] = x12; +} + +/// The function fiat_25519_add adds two field elements. +/// +/// Postconditions: +/// eval out1 mod m = (eval arg1 + eval arg2) mod m +/// +#[inline] +pub fn fiat_25519_add(out1: &mut fiat_25519_loose_field_element, arg1: &fiat_25519_tight_field_element, arg2: &fiat_25519_tight_field_element) -> () { + let x1: u64 = ((arg1[0]) + (arg2[0])); + let x2: u64 = ((arg1[1]) + (arg2[1])); + let x3: u64 = ((arg1[2]) + (arg2[2])); + let x4: u64 = ((arg1[3]) + (arg2[3])); + let x5: u64 = ((arg1[4]) + (arg2[4])); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; + out1[3] = x4; + out1[4] = x5; +} + +/// The function fiat_25519_sub subtracts two field elements. +/// +/// Postconditions: +/// eval out1 mod m = (eval arg1 - eval arg2) mod m +/// +#[inline] +pub fn fiat_25519_sub(out1: &mut fiat_25519_loose_field_element, arg1: &fiat_25519_tight_field_element, arg2: &fiat_25519_tight_field_element) -> () { + let x1: u64 = ((0xfffffffffffda + (arg1[0])) - (arg2[0])); + let x2: u64 = ((0xffffffffffffe + (arg1[1])) - (arg2[1])); + let x3: u64 = ((0xffffffffffffe + (arg1[2])) - (arg2[2])); + let x4: u64 = ((0xffffffffffffe + (arg1[3])) - (arg2[3])); + let x5: u64 = ((0xffffffffffffe + (arg1[4])) - (arg2[4])); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; + out1[3] = x4; + out1[4] = x5; +} + +/// The function fiat_25519_opp negates a field element. +/// +/// Postconditions: +/// eval out1 mod m = -eval arg1 mod m +/// +#[inline] +pub fn fiat_25519_opp(out1: &mut fiat_25519_loose_field_element, arg1: &fiat_25519_tight_field_element) -> () { + let x1: u64 = (0xfffffffffffda - (arg1[0])); + let x2: u64 = (0xffffffffffffe - (arg1[1])); + let x3: u64 = (0xffffffffffffe - (arg1[2])); + let x4: u64 = (0xffffffffffffe - (arg1[3])); + let x5: u64 = (0xffffffffffffe - (arg1[4])); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; + out1[3] = x4; + out1[4] = x5; +} + +/// The function fiat_25519_selectznz is a multi-limb conditional select. +/// +/// Postconditions: +/// out1 = (if arg1 = 0 then arg2 else arg3) +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +#[inline] +pub fn fiat_25519_selectznz(out1: &mut [u64; 5], arg1: fiat_25519_u1, arg2: &[u64; 5], arg3: &[u64; 5]) -> () { + let mut x1: u64 = 0; + fiat_25519_cmovznz_u64(&mut x1, arg1, (arg2[0]), (arg3[0])); + let mut x2: u64 = 0; + fiat_25519_cmovznz_u64(&mut x2, arg1, (arg2[1]), (arg3[1])); + let mut x3: u64 = 0; + fiat_25519_cmovznz_u64(&mut x3, arg1, (arg2[2]), (arg3[2])); + let mut x4: u64 = 0; + fiat_25519_cmovznz_u64(&mut x4, arg1, (arg2[3]), (arg3[3])); + let mut x5: u64 = 0; + fiat_25519_cmovznz_u64(&mut x5, arg1, (arg2[4]), (arg3[4])); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; + out1[3] = x4; + out1[4] = x5; +} + +/// The function fiat_25519_to_bytes serializes a field element to bytes in little-endian order. +/// +/// Postconditions: +/// out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..31] +/// +/// Output Bounds: +/// out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0x7f]] +#[inline] +pub fn fiat_25519_to_bytes(out1: &mut [u8; 32], arg1: &fiat_25519_tight_field_element) -> () { + let mut x1: u64 = 0; + let mut x2: fiat_25519_u1 = 0; + fiat_25519_subborrowx_u51(&mut x1, &mut x2, 0x0, (arg1[0]), 0x7ffffffffffed); + let mut x3: u64 = 0; + let mut x4: fiat_25519_u1 = 0; + fiat_25519_subborrowx_u51(&mut x3, &mut x4, x2, (arg1[1]), 0x7ffffffffffff); + let mut x5: u64 = 0; + let mut x6: fiat_25519_u1 = 0; + fiat_25519_subborrowx_u51(&mut x5, &mut x6, x4, (arg1[2]), 0x7ffffffffffff); + let mut x7: u64 = 0; + let mut x8: fiat_25519_u1 = 0; + fiat_25519_subborrowx_u51(&mut x7, &mut x8, x6, (arg1[3]), 0x7ffffffffffff); + let mut x9: u64 = 0; + let mut x10: fiat_25519_u1 = 0; + fiat_25519_subborrowx_u51(&mut x9, &mut x10, x8, (arg1[4]), 0x7ffffffffffff); + let mut x11: u64 = 0; + fiat_25519_cmovznz_u64(&mut x11, x10, (0x0 as u64), 0xffffffffffffffff); + let mut x12: u64 = 0; + let mut x13: fiat_25519_u1 = 0; + fiat_25519_addcarryx_u51(&mut x12, &mut x13, 0x0, x1, (x11 & 0x7ffffffffffed)); + let mut x14: u64 = 0; + let mut x15: fiat_25519_u1 = 0; + fiat_25519_addcarryx_u51(&mut x14, &mut x15, x13, x3, (x11 & 0x7ffffffffffff)); + let mut x16: u64 = 0; + let mut x17: fiat_25519_u1 = 0; + fiat_25519_addcarryx_u51(&mut x16, &mut x17, x15, x5, (x11 & 0x7ffffffffffff)); + let mut x18: u64 = 0; + let mut x19: fiat_25519_u1 = 0; + fiat_25519_addcarryx_u51(&mut x18, &mut x19, x17, x7, (x11 & 0x7ffffffffffff)); + let mut x20: u64 = 0; + let mut x21: fiat_25519_u1 = 0; + fiat_25519_addcarryx_u51(&mut x20, &mut x21, x19, x9, (x11 & 0x7ffffffffffff)); + let x22: u64 = (x20 << 4); + let x23: u64 = (x18 * (0x2 as u64)); + let x24: u64 = (x16 << 6); + let x25: u64 = (x14 << 3); + let x26: u8 = ((x12 & (0xff as u64)) as u8); + let x27: u64 = (x12 >> 8); + let x28: u8 = ((x27 & (0xff as u64)) as u8); + let x29: u64 = (x27 >> 8); + let x30: u8 = ((x29 & (0xff as u64)) as u8); + let x31: u64 = (x29 >> 8); + let x32: u8 = ((x31 & (0xff as u64)) as u8); + let x33: u64 = (x31 >> 8); + let x34: u8 = ((x33 & (0xff as u64)) as u8); + let x35: u64 = (x33 >> 8); + let x36: u8 = ((x35 & (0xff as u64)) as u8); + let x37: u8 = ((x35 >> 8) as u8); + let x38: u64 = (x25 + (x37 as u64)); + let x39: u8 = ((x38 & (0xff as u64)) as u8); + let x40: u64 = (x38 >> 8); + let x41: u8 = ((x40 & (0xff as u64)) as u8); + let x42: u64 = (x40 >> 8); + let x43: u8 = ((x42 & (0xff as u64)) as u8); + let x44: u64 = (x42 >> 8); + let x45: u8 = ((x44 & (0xff as u64)) as u8); + let x46: u64 = (x44 >> 8); + let x47: u8 = ((x46 & (0xff as u64)) as u8); + let x48: u64 = (x46 >> 8); + let x49: u8 = ((x48 & (0xff as u64)) as u8); + let x50: u8 = ((x48 >> 8) as u8); + let x51: u64 = (x24 + (x50 as u64)); + let x52: u8 = ((x51 & (0xff as u64)) as u8); + let x53: u64 = (x51 >> 8); + let x54: u8 = ((x53 & (0xff as u64)) as u8); + let x55: u64 = (x53 >> 8); + let x56: u8 = ((x55 & (0xff as u64)) as u8); + let x57: u64 = (x55 >> 8); + let x58: u8 = ((x57 & (0xff as u64)) as u8); + let x59: u64 = (x57 >> 8); + let x60: u8 = ((x59 & (0xff as u64)) as u8); + let x61: u64 = (x59 >> 8); + let x62: u8 = ((x61 & (0xff as u64)) as u8); + let x63: u64 = (x61 >> 8); + let x64: u8 = ((x63 & (0xff as u64)) as u8); + let x65: fiat_25519_u1 = ((x63 >> 8) as fiat_25519_u1); + let x66: u64 = (x23 + (x65 as u64)); + let x67: u8 = ((x66 & (0xff as u64)) as u8); + let x68: u64 = (x66 >> 8); + let x69: u8 = ((x68 & (0xff as u64)) as u8); + let x70: u64 = (x68 >> 8); + let x71: u8 = ((x70 & (0xff as u64)) as u8); + let x72: u64 = (x70 >> 8); + let x73: u8 = ((x72 & (0xff as u64)) as u8); + let x74: u64 = (x72 >> 8); + let x75: u8 = ((x74 & (0xff as u64)) as u8); + let x76: u64 = (x74 >> 8); + let x77: u8 = ((x76 & (0xff as u64)) as u8); + let x78: u8 = ((x76 >> 8) as u8); + let x79: u64 = (x22 + (x78 as u64)); + let x80: u8 = ((x79 & (0xff as u64)) as u8); + let x81: u64 = (x79 >> 8); + let x82: u8 = ((x81 & (0xff as u64)) as u8); + let x83: u64 = (x81 >> 8); + let x84: u8 = ((x83 & (0xff as u64)) as u8); + let x85: u64 = (x83 >> 8); + let x86: u8 = ((x85 & (0xff as u64)) as u8); + let x87: u64 = (x85 >> 8); + let x88: u8 = ((x87 & (0xff as u64)) as u8); + let x89: u64 = (x87 >> 8); + let x90: u8 = ((x89 & (0xff as u64)) as u8); + let x91: u8 = ((x89 >> 8) as u8); + out1[0] = x26; + out1[1] = x28; + out1[2] = x30; + out1[3] = x32; + out1[4] = x34; + out1[5] = x36; + out1[6] = x39; + out1[7] = x41; + out1[8] = x43; + out1[9] = x45; + out1[10] = x47; + out1[11] = x49; + out1[12] = x52; + out1[13] = x54; + out1[14] = x56; + out1[15] = x58; + out1[16] = x60; + out1[17] = x62; + out1[18] = x64; + out1[19] = x67; + out1[20] = x69; + out1[21] = x71; + out1[22] = x73; + out1[23] = x75; + out1[24] = x77; + out1[25] = x80; + out1[26] = x82; + out1[27] = x84; + out1[28] = x86; + out1[29] = x88; + out1[30] = x90; + out1[31] = x91; +} + +/// The function fiat_25519_from_bytes deserializes a field element from bytes in little-endian order. +/// +/// Postconditions: +/// eval out1 mod m = bytes_eval arg1 mod m +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0x7f]] +#[inline] +pub fn fiat_25519_from_bytes(out1: &mut fiat_25519_tight_field_element, arg1: &[u8; 32]) -> () { + let x1: u64 = (((arg1[31]) as u64) << 44); + let x2: u64 = (((arg1[30]) as u64) << 36); + let x3: u64 = (((arg1[29]) as u64) << 28); + let x4: u64 = (((arg1[28]) as u64) << 20); + let x5: u64 = (((arg1[27]) as u64) << 12); + let x6: u64 = (((arg1[26]) as u64) << 4); + let x7: u64 = (((arg1[25]) as u64) << 47); + let x8: u64 = (((arg1[24]) as u64) << 39); + let x9: u64 = (((arg1[23]) as u64) << 31); + let x10: u64 = (((arg1[22]) as u64) << 23); + let x11: u64 = (((arg1[21]) as u64) << 15); + let x12: u64 = (((arg1[20]) as u64) << 7); + let x13: u64 = (((arg1[19]) as u64) << 50); + let x14: u64 = (((arg1[18]) as u64) << 42); + let x15: u64 = (((arg1[17]) as u64) << 34); + let x16: u64 = (((arg1[16]) as u64) << 26); + let x17: u64 = (((arg1[15]) as u64) << 18); + let x18: u64 = (((arg1[14]) as u64) << 10); + let x19: u64 = (((arg1[13]) as u64) << 2); + let x20: u64 = (((arg1[12]) as u64) << 45); + let x21: u64 = (((arg1[11]) as u64) << 37); + let x22: u64 = (((arg1[10]) as u64) << 29); + let x23: u64 = (((arg1[9]) as u64) << 21); + let x24: u64 = (((arg1[8]) as u64) << 13); + let x25: u64 = (((arg1[7]) as u64) << 5); + let x26: u64 = (((arg1[6]) as u64) << 48); + let x27: u64 = (((arg1[5]) as u64) << 40); + let x28: u64 = (((arg1[4]) as u64) << 32); + let x29: u64 = (((arg1[3]) as u64) << 24); + let x30: u64 = (((arg1[2]) as u64) << 16); + let x31: u64 = (((arg1[1]) as u64) << 8); + let x32: u8 = (arg1[0]); + let x33: u64 = (x31 + (x32 as u64)); + let x34: u64 = (x30 + x33); + let x35: u64 = (x29 + x34); + let x36: u64 = (x28 + x35); + let x37: u64 = (x27 + x36); + let x38: u64 = (x26 + x37); + let x39: u64 = (x38 & 0x7ffffffffffff); + let x40: u8 = ((x38 >> 51) as u8); + let x41: u64 = (x25 + (x40 as u64)); + let x42: u64 = (x24 + x41); + let x43: u64 = (x23 + x42); + let x44: u64 = (x22 + x43); + let x45: u64 = (x21 + x44); + let x46: u64 = (x20 + x45); + let x47: u64 = (x46 & 0x7ffffffffffff); + let x48: u8 = ((x46 >> 51) as u8); + let x49: u64 = (x19 + (x48 as u64)); + let x50: u64 = (x18 + x49); + let x51: u64 = (x17 + x50); + let x52: u64 = (x16 + x51); + let x53: u64 = (x15 + x52); + let x54: u64 = (x14 + x53); + let x55: u64 = (x13 + x54); + let x56: u64 = (x55 & 0x7ffffffffffff); + let x57: u8 = ((x55 >> 51) as u8); + let x58: u64 = (x12 + (x57 as u64)); + let x59: u64 = (x11 + x58); + let x60: u64 = (x10 + x59); + let x61: u64 = (x9 + x60); + let x62: u64 = (x8 + x61); + let x63: u64 = (x7 + x62); + let x64: u64 = (x63 & 0x7ffffffffffff); + let x65: u8 = ((x63 >> 51) as u8); + let x66: u64 = (x6 + (x65 as u64)); + let x67: u64 = (x5 + x66); + let x68: u64 = (x4 + x67); + let x69: u64 = (x3 + x68); + let x70: u64 = (x2 + x69); + let x71: u64 = (x1 + x70); + out1[0] = x39; + out1[1] = x47; + out1[2] = x56; + out1[3] = x64; + out1[4] = x71; +} + +/// The function fiat_25519_relax is the identity function converting from tight field elements to loose field elements. +/// +/// Postconditions: +/// out1 = arg1 +/// +#[inline] +pub fn fiat_25519_relax(out1: &mut fiat_25519_loose_field_element, arg1: &fiat_25519_tight_field_element) -> () { + let x1: u64 = (arg1[0]); + let x2: u64 = (arg1[1]); + let x3: u64 = (arg1[2]); + let x4: u64 = (arg1[3]); + let x5: u64 = (arg1[4]); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; + out1[3] = x4; + out1[4] = x5; +} + +/// The function fiat_25519_carry_scmul_121666 multiplies a field element by 121666 and reduces the result. +/// +/// Postconditions: +/// eval out1 mod m = (121666 * eval arg1) mod m +/// +#[inline] +pub fn fiat_25519_carry_scmul_121666(out1: &mut fiat_25519_tight_field_element, arg1: &fiat_25519_loose_field_element) -> () { + let x1: u128 = ((0x1db42 as u128) * ((arg1[4]) as u128)); + let x2: u128 = ((0x1db42 as u128) * ((arg1[3]) as u128)); + let x3: u128 = ((0x1db42 as u128) * ((arg1[2]) as u128)); + let x4: u128 = ((0x1db42 as u128) * ((arg1[1]) as u128)); + let x5: u128 = ((0x1db42 as u128) * ((arg1[0]) as u128)); + let x6: u64 = ((x5 >> 51) as u64); + let x7: u64 = ((x5 & (0x7ffffffffffff as u128)) as u64); + let x8: u128 = ((x6 as u128) + x4); + let x9: u64 = ((x8 >> 51) as u64); + let x10: u64 = ((x8 & (0x7ffffffffffff as u128)) as u64); + let x11: u128 = ((x9 as u128) + x3); + let x12: u64 = ((x11 >> 51) as u64); + let x13: u64 = ((x11 & (0x7ffffffffffff as u128)) as u64); + let x14: u128 = ((x12 as u128) + x2); + let x15: u64 = ((x14 >> 51) as u64); + let x16: u64 = ((x14 & (0x7ffffffffffff as u128)) as u64); + let x17: u128 = ((x15 as u128) + x1); + let x18: u64 = ((x17 >> 51) as u64); + let x19: u64 = ((x17 & (0x7ffffffffffff as u128)) as u64); + let x20: u64 = (x18 * 0x13); + let x21: u64 = (x7 + x20); + let x22: fiat_25519_u1 = ((x21 >> 51) as fiat_25519_u1); + let x23: u64 = (x21 & 0x7ffffffffffff); + let x24: u64 = ((x22 as u64) + x10); + let x25: fiat_25519_u1 = ((x24 >> 51) as fiat_25519_u1); + let x26: u64 = (x24 & 0x7ffffffffffff); + let x27: u64 = ((x25 as u64) + x13); + out1[0] = x23; + out1[1] = x26; + out1[2] = x27; + out1[3] = x16; + out1[4] = x19; +} diff --git a/vendor/fiat-crypto/src/curve25519_scalar_32.rs b/vendor/fiat-crypto/src/curve25519_scalar_32.rs new file mode 100644 index 000000000..e38b24c23 --- /dev/null +++ b/vendor/fiat-crypto/src/curve25519_scalar_32.rs @@ -0,0 +1,4796 @@ +//! Autogenerated: 'src/ExtractionOCaml/word_by_word_montgomery' --lang Rust --inline 25519_scalar 32 '2^252 + 27742317777372353535851937790883648493' mul square add sub opp from_montgomery to_montgomery nonzero selectznz to_bytes from_bytes one msat divstep divstep_precomp +//! curve description: 25519_scalar +//! machine_wordsize = 32 (from "32") +//! requested operations: mul, square, add, sub, opp, from_montgomery, to_montgomery, nonzero, selectznz, to_bytes, from_bytes, one, msat, divstep, divstep_precomp +//! m = 0x1000000000000000000000000000000014def9dea2f79cd65812631a5cf5d3ed (from "2^252 + 27742317777372353535851937790883648493") +//! +//! NOTE: In addition to the bounds specified above each function, all +//! functions synthesized for this Montgomery arithmetic require the +//! input to be strictly less than the prime modulus (m), and also +//! require the input to be in the unique saturated representation. +//! All functions also ensure that these two properties are true of +//! return values. +//! +//! Computed values: +//! eval z = z[0] + (z[1] << 32) + (z[2] << 64) + (z[3] << 96) + (z[4] << 128) + (z[5] << 160) + (z[6] << 192) + (z[7] << 224) +//! bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248) +//! twos_complement_eval z = let x1 := z[0] + (z[1] << 32) + (z[2] << 64) + (z[3] << 96) + (z[4] << 128) + (z[5] << 160) + (z[6] << 192) + (z[7] << 224) in +//! if x1 & (2^256-1) < 2^255 then x1 & (2^256-1) else (x1 & (2^256-1)) - 2^256 + +#![allow(unused_parens)] +#![allow(non_camel_case_types)] + +pub type fiat_25519_scalar_u1 = u8; +pub type fiat_25519_scalar_i1 = i8; +pub type fiat_25519_scalar_u2 = u8; +pub type fiat_25519_scalar_i2 = i8; + +/* The type fiat_25519_scalar_montgomery_domain_field_element is a field element in the Montgomery domain. */ +/* Bounds: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] */ +pub type fiat_25519_scalar_montgomery_domain_field_element = [u32; 8]; + +/* The type fiat_25519_scalar_non_montgomery_domain_field_element is a field element NOT in the Montgomery domain. */ +/* Bounds: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] */ +pub type fiat_25519_scalar_non_montgomery_domain_field_element = [u32; 8]; + + +/// The function fiat_25519_scalar_addcarryx_u32 is an addition with carry. +/// +/// Postconditions: +/// out1 = (arg1 + arg2 + arg3) mod 2^32 +/// out2 = ⌊(arg1 + arg2 + arg3) / 2^32⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffff] +/// arg3: [0x0 ~> 0xffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_25519_scalar_addcarryx_u32(out1: &mut u32, out2: &mut fiat_25519_scalar_u1, arg1: fiat_25519_scalar_u1, arg2: u32, arg3: u32) -> () { + let x1: u64 = (((arg1 as u64) + (arg2 as u64)) + (arg3 as u64)); + let x2: u32 = ((x1 & (0xffffffff as u64)) as u32); + let x3: fiat_25519_scalar_u1 = ((x1 >> 32) as fiat_25519_scalar_u1); + *out1 = x2; + *out2 = x3; +} + +/// The function fiat_25519_scalar_subborrowx_u32 is a subtraction with borrow. +/// +/// Postconditions: +/// out1 = (-arg1 + arg2 + -arg3) mod 2^32 +/// out2 = -⌊(-arg1 + arg2 + -arg3) / 2^32⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffff] +/// arg3: [0x0 ~> 0xffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_25519_scalar_subborrowx_u32(out1: &mut u32, out2: &mut fiat_25519_scalar_u1, arg1: fiat_25519_scalar_u1, arg2: u32, arg3: u32) -> () { + let x1: i64 = (((arg2 as i64) - (arg1 as i64)) - (arg3 as i64)); + let x2: fiat_25519_scalar_i1 = ((x1 >> 32) as fiat_25519_scalar_i1); + let x3: u32 = ((x1 & (0xffffffff as i64)) as u32); + *out1 = x3; + *out2 = (((0x0 as fiat_25519_scalar_i2) - (x2 as fiat_25519_scalar_i2)) as fiat_25519_scalar_u1); +} + +/// The function fiat_25519_scalar_mulx_u32 is a multiplication, returning the full double-width result. +/// +/// Postconditions: +/// out1 = (arg1 * arg2) mod 2^32 +/// out2 = ⌊arg1 * arg2 / 2^32⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0xffffffff] +/// arg2: [0x0 ~> 0xffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +/// out2: [0x0 ~> 0xffffffff] +#[inline] +pub fn fiat_25519_scalar_mulx_u32(out1: &mut u32, out2: &mut u32, arg1: u32, arg2: u32) -> () { + let x1: u64 = ((arg1 as u64) * (arg2 as u64)); + let x2: u32 = ((x1 & (0xffffffff as u64)) as u32); + let x3: u32 = ((x1 >> 32) as u32); + *out1 = x2; + *out2 = x3; +} + +/// The function fiat_25519_scalar_cmovznz_u32 is a single-word conditional move. +/// +/// Postconditions: +/// out1 = (if arg1 = 0 then arg2 else arg3) +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffff] +/// arg3: [0x0 ~> 0xffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +#[inline] +pub fn fiat_25519_scalar_cmovznz_u32(out1: &mut u32, arg1: fiat_25519_scalar_u1, arg2: u32, arg3: u32) -> () { + let x1: fiat_25519_scalar_u1 = (!(!arg1)); + let x2: u32 = ((((((0x0 as fiat_25519_scalar_i2) - (x1 as fiat_25519_scalar_i2)) as fiat_25519_scalar_i1) as i64) & (0xffffffff as i64)) as u32); + let x3: u32 = ((x2 & arg3) | ((!x2) & arg2)); + *out1 = x3; +} + +/// The function fiat_25519_scalar_mul multiplies two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_25519_scalar_mul(out1: &mut fiat_25519_scalar_montgomery_domain_field_element, arg1: &fiat_25519_scalar_montgomery_domain_field_element, arg2: &fiat_25519_scalar_montgomery_domain_field_element) -> () { + let x1: u32 = (arg1[1]); + let x2: u32 = (arg1[2]); + let x3: u32 = (arg1[3]); + let x4: u32 = (arg1[4]); + let x5: u32 = (arg1[5]); + let x6: u32 = (arg1[6]); + let x7: u32 = (arg1[7]); + let x8: u32 = (arg1[0]); + let mut x9: u32 = 0; + let mut x10: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x9, &mut x10, x8, (arg2[7])); + let mut x11: u32 = 0; + let mut x12: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x11, &mut x12, x8, (arg2[6])); + let mut x13: u32 = 0; + let mut x14: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x13, &mut x14, x8, (arg2[5])); + let mut x15: u32 = 0; + let mut x16: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x15, &mut x16, x8, (arg2[4])); + let mut x17: u32 = 0; + let mut x18: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x17, &mut x18, x8, (arg2[3])); + let mut x19: u32 = 0; + let mut x20: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x19, &mut x20, x8, (arg2[2])); + let mut x21: u32 = 0; + let mut x22: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x21, &mut x22, x8, (arg2[1])); + let mut x23: u32 = 0; + let mut x24: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x23, &mut x24, x8, (arg2[0])); + let mut x25: u32 = 0; + let mut x26: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x25, &mut x26, 0x0, x24, x21); + let mut x27: u32 = 0; + let mut x28: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x27, &mut x28, x26, x22, x19); + let mut x29: u32 = 0; + let mut x30: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x29, &mut x30, x28, x20, x17); + let mut x31: u32 = 0; + let mut x32: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x31, &mut x32, x30, x18, x15); + let mut x33: u32 = 0; + let mut x34: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x33, &mut x34, x32, x16, x13); + let mut x35: u32 = 0; + let mut x36: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x35, &mut x36, x34, x14, x11); + let mut x37: u32 = 0; + let mut x38: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x37, &mut x38, x36, x12, x9); + let x39: u32 = ((x38 as u32) + x10); + let mut x40: u32 = 0; + let mut x41: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x40, &mut x41, x23, 0x12547e1b); + let mut x42: u32 = 0; + let mut x43: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x42, &mut x43, x40, 0x10000000); + let mut x44: u32 = 0; + let mut x45: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x44, &mut x45, x40, 0x14def9de); + let mut x46: u32 = 0; + let mut x47: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x46, &mut x47, x40, 0xa2f79cd6); + let mut x48: u32 = 0; + let mut x49: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x48, &mut x49, x40, 0x5812631a); + let mut x50: u32 = 0; + let mut x51: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x50, &mut x51, x40, 0x5cf5d3ed); + let mut x52: u32 = 0; + let mut x53: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x52, &mut x53, 0x0, x51, x48); + let mut x54: u32 = 0; + let mut x55: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x54, &mut x55, x53, x49, x46); + let mut x56: u32 = 0; + let mut x57: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x56, &mut x57, x55, x47, x44); + let x58: u32 = ((x57 as u32) + x45); + let mut x59: u32 = 0; + let mut x60: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x59, &mut x60, 0x0, x23, x50); + let mut x61: u32 = 0; + let mut x62: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x61, &mut x62, x60, x25, x52); + let mut x63: u32 = 0; + let mut x64: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x63, &mut x64, x62, x27, x54); + let mut x65: u32 = 0; + let mut x66: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x65, &mut x66, x64, x29, x56); + let mut x67: u32 = 0; + let mut x68: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x67, &mut x68, x66, x31, x58); + let mut x69: u32 = 0; + let mut x70: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x69, &mut x70, x68, x33, (0x0 as u32)); + let mut x71: u32 = 0; + let mut x72: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x71, &mut x72, x70, x35, (0x0 as u32)); + let mut x73: u32 = 0; + let mut x74: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x73, &mut x74, x72, x37, x42); + let mut x75: u32 = 0; + let mut x76: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x75, &mut x76, x74, x39, x43); + let mut x77: u32 = 0; + let mut x78: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x77, &mut x78, x1, (arg2[7])); + let mut x79: u32 = 0; + let mut x80: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x79, &mut x80, x1, (arg2[6])); + let mut x81: u32 = 0; + let mut x82: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x81, &mut x82, x1, (arg2[5])); + let mut x83: u32 = 0; + let mut x84: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x83, &mut x84, x1, (arg2[4])); + let mut x85: u32 = 0; + let mut x86: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x85, &mut x86, x1, (arg2[3])); + let mut x87: u32 = 0; + let mut x88: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x87, &mut x88, x1, (arg2[2])); + let mut x89: u32 = 0; + let mut x90: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x89, &mut x90, x1, (arg2[1])); + let mut x91: u32 = 0; + let mut x92: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x91, &mut x92, x1, (arg2[0])); + let mut x93: u32 = 0; + let mut x94: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x93, &mut x94, 0x0, x92, x89); + let mut x95: u32 = 0; + let mut x96: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x95, &mut x96, x94, x90, x87); + let mut x97: u32 = 0; + let mut x98: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x97, &mut x98, x96, x88, x85); + let mut x99: u32 = 0; + let mut x100: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x99, &mut x100, x98, x86, x83); + let mut x101: u32 = 0; + let mut x102: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x101, &mut x102, x100, x84, x81); + let mut x103: u32 = 0; + let mut x104: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x103, &mut x104, x102, x82, x79); + let mut x105: u32 = 0; + let mut x106: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x105, &mut x106, x104, x80, x77); + let x107: u32 = ((x106 as u32) + x78); + let mut x108: u32 = 0; + let mut x109: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x108, &mut x109, 0x0, x61, x91); + let mut x110: u32 = 0; + let mut x111: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x110, &mut x111, x109, x63, x93); + let mut x112: u32 = 0; + let mut x113: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x112, &mut x113, x111, x65, x95); + let mut x114: u32 = 0; + let mut x115: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x114, &mut x115, x113, x67, x97); + let mut x116: u32 = 0; + let mut x117: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x116, &mut x117, x115, x69, x99); + let mut x118: u32 = 0; + let mut x119: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x118, &mut x119, x117, x71, x101); + let mut x120: u32 = 0; + let mut x121: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x120, &mut x121, x119, x73, x103); + let mut x122: u32 = 0; + let mut x123: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x122, &mut x123, x121, x75, x105); + let mut x124: u32 = 0; + let mut x125: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x124, &mut x125, x123, (x76 as u32), x107); + let mut x126: u32 = 0; + let mut x127: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x126, &mut x127, x108, 0x12547e1b); + let mut x128: u32 = 0; + let mut x129: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x128, &mut x129, x126, 0x10000000); + let mut x130: u32 = 0; + let mut x131: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x130, &mut x131, x126, 0x14def9de); + let mut x132: u32 = 0; + let mut x133: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x132, &mut x133, x126, 0xa2f79cd6); + let mut x134: u32 = 0; + let mut x135: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x134, &mut x135, x126, 0x5812631a); + let mut x136: u32 = 0; + let mut x137: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x136, &mut x137, x126, 0x5cf5d3ed); + let mut x138: u32 = 0; + let mut x139: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x138, &mut x139, 0x0, x137, x134); + let mut x140: u32 = 0; + let mut x141: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x140, &mut x141, x139, x135, x132); + let mut x142: u32 = 0; + let mut x143: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x142, &mut x143, x141, x133, x130); + let x144: u32 = ((x143 as u32) + x131); + let mut x145: u32 = 0; + let mut x146: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x145, &mut x146, 0x0, x108, x136); + let mut x147: u32 = 0; + let mut x148: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x147, &mut x148, x146, x110, x138); + let mut x149: u32 = 0; + let mut x150: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x149, &mut x150, x148, x112, x140); + let mut x151: u32 = 0; + let mut x152: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x151, &mut x152, x150, x114, x142); + let mut x153: u32 = 0; + let mut x154: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x153, &mut x154, x152, x116, x144); + let mut x155: u32 = 0; + let mut x156: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x155, &mut x156, x154, x118, (0x0 as u32)); + let mut x157: u32 = 0; + let mut x158: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x157, &mut x158, x156, x120, (0x0 as u32)); + let mut x159: u32 = 0; + let mut x160: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x159, &mut x160, x158, x122, x128); + let mut x161: u32 = 0; + let mut x162: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x161, &mut x162, x160, x124, x129); + let x163: u32 = ((x162 as u32) + (x125 as u32)); + let mut x164: u32 = 0; + let mut x165: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x164, &mut x165, x2, (arg2[7])); + let mut x166: u32 = 0; + let mut x167: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x166, &mut x167, x2, (arg2[6])); + let mut x168: u32 = 0; + let mut x169: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x168, &mut x169, x2, (arg2[5])); + let mut x170: u32 = 0; + let mut x171: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x170, &mut x171, x2, (arg2[4])); + let mut x172: u32 = 0; + let mut x173: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x172, &mut x173, x2, (arg2[3])); + let mut x174: u32 = 0; + let mut x175: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x174, &mut x175, x2, (arg2[2])); + let mut x176: u32 = 0; + let mut x177: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x176, &mut x177, x2, (arg2[1])); + let mut x178: u32 = 0; + let mut x179: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x178, &mut x179, x2, (arg2[0])); + let mut x180: u32 = 0; + let mut x181: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x180, &mut x181, 0x0, x179, x176); + let mut x182: u32 = 0; + let mut x183: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x182, &mut x183, x181, x177, x174); + let mut x184: u32 = 0; + let mut x185: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x184, &mut x185, x183, x175, x172); + let mut x186: u32 = 0; + let mut x187: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x186, &mut x187, x185, x173, x170); + let mut x188: u32 = 0; + let mut x189: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x188, &mut x189, x187, x171, x168); + let mut x190: u32 = 0; + let mut x191: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x190, &mut x191, x189, x169, x166); + let mut x192: u32 = 0; + let mut x193: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x192, &mut x193, x191, x167, x164); + let x194: u32 = ((x193 as u32) + x165); + let mut x195: u32 = 0; + let mut x196: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x195, &mut x196, 0x0, x147, x178); + let mut x197: u32 = 0; + let mut x198: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x197, &mut x198, x196, x149, x180); + let mut x199: u32 = 0; + let mut x200: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x199, &mut x200, x198, x151, x182); + let mut x201: u32 = 0; + let mut x202: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x201, &mut x202, x200, x153, x184); + let mut x203: u32 = 0; + let mut x204: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x203, &mut x204, x202, x155, x186); + let mut x205: u32 = 0; + let mut x206: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x205, &mut x206, x204, x157, x188); + let mut x207: u32 = 0; + let mut x208: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x207, &mut x208, x206, x159, x190); + let mut x209: u32 = 0; + let mut x210: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x209, &mut x210, x208, x161, x192); + let mut x211: u32 = 0; + let mut x212: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x211, &mut x212, x210, x163, x194); + let mut x213: u32 = 0; + let mut x214: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x213, &mut x214, x195, 0x12547e1b); + let mut x215: u32 = 0; + let mut x216: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x215, &mut x216, x213, 0x10000000); + let mut x217: u32 = 0; + let mut x218: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x217, &mut x218, x213, 0x14def9de); + let mut x219: u32 = 0; + let mut x220: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x219, &mut x220, x213, 0xa2f79cd6); + let mut x221: u32 = 0; + let mut x222: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x221, &mut x222, x213, 0x5812631a); + let mut x223: u32 = 0; + let mut x224: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x223, &mut x224, x213, 0x5cf5d3ed); + let mut x225: u32 = 0; + let mut x226: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x225, &mut x226, 0x0, x224, x221); + let mut x227: u32 = 0; + let mut x228: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x227, &mut x228, x226, x222, x219); + let mut x229: u32 = 0; + let mut x230: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x229, &mut x230, x228, x220, x217); + let x231: u32 = ((x230 as u32) + x218); + let mut x232: u32 = 0; + let mut x233: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x232, &mut x233, 0x0, x195, x223); + let mut x234: u32 = 0; + let mut x235: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x234, &mut x235, x233, x197, x225); + let mut x236: u32 = 0; + let mut x237: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x236, &mut x237, x235, x199, x227); + let mut x238: u32 = 0; + let mut x239: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x238, &mut x239, x237, x201, x229); + let mut x240: u32 = 0; + let mut x241: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x240, &mut x241, x239, x203, x231); + let mut x242: u32 = 0; + let mut x243: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x242, &mut x243, x241, x205, (0x0 as u32)); + let mut x244: u32 = 0; + let mut x245: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x244, &mut x245, x243, x207, (0x0 as u32)); + let mut x246: u32 = 0; + let mut x247: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x246, &mut x247, x245, x209, x215); + let mut x248: u32 = 0; + let mut x249: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x248, &mut x249, x247, x211, x216); + let x250: u32 = ((x249 as u32) + (x212 as u32)); + let mut x251: u32 = 0; + let mut x252: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x251, &mut x252, x3, (arg2[7])); + let mut x253: u32 = 0; + let mut x254: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x253, &mut x254, x3, (arg2[6])); + let mut x255: u32 = 0; + let mut x256: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x255, &mut x256, x3, (arg2[5])); + let mut x257: u32 = 0; + let mut x258: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x257, &mut x258, x3, (arg2[4])); + let mut x259: u32 = 0; + let mut x260: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x259, &mut x260, x3, (arg2[3])); + let mut x261: u32 = 0; + let mut x262: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x261, &mut x262, x3, (arg2[2])); + let mut x263: u32 = 0; + let mut x264: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x263, &mut x264, x3, (arg2[1])); + let mut x265: u32 = 0; + let mut x266: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x265, &mut x266, x3, (arg2[0])); + let mut x267: u32 = 0; + let mut x268: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x267, &mut x268, 0x0, x266, x263); + let mut x269: u32 = 0; + let mut x270: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x269, &mut x270, x268, x264, x261); + let mut x271: u32 = 0; + let mut x272: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x271, &mut x272, x270, x262, x259); + let mut x273: u32 = 0; + let mut x274: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x273, &mut x274, x272, x260, x257); + let mut x275: u32 = 0; + let mut x276: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x275, &mut x276, x274, x258, x255); + let mut x277: u32 = 0; + let mut x278: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x277, &mut x278, x276, x256, x253); + let mut x279: u32 = 0; + let mut x280: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x279, &mut x280, x278, x254, x251); + let x281: u32 = ((x280 as u32) + x252); + let mut x282: u32 = 0; + let mut x283: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x282, &mut x283, 0x0, x234, x265); + let mut x284: u32 = 0; + let mut x285: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x284, &mut x285, x283, x236, x267); + let mut x286: u32 = 0; + let mut x287: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x286, &mut x287, x285, x238, x269); + let mut x288: u32 = 0; + let mut x289: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x288, &mut x289, x287, x240, x271); + let mut x290: u32 = 0; + let mut x291: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x290, &mut x291, x289, x242, x273); + let mut x292: u32 = 0; + let mut x293: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x292, &mut x293, x291, x244, x275); + let mut x294: u32 = 0; + let mut x295: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x294, &mut x295, x293, x246, x277); + let mut x296: u32 = 0; + let mut x297: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x296, &mut x297, x295, x248, x279); + let mut x298: u32 = 0; + let mut x299: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x298, &mut x299, x297, x250, x281); + let mut x300: u32 = 0; + let mut x301: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x300, &mut x301, x282, 0x12547e1b); + let mut x302: u32 = 0; + let mut x303: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x302, &mut x303, x300, 0x10000000); + let mut x304: u32 = 0; + let mut x305: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x304, &mut x305, x300, 0x14def9de); + let mut x306: u32 = 0; + let mut x307: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x306, &mut x307, x300, 0xa2f79cd6); + let mut x308: u32 = 0; + let mut x309: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x308, &mut x309, x300, 0x5812631a); + let mut x310: u32 = 0; + let mut x311: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x310, &mut x311, x300, 0x5cf5d3ed); + let mut x312: u32 = 0; + let mut x313: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x312, &mut x313, 0x0, x311, x308); + let mut x314: u32 = 0; + let mut x315: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x314, &mut x315, x313, x309, x306); + let mut x316: u32 = 0; + let mut x317: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x316, &mut x317, x315, x307, x304); + let x318: u32 = ((x317 as u32) + x305); + let mut x319: u32 = 0; + let mut x320: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x319, &mut x320, 0x0, x282, x310); + let mut x321: u32 = 0; + let mut x322: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x321, &mut x322, x320, x284, x312); + let mut x323: u32 = 0; + let mut x324: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x323, &mut x324, x322, x286, x314); + let mut x325: u32 = 0; + let mut x326: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x325, &mut x326, x324, x288, x316); + let mut x327: u32 = 0; + let mut x328: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x327, &mut x328, x326, x290, x318); + let mut x329: u32 = 0; + let mut x330: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x329, &mut x330, x328, x292, (0x0 as u32)); + let mut x331: u32 = 0; + let mut x332: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x331, &mut x332, x330, x294, (0x0 as u32)); + let mut x333: u32 = 0; + let mut x334: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x333, &mut x334, x332, x296, x302); + let mut x335: u32 = 0; + let mut x336: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x335, &mut x336, x334, x298, x303); + let x337: u32 = ((x336 as u32) + (x299 as u32)); + let mut x338: u32 = 0; + let mut x339: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x338, &mut x339, x4, (arg2[7])); + let mut x340: u32 = 0; + let mut x341: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x340, &mut x341, x4, (arg2[6])); + let mut x342: u32 = 0; + let mut x343: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x342, &mut x343, x4, (arg2[5])); + let mut x344: u32 = 0; + let mut x345: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x344, &mut x345, x4, (arg2[4])); + let mut x346: u32 = 0; + let mut x347: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x346, &mut x347, x4, (arg2[3])); + let mut x348: u32 = 0; + let mut x349: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x348, &mut x349, x4, (arg2[2])); + let mut x350: u32 = 0; + let mut x351: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x350, &mut x351, x4, (arg2[1])); + let mut x352: u32 = 0; + let mut x353: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x352, &mut x353, x4, (arg2[0])); + let mut x354: u32 = 0; + let mut x355: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x354, &mut x355, 0x0, x353, x350); + let mut x356: u32 = 0; + let mut x357: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x356, &mut x357, x355, x351, x348); + let mut x358: u32 = 0; + let mut x359: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x358, &mut x359, x357, x349, x346); + let mut x360: u32 = 0; + let mut x361: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x360, &mut x361, x359, x347, x344); + let mut x362: u32 = 0; + let mut x363: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x362, &mut x363, x361, x345, x342); + let mut x364: u32 = 0; + let mut x365: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x364, &mut x365, x363, x343, x340); + let mut x366: u32 = 0; + let mut x367: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x366, &mut x367, x365, x341, x338); + let x368: u32 = ((x367 as u32) + x339); + let mut x369: u32 = 0; + let mut x370: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x369, &mut x370, 0x0, x321, x352); + let mut x371: u32 = 0; + let mut x372: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x371, &mut x372, x370, x323, x354); + let mut x373: u32 = 0; + let mut x374: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x373, &mut x374, x372, x325, x356); + let mut x375: u32 = 0; + let mut x376: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x375, &mut x376, x374, x327, x358); + let mut x377: u32 = 0; + let mut x378: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x377, &mut x378, x376, x329, x360); + let mut x379: u32 = 0; + let mut x380: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x379, &mut x380, x378, x331, x362); + let mut x381: u32 = 0; + let mut x382: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x381, &mut x382, x380, x333, x364); + let mut x383: u32 = 0; + let mut x384: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x383, &mut x384, x382, x335, x366); + let mut x385: u32 = 0; + let mut x386: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x385, &mut x386, x384, x337, x368); + let mut x387: u32 = 0; + let mut x388: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x387, &mut x388, x369, 0x12547e1b); + let mut x389: u32 = 0; + let mut x390: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x389, &mut x390, x387, 0x10000000); + let mut x391: u32 = 0; + let mut x392: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x391, &mut x392, x387, 0x14def9de); + let mut x393: u32 = 0; + let mut x394: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x393, &mut x394, x387, 0xa2f79cd6); + let mut x395: u32 = 0; + let mut x396: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x395, &mut x396, x387, 0x5812631a); + let mut x397: u32 = 0; + let mut x398: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x397, &mut x398, x387, 0x5cf5d3ed); + let mut x399: u32 = 0; + let mut x400: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x399, &mut x400, 0x0, x398, x395); + let mut x401: u32 = 0; + let mut x402: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x401, &mut x402, x400, x396, x393); + let mut x403: u32 = 0; + let mut x404: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x403, &mut x404, x402, x394, x391); + let x405: u32 = ((x404 as u32) + x392); + let mut x406: u32 = 0; + let mut x407: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x406, &mut x407, 0x0, x369, x397); + let mut x408: u32 = 0; + let mut x409: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x408, &mut x409, x407, x371, x399); + let mut x410: u32 = 0; + let mut x411: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x410, &mut x411, x409, x373, x401); + let mut x412: u32 = 0; + let mut x413: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x412, &mut x413, x411, x375, x403); + let mut x414: u32 = 0; + let mut x415: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x414, &mut x415, x413, x377, x405); + let mut x416: u32 = 0; + let mut x417: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x416, &mut x417, x415, x379, (0x0 as u32)); + let mut x418: u32 = 0; + let mut x419: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x418, &mut x419, x417, x381, (0x0 as u32)); + let mut x420: u32 = 0; + let mut x421: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x420, &mut x421, x419, x383, x389); + let mut x422: u32 = 0; + let mut x423: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x422, &mut x423, x421, x385, x390); + let x424: u32 = ((x423 as u32) + (x386 as u32)); + let mut x425: u32 = 0; + let mut x426: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x425, &mut x426, x5, (arg2[7])); + let mut x427: u32 = 0; + let mut x428: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x427, &mut x428, x5, (arg2[6])); + let mut x429: u32 = 0; + let mut x430: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x429, &mut x430, x5, (arg2[5])); + let mut x431: u32 = 0; + let mut x432: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x431, &mut x432, x5, (arg2[4])); + let mut x433: u32 = 0; + let mut x434: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x433, &mut x434, x5, (arg2[3])); + let mut x435: u32 = 0; + let mut x436: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x435, &mut x436, x5, (arg2[2])); + let mut x437: u32 = 0; + let mut x438: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x437, &mut x438, x5, (arg2[1])); + let mut x439: u32 = 0; + let mut x440: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x439, &mut x440, x5, (arg2[0])); + let mut x441: u32 = 0; + let mut x442: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x441, &mut x442, 0x0, x440, x437); + let mut x443: u32 = 0; + let mut x444: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x443, &mut x444, x442, x438, x435); + let mut x445: u32 = 0; + let mut x446: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x445, &mut x446, x444, x436, x433); + let mut x447: u32 = 0; + let mut x448: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x447, &mut x448, x446, x434, x431); + let mut x449: u32 = 0; + let mut x450: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x449, &mut x450, x448, x432, x429); + let mut x451: u32 = 0; + let mut x452: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x451, &mut x452, x450, x430, x427); + let mut x453: u32 = 0; + let mut x454: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x453, &mut x454, x452, x428, x425); + let x455: u32 = ((x454 as u32) + x426); + let mut x456: u32 = 0; + let mut x457: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x456, &mut x457, 0x0, x408, x439); + let mut x458: u32 = 0; + let mut x459: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x458, &mut x459, x457, x410, x441); + let mut x460: u32 = 0; + let mut x461: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x460, &mut x461, x459, x412, x443); + let mut x462: u32 = 0; + let mut x463: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x462, &mut x463, x461, x414, x445); + let mut x464: u32 = 0; + let mut x465: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x464, &mut x465, x463, x416, x447); + let mut x466: u32 = 0; + let mut x467: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x466, &mut x467, x465, x418, x449); + let mut x468: u32 = 0; + let mut x469: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x468, &mut x469, x467, x420, x451); + let mut x470: u32 = 0; + let mut x471: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x470, &mut x471, x469, x422, x453); + let mut x472: u32 = 0; + let mut x473: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x472, &mut x473, x471, x424, x455); + let mut x474: u32 = 0; + let mut x475: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x474, &mut x475, x456, 0x12547e1b); + let mut x476: u32 = 0; + let mut x477: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x476, &mut x477, x474, 0x10000000); + let mut x478: u32 = 0; + let mut x479: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x478, &mut x479, x474, 0x14def9de); + let mut x480: u32 = 0; + let mut x481: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x480, &mut x481, x474, 0xa2f79cd6); + let mut x482: u32 = 0; + let mut x483: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x482, &mut x483, x474, 0x5812631a); + let mut x484: u32 = 0; + let mut x485: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x484, &mut x485, x474, 0x5cf5d3ed); + let mut x486: u32 = 0; + let mut x487: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x486, &mut x487, 0x0, x485, x482); + let mut x488: u32 = 0; + let mut x489: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x488, &mut x489, x487, x483, x480); + let mut x490: u32 = 0; + let mut x491: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x490, &mut x491, x489, x481, x478); + let x492: u32 = ((x491 as u32) + x479); + let mut x493: u32 = 0; + let mut x494: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x493, &mut x494, 0x0, x456, x484); + let mut x495: u32 = 0; + let mut x496: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x495, &mut x496, x494, x458, x486); + let mut x497: u32 = 0; + let mut x498: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x497, &mut x498, x496, x460, x488); + let mut x499: u32 = 0; + let mut x500: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x499, &mut x500, x498, x462, x490); + let mut x501: u32 = 0; + let mut x502: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x501, &mut x502, x500, x464, x492); + let mut x503: u32 = 0; + let mut x504: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x503, &mut x504, x502, x466, (0x0 as u32)); + let mut x505: u32 = 0; + let mut x506: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x505, &mut x506, x504, x468, (0x0 as u32)); + let mut x507: u32 = 0; + let mut x508: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x507, &mut x508, x506, x470, x476); + let mut x509: u32 = 0; + let mut x510: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x509, &mut x510, x508, x472, x477); + let x511: u32 = ((x510 as u32) + (x473 as u32)); + let mut x512: u32 = 0; + let mut x513: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x512, &mut x513, x6, (arg2[7])); + let mut x514: u32 = 0; + let mut x515: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x514, &mut x515, x6, (arg2[6])); + let mut x516: u32 = 0; + let mut x517: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x516, &mut x517, x6, (arg2[5])); + let mut x518: u32 = 0; + let mut x519: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x518, &mut x519, x6, (arg2[4])); + let mut x520: u32 = 0; + let mut x521: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x520, &mut x521, x6, (arg2[3])); + let mut x522: u32 = 0; + let mut x523: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x522, &mut x523, x6, (arg2[2])); + let mut x524: u32 = 0; + let mut x525: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x524, &mut x525, x6, (arg2[1])); + let mut x526: u32 = 0; + let mut x527: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x526, &mut x527, x6, (arg2[0])); + let mut x528: u32 = 0; + let mut x529: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x528, &mut x529, 0x0, x527, x524); + let mut x530: u32 = 0; + let mut x531: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x530, &mut x531, x529, x525, x522); + let mut x532: u32 = 0; + let mut x533: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x532, &mut x533, x531, x523, x520); + let mut x534: u32 = 0; + let mut x535: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x534, &mut x535, x533, x521, x518); + let mut x536: u32 = 0; + let mut x537: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x536, &mut x537, x535, x519, x516); + let mut x538: u32 = 0; + let mut x539: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x538, &mut x539, x537, x517, x514); + let mut x540: u32 = 0; + let mut x541: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x540, &mut x541, x539, x515, x512); + let x542: u32 = ((x541 as u32) + x513); + let mut x543: u32 = 0; + let mut x544: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x543, &mut x544, 0x0, x495, x526); + let mut x545: u32 = 0; + let mut x546: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x545, &mut x546, x544, x497, x528); + let mut x547: u32 = 0; + let mut x548: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x547, &mut x548, x546, x499, x530); + let mut x549: u32 = 0; + let mut x550: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x549, &mut x550, x548, x501, x532); + let mut x551: u32 = 0; + let mut x552: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x551, &mut x552, x550, x503, x534); + let mut x553: u32 = 0; + let mut x554: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x553, &mut x554, x552, x505, x536); + let mut x555: u32 = 0; + let mut x556: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x555, &mut x556, x554, x507, x538); + let mut x557: u32 = 0; + let mut x558: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x557, &mut x558, x556, x509, x540); + let mut x559: u32 = 0; + let mut x560: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x559, &mut x560, x558, x511, x542); + let mut x561: u32 = 0; + let mut x562: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x561, &mut x562, x543, 0x12547e1b); + let mut x563: u32 = 0; + let mut x564: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x563, &mut x564, x561, 0x10000000); + let mut x565: u32 = 0; + let mut x566: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x565, &mut x566, x561, 0x14def9de); + let mut x567: u32 = 0; + let mut x568: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x567, &mut x568, x561, 0xa2f79cd6); + let mut x569: u32 = 0; + let mut x570: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x569, &mut x570, x561, 0x5812631a); + let mut x571: u32 = 0; + let mut x572: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x571, &mut x572, x561, 0x5cf5d3ed); + let mut x573: u32 = 0; + let mut x574: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x573, &mut x574, 0x0, x572, x569); + let mut x575: u32 = 0; + let mut x576: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x575, &mut x576, x574, x570, x567); + let mut x577: u32 = 0; + let mut x578: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x577, &mut x578, x576, x568, x565); + let x579: u32 = ((x578 as u32) + x566); + let mut x580: u32 = 0; + let mut x581: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x580, &mut x581, 0x0, x543, x571); + let mut x582: u32 = 0; + let mut x583: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x582, &mut x583, x581, x545, x573); + let mut x584: u32 = 0; + let mut x585: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x584, &mut x585, x583, x547, x575); + let mut x586: u32 = 0; + let mut x587: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x586, &mut x587, x585, x549, x577); + let mut x588: u32 = 0; + let mut x589: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x588, &mut x589, x587, x551, x579); + let mut x590: u32 = 0; + let mut x591: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x590, &mut x591, x589, x553, (0x0 as u32)); + let mut x592: u32 = 0; + let mut x593: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x592, &mut x593, x591, x555, (0x0 as u32)); + let mut x594: u32 = 0; + let mut x595: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x594, &mut x595, x593, x557, x563); + let mut x596: u32 = 0; + let mut x597: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x596, &mut x597, x595, x559, x564); + let x598: u32 = ((x597 as u32) + (x560 as u32)); + let mut x599: u32 = 0; + let mut x600: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x599, &mut x600, x7, (arg2[7])); + let mut x601: u32 = 0; + let mut x602: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x601, &mut x602, x7, (arg2[6])); + let mut x603: u32 = 0; + let mut x604: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x603, &mut x604, x7, (arg2[5])); + let mut x605: u32 = 0; + let mut x606: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x605, &mut x606, x7, (arg2[4])); + let mut x607: u32 = 0; + let mut x608: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x607, &mut x608, x7, (arg2[3])); + let mut x609: u32 = 0; + let mut x610: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x609, &mut x610, x7, (arg2[2])); + let mut x611: u32 = 0; + let mut x612: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x611, &mut x612, x7, (arg2[1])); + let mut x613: u32 = 0; + let mut x614: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x613, &mut x614, x7, (arg2[0])); + let mut x615: u32 = 0; + let mut x616: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x615, &mut x616, 0x0, x614, x611); + let mut x617: u32 = 0; + let mut x618: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x617, &mut x618, x616, x612, x609); + let mut x619: u32 = 0; + let mut x620: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x619, &mut x620, x618, x610, x607); + let mut x621: u32 = 0; + let mut x622: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x621, &mut x622, x620, x608, x605); + let mut x623: u32 = 0; + let mut x624: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x623, &mut x624, x622, x606, x603); + let mut x625: u32 = 0; + let mut x626: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x625, &mut x626, x624, x604, x601); + let mut x627: u32 = 0; + let mut x628: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x627, &mut x628, x626, x602, x599); + let x629: u32 = ((x628 as u32) + x600); + let mut x630: u32 = 0; + let mut x631: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x630, &mut x631, 0x0, x582, x613); + let mut x632: u32 = 0; + let mut x633: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x632, &mut x633, x631, x584, x615); + let mut x634: u32 = 0; + let mut x635: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x634, &mut x635, x633, x586, x617); + let mut x636: u32 = 0; + let mut x637: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x636, &mut x637, x635, x588, x619); + let mut x638: u32 = 0; + let mut x639: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x638, &mut x639, x637, x590, x621); + let mut x640: u32 = 0; + let mut x641: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x640, &mut x641, x639, x592, x623); + let mut x642: u32 = 0; + let mut x643: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x642, &mut x643, x641, x594, x625); + let mut x644: u32 = 0; + let mut x645: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x644, &mut x645, x643, x596, x627); + let mut x646: u32 = 0; + let mut x647: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x646, &mut x647, x645, x598, x629); + let mut x648: u32 = 0; + let mut x649: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x648, &mut x649, x630, 0x12547e1b); + let mut x650: u32 = 0; + let mut x651: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x650, &mut x651, x648, 0x10000000); + let mut x652: u32 = 0; + let mut x653: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x652, &mut x653, x648, 0x14def9de); + let mut x654: u32 = 0; + let mut x655: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x654, &mut x655, x648, 0xa2f79cd6); + let mut x656: u32 = 0; + let mut x657: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x656, &mut x657, x648, 0x5812631a); + let mut x658: u32 = 0; + let mut x659: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x658, &mut x659, x648, 0x5cf5d3ed); + let mut x660: u32 = 0; + let mut x661: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x660, &mut x661, 0x0, x659, x656); + let mut x662: u32 = 0; + let mut x663: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x662, &mut x663, x661, x657, x654); + let mut x664: u32 = 0; + let mut x665: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x664, &mut x665, x663, x655, x652); + let x666: u32 = ((x665 as u32) + x653); + let mut x667: u32 = 0; + let mut x668: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x667, &mut x668, 0x0, x630, x658); + let mut x669: u32 = 0; + let mut x670: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x669, &mut x670, x668, x632, x660); + let mut x671: u32 = 0; + let mut x672: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x671, &mut x672, x670, x634, x662); + let mut x673: u32 = 0; + let mut x674: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x673, &mut x674, x672, x636, x664); + let mut x675: u32 = 0; + let mut x676: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x675, &mut x676, x674, x638, x666); + let mut x677: u32 = 0; + let mut x678: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x677, &mut x678, x676, x640, (0x0 as u32)); + let mut x679: u32 = 0; + let mut x680: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x679, &mut x680, x678, x642, (0x0 as u32)); + let mut x681: u32 = 0; + let mut x682: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x681, &mut x682, x680, x644, x650); + let mut x683: u32 = 0; + let mut x684: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x683, &mut x684, x682, x646, x651); + let x685: u32 = ((x684 as u32) + (x647 as u32)); + let mut x686: u32 = 0; + let mut x687: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x686, &mut x687, 0x0, x669, 0x5cf5d3ed); + let mut x688: u32 = 0; + let mut x689: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x688, &mut x689, x687, x671, 0x5812631a); + let mut x690: u32 = 0; + let mut x691: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x690, &mut x691, x689, x673, 0xa2f79cd6); + let mut x692: u32 = 0; + let mut x693: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x692, &mut x693, x691, x675, 0x14def9de); + let mut x694: u32 = 0; + let mut x695: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x694, &mut x695, x693, x677, (0x0 as u32)); + let mut x696: u32 = 0; + let mut x697: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x696, &mut x697, x695, x679, (0x0 as u32)); + let mut x698: u32 = 0; + let mut x699: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x698, &mut x699, x697, x681, (0x0 as u32)); + let mut x700: u32 = 0; + let mut x701: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x700, &mut x701, x699, x683, 0x10000000); + let mut x702: u32 = 0; + let mut x703: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x702, &mut x703, x701, x685, (0x0 as u32)); + let mut x704: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x704, x703, x686, x669); + let mut x705: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x705, x703, x688, x671); + let mut x706: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x706, x703, x690, x673); + let mut x707: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x707, x703, x692, x675); + let mut x708: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x708, x703, x694, x677); + let mut x709: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x709, x703, x696, x679); + let mut x710: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x710, x703, x698, x681); + let mut x711: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x711, x703, x700, x683); + out1[0] = x704; + out1[1] = x705; + out1[2] = x706; + out1[3] = x707; + out1[4] = x708; + out1[5] = x709; + out1[6] = x710; + out1[7] = x711; +} + +/// The function fiat_25519_scalar_square squares a field element in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg1)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_25519_scalar_square(out1: &mut fiat_25519_scalar_montgomery_domain_field_element, arg1: &fiat_25519_scalar_montgomery_domain_field_element) -> () { + let x1: u32 = (arg1[1]); + let x2: u32 = (arg1[2]); + let x3: u32 = (arg1[3]); + let x4: u32 = (arg1[4]); + let x5: u32 = (arg1[5]); + let x6: u32 = (arg1[6]); + let x7: u32 = (arg1[7]); + let x8: u32 = (arg1[0]); + let mut x9: u32 = 0; + let mut x10: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x9, &mut x10, x8, (arg1[7])); + let mut x11: u32 = 0; + let mut x12: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x11, &mut x12, x8, (arg1[6])); + let mut x13: u32 = 0; + let mut x14: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x13, &mut x14, x8, (arg1[5])); + let mut x15: u32 = 0; + let mut x16: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x15, &mut x16, x8, (arg1[4])); + let mut x17: u32 = 0; + let mut x18: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x17, &mut x18, x8, (arg1[3])); + let mut x19: u32 = 0; + let mut x20: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x19, &mut x20, x8, (arg1[2])); + let mut x21: u32 = 0; + let mut x22: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x21, &mut x22, x8, (arg1[1])); + let mut x23: u32 = 0; + let mut x24: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x23, &mut x24, x8, (arg1[0])); + let mut x25: u32 = 0; + let mut x26: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x25, &mut x26, 0x0, x24, x21); + let mut x27: u32 = 0; + let mut x28: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x27, &mut x28, x26, x22, x19); + let mut x29: u32 = 0; + let mut x30: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x29, &mut x30, x28, x20, x17); + let mut x31: u32 = 0; + let mut x32: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x31, &mut x32, x30, x18, x15); + let mut x33: u32 = 0; + let mut x34: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x33, &mut x34, x32, x16, x13); + let mut x35: u32 = 0; + let mut x36: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x35, &mut x36, x34, x14, x11); + let mut x37: u32 = 0; + let mut x38: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x37, &mut x38, x36, x12, x9); + let x39: u32 = ((x38 as u32) + x10); + let mut x40: u32 = 0; + let mut x41: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x40, &mut x41, x23, 0x12547e1b); + let mut x42: u32 = 0; + let mut x43: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x42, &mut x43, x40, 0x10000000); + let mut x44: u32 = 0; + let mut x45: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x44, &mut x45, x40, 0x14def9de); + let mut x46: u32 = 0; + let mut x47: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x46, &mut x47, x40, 0xa2f79cd6); + let mut x48: u32 = 0; + let mut x49: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x48, &mut x49, x40, 0x5812631a); + let mut x50: u32 = 0; + let mut x51: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x50, &mut x51, x40, 0x5cf5d3ed); + let mut x52: u32 = 0; + let mut x53: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x52, &mut x53, 0x0, x51, x48); + let mut x54: u32 = 0; + let mut x55: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x54, &mut x55, x53, x49, x46); + let mut x56: u32 = 0; + let mut x57: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x56, &mut x57, x55, x47, x44); + let x58: u32 = ((x57 as u32) + x45); + let mut x59: u32 = 0; + let mut x60: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x59, &mut x60, 0x0, x23, x50); + let mut x61: u32 = 0; + let mut x62: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x61, &mut x62, x60, x25, x52); + let mut x63: u32 = 0; + let mut x64: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x63, &mut x64, x62, x27, x54); + let mut x65: u32 = 0; + let mut x66: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x65, &mut x66, x64, x29, x56); + let mut x67: u32 = 0; + let mut x68: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x67, &mut x68, x66, x31, x58); + let mut x69: u32 = 0; + let mut x70: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x69, &mut x70, x68, x33, (0x0 as u32)); + let mut x71: u32 = 0; + let mut x72: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x71, &mut x72, x70, x35, (0x0 as u32)); + let mut x73: u32 = 0; + let mut x74: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x73, &mut x74, x72, x37, x42); + let mut x75: u32 = 0; + let mut x76: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x75, &mut x76, x74, x39, x43); + let mut x77: u32 = 0; + let mut x78: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x77, &mut x78, x1, (arg1[7])); + let mut x79: u32 = 0; + let mut x80: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x79, &mut x80, x1, (arg1[6])); + let mut x81: u32 = 0; + let mut x82: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x81, &mut x82, x1, (arg1[5])); + let mut x83: u32 = 0; + let mut x84: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x83, &mut x84, x1, (arg1[4])); + let mut x85: u32 = 0; + let mut x86: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x85, &mut x86, x1, (arg1[3])); + let mut x87: u32 = 0; + let mut x88: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x87, &mut x88, x1, (arg1[2])); + let mut x89: u32 = 0; + let mut x90: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x89, &mut x90, x1, (arg1[1])); + let mut x91: u32 = 0; + let mut x92: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x91, &mut x92, x1, (arg1[0])); + let mut x93: u32 = 0; + let mut x94: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x93, &mut x94, 0x0, x92, x89); + let mut x95: u32 = 0; + let mut x96: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x95, &mut x96, x94, x90, x87); + let mut x97: u32 = 0; + let mut x98: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x97, &mut x98, x96, x88, x85); + let mut x99: u32 = 0; + let mut x100: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x99, &mut x100, x98, x86, x83); + let mut x101: u32 = 0; + let mut x102: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x101, &mut x102, x100, x84, x81); + let mut x103: u32 = 0; + let mut x104: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x103, &mut x104, x102, x82, x79); + let mut x105: u32 = 0; + let mut x106: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x105, &mut x106, x104, x80, x77); + let x107: u32 = ((x106 as u32) + x78); + let mut x108: u32 = 0; + let mut x109: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x108, &mut x109, 0x0, x61, x91); + let mut x110: u32 = 0; + let mut x111: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x110, &mut x111, x109, x63, x93); + let mut x112: u32 = 0; + let mut x113: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x112, &mut x113, x111, x65, x95); + let mut x114: u32 = 0; + let mut x115: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x114, &mut x115, x113, x67, x97); + let mut x116: u32 = 0; + let mut x117: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x116, &mut x117, x115, x69, x99); + let mut x118: u32 = 0; + let mut x119: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x118, &mut x119, x117, x71, x101); + let mut x120: u32 = 0; + let mut x121: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x120, &mut x121, x119, x73, x103); + let mut x122: u32 = 0; + let mut x123: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x122, &mut x123, x121, x75, x105); + let mut x124: u32 = 0; + let mut x125: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x124, &mut x125, x123, (x76 as u32), x107); + let mut x126: u32 = 0; + let mut x127: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x126, &mut x127, x108, 0x12547e1b); + let mut x128: u32 = 0; + let mut x129: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x128, &mut x129, x126, 0x10000000); + let mut x130: u32 = 0; + let mut x131: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x130, &mut x131, x126, 0x14def9de); + let mut x132: u32 = 0; + let mut x133: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x132, &mut x133, x126, 0xa2f79cd6); + let mut x134: u32 = 0; + let mut x135: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x134, &mut x135, x126, 0x5812631a); + let mut x136: u32 = 0; + let mut x137: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x136, &mut x137, x126, 0x5cf5d3ed); + let mut x138: u32 = 0; + let mut x139: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x138, &mut x139, 0x0, x137, x134); + let mut x140: u32 = 0; + let mut x141: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x140, &mut x141, x139, x135, x132); + let mut x142: u32 = 0; + let mut x143: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x142, &mut x143, x141, x133, x130); + let x144: u32 = ((x143 as u32) + x131); + let mut x145: u32 = 0; + let mut x146: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x145, &mut x146, 0x0, x108, x136); + let mut x147: u32 = 0; + let mut x148: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x147, &mut x148, x146, x110, x138); + let mut x149: u32 = 0; + let mut x150: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x149, &mut x150, x148, x112, x140); + let mut x151: u32 = 0; + let mut x152: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x151, &mut x152, x150, x114, x142); + let mut x153: u32 = 0; + let mut x154: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x153, &mut x154, x152, x116, x144); + let mut x155: u32 = 0; + let mut x156: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x155, &mut x156, x154, x118, (0x0 as u32)); + let mut x157: u32 = 0; + let mut x158: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x157, &mut x158, x156, x120, (0x0 as u32)); + let mut x159: u32 = 0; + let mut x160: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x159, &mut x160, x158, x122, x128); + let mut x161: u32 = 0; + let mut x162: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x161, &mut x162, x160, x124, x129); + let x163: u32 = ((x162 as u32) + (x125 as u32)); + let mut x164: u32 = 0; + let mut x165: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x164, &mut x165, x2, (arg1[7])); + let mut x166: u32 = 0; + let mut x167: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x166, &mut x167, x2, (arg1[6])); + let mut x168: u32 = 0; + let mut x169: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x168, &mut x169, x2, (arg1[5])); + let mut x170: u32 = 0; + let mut x171: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x170, &mut x171, x2, (arg1[4])); + let mut x172: u32 = 0; + let mut x173: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x172, &mut x173, x2, (arg1[3])); + let mut x174: u32 = 0; + let mut x175: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x174, &mut x175, x2, (arg1[2])); + let mut x176: u32 = 0; + let mut x177: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x176, &mut x177, x2, (arg1[1])); + let mut x178: u32 = 0; + let mut x179: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x178, &mut x179, x2, (arg1[0])); + let mut x180: u32 = 0; + let mut x181: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x180, &mut x181, 0x0, x179, x176); + let mut x182: u32 = 0; + let mut x183: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x182, &mut x183, x181, x177, x174); + let mut x184: u32 = 0; + let mut x185: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x184, &mut x185, x183, x175, x172); + let mut x186: u32 = 0; + let mut x187: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x186, &mut x187, x185, x173, x170); + let mut x188: u32 = 0; + let mut x189: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x188, &mut x189, x187, x171, x168); + let mut x190: u32 = 0; + let mut x191: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x190, &mut x191, x189, x169, x166); + let mut x192: u32 = 0; + let mut x193: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x192, &mut x193, x191, x167, x164); + let x194: u32 = ((x193 as u32) + x165); + let mut x195: u32 = 0; + let mut x196: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x195, &mut x196, 0x0, x147, x178); + let mut x197: u32 = 0; + let mut x198: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x197, &mut x198, x196, x149, x180); + let mut x199: u32 = 0; + let mut x200: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x199, &mut x200, x198, x151, x182); + let mut x201: u32 = 0; + let mut x202: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x201, &mut x202, x200, x153, x184); + let mut x203: u32 = 0; + let mut x204: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x203, &mut x204, x202, x155, x186); + let mut x205: u32 = 0; + let mut x206: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x205, &mut x206, x204, x157, x188); + let mut x207: u32 = 0; + let mut x208: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x207, &mut x208, x206, x159, x190); + let mut x209: u32 = 0; + let mut x210: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x209, &mut x210, x208, x161, x192); + let mut x211: u32 = 0; + let mut x212: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x211, &mut x212, x210, x163, x194); + let mut x213: u32 = 0; + let mut x214: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x213, &mut x214, x195, 0x12547e1b); + let mut x215: u32 = 0; + let mut x216: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x215, &mut x216, x213, 0x10000000); + let mut x217: u32 = 0; + let mut x218: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x217, &mut x218, x213, 0x14def9de); + let mut x219: u32 = 0; + let mut x220: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x219, &mut x220, x213, 0xa2f79cd6); + let mut x221: u32 = 0; + let mut x222: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x221, &mut x222, x213, 0x5812631a); + let mut x223: u32 = 0; + let mut x224: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x223, &mut x224, x213, 0x5cf5d3ed); + let mut x225: u32 = 0; + let mut x226: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x225, &mut x226, 0x0, x224, x221); + let mut x227: u32 = 0; + let mut x228: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x227, &mut x228, x226, x222, x219); + let mut x229: u32 = 0; + let mut x230: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x229, &mut x230, x228, x220, x217); + let x231: u32 = ((x230 as u32) + x218); + let mut x232: u32 = 0; + let mut x233: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x232, &mut x233, 0x0, x195, x223); + let mut x234: u32 = 0; + let mut x235: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x234, &mut x235, x233, x197, x225); + let mut x236: u32 = 0; + let mut x237: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x236, &mut x237, x235, x199, x227); + let mut x238: u32 = 0; + let mut x239: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x238, &mut x239, x237, x201, x229); + let mut x240: u32 = 0; + let mut x241: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x240, &mut x241, x239, x203, x231); + let mut x242: u32 = 0; + let mut x243: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x242, &mut x243, x241, x205, (0x0 as u32)); + let mut x244: u32 = 0; + let mut x245: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x244, &mut x245, x243, x207, (0x0 as u32)); + let mut x246: u32 = 0; + let mut x247: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x246, &mut x247, x245, x209, x215); + let mut x248: u32 = 0; + let mut x249: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x248, &mut x249, x247, x211, x216); + let x250: u32 = ((x249 as u32) + (x212 as u32)); + let mut x251: u32 = 0; + let mut x252: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x251, &mut x252, x3, (arg1[7])); + let mut x253: u32 = 0; + let mut x254: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x253, &mut x254, x3, (arg1[6])); + let mut x255: u32 = 0; + let mut x256: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x255, &mut x256, x3, (arg1[5])); + let mut x257: u32 = 0; + let mut x258: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x257, &mut x258, x3, (arg1[4])); + let mut x259: u32 = 0; + let mut x260: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x259, &mut x260, x3, (arg1[3])); + let mut x261: u32 = 0; + let mut x262: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x261, &mut x262, x3, (arg1[2])); + let mut x263: u32 = 0; + let mut x264: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x263, &mut x264, x3, (arg1[1])); + let mut x265: u32 = 0; + let mut x266: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x265, &mut x266, x3, (arg1[0])); + let mut x267: u32 = 0; + let mut x268: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x267, &mut x268, 0x0, x266, x263); + let mut x269: u32 = 0; + let mut x270: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x269, &mut x270, x268, x264, x261); + let mut x271: u32 = 0; + let mut x272: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x271, &mut x272, x270, x262, x259); + let mut x273: u32 = 0; + let mut x274: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x273, &mut x274, x272, x260, x257); + let mut x275: u32 = 0; + let mut x276: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x275, &mut x276, x274, x258, x255); + let mut x277: u32 = 0; + let mut x278: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x277, &mut x278, x276, x256, x253); + let mut x279: u32 = 0; + let mut x280: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x279, &mut x280, x278, x254, x251); + let x281: u32 = ((x280 as u32) + x252); + let mut x282: u32 = 0; + let mut x283: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x282, &mut x283, 0x0, x234, x265); + let mut x284: u32 = 0; + let mut x285: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x284, &mut x285, x283, x236, x267); + let mut x286: u32 = 0; + let mut x287: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x286, &mut x287, x285, x238, x269); + let mut x288: u32 = 0; + let mut x289: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x288, &mut x289, x287, x240, x271); + let mut x290: u32 = 0; + let mut x291: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x290, &mut x291, x289, x242, x273); + let mut x292: u32 = 0; + let mut x293: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x292, &mut x293, x291, x244, x275); + let mut x294: u32 = 0; + let mut x295: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x294, &mut x295, x293, x246, x277); + let mut x296: u32 = 0; + let mut x297: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x296, &mut x297, x295, x248, x279); + let mut x298: u32 = 0; + let mut x299: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x298, &mut x299, x297, x250, x281); + let mut x300: u32 = 0; + let mut x301: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x300, &mut x301, x282, 0x12547e1b); + let mut x302: u32 = 0; + let mut x303: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x302, &mut x303, x300, 0x10000000); + let mut x304: u32 = 0; + let mut x305: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x304, &mut x305, x300, 0x14def9de); + let mut x306: u32 = 0; + let mut x307: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x306, &mut x307, x300, 0xa2f79cd6); + let mut x308: u32 = 0; + let mut x309: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x308, &mut x309, x300, 0x5812631a); + let mut x310: u32 = 0; + let mut x311: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x310, &mut x311, x300, 0x5cf5d3ed); + let mut x312: u32 = 0; + let mut x313: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x312, &mut x313, 0x0, x311, x308); + let mut x314: u32 = 0; + let mut x315: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x314, &mut x315, x313, x309, x306); + let mut x316: u32 = 0; + let mut x317: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x316, &mut x317, x315, x307, x304); + let x318: u32 = ((x317 as u32) + x305); + let mut x319: u32 = 0; + let mut x320: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x319, &mut x320, 0x0, x282, x310); + let mut x321: u32 = 0; + let mut x322: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x321, &mut x322, x320, x284, x312); + let mut x323: u32 = 0; + let mut x324: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x323, &mut x324, x322, x286, x314); + let mut x325: u32 = 0; + let mut x326: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x325, &mut x326, x324, x288, x316); + let mut x327: u32 = 0; + let mut x328: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x327, &mut x328, x326, x290, x318); + let mut x329: u32 = 0; + let mut x330: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x329, &mut x330, x328, x292, (0x0 as u32)); + let mut x331: u32 = 0; + let mut x332: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x331, &mut x332, x330, x294, (0x0 as u32)); + let mut x333: u32 = 0; + let mut x334: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x333, &mut x334, x332, x296, x302); + let mut x335: u32 = 0; + let mut x336: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x335, &mut x336, x334, x298, x303); + let x337: u32 = ((x336 as u32) + (x299 as u32)); + let mut x338: u32 = 0; + let mut x339: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x338, &mut x339, x4, (arg1[7])); + let mut x340: u32 = 0; + let mut x341: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x340, &mut x341, x4, (arg1[6])); + let mut x342: u32 = 0; + let mut x343: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x342, &mut x343, x4, (arg1[5])); + let mut x344: u32 = 0; + let mut x345: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x344, &mut x345, x4, (arg1[4])); + let mut x346: u32 = 0; + let mut x347: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x346, &mut x347, x4, (arg1[3])); + let mut x348: u32 = 0; + let mut x349: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x348, &mut x349, x4, (arg1[2])); + let mut x350: u32 = 0; + let mut x351: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x350, &mut x351, x4, (arg1[1])); + let mut x352: u32 = 0; + let mut x353: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x352, &mut x353, x4, (arg1[0])); + let mut x354: u32 = 0; + let mut x355: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x354, &mut x355, 0x0, x353, x350); + let mut x356: u32 = 0; + let mut x357: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x356, &mut x357, x355, x351, x348); + let mut x358: u32 = 0; + let mut x359: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x358, &mut x359, x357, x349, x346); + let mut x360: u32 = 0; + let mut x361: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x360, &mut x361, x359, x347, x344); + let mut x362: u32 = 0; + let mut x363: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x362, &mut x363, x361, x345, x342); + let mut x364: u32 = 0; + let mut x365: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x364, &mut x365, x363, x343, x340); + let mut x366: u32 = 0; + let mut x367: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x366, &mut x367, x365, x341, x338); + let x368: u32 = ((x367 as u32) + x339); + let mut x369: u32 = 0; + let mut x370: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x369, &mut x370, 0x0, x321, x352); + let mut x371: u32 = 0; + let mut x372: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x371, &mut x372, x370, x323, x354); + let mut x373: u32 = 0; + let mut x374: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x373, &mut x374, x372, x325, x356); + let mut x375: u32 = 0; + let mut x376: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x375, &mut x376, x374, x327, x358); + let mut x377: u32 = 0; + let mut x378: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x377, &mut x378, x376, x329, x360); + let mut x379: u32 = 0; + let mut x380: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x379, &mut x380, x378, x331, x362); + let mut x381: u32 = 0; + let mut x382: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x381, &mut x382, x380, x333, x364); + let mut x383: u32 = 0; + let mut x384: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x383, &mut x384, x382, x335, x366); + let mut x385: u32 = 0; + let mut x386: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x385, &mut x386, x384, x337, x368); + let mut x387: u32 = 0; + let mut x388: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x387, &mut x388, x369, 0x12547e1b); + let mut x389: u32 = 0; + let mut x390: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x389, &mut x390, x387, 0x10000000); + let mut x391: u32 = 0; + let mut x392: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x391, &mut x392, x387, 0x14def9de); + let mut x393: u32 = 0; + let mut x394: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x393, &mut x394, x387, 0xa2f79cd6); + let mut x395: u32 = 0; + let mut x396: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x395, &mut x396, x387, 0x5812631a); + let mut x397: u32 = 0; + let mut x398: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x397, &mut x398, x387, 0x5cf5d3ed); + let mut x399: u32 = 0; + let mut x400: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x399, &mut x400, 0x0, x398, x395); + let mut x401: u32 = 0; + let mut x402: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x401, &mut x402, x400, x396, x393); + let mut x403: u32 = 0; + let mut x404: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x403, &mut x404, x402, x394, x391); + let x405: u32 = ((x404 as u32) + x392); + let mut x406: u32 = 0; + let mut x407: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x406, &mut x407, 0x0, x369, x397); + let mut x408: u32 = 0; + let mut x409: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x408, &mut x409, x407, x371, x399); + let mut x410: u32 = 0; + let mut x411: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x410, &mut x411, x409, x373, x401); + let mut x412: u32 = 0; + let mut x413: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x412, &mut x413, x411, x375, x403); + let mut x414: u32 = 0; + let mut x415: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x414, &mut x415, x413, x377, x405); + let mut x416: u32 = 0; + let mut x417: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x416, &mut x417, x415, x379, (0x0 as u32)); + let mut x418: u32 = 0; + let mut x419: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x418, &mut x419, x417, x381, (0x0 as u32)); + let mut x420: u32 = 0; + let mut x421: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x420, &mut x421, x419, x383, x389); + let mut x422: u32 = 0; + let mut x423: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x422, &mut x423, x421, x385, x390); + let x424: u32 = ((x423 as u32) + (x386 as u32)); + let mut x425: u32 = 0; + let mut x426: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x425, &mut x426, x5, (arg1[7])); + let mut x427: u32 = 0; + let mut x428: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x427, &mut x428, x5, (arg1[6])); + let mut x429: u32 = 0; + let mut x430: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x429, &mut x430, x5, (arg1[5])); + let mut x431: u32 = 0; + let mut x432: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x431, &mut x432, x5, (arg1[4])); + let mut x433: u32 = 0; + let mut x434: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x433, &mut x434, x5, (arg1[3])); + let mut x435: u32 = 0; + let mut x436: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x435, &mut x436, x5, (arg1[2])); + let mut x437: u32 = 0; + let mut x438: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x437, &mut x438, x5, (arg1[1])); + let mut x439: u32 = 0; + let mut x440: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x439, &mut x440, x5, (arg1[0])); + let mut x441: u32 = 0; + let mut x442: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x441, &mut x442, 0x0, x440, x437); + let mut x443: u32 = 0; + let mut x444: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x443, &mut x444, x442, x438, x435); + let mut x445: u32 = 0; + let mut x446: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x445, &mut x446, x444, x436, x433); + let mut x447: u32 = 0; + let mut x448: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x447, &mut x448, x446, x434, x431); + let mut x449: u32 = 0; + let mut x450: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x449, &mut x450, x448, x432, x429); + let mut x451: u32 = 0; + let mut x452: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x451, &mut x452, x450, x430, x427); + let mut x453: u32 = 0; + let mut x454: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x453, &mut x454, x452, x428, x425); + let x455: u32 = ((x454 as u32) + x426); + let mut x456: u32 = 0; + let mut x457: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x456, &mut x457, 0x0, x408, x439); + let mut x458: u32 = 0; + let mut x459: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x458, &mut x459, x457, x410, x441); + let mut x460: u32 = 0; + let mut x461: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x460, &mut x461, x459, x412, x443); + let mut x462: u32 = 0; + let mut x463: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x462, &mut x463, x461, x414, x445); + let mut x464: u32 = 0; + let mut x465: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x464, &mut x465, x463, x416, x447); + let mut x466: u32 = 0; + let mut x467: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x466, &mut x467, x465, x418, x449); + let mut x468: u32 = 0; + let mut x469: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x468, &mut x469, x467, x420, x451); + let mut x470: u32 = 0; + let mut x471: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x470, &mut x471, x469, x422, x453); + let mut x472: u32 = 0; + let mut x473: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x472, &mut x473, x471, x424, x455); + let mut x474: u32 = 0; + let mut x475: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x474, &mut x475, x456, 0x12547e1b); + let mut x476: u32 = 0; + let mut x477: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x476, &mut x477, x474, 0x10000000); + let mut x478: u32 = 0; + let mut x479: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x478, &mut x479, x474, 0x14def9de); + let mut x480: u32 = 0; + let mut x481: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x480, &mut x481, x474, 0xa2f79cd6); + let mut x482: u32 = 0; + let mut x483: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x482, &mut x483, x474, 0x5812631a); + let mut x484: u32 = 0; + let mut x485: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x484, &mut x485, x474, 0x5cf5d3ed); + let mut x486: u32 = 0; + let mut x487: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x486, &mut x487, 0x0, x485, x482); + let mut x488: u32 = 0; + let mut x489: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x488, &mut x489, x487, x483, x480); + let mut x490: u32 = 0; + let mut x491: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x490, &mut x491, x489, x481, x478); + let x492: u32 = ((x491 as u32) + x479); + let mut x493: u32 = 0; + let mut x494: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x493, &mut x494, 0x0, x456, x484); + let mut x495: u32 = 0; + let mut x496: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x495, &mut x496, x494, x458, x486); + let mut x497: u32 = 0; + let mut x498: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x497, &mut x498, x496, x460, x488); + let mut x499: u32 = 0; + let mut x500: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x499, &mut x500, x498, x462, x490); + let mut x501: u32 = 0; + let mut x502: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x501, &mut x502, x500, x464, x492); + let mut x503: u32 = 0; + let mut x504: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x503, &mut x504, x502, x466, (0x0 as u32)); + let mut x505: u32 = 0; + let mut x506: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x505, &mut x506, x504, x468, (0x0 as u32)); + let mut x507: u32 = 0; + let mut x508: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x507, &mut x508, x506, x470, x476); + let mut x509: u32 = 0; + let mut x510: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x509, &mut x510, x508, x472, x477); + let x511: u32 = ((x510 as u32) + (x473 as u32)); + let mut x512: u32 = 0; + let mut x513: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x512, &mut x513, x6, (arg1[7])); + let mut x514: u32 = 0; + let mut x515: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x514, &mut x515, x6, (arg1[6])); + let mut x516: u32 = 0; + let mut x517: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x516, &mut x517, x6, (arg1[5])); + let mut x518: u32 = 0; + let mut x519: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x518, &mut x519, x6, (arg1[4])); + let mut x520: u32 = 0; + let mut x521: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x520, &mut x521, x6, (arg1[3])); + let mut x522: u32 = 0; + let mut x523: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x522, &mut x523, x6, (arg1[2])); + let mut x524: u32 = 0; + let mut x525: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x524, &mut x525, x6, (arg1[1])); + let mut x526: u32 = 0; + let mut x527: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x526, &mut x527, x6, (arg1[0])); + let mut x528: u32 = 0; + let mut x529: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x528, &mut x529, 0x0, x527, x524); + let mut x530: u32 = 0; + let mut x531: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x530, &mut x531, x529, x525, x522); + let mut x532: u32 = 0; + let mut x533: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x532, &mut x533, x531, x523, x520); + let mut x534: u32 = 0; + let mut x535: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x534, &mut x535, x533, x521, x518); + let mut x536: u32 = 0; + let mut x537: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x536, &mut x537, x535, x519, x516); + let mut x538: u32 = 0; + let mut x539: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x538, &mut x539, x537, x517, x514); + let mut x540: u32 = 0; + let mut x541: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x540, &mut x541, x539, x515, x512); + let x542: u32 = ((x541 as u32) + x513); + let mut x543: u32 = 0; + let mut x544: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x543, &mut x544, 0x0, x495, x526); + let mut x545: u32 = 0; + let mut x546: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x545, &mut x546, x544, x497, x528); + let mut x547: u32 = 0; + let mut x548: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x547, &mut x548, x546, x499, x530); + let mut x549: u32 = 0; + let mut x550: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x549, &mut x550, x548, x501, x532); + let mut x551: u32 = 0; + let mut x552: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x551, &mut x552, x550, x503, x534); + let mut x553: u32 = 0; + let mut x554: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x553, &mut x554, x552, x505, x536); + let mut x555: u32 = 0; + let mut x556: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x555, &mut x556, x554, x507, x538); + let mut x557: u32 = 0; + let mut x558: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x557, &mut x558, x556, x509, x540); + let mut x559: u32 = 0; + let mut x560: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x559, &mut x560, x558, x511, x542); + let mut x561: u32 = 0; + let mut x562: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x561, &mut x562, x543, 0x12547e1b); + let mut x563: u32 = 0; + let mut x564: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x563, &mut x564, x561, 0x10000000); + let mut x565: u32 = 0; + let mut x566: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x565, &mut x566, x561, 0x14def9de); + let mut x567: u32 = 0; + let mut x568: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x567, &mut x568, x561, 0xa2f79cd6); + let mut x569: u32 = 0; + let mut x570: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x569, &mut x570, x561, 0x5812631a); + let mut x571: u32 = 0; + let mut x572: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x571, &mut x572, x561, 0x5cf5d3ed); + let mut x573: u32 = 0; + let mut x574: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x573, &mut x574, 0x0, x572, x569); + let mut x575: u32 = 0; + let mut x576: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x575, &mut x576, x574, x570, x567); + let mut x577: u32 = 0; + let mut x578: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x577, &mut x578, x576, x568, x565); + let x579: u32 = ((x578 as u32) + x566); + let mut x580: u32 = 0; + let mut x581: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x580, &mut x581, 0x0, x543, x571); + let mut x582: u32 = 0; + let mut x583: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x582, &mut x583, x581, x545, x573); + let mut x584: u32 = 0; + let mut x585: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x584, &mut x585, x583, x547, x575); + let mut x586: u32 = 0; + let mut x587: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x586, &mut x587, x585, x549, x577); + let mut x588: u32 = 0; + let mut x589: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x588, &mut x589, x587, x551, x579); + let mut x590: u32 = 0; + let mut x591: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x590, &mut x591, x589, x553, (0x0 as u32)); + let mut x592: u32 = 0; + let mut x593: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x592, &mut x593, x591, x555, (0x0 as u32)); + let mut x594: u32 = 0; + let mut x595: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x594, &mut x595, x593, x557, x563); + let mut x596: u32 = 0; + let mut x597: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x596, &mut x597, x595, x559, x564); + let x598: u32 = ((x597 as u32) + (x560 as u32)); + let mut x599: u32 = 0; + let mut x600: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x599, &mut x600, x7, (arg1[7])); + let mut x601: u32 = 0; + let mut x602: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x601, &mut x602, x7, (arg1[6])); + let mut x603: u32 = 0; + let mut x604: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x603, &mut x604, x7, (arg1[5])); + let mut x605: u32 = 0; + let mut x606: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x605, &mut x606, x7, (arg1[4])); + let mut x607: u32 = 0; + let mut x608: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x607, &mut x608, x7, (arg1[3])); + let mut x609: u32 = 0; + let mut x610: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x609, &mut x610, x7, (arg1[2])); + let mut x611: u32 = 0; + let mut x612: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x611, &mut x612, x7, (arg1[1])); + let mut x613: u32 = 0; + let mut x614: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x613, &mut x614, x7, (arg1[0])); + let mut x615: u32 = 0; + let mut x616: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x615, &mut x616, 0x0, x614, x611); + let mut x617: u32 = 0; + let mut x618: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x617, &mut x618, x616, x612, x609); + let mut x619: u32 = 0; + let mut x620: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x619, &mut x620, x618, x610, x607); + let mut x621: u32 = 0; + let mut x622: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x621, &mut x622, x620, x608, x605); + let mut x623: u32 = 0; + let mut x624: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x623, &mut x624, x622, x606, x603); + let mut x625: u32 = 0; + let mut x626: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x625, &mut x626, x624, x604, x601); + let mut x627: u32 = 0; + let mut x628: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x627, &mut x628, x626, x602, x599); + let x629: u32 = ((x628 as u32) + x600); + let mut x630: u32 = 0; + let mut x631: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x630, &mut x631, 0x0, x582, x613); + let mut x632: u32 = 0; + let mut x633: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x632, &mut x633, x631, x584, x615); + let mut x634: u32 = 0; + let mut x635: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x634, &mut x635, x633, x586, x617); + let mut x636: u32 = 0; + let mut x637: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x636, &mut x637, x635, x588, x619); + let mut x638: u32 = 0; + let mut x639: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x638, &mut x639, x637, x590, x621); + let mut x640: u32 = 0; + let mut x641: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x640, &mut x641, x639, x592, x623); + let mut x642: u32 = 0; + let mut x643: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x642, &mut x643, x641, x594, x625); + let mut x644: u32 = 0; + let mut x645: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x644, &mut x645, x643, x596, x627); + let mut x646: u32 = 0; + let mut x647: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x646, &mut x647, x645, x598, x629); + let mut x648: u32 = 0; + let mut x649: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x648, &mut x649, x630, 0x12547e1b); + let mut x650: u32 = 0; + let mut x651: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x650, &mut x651, x648, 0x10000000); + let mut x652: u32 = 0; + let mut x653: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x652, &mut x653, x648, 0x14def9de); + let mut x654: u32 = 0; + let mut x655: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x654, &mut x655, x648, 0xa2f79cd6); + let mut x656: u32 = 0; + let mut x657: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x656, &mut x657, x648, 0x5812631a); + let mut x658: u32 = 0; + let mut x659: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x658, &mut x659, x648, 0x5cf5d3ed); + let mut x660: u32 = 0; + let mut x661: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x660, &mut x661, 0x0, x659, x656); + let mut x662: u32 = 0; + let mut x663: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x662, &mut x663, x661, x657, x654); + let mut x664: u32 = 0; + let mut x665: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x664, &mut x665, x663, x655, x652); + let x666: u32 = ((x665 as u32) + x653); + let mut x667: u32 = 0; + let mut x668: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x667, &mut x668, 0x0, x630, x658); + let mut x669: u32 = 0; + let mut x670: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x669, &mut x670, x668, x632, x660); + let mut x671: u32 = 0; + let mut x672: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x671, &mut x672, x670, x634, x662); + let mut x673: u32 = 0; + let mut x674: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x673, &mut x674, x672, x636, x664); + let mut x675: u32 = 0; + let mut x676: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x675, &mut x676, x674, x638, x666); + let mut x677: u32 = 0; + let mut x678: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x677, &mut x678, x676, x640, (0x0 as u32)); + let mut x679: u32 = 0; + let mut x680: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x679, &mut x680, x678, x642, (0x0 as u32)); + let mut x681: u32 = 0; + let mut x682: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x681, &mut x682, x680, x644, x650); + let mut x683: u32 = 0; + let mut x684: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x683, &mut x684, x682, x646, x651); + let x685: u32 = ((x684 as u32) + (x647 as u32)); + let mut x686: u32 = 0; + let mut x687: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x686, &mut x687, 0x0, x669, 0x5cf5d3ed); + let mut x688: u32 = 0; + let mut x689: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x688, &mut x689, x687, x671, 0x5812631a); + let mut x690: u32 = 0; + let mut x691: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x690, &mut x691, x689, x673, 0xa2f79cd6); + let mut x692: u32 = 0; + let mut x693: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x692, &mut x693, x691, x675, 0x14def9de); + let mut x694: u32 = 0; + let mut x695: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x694, &mut x695, x693, x677, (0x0 as u32)); + let mut x696: u32 = 0; + let mut x697: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x696, &mut x697, x695, x679, (0x0 as u32)); + let mut x698: u32 = 0; + let mut x699: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x698, &mut x699, x697, x681, (0x0 as u32)); + let mut x700: u32 = 0; + let mut x701: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x700, &mut x701, x699, x683, 0x10000000); + let mut x702: u32 = 0; + let mut x703: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x702, &mut x703, x701, x685, (0x0 as u32)); + let mut x704: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x704, x703, x686, x669); + let mut x705: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x705, x703, x688, x671); + let mut x706: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x706, x703, x690, x673); + let mut x707: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x707, x703, x692, x675); + let mut x708: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x708, x703, x694, x677); + let mut x709: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x709, x703, x696, x679); + let mut x710: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x710, x703, x698, x681); + let mut x711: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x711, x703, x700, x683); + out1[0] = x704; + out1[1] = x705; + out1[2] = x706; + out1[3] = x707; + out1[4] = x708; + out1[5] = x709; + out1[6] = x710; + out1[7] = x711; +} + +/// The function fiat_25519_scalar_add adds two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) + eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_25519_scalar_add(out1: &mut fiat_25519_scalar_montgomery_domain_field_element, arg1: &fiat_25519_scalar_montgomery_domain_field_element, arg2: &fiat_25519_scalar_montgomery_domain_field_element) -> () { + let mut x1: u32 = 0; + let mut x2: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x1, &mut x2, 0x0, (arg1[0]), (arg2[0])); + let mut x3: u32 = 0; + let mut x4: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x3, &mut x4, x2, (arg1[1]), (arg2[1])); + let mut x5: u32 = 0; + let mut x6: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x5, &mut x6, x4, (arg1[2]), (arg2[2])); + let mut x7: u32 = 0; + let mut x8: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x7, &mut x8, x6, (arg1[3]), (arg2[3])); + let mut x9: u32 = 0; + let mut x10: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x9, &mut x10, x8, (arg1[4]), (arg2[4])); + let mut x11: u32 = 0; + let mut x12: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x11, &mut x12, x10, (arg1[5]), (arg2[5])); + let mut x13: u32 = 0; + let mut x14: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x13, &mut x14, x12, (arg1[6]), (arg2[6])); + let mut x15: u32 = 0; + let mut x16: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x15, &mut x16, x14, (arg1[7]), (arg2[7])); + let mut x17: u32 = 0; + let mut x18: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x17, &mut x18, 0x0, x1, 0x5cf5d3ed); + let mut x19: u32 = 0; + let mut x20: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x19, &mut x20, x18, x3, 0x5812631a); + let mut x21: u32 = 0; + let mut x22: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x21, &mut x22, x20, x5, 0xa2f79cd6); + let mut x23: u32 = 0; + let mut x24: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x23, &mut x24, x22, x7, 0x14def9de); + let mut x25: u32 = 0; + let mut x26: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x25, &mut x26, x24, x9, (0x0 as u32)); + let mut x27: u32 = 0; + let mut x28: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x27, &mut x28, x26, x11, (0x0 as u32)); + let mut x29: u32 = 0; + let mut x30: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x29, &mut x30, x28, x13, (0x0 as u32)); + let mut x31: u32 = 0; + let mut x32: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x31, &mut x32, x30, x15, 0x10000000); + let mut x33: u32 = 0; + let mut x34: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x33, &mut x34, x32, (x16 as u32), (0x0 as u32)); + let mut x35: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x35, x34, x17, x1); + let mut x36: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x36, x34, x19, x3); + let mut x37: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x37, x34, x21, x5); + let mut x38: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x38, x34, x23, x7); + let mut x39: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x39, x34, x25, x9); + let mut x40: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x40, x34, x27, x11); + let mut x41: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x41, x34, x29, x13); + let mut x42: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x42, x34, x31, x15); + out1[0] = x35; + out1[1] = x36; + out1[2] = x37; + out1[3] = x38; + out1[4] = x39; + out1[5] = x40; + out1[6] = x41; + out1[7] = x42; +} + +/// The function fiat_25519_scalar_sub subtracts two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) - eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_25519_scalar_sub(out1: &mut fiat_25519_scalar_montgomery_domain_field_element, arg1: &fiat_25519_scalar_montgomery_domain_field_element, arg2: &fiat_25519_scalar_montgomery_domain_field_element) -> () { + let mut x1: u32 = 0; + let mut x2: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x1, &mut x2, 0x0, (arg1[0]), (arg2[0])); + let mut x3: u32 = 0; + let mut x4: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x3, &mut x4, x2, (arg1[1]), (arg2[1])); + let mut x5: u32 = 0; + let mut x6: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x5, &mut x6, x4, (arg1[2]), (arg2[2])); + let mut x7: u32 = 0; + let mut x8: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x7, &mut x8, x6, (arg1[3]), (arg2[3])); + let mut x9: u32 = 0; + let mut x10: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x9, &mut x10, x8, (arg1[4]), (arg2[4])); + let mut x11: u32 = 0; + let mut x12: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x11, &mut x12, x10, (arg1[5]), (arg2[5])); + let mut x13: u32 = 0; + let mut x14: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x13, &mut x14, x12, (arg1[6]), (arg2[6])); + let mut x15: u32 = 0; + let mut x16: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x15, &mut x16, x14, (arg1[7]), (arg2[7])); + let mut x17: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x17, x16, (0x0 as u32), 0xffffffff); + let mut x18: u32 = 0; + let mut x19: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x18, &mut x19, 0x0, x1, (x17 & 0x5cf5d3ed)); + let mut x20: u32 = 0; + let mut x21: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x20, &mut x21, x19, x3, (x17 & 0x5812631a)); + let mut x22: u32 = 0; + let mut x23: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x22, &mut x23, x21, x5, (x17 & 0xa2f79cd6)); + let mut x24: u32 = 0; + let mut x25: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x24, &mut x25, x23, x7, (x17 & 0x14def9de)); + let mut x26: u32 = 0; + let mut x27: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x26, &mut x27, x25, x9, (0x0 as u32)); + let mut x28: u32 = 0; + let mut x29: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x28, &mut x29, x27, x11, (0x0 as u32)); + let mut x30: u32 = 0; + let mut x31: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x30, &mut x31, x29, x13, (0x0 as u32)); + let mut x32: u32 = 0; + let mut x33: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x32, &mut x33, x31, x15, (x17 & 0x10000000)); + out1[0] = x18; + out1[1] = x20; + out1[2] = x22; + out1[3] = x24; + out1[4] = x26; + out1[5] = x28; + out1[6] = x30; + out1[7] = x32; +} + +/// The function fiat_25519_scalar_opp negates a field element in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = -eval (from_montgomery arg1) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_25519_scalar_opp(out1: &mut fiat_25519_scalar_montgomery_domain_field_element, arg1: &fiat_25519_scalar_montgomery_domain_field_element) -> () { + let mut x1: u32 = 0; + let mut x2: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x1, &mut x2, 0x0, (0x0 as u32), (arg1[0])); + let mut x3: u32 = 0; + let mut x4: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x3, &mut x4, x2, (0x0 as u32), (arg1[1])); + let mut x5: u32 = 0; + let mut x6: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x5, &mut x6, x4, (0x0 as u32), (arg1[2])); + let mut x7: u32 = 0; + let mut x8: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x7, &mut x8, x6, (0x0 as u32), (arg1[3])); + let mut x9: u32 = 0; + let mut x10: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x9, &mut x10, x8, (0x0 as u32), (arg1[4])); + let mut x11: u32 = 0; + let mut x12: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x11, &mut x12, x10, (0x0 as u32), (arg1[5])); + let mut x13: u32 = 0; + let mut x14: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x13, &mut x14, x12, (0x0 as u32), (arg1[6])); + let mut x15: u32 = 0; + let mut x16: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x15, &mut x16, x14, (0x0 as u32), (arg1[7])); + let mut x17: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x17, x16, (0x0 as u32), 0xffffffff); + let mut x18: u32 = 0; + let mut x19: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x18, &mut x19, 0x0, x1, (x17 & 0x5cf5d3ed)); + let mut x20: u32 = 0; + let mut x21: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x20, &mut x21, x19, x3, (x17 & 0x5812631a)); + let mut x22: u32 = 0; + let mut x23: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x22, &mut x23, x21, x5, (x17 & 0xa2f79cd6)); + let mut x24: u32 = 0; + let mut x25: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x24, &mut x25, x23, x7, (x17 & 0x14def9de)); + let mut x26: u32 = 0; + let mut x27: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x26, &mut x27, x25, x9, (0x0 as u32)); + let mut x28: u32 = 0; + let mut x29: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x28, &mut x29, x27, x11, (0x0 as u32)); + let mut x30: u32 = 0; + let mut x31: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x30, &mut x31, x29, x13, (0x0 as u32)); + let mut x32: u32 = 0; + let mut x33: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x32, &mut x33, x31, x15, (x17 & 0x10000000)); + out1[0] = x18; + out1[1] = x20; + out1[2] = x22; + out1[3] = x24; + out1[4] = x26; + out1[5] = x28; + out1[6] = x30; + out1[7] = x32; +} + +/// The function fiat_25519_scalar_from_montgomery translates a field element out of the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval out1 mod m = (eval arg1 * ((2^32)⁻¹ mod m)^8) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_25519_scalar_from_montgomery(out1: &mut fiat_25519_scalar_non_montgomery_domain_field_element, arg1: &fiat_25519_scalar_montgomery_domain_field_element) -> () { + let x1: u32 = (arg1[0]); + let mut x2: u32 = 0; + let mut x3: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x2, &mut x3, x1, 0x12547e1b); + let mut x4: u32 = 0; + let mut x5: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x4, &mut x5, x2, 0x10000000); + let mut x6: u32 = 0; + let mut x7: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x6, &mut x7, x2, 0x14def9de); + let mut x8: u32 = 0; + let mut x9: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x8, &mut x9, x2, 0xa2f79cd6); + let mut x10: u32 = 0; + let mut x11: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x10, &mut x11, x2, 0x5812631a); + let mut x12: u32 = 0; + let mut x13: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x12, &mut x13, x2, 0x5cf5d3ed); + let mut x14: u32 = 0; + let mut x15: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x14, &mut x15, 0x0, x13, x10); + let mut x16: u32 = 0; + let mut x17: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x16, &mut x17, x15, x11, x8); + let mut x18: u32 = 0; + let mut x19: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x18, &mut x19, x17, x9, x6); + let mut x20: u32 = 0; + let mut x21: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x20, &mut x21, 0x0, x1, x12); + let mut x22: u32 = 0; + let mut x23: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x22, &mut x23, x21, (0x0 as u32), x14); + let mut x24: u32 = 0; + let mut x25: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x24, &mut x25, x23, (0x0 as u32), x16); + let mut x26: u32 = 0; + let mut x27: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x26, &mut x27, x25, (0x0 as u32), x18); + let mut x28: u32 = 0; + let mut x29: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x28, &mut x29, 0x0, x22, (arg1[1])); + let mut x30: u32 = 0; + let mut x31: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x30, &mut x31, x29, x24, (0x0 as u32)); + let mut x32: u32 = 0; + let mut x33: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x32, &mut x33, x31, x26, (0x0 as u32)); + let mut x34: u32 = 0; + let mut x35: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x34, &mut x35, x28, 0x12547e1b); + let mut x36: u32 = 0; + let mut x37: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x36, &mut x37, x34, 0x10000000); + let mut x38: u32 = 0; + let mut x39: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x38, &mut x39, x34, 0x14def9de); + let mut x40: u32 = 0; + let mut x41: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x40, &mut x41, x34, 0xa2f79cd6); + let mut x42: u32 = 0; + let mut x43: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x42, &mut x43, x34, 0x5812631a); + let mut x44: u32 = 0; + let mut x45: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x44, &mut x45, x34, 0x5cf5d3ed); + let mut x46: u32 = 0; + let mut x47: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x46, &mut x47, 0x0, x45, x42); + let mut x48: u32 = 0; + let mut x49: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x48, &mut x49, x47, x43, x40); + let mut x50: u32 = 0; + let mut x51: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x50, &mut x51, x49, x41, x38); + let mut x52: u32 = 0; + let mut x53: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x52, &mut x53, 0x0, x28, x44); + let mut x54: u32 = 0; + let mut x55: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x54, &mut x55, x53, x30, x46); + let mut x56: u32 = 0; + let mut x57: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x56, &mut x57, x55, x32, x48); + let mut x58: u32 = 0; + let mut x59: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x58, &mut x59, x57, ((x33 as u32) + ((x27 as u32) + ((x19 as u32) + x7))), x50); + let mut x60: u32 = 0; + let mut x61: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x60, &mut x61, 0x0, x5, x36); + let mut x62: u32 = 0; + let mut x63: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x62, &mut x63, 0x0, x54, (arg1[2])); + let mut x64: u32 = 0; + let mut x65: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x64, &mut x65, x63, x56, (0x0 as u32)); + let mut x66: u32 = 0; + let mut x67: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x66, &mut x67, x65, x58, (0x0 as u32)); + let mut x68: u32 = 0; + let mut x69: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x68, &mut x69, x62, 0x12547e1b); + let mut x70: u32 = 0; + let mut x71: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x70, &mut x71, x68, 0x10000000); + let mut x72: u32 = 0; + let mut x73: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x72, &mut x73, x68, 0x14def9de); + let mut x74: u32 = 0; + let mut x75: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x74, &mut x75, x68, 0xa2f79cd6); + let mut x76: u32 = 0; + let mut x77: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x76, &mut x77, x68, 0x5812631a); + let mut x78: u32 = 0; + let mut x79: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x78, &mut x79, x68, 0x5cf5d3ed); + let mut x80: u32 = 0; + let mut x81: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x80, &mut x81, 0x0, x79, x76); + let mut x82: u32 = 0; + let mut x83: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x82, &mut x83, x81, x77, x74); + let mut x84: u32 = 0; + let mut x85: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x84, &mut x85, x83, x75, x72); + let mut x86: u32 = 0; + let mut x87: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x86, &mut x87, 0x0, x62, x78); + let mut x88: u32 = 0; + let mut x89: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x88, &mut x89, x87, x64, x80); + let mut x90: u32 = 0; + let mut x91: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x90, &mut x91, x89, x66, x82); + let mut x92: u32 = 0; + let mut x93: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x92, &mut x93, x91, ((x67 as u32) + ((x59 as u32) + ((x51 as u32) + x39))), x84); + let mut x94: u32 = 0; + let mut x95: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x94, &mut x95, 0x0, ((x61 as u32) + x37), x70); + let mut x96: u32 = 0; + let mut x97: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x96, &mut x97, 0x0, x88, (arg1[3])); + let mut x98: u32 = 0; + let mut x99: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x98, &mut x99, x97, x90, (0x0 as u32)); + let mut x100: u32 = 0; + let mut x101: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x100, &mut x101, x99, x92, (0x0 as u32)); + let mut x102: u32 = 0; + let mut x103: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x102, &mut x103, x96, 0x12547e1b); + let mut x104: u32 = 0; + let mut x105: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x104, &mut x105, x102, 0x10000000); + let mut x106: u32 = 0; + let mut x107: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x106, &mut x107, x102, 0x14def9de); + let mut x108: u32 = 0; + let mut x109: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x108, &mut x109, x102, 0xa2f79cd6); + let mut x110: u32 = 0; + let mut x111: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x110, &mut x111, x102, 0x5812631a); + let mut x112: u32 = 0; + let mut x113: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x112, &mut x113, x102, 0x5cf5d3ed); + let mut x114: u32 = 0; + let mut x115: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x114, &mut x115, 0x0, x113, x110); + let mut x116: u32 = 0; + let mut x117: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x116, &mut x117, x115, x111, x108); + let mut x118: u32 = 0; + let mut x119: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x118, &mut x119, x117, x109, x106); + let mut x120: u32 = 0; + let mut x121: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x120, &mut x121, 0x0, x96, x112); + let mut x122: u32 = 0; + let mut x123: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x122, &mut x123, x121, x98, x114); + let mut x124: u32 = 0; + let mut x125: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x124, &mut x125, x123, x100, x116); + let mut x126: u32 = 0; + let mut x127: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x126, &mut x127, x125, ((x101 as u32) + ((x93 as u32) + ((x85 as u32) + x73))), x118); + let mut x128: u32 = 0; + let mut x129: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x128, &mut x129, x127, x4, ((x119 as u32) + x107)); + let mut x130: u32 = 0; + let mut x131: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x130, &mut x131, x129, x60, (0x0 as u32)); + let mut x132: u32 = 0; + let mut x133: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x132, &mut x133, x131, x94, (0x0 as u32)); + let mut x134: u32 = 0; + let mut x135: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x134, &mut x135, x133, ((x95 as u32) + x71), x104); + let mut x136: u32 = 0; + let mut x137: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x136, &mut x137, 0x0, x122, (arg1[4])); + let mut x138: u32 = 0; + let mut x139: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x138, &mut x139, x137, x124, (0x0 as u32)); + let mut x140: u32 = 0; + let mut x141: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x140, &mut x141, x139, x126, (0x0 as u32)); + let mut x142: u32 = 0; + let mut x143: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x142, &mut x143, x141, x128, (0x0 as u32)); + let mut x144: u32 = 0; + let mut x145: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x144, &mut x145, x143, x130, (0x0 as u32)); + let mut x146: u32 = 0; + let mut x147: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x146, &mut x147, x145, x132, (0x0 as u32)); + let mut x148: u32 = 0; + let mut x149: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x148, &mut x149, x147, x134, (0x0 as u32)); + let mut x150: u32 = 0; + let mut x151: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x150, &mut x151, x136, 0x12547e1b); + let mut x152: u32 = 0; + let mut x153: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x152, &mut x153, x150, 0x10000000); + let mut x154: u32 = 0; + let mut x155: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x154, &mut x155, x150, 0x14def9de); + let mut x156: u32 = 0; + let mut x157: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x156, &mut x157, x150, 0xa2f79cd6); + let mut x158: u32 = 0; + let mut x159: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x158, &mut x159, x150, 0x5812631a); + let mut x160: u32 = 0; + let mut x161: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x160, &mut x161, x150, 0x5cf5d3ed); + let mut x162: u32 = 0; + let mut x163: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x162, &mut x163, 0x0, x161, x158); + let mut x164: u32 = 0; + let mut x165: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x164, &mut x165, x163, x159, x156); + let mut x166: u32 = 0; + let mut x167: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x166, &mut x167, x165, x157, x154); + let mut x168: u32 = 0; + let mut x169: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x168, &mut x169, 0x0, x136, x160); + let mut x170: u32 = 0; + let mut x171: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x170, &mut x171, x169, x138, x162); + let mut x172: u32 = 0; + let mut x173: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x172, &mut x173, x171, x140, x164); + let mut x174: u32 = 0; + let mut x175: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x174, &mut x175, x173, x142, x166); + let mut x176: u32 = 0; + let mut x177: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x176, &mut x177, x175, x144, ((x167 as u32) + x155)); + let mut x178: u32 = 0; + let mut x179: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x178, &mut x179, x177, x146, (0x0 as u32)); + let mut x180: u32 = 0; + let mut x181: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x180, &mut x181, x179, x148, (0x0 as u32)); + let mut x182: u32 = 0; + let mut x183: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x182, &mut x183, x181, ((x149 as u32) + ((x135 as u32) + x105)), x152); + let mut x184: u32 = 0; + let mut x185: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x184, &mut x185, 0x0, x170, (arg1[5])); + let mut x186: u32 = 0; + let mut x187: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x186, &mut x187, x185, x172, (0x0 as u32)); + let mut x188: u32 = 0; + let mut x189: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x188, &mut x189, x187, x174, (0x0 as u32)); + let mut x190: u32 = 0; + let mut x191: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x190, &mut x191, x189, x176, (0x0 as u32)); + let mut x192: u32 = 0; + let mut x193: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x192, &mut x193, x191, x178, (0x0 as u32)); + let mut x194: u32 = 0; + let mut x195: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x194, &mut x195, x193, x180, (0x0 as u32)); + let mut x196: u32 = 0; + let mut x197: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x196, &mut x197, x195, x182, (0x0 as u32)); + let mut x198: u32 = 0; + let mut x199: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x198, &mut x199, x184, 0x12547e1b); + let mut x200: u32 = 0; + let mut x201: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x200, &mut x201, x198, 0x10000000); + let mut x202: u32 = 0; + let mut x203: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x202, &mut x203, x198, 0x14def9de); + let mut x204: u32 = 0; + let mut x205: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x204, &mut x205, x198, 0xa2f79cd6); + let mut x206: u32 = 0; + let mut x207: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x206, &mut x207, x198, 0x5812631a); + let mut x208: u32 = 0; + let mut x209: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x208, &mut x209, x198, 0x5cf5d3ed); + let mut x210: u32 = 0; + let mut x211: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x210, &mut x211, 0x0, x209, x206); + let mut x212: u32 = 0; + let mut x213: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x212, &mut x213, x211, x207, x204); + let mut x214: u32 = 0; + let mut x215: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x214, &mut x215, x213, x205, x202); + let mut x216: u32 = 0; + let mut x217: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x216, &mut x217, 0x0, x184, x208); + let mut x218: u32 = 0; + let mut x219: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x218, &mut x219, x217, x186, x210); + let mut x220: u32 = 0; + let mut x221: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x220, &mut x221, x219, x188, x212); + let mut x222: u32 = 0; + let mut x223: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x222, &mut x223, x221, x190, x214); + let mut x224: u32 = 0; + let mut x225: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x224, &mut x225, x223, x192, ((x215 as u32) + x203)); + let mut x226: u32 = 0; + let mut x227: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x226, &mut x227, x225, x194, (0x0 as u32)); + let mut x228: u32 = 0; + let mut x229: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x228, &mut x229, x227, x196, (0x0 as u32)); + let mut x230: u32 = 0; + let mut x231: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x230, &mut x231, x229, ((x197 as u32) + ((x183 as u32) + x153)), x200); + let mut x232: u32 = 0; + let mut x233: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x232, &mut x233, 0x0, x218, (arg1[6])); + let mut x234: u32 = 0; + let mut x235: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x234, &mut x235, x233, x220, (0x0 as u32)); + let mut x236: u32 = 0; + let mut x237: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x236, &mut x237, x235, x222, (0x0 as u32)); + let mut x238: u32 = 0; + let mut x239: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x238, &mut x239, x237, x224, (0x0 as u32)); + let mut x240: u32 = 0; + let mut x241: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x240, &mut x241, x239, x226, (0x0 as u32)); + let mut x242: u32 = 0; + let mut x243: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x242, &mut x243, x241, x228, (0x0 as u32)); + let mut x244: u32 = 0; + let mut x245: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x244, &mut x245, x243, x230, (0x0 as u32)); + let mut x246: u32 = 0; + let mut x247: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x246, &mut x247, x232, 0x12547e1b); + let mut x248: u32 = 0; + let mut x249: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x248, &mut x249, x246, 0x10000000); + let mut x250: u32 = 0; + let mut x251: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x250, &mut x251, x246, 0x14def9de); + let mut x252: u32 = 0; + let mut x253: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x252, &mut x253, x246, 0xa2f79cd6); + let mut x254: u32 = 0; + let mut x255: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x254, &mut x255, x246, 0x5812631a); + let mut x256: u32 = 0; + let mut x257: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x256, &mut x257, x246, 0x5cf5d3ed); + let mut x258: u32 = 0; + let mut x259: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x258, &mut x259, 0x0, x257, x254); + let mut x260: u32 = 0; + let mut x261: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x260, &mut x261, x259, x255, x252); + let mut x262: u32 = 0; + let mut x263: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x262, &mut x263, x261, x253, x250); + let mut x264: u32 = 0; + let mut x265: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x264, &mut x265, 0x0, x232, x256); + let mut x266: u32 = 0; + let mut x267: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x266, &mut x267, x265, x234, x258); + let mut x268: u32 = 0; + let mut x269: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x268, &mut x269, x267, x236, x260); + let mut x270: u32 = 0; + let mut x271: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x270, &mut x271, x269, x238, x262); + let mut x272: u32 = 0; + let mut x273: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x272, &mut x273, x271, x240, ((x263 as u32) + x251)); + let mut x274: u32 = 0; + let mut x275: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x274, &mut x275, x273, x242, (0x0 as u32)); + let mut x276: u32 = 0; + let mut x277: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x276, &mut x277, x275, x244, (0x0 as u32)); + let mut x278: u32 = 0; + let mut x279: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x278, &mut x279, x277, ((x245 as u32) + ((x231 as u32) + x201)), x248); + let mut x280: u32 = 0; + let mut x281: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x280, &mut x281, 0x0, x266, (arg1[7])); + let mut x282: u32 = 0; + let mut x283: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x282, &mut x283, x281, x268, (0x0 as u32)); + let mut x284: u32 = 0; + let mut x285: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x284, &mut x285, x283, x270, (0x0 as u32)); + let mut x286: u32 = 0; + let mut x287: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x286, &mut x287, x285, x272, (0x0 as u32)); + let mut x288: u32 = 0; + let mut x289: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x288, &mut x289, x287, x274, (0x0 as u32)); + let mut x290: u32 = 0; + let mut x291: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x290, &mut x291, x289, x276, (0x0 as u32)); + let mut x292: u32 = 0; + let mut x293: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x292, &mut x293, x291, x278, (0x0 as u32)); + let mut x294: u32 = 0; + let mut x295: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x294, &mut x295, x280, 0x12547e1b); + let mut x296: u32 = 0; + let mut x297: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x296, &mut x297, x294, 0x10000000); + let mut x298: u32 = 0; + let mut x299: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x298, &mut x299, x294, 0x14def9de); + let mut x300: u32 = 0; + let mut x301: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x300, &mut x301, x294, 0xa2f79cd6); + let mut x302: u32 = 0; + let mut x303: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x302, &mut x303, x294, 0x5812631a); + let mut x304: u32 = 0; + let mut x305: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x304, &mut x305, x294, 0x5cf5d3ed); + let mut x306: u32 = 0; + let mut x307: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x306, &mut x307, 0x0, x305, x302); + let mut x308: u32 = 0; + let mut x309: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x308, &mut x309, x307, x303, x300); + let mut x310: u32 = 0; + let mut x311: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x310, &mut x311, x309, x301, x298); + let mut x312: u32 = 0; + let mut x313: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x312, &mut x313, 0x0, x280, x304); + let mut x314: u32 = 0; + let mut x315: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x314, &mut x315, x313, x282, x306); + let mut x316: u32 = 0; + let mut x317: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x316, &mut x317, x315, x284, x308); + let mut x318: u32 = 0; + let mut x319: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x318, &mut x319, x317, x286, x310); + let mut x320: u32 = 0; + let mut x321: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x320, &mut x321, x319, x288, ((x311 as u32) + x299)); + let mut x322: u32 = 0; + let mut x323: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x322, &mut x323, x321, x290, (0x0 as u32)); + let mut x324: u32 = 0; + let mut x325: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x324, &mut x325, x323, x292, (0x0 as u32)); + let mut x326: u32 = 0; + let mut x327: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x326, &mut x327, x325, ((x293 as u32) + ((x279 as u32) + x249)), x296); + let x328: u32 = ((x327 as u32) + x297); + let mut x329: u32 = 0; + let mut x330: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x329, &mut x330, 0x0, x314, 0x5cf5d3ed); + let mut x331: u32 = 0; + let mut x332: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x331, &mut x332, x330, x316, 0x5812631a); + let mut x333: u32 = 0; + let mut x334: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x333, &mut x334, x332, x318, 0xa2f79cd6); + let mut x335: u32 = 0; + let mut x336: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x335, &mut x336, x334, x320, 0x14def9de); + let mut x337: u32 = 0; + let mut x338: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x337, &mut x338, x336, x322, (0x0 as u32)); + let mut x339: u32 = 0; + let mut x340: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x339, &mut x340, x338, x324, (0x0 as u32)); + let mut x341: u32 = 0; + let mut x342: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x341, &mut x342, x340, x326, (0x0 as u32)); + let mut x343: u32 = 0; + let mut x344: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x343, &mut x344, x342, x328, 0x10000000); + let mut x345: u32 = 0; + let mut x346: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x345, &mut x346, x344, (0x0 as u32), (0x0 as u32)); + let mut x347: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x347, x346, x329, x314); + let mut x348: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x348, x346, x331, x316); + let mut x349: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x349, x346, x333, x318); + let mut x350: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x350, x346, x335, x320); + let mut x351: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x351, x346, x337, x322); + let mut x352: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x352, x346, x339, x324); + let mut x353: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x353, x346, x341, x326); + let mut x354: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x354, x346, x343, x328); + out1[0] = x347; + out1[1] = x348; + out1[2] = x349; + out1[3] = x350; + out1[4] = x351; + out1[5] = x352; + out1[6] = x353; + out1[7] = x354; +} + +/// The function fiat_25519_scalar_to_montgomery translates a field element into the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = eval arg1 mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_25519_scalar_to_montgomery(out1: &mut fiat_25519_scalar_montgomery_domain_field_element, arg1: &fiat_25519_scalar_non_montgomery_domain_field_element) -> () { + let x1: u32 = (arg1[1]); + let x2: u32 = (arg1[2]); + let x3: u32 = (arg1[3]); + let x4: u32 = (arg1[4]); + let x5: u32 = (arg1[5]); + let x6: u32 = (arg1[6]); + let x7: u32 = (arg1[7]); + let x8: u32 = (arg1[0]); + let mut x9: u32 = 0; + let mut x10: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x9, &mut x10, x8, 0x399411b); + let mut x11: u32 = 0; + let mut x12: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x11, &mut x12, x8, 0x7c309a3d); + let mut x13: u32 = 0; + let mut x14: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x13, &mut x14, x8, 0xceec73d2); + let mut x15: u32 = 0; + let mut x16: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x15, &mut x16, x8, 0x17f5be65); + let mut x17: u32 = 0; + let mut x18: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x17, &mut x18, x8, 0xd00e1ba7); + let mut x19: u32 = 0; + let mut x20: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x19, &mut x20, x8, 0x68859347); + let mut x21: u32 = 0; + let mut x22: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x21, &mut x22, x8, 0xa40611e3); + let mut x23: u32 = 0; + let mut x24: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x23, &mut x24, x8, 0x449c0f01); + let mut x25: u32 = 0; + let mut x26: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x25, &mut x26, 0x0, x24, x21); + let mut x27: u32 = 0; + let mut x28: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x27, &mut x28, x26, x22, x19); + let mut x29: u32 = 0; + let mut x30: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x29, &mut x30, x28, x20, x17); + let mut x31: u32 = 0; + let mut x32: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x31, &mut x32, x30, x18, x15); + let mut x33: u32 = 0; + let mut x34: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x33, &mut x34, x32, x16, x13); + let mut x35: u32 = 0; + let mut x36: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x35, &mut x36, x34, x14, x11); + let mut x37: u32 = 0; + let mut x38: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x37, &mut x38, x36, x12, x9); + let mut x39: u32 = 0; + let mut x40: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x39, &mut x40, x23, 0x12547e1b); + let mut x41: u32 = 0; + let mut x42: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x41, &mut x42, x39, 0x10000000); + let mut x43: u32 = 0; + let mut x44: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x43, &mut x44, x39, 0x14def9de); + let mut x45: u32 = 0; + let mut x46: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x45, &mut x46, x39, 0xa2f79cd6); + let mut x47: u32 = 0; + let mut x48: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x47, &mut x48, x39, 0x5812631a); + let mut x49: u32 = 0; + let mut x50: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x49, &mut x50, x39, 0x5cf5d3ed); + let mut x51: u32 = 0; + let mut x52: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x51, &mut x52, 0x0, x50, x47); + let mut x53: u32 = 0; + let mut x54: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x53, &mut x54, x52, x48, x45); + let mut x55: u32 = 0; + let mut x56: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x55, &mut x56, x54, x46, x43); + let mut x57: u32 = 0; + let mut x58: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x57, &mut x58, 0x0, x23, x49); + let mut x59: u32 = 0; + let mut x60: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x59, &mut x60, x58, x25, x51); + let mut x61: u32 = 0; + let mut x62: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x61, &mut x62, x60, x27, x53); + let mut x63: u32 = 0; + let mut x64: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x63, &mut x64, x62, x29, x55); + let mut x65: u32 = 0; + let mut x66: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x65, &mut x66, x64, x31, ((x56 as u32) + x44)); + let mut x67: u32 = 0; + let mut x68: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x67, &mut x68, x66, x33, (0x0 as u32)); + let mut x69: u32 = 0; + let mut x70: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x69, &mut x70, x68, x35, (0x0 as u32)); + let mut x71: u32 = 0; + let mut x72: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x71, &mut x72, x70, x37, x41); + let mut x73: u32 = 0; + let mut x74: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x73, &mut x74, x1, 0x399411b); + let mut x75: u32 = 0; + let mut x76: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x75, &mut x76, x1, 0x7c309a3d); + let mut x77: u32 = 0; + let mut x78: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x77, &mut x78, x1, 0xceec73d2); + let mut x79: u32 = 0; + let mut x80: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x79, &mut x80, x1, 0x17f5be65); + let mut x81: u32 = 0; + let mut x82: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x81, &mut x82, x1, 0xd00e1ba7); + let mut x83: u32 = 0; + let mut x84: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x83, &mut x84, x1, 0x68859347); + let mut x85: u32 = 0; + let mut x86: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x85, &mut x86, x1, 0xa40611e3); + let mut x87: u32 = 0; + let mut x88: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x87, &mut x88, x1, 0x449c0f01); + let mut x89: u32 = 0; + let mut x90: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x89, &mut x90, 0x0, x88, x85); + let mut x91: u32 = 0; + let mut x92: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x91, &mut x92, x90, x86, x83); + let mut x93: u32 = 0; + let mut x94: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x93, &mut x94, x92, x84, x81); + let mut x95: u32 = 0; + let mut x96: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x95, &mut x96, x94, x82, x79); + let mut x97: u32 = 0; + let mut x98: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x97, &mut x98, x96, x80, x77); + let mut x99: u32 = 0; + let mut x100: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x99, &mut x100, x98, x78, x75); + let mut x101: u32 = 0; + let mut x102: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x101, &mut x102, x100, x76, x73); + let mut x103: u32 = 0; + let mut x104: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x103, &mut x104, 0x0, x59, x87); + let mut x105: u32 = 0; + let mut x106: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x105, &mut x106, x104, x61, x89); + let mut x107: u32 = 0; + let mut x108: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x107, &mut x108, x106, x63, x91); + let mut x109: u32 = 0; + let mut x110: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x109, &mut x110, x108, x65, x93); + let mut x111: u32 = 0; + let mut x112: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x111, &mut x112, x110, x67, x95); + let mut x113: u32 = 0; + let mut x114: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x113, &mut x114, x112, x69, x97); + let mut x115: u32 = 0; + let mut x116: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x115, &mut x116, x114, x71, x99); + let mut x117: u32 = 0; + let mut x118: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x117, &mut x118, x116, (((x72 as u32) + ((x38 as u32) + x10)) + x42), x101); + let mut x119: u32 = 0; + let mut x120: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x119, &mut x120, x103, 0x12547e1b); + let mut x121: u32 = 0; + let mut x122: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x121, &mut x122, x119, 0x10000000); + let mut x123: u32 = 0; + let mut x124: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x123, &mut x124, x119, 0x14def9de); + let mut x125: u32 = 0; + let mut x126: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x125, &mut x126, x119, 0xa2f79cd6); + let mut x127: u32 = 0; + let mut x128: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x127, &mut x128, x119, 0x5812631a); + let mut x129: u32 = 0; + let mut x130: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x129, &mut x130, x119, 0x5cf5d3ed); + let mut x131: u32 = 0; + let mut x132: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x131, &mut x132, 0x0, x130, x127); + let mut x133: u32 = 0; + let mut x134: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x133, &mut x134, x132, x128, x125); + let mut x135: u32 = 0; + let mut x136: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x135, &mut x136, x134, x126, x123); + let mut x137: u32 = 0; + let mut x138: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x137, &mut x138, 0x0, x103, x129); + let mut x139: u32 = 0; + let mut x140: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x139, &mut x140, x138, x105, x131); + let mut x141: u32 = 0; + let mut x142: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x141, &mut x142, x140, x107, x133); + let mut x143: u32 = 0; + let mut x144: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x143, &mut x144, x142, x109, x135); + let mut x145: u32 = 0; + let mut x146: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x145, &mut x146, x144, x111, ((x136 as u32) + x124)); + let mut x147: u32 = 0; + let mut x148: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x147, &mut x148, x146, x113, (0x0 as u32)); + let mut x149: u32 = 0; + let mut x150: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x149, &mut x150, x148, x115, (0x0 as u32)); + let mut x151: u32 = 0; + let mut x152: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x151, &mut x152, x150, x117, x121); + let mut x153: u32 = 0; + let mut x154: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x153, &mut x154, x2, 0x399411b); + let mut x155: u32 = 0; + let mut x156: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x155, &mut x156, x2, 0x7c309a3d); + let mut x157: u32 = 0; + let mut x158: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x157, &mut x158, x2, 0xceec73d2); + let mut x159: u32 = 0; + let mut x160: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x159, &mut x160, x2, 0x17f5be65); + let mut x161: u32 = 0; + let mut x162: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x161, &mut x162, x2, 0xd00e1ba7); + let mut x163: u32 = 0; + let mut x164: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x163, &mut x164, x2, 0x68859347); + let mut x165: u32 = 0; + let mut x166: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x165, &mut x166, x2, 0xa40611e3); + let mut x167: u32 = 0; + let mut x168: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x167, &mut x168, x2, 0x449c0f01); + let mut x169: u32 = 0; + let mut x170: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x169, &mut x170, 0x0, x168, x165); + let mut x171: u32 = 0; + let mut x172: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x171, &mut x172, x170, x166, x163); + let mut x173: u32 = 0; + let mut x174: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x173, &mut x174, x172, x164, x161); + let mut x175: u32 = 0; + let mut x176: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x175, &mut x176, x174, x162, x159); + let mut x177: u32 = 0; + let mut x178: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x177, &mut x178, x176, x160, x157); + let mut x179: u32 = 0; + let mut x180: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x179, &mut x180, x178, x158, x155); + let mut x181: u32 = 0; + let mut x182: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x181, &mut x182, x180, x156, x153); + let mut x183: u32 = 0; + let mut x184: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x183, &mut x184, 0x0, x139, x167); + let mut x185: u32 = 0; + let mut x186: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x185, &mut x186, x184, x141, x169); + let mut x187: u32 = 0; + let mut x188: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x187, &mut x188, x186, x143, x171); + let mut x189: u32 = 0; + let mut x190: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x189, &mut x190, x188, x145, x173); + let mut x191: u32 = 0; + let mut x192: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x191, &mut x192, x190, x147, x175); + let mut x193: u32 = 0; + let mut x194: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x193, &mut x194, x192, x149, x177); + let mut x195: u32 = 0; + let mut x196: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x195, &mut x196, x194, x151, x179); + let mut x197: u32 = 0; + let mut x198: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x197, &mut x198, x196, (((x152 as u32) + ((x118 as u32) + ((x102 as u32) + x74))) + x122), x181); + let mut x199: u32 = 0; + let mut x200: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x199, &mut x200, x183, 0x12547e1b); + let mut x201: u32 = 0; + let mut x202: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x201, &mut x202, x199, 0x10000000); + let mut x203: u32 = 0; + let mut x204: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x203, &mut x204, x199, 0x14def9de); + let mut x205: u32 = 0; + let mut x206: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x205, &mut x206, x199, 0xa2f79cd6); + let mut x207: u32 = 0; + let mut x208: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x207, &mut x208, x199, 0x5812631a); + let mut x209: u32 = 0; + let mut x210: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x209, &mut x210, x199, 0x5cf5d3ed); + let mut x211: u32 = 0; + let mut x212: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x211, &mut x212, 0x0, x210, x207); + let mut x213: u32 = 0; + let mut x214: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x213, &mut x214, x212, x208, x205); + let mut x215: u32 = 0; + let mut x216: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x215, &mut x216, x214, x206, x203); + let mut x217: u32 = 0; + let mut x218: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x217, &mut x218, 0x0, x183, x209); + let mut x219: u32 = 0; + let mut x220: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x219, &mut x220, x218, x185, x211); + let mut x221: u32 = 0; + let mut x222: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x221, &mut x222, x220, x187, x213); + let mut x223: u32 = 0; + let mut x224: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x223, &mut x224, x222, x189, x215); + let mut x225: u32 = 0; + let mut x226: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x225, &mut x226, x224, x191, ((x216 as u32) + x204)); + let mut x227: u32 = 0; + let mut x228: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x227, &mut x228, x226, x193, (0x0 as u32)); + let mut x229: u32 = 0; + let mut x230: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x229, &mut x230, x228, x195, (0x0 as u32)); + let mut x231: u32 = 0; + let mut x232: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x231, &mut x232, x230, x197, x201); + let mut x233: u32 = 0; + let mut x234: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x233, &mut x234, x3, 0x399411b); + let mut x235: u32 = 0; + let mut x236: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x235, &mut x236, x3, 0x7c309a3d); + let mut x237: u32 = 0; + let mut x238: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x237, &mut x238, x3, 0xceec73d2); + let mut x239: u32 = 0; + let mut x240: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x239, &mut x240, x3, 0x17f5be65); + let mut x241: u32 = 0; + let mut x242: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x241, &mut x242, x3, 0xd00e1ba7); + let mut x243: u32 = 0; + let mut x244: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x243, &mut x244, x3, 0x68859347); + let mut x245: u32 = 0; + let mut x246: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x245, &mut x246, x3, 0xa40611e3); + let mut x247: u32 = 0; + let mut x248: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x247, &mut x248, x3, 0x449c0f01); + let mut x249: u32 = 0; + let mut x250: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x249, &mut x250, 0x0, x248, x245); + let mut x251: u32 = 0; + let mut x252: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x251, &mut x252, x250, x246, x243); + let mut x253: u32 = 0; + let mut x254: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x253, &mut x254, x252, x244, x241); + let mut x255: u32 = 0; + let mut x256: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x255, &mut x256, x254, x242, x239); + let mut x257: u32 = 0; + let mut x258: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x257, &mut x258, x256, x240, x237); + let mut x259: u32 = 0; + let mut x260: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x259, &mut x260, x258, x238, x235); + let mut x261: u32 = 0; + let mut x262: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x261, &mut x262, x260, x236, x233); + let mut x263: u32 = 0; + let mut x264: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x263, &mut x264, 0x0, x219, x247); + let mut x265: u32 = 0; + let mut x266: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x265, &mut x266, x264, x221, x249); + let mut x267: u32 = 0; + let mut x268: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x267, &mut x268, x266, x223, x251); + let mut x269: u32 = 0; + let mut x270: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x269, &mut x270, x268, x225, x253); + let mut x271: u32 = 0; + let mut x272: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x271, &mut x272, x270, x227, x255); + let mut x273: u32 = 0; + let mut x274: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x273, &mut x274, x272, x229, x257); + let mut x275: u32 = 0; + let mut x276: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x275, &mut x276, x274, x231, x259); + let mut x277: u32 = 0; + let mut x278: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x277, &mut x278, x276, (((x232 as u32) + ((x198 as u32) + ((x182 as u32) + x154))) + x202), x261); + let mut x279: u32 = 0; + let mut x280: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x279, &mut x280, x263, 0x12547e1b); + let mut x281: u32 = 0; + let mut x282: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x281, &mut x282, x279, 0x10000000); + let mut x283: u32 = 0; + let mut x284: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x283, &mut x284, x279, 0x14def9de); + let mut x285: u32 = 0; + let mut x286: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x285, &mut x286, x279, 0xa2f79cd6); + let mut x287: u32 = 0; + let mut x288: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x287, &mut x288, x279, 0x5812631a); + let mut x289: u32 = 0; + let mut x290: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x289, &mut x290, x279, 0x5cf5d3ed); + let mut x291: u32 = 0; + let mut x292: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x291, &mut x292, 0x0, x290, x287); + let mut x293: u32 = 0; + let mut x294: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x293, &mut x294, x292, x288, x285); + let mut x295: u32 = 0; + let mut x296: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x295, &mut x296, x294, x286, x283); + let mut x297: u32 = 0; + let mut x298: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x297, &mut x298, 0x0, x263, x289); + let mut x299: u32 = 0; + let mut x300: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x299, &mut x300, x298, x265, x291); + let mut x301: u32 = 0; + let mut x302: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x301, &mut x302, x300, x267, x293); + let mut x303: u32 = 0; + let mut x304: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x303, &mut x304, x302, x269, x295); + let mut x305: u32 = 0; + let mut x306: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x305, &mut x306, x304, x271, ((x296 as u32) + x284)); + let mut x307: u32 = 0; + let mut x308: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x307, &mut x308, x306, x273, (0x0 as u32)); + let mut x309: u32 = 0; + let mut x310: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x309, &mut x310, x308, x275, (0x0 as u32)); + let mut x311: u32 = 0; + let mut x312: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x311, &mut x312, x310, x277, x281); + let mut x313: u32 = 0; + let mut x314: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x313, &mut x314, x4, 0x399411b); + let mut x315: u32 = 0; + let mut x316: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x315, &mut x316, x4, 0x7c309a3d); + let mut x317: u32 = 0; + let mut x318: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x317, &mut x318, x4, 0xceec73d2); + let mut x319: u32 = 0; + let mut x320: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x319, &mut x320, x4, 0x17f5be65); + let mut x321: u32 = 0; + let mut x322: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x321, &mut x322, x4, 0xd00e1ba7); + let mut x323: u32 = 0; + let mut x324: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x323, &mut x324, x4, 0x68859347); + let mut x325: u32 = 0; + let mut x326: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x325, &mut x326, x4, 0xa40611e3); + let mut x327: u32 = 0; + let mut x328: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x327, &mut x328, x4, 0x449c0f01); + let mut x329: u32 = 0; + let mut x330: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x329, &mut x330, 0x0, x328, x325); + let mut x331: u32 = 0; + let mut x332: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x331, &mut x332, x330, x326, x323); + let mut x333: u32 = 0; + let mut x334: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x333, &mut x334, x332, x324, x321); + let mut x335: u32 = 0; + let mut x336: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x335, &mut x336, x334, x322, x319); + let mut x337: u32 = 0; + let mut x338: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x337, &mut x338, x336, x320, x317); + let mut x339: u32 = 0; + let mut x340: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x339, &mut x340, x338, x318, x315); + let mut x341: u32 = 0; + let mut x342: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x341, &mut x342, x340, x316, x313); + let mut x343: u32 = 0; + let mut x344: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x343, &mut x344, 0x0, x299, x327); + let mut x345: u32 = 0; + let mut x346: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x345, &mut x346, x344, x301, x329); + let mut x347: u32 = 0; + let mut x348: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x347, &mut x348, x346, x303, x331); + let mut x349: u32 = 0; + let mut x350: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x349, &mut x350, x348, x305, x333); + let mut x351: u32 = 0; + let mut x352: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x351, &mut x352, x350, x307, x335); + let mut x353: u32 = 0; + let mut x354: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x353, &mut x354, x352, x309, x337); + let mut x355: u32 = 0; + let mut x356: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x355, &mut x356, x354, x311, x339); + let mut x357: u32 = 0; + let mut x358: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x357, &mut x358, x356, (((x312 as u32) + ((x278 as u32) + ((x262 as u32) + x234))) + x282), x341); + let mut x359: u32 = 0; + let mut x360: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x359, &mut x360, x343, 0x12547e1b); + let mut x361: u32 = 0; + let mut x362: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x361, &mut x362, x359, 0x10000000); + let mut x363: u32 = 0; + let mut x364: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x363, &mut x364, x359, 0x14def9de); + let mut x365: u32 = 0; + let mut x366: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x365, &mut x366, x359, 0xa2f79cd6); + let mut x367: u32 = 0; + let mut x368: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x367, &mut x368, x359, 0x5812631a); + let mut x369: u32 = 0; + let mut x370: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x369, &mut x370, x359, 0x5cf5d3ed); + let mut x371: u32 = 0; + let mut x372: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x371, &mut x372, 0x0, x370, x367); + let mut x373: u32 = 0; + let mut x374: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x373, &mut x374, x372, x368, x365); + let mut x375: u32 = 0; + let mut x376: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x375, &mut x376, x374, x366, x363); + let mut x377: u32 = 0; + let mut x378: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x377, &mut x378, 0x0, x343, x369); + let mut x379: u32 = 0; + let mut x380: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x379, &mut x380, x378, x345, x371); + let mut x381: u32 = 0; + let mut x382: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x381, &mut x382, x380, x347, x373); + let mut x383: u32 = 0; + let mut x384: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x383, &mut x384, x382, x349, x375); + let mut x385: u32 = 0; + let mut x386: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x385, &mut x386, x384, x351, ((x376 as u32) + x364)); + let mut x387: u32 = 0; + let mut x388: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x387, &mut x388, x386, x353, (0x0 as u32)); + let mut x389: u32 = 0; + let mut x390: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x389, &mut x390, x388, x355, (0x0 as u32)); + let mut x391: u32 = 0; + let mut x392: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x391, &mut x392, x390, x357, x361); + let mut x393: u32 = 0; + let mut x394: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x393, &mut x394, x5, 0x399411b); + let mut x395: u32 = 0; + let mut x396: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x395, &mut x396, x5, 0x7c309a3d); + let mut x397: u32 = 0; + let mut x398: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x397, &mut x398, x5, 0xceec73d2); + let mut x399: u32 = 0; + let mut x400: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x399, &mut x400, x5, 0x17f5be65); + let mut x401: u32 = 0; + let mut x402: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x401, &mut x402, x5, 0xd00e1ba7); + let mut x403: u32 = 0; + let mut x404: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x403, &mut x404, x5, 0x68859347); + let mut x405: u32 = 0; + let mut x406: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x405, &mut x406, x5, 0xa40611e3); + let mut x407: u32 = 0; + let mut x408: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x407, &mut x408, x5, 0x449c0f01); + let mut x409: u32 = 0; + let mut x410: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x409, &mut x410, 0x0, x408, x405); + let mut x411: u32 = 0; + let mut x412: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x411, &mut x412, x410, x406, x403); + let mut x413: u32 = 0; + let mut x414: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x413, &mut x414, x412, x404, x401); + let mut x415: u32 = 0; + let mut x416: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x415, &mut x416, x414, x402, x399); + let mut x417: u32 = 0; + let mut x418: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x417, &mut x418, x416, x400, x397); + let mut x419: u32 = 0; + let mut x420: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x419, &mut x420, x418, x398, x395); + let mut x421: u32 = 0; + let mut x422: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x421, &mut x422, x420, x396, x393); + let mut x423: u32 = 0; + let mut x424: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x423, &mut x424, 0x0, x379, x407); + let mut x425: u32 = 0; + let mut x426: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x425, &mut x426, x424, x381, x409); + let mut x427: u32 = 0; + let mut x428: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x427, &mut x428, x426, x383, x411); + let mut x429: u32 = 0; + let mut x430: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x429, &mut x430, x428, x385, x413); + let mut x431: u32 = 0; + let mut x432: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x431, &mut x432, x430, x387, x415); + let mut x433: u32 = 0; + let mut x434: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x433, &mut x434, x432, x389, x417); + let mut x435: u32 = 0; + let mut x436: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x435, &mut x436, x434, x391, x419); + let mut x437: u32 = 0; + let mut x438: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x437, &mut x438, x436, (((x392 as u32) + ((x358 as u32) + ((x342 as u32) + x314))) + x362), x421); + let mut x439: u32 = 0; + let mut x440: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x439, &mut x440, x423, 0x12547e1b); + let mut x441: u32 = 0; + let mut x442: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x441, &mut x442, x439, 0x10000000); + let mut x443: u32 = 0; + let mut x444: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x443, &mut x444, x439, 0x14def9de); + let mut x445: u32 = 0; + let mut x446: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x445, &mut x446, x439, 0xa2f79cd6); + let mut x447: u32 = 0; + let mut x448: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x447, &mut x448, x439, 0x5812631a); + let mut x449: u32 = 0; + let mut x450: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x449, &mut x450, x439, 0x5cf5d3ed); + let mut x451: u32 = 0; + let mut x452: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x451, &mut x452, 0x0, x450, x447); + let mut x453: u32 = 0; + let mut x454: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x453, &mut x454, x452, x448, x445); + let mut x455: u32 = 0; + let mut x456: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x455, &mut x456, x454, x446, x443); + let mut x457: u32 = 0; + let mut x458: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x457, &mut x458, 0x0, x423, x449); + let mut x459: u32 = 0; + let mut x460: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x459, &mut x460, x458, x425, x451); + let mut x461: u32 = 0; + let mut x462: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x461, &mut x462, x460, x427, x453); + let mut x463: u32 = 0; + let mut x464: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x463, &mut x464, x462, x429, x455); + let mut x465: u32 = 0; + let mut x466: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x465, &mut x466, x464, x431, ((x456 as u32) + x444)); + let mut x467: u32 = 0; + let mut x468: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x467, &mut x468, x466, x433, (0x0 as u32)); + let mut x469: u32 = 0; + let mut x470: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x469, &mut x470, x468, x435, (0x0 as u32)); + let mut x471: u32 = 0; + let mut x472: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x471, &mut x472, x470, x437, x441); + let mut x473: u32 = 0; + let mut x474: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x473, &mut x474, x6, 0x399411b); + let mut x475: u32 = 0; + let mut x476: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x475, &mut x476, x6, 0x7c309a3d); + let mut x477: u32 = 0; + let mut x478: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x477, &mut x478, x6, 0xceec73d2); + let mut x479: u32 = 0; + let mut x480: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x479, &mut x480, x6, 0x17f5be65); + let mut x481: u32 = 0; + let mut x482: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x481, &mut x482, x6, 0xd00e1ba7); + let mut x483: u32 = 0; + let mut x484: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x483, &mut x484, x6, 0x68859347); + let mut x485: u32 = 0; + let mut x486: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x485, &mut x486, x6, 0xa40611e3); + let mut x487: u32 = 0; + let mut x488: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x487, &mut x488, x6, 0x449c0f01); + let mut x489: u32 = 0; + let mut x490: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x489, &mut x490, 0x0, x488, x485); + let mut x491: u32 = 0; + let mut x492: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x491, &mut x492, x490, x486, x483); + let mut x493: u32 = 0; + let mut x494: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x493, &mut x494, x492, x484, x481); + let mut x495: u32 = 0; + let mut x496: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x495, &mut x496, x494, x482, x479); + let mut x497: u32 = 0; + let mut x498: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x497, &mut x498, x496, x480, x477); + let mut x499: u32 = 0; + let mut x500: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x499, &mut x500, x498, x478, x475); + let mut x501: u32 = 0; + let mut x502: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x501, &mut x502, x500, x476, x473); + let mut x503: u32 = 0; + let mut x504: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x503, &mut x504, 0x0, x459, x487); + let mut x505: u32 = 0; + let mut x506: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x505, &mut x506, x504, x461, x489); + let mut x507: u32 = 0; + let mut x508: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x507, &mut x508, x506, x463, x491); + let mut x509: u32 = 0; + let mut x510: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x509, &mut x510, x508, x465, x493); + let mut x511: u32 = 0; + let mut x512: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x511, &mut x512, x510, x467, x495); + let mut x513: u32 = 0; + let mut x514: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x513, &mut x514, x512, x469, x497); + let mut x515: u32 = 0; + let mut x516: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x515, &mut x516, x514, x471, x499); + let mut x517: u32 = 0; + let mut x518: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x517, &mut x518, x516, (((x472 as u32) + ((x438 as u32) + ((x422 as u32) + x394))) + x442), x501); + let mut x519: u32 = 0; + let mut x520: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x519, &mut x520, x503, 0x12547e1b); + let mut x521: u32 = 0; + let mut x522: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x521, &mut x522, x519, 0x10000000); + let mut x523: u32 = 0; + let mut x524: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x523, &mut x524, x519, 0x14def9de); + let mut x525: u32 = 0; + let mut x526: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x525, &mut x526, x519, 0xa2f79cd6); + let mut x527: u32 = 0; + let mut x528: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x527, &mut x528, x519, 0x5812631a); + let mut x529: u32 = 0; + let mut x530: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x529, &mut x530, x519, 0x5cf5d3ed); + let mut x531: u32 = 0; + let mut x532: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x531, &mut x532, 0x0, x530, x527); + let mut x533: u32 = 0; + let mut x534: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x533, &mut x534, x532, x528, x525); + let mut x535: u32 = 0; + let mut x536: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x535, &mut x536, x534, x526, x523); + let mut x537: u32 = 0; + let mut x538: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x537, &mut x538, 0x0, x503, x529); + let mut x539: u32 = 0; + let mut x540: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x539, &mut x540, x538, x505, x531); + let mut x541: u32 = 0; + let mut x542: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x541, &mut x542, x540, x507, x533); + let mut x543: u32 = 0; + let mut x544: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x543, &mut x544, x542, x509, x535); + let mut x545: u32 = 0; + let mut x546: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x545, &mut x546, x544, x511, ((x536 as u32) + x524)); + let mut x547: u32 = 0; + let mut x548: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x547, &mut x548, x546, x513, (0x0 as u32)); + let mut x549: u32 = 0; + let mut x550: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x549, &mut x550, x548, x515, (0x0 as u32)); + let mut x551: u32 = 0; + let mut x552: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x551, &mut x552, x550, x517, x521); + let mut x553: u32 = 0; + let mut x554: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x553, &mut x554, x7, 0x399411b); + let mut x555: u32 = 0; + let mut x556: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x555, &mut x556, x7, 0x7c309a3d); + let mut x557: u32 = 0; + let mut x558: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x557, &mut x558, x7, 0xceec73d2); + let mut x559: u32 = 0; + let mut x560: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x559, &mut x560, x7, 0x17f5be65); + let mut x561: u32 = 0; + let mut x562: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x561, &mut x562, x7, 0xd00e1ba7); + let mut x563: u32 = 0; + let mut x564: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x563, &mut x564, x7, 0x68859347); + let mut x565: u32 = 0; + let mut x566: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x565, &mut x566, x7, 0xa40611e3); + let mut x567: u32 = 0; + let mut x568: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x567, &mut x568, x7, 0x449c0f01); + let mut x569: u32 = 0; + let mut x570: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x569, &mut x570, 0x0, x568, x565); + let mut x571: u32 = 0; + let mut x572: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x571, &mut x572, x570, x566, x563); + let mut x573: u32 = 0; + let mut x574: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x573, &mut x574, x572, x564, x561); + let mut x575: u32 = 0; + let mut x576: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x575, &mut x576, x574, x562, x559); + let mut x577: u32 = 0; + let mut x578: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x577, &mut x578, x576, x560, x557); + let mut x579: u32 = 0; + let mut x580: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x579, &mut x580, x578, x558, x555); + let mut x581: u32 = 0; + let mut x582: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x581, &mut x582, x580, x556, x553); + let mut x583: u32 = 0; + let mut x584: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x583, &mut x584, 0x0, x539, x567); + let mut x585: u32 = 0; + let mut x586: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x585, &mut x586, x584, x541, x569); + let mut x587: u32 = 0; + let mut x588: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x587, &mut x588, x586, x543, x571); + let mut x589: u32 = 0; + let mut x590: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x589, &mut x590, x588, x545, x573); + let mut x591: u32 = 0; + let mut x592: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x591, &mut x592, x590, x547, x575); + let mut x593: u32 = 0; + let mut x594: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x593, &mut x594, x592, x549, x577); + let mut x595: u32 = 0; + let mut x596: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x595, &mut x596, x594, x551, x579); + let mut x597: u32 = 0; + let mut x598: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x597, &mut x598, x596, (((x552 as u32) + ((x518 as u32) + ((x502 as u32) + x474))) + x522), x581); + let mut x599: u32 = 0; + let mut x600: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x599, &mut x600, x583, 0x12547e1b); + let mut x601: u32 = 0; + let mut x602: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x601, &mut x602, x599, 0x10000000); + let mut x603: u32 = 0; + let mut x604: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x603, &mut x604, x599, 0x14def9de); + let mut x605: u32 = 0; + let mut x606: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x605, &mut x606, x599, 0xa2f79cd6); + let mut x607: u32 = 0; + let mut x608: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x607, &mut x608, x599, 0x5812631a); + let mut x609: u32 = 0; + let mut x610: u32 = 0; + fiat_25519_scalar_mulx_u32(&mut x609, &mut x610, x599, 0x5cf5d3ed); + let mut x611: u32 = 0; + let mut x612: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x611, &mut x612, 0x0, x610, x607); + let mut x613: u32 = 0; + let mut x614: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x613, &mut x614, x612, x608, x605); + let mut x615: u32 = 0; + let mut x616: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x615, &mut x616, x614, x606, x603); + let mut x617: u32 = 0; + let mut x618: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x617, &mut x618, 0x0, x583, x609); + let mut x619: u32 = 0; + let mut x620: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x619, &mut x620, x618, x585, x611); + let mut x621: u32 = 0; + let mut x622: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x621, &mut x622, x620, x587, x613); + let mut x623: u32 = 0; + let mut x624: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x623, &mut x624, x622, x589, x615); + let mut x625: u32 = 0; + let mut x626: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x625, &mut x626, x624, x591, ((x616 as u32) + x604)); + let mut x627: u32 = 0; + let mut x628: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x627, &mut x628, x626, x593, (0x0 as u32)); + let mut x629: u32 = 0; + let mut x630: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x629, &mut x630, x628, x595, (0x0 as u32)); + let mut x631: u32 = 0; + let mut x632: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x631, &mut x632, x630, x597, x601); + let x633: u32 = (((x632 as u32) + ((x598 as u32) + ((x582 as u32) + x554))) + x602); + let mut x634: u32 = 0; + let mut x635: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x634, &mut x635, 0x0, x619, 0x5cf5d3ed); + let mut x636: u32 = 0; + let mut x637: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x636, &mut x637, x635, x621, 0x5812631a); + let mut x638: u32 = 0; + let mut x639: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x638, &mut x639, x637, x623, 0xa2f79cd6); + let mut x640: u32 = 0; + let mut x641: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x640, &mut x641, x639, x625, 0x14def9de); + let mut x642: u32 = 0; + let mut x643: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x642, &mut x643, x641, x627, (0x0 as u32)); + let mut x644: u32 = 0; + let mut x645: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x644, &mut x645, x643, x629, (0x0 as u32)); + let mut x646: u32 = 0; + let mut x647: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x646, &mut x647, x645, x631, (0x0 as u32)); + let mut x648: u32 = 0; + let mut x649: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x648, &mut x649, x647, x633, 0x10000000); + let mut x650: u32 = 0; + let mut x651: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x650, &mut x651, x649, (0x0 as u32), (0x0 as u32)); + let mut x652: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x652, x651, x634, x619); + let mut x653: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x653, x651, x636, x621); + let mut x654: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x654, x651, x638, x623); + let mut x655: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x655, x651, x640, x625); + let mut x656: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x656, x651, x642, x627); + let mut x657: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x657, x651, x644, x629); + let mut x658: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x658, x651, x646, x631); + let mut x659: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x659, x651, x648, x633); + out1[0] = x652; + out1[1] = x653; + out1[2] = x654; + out1[3] = x655; + out1[4] = x656; + out1[5] = x657; + out1[6] = x658; + out1[7] = x659; +} + +/// The function fiat_25519_scalar_nonzero outputs a single non-zero word if the input is non-zero and zero otherwise. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// out1 = 0 ↔ eval (from_montgomery arg1) mod m = 0 +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +#[inline] +pub fn fiat_25519_scalar_nonzero(out1: &mut u32, arg1: &[u32; 8]) -> () { + let x1: u32 = ((arg1[0]) | ((arg1[1]) | ((arg1[2]) | ((arg1[3]) | ((arg1[4]) | ((arg1[5]) | ((arg1[6]) | (arg1[7])))))))); + *out1 = x1; +} + +/// The function fiat_25519_scalar_selectznz is a multi-limb conditional select. +/// +/// Postconditions: +/// out1 = (if arg1 = 0 then arg2 else arg3) +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// arg3: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +#[inline] +pub fn fiat_25519_scalar_selectznz(out1: &mut [u32; 8], arg1: fiat_25519_scalar_u1, arg2: &[u32; 8], arg3: &[u32; 8]) -> () { + let mut x1: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x1, arg1, (arg2[0]), (arg3[0])); + let mut x2: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x2, arg1, (arg2[1]), (arg3[1])); + let mut x3: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x3, arg1, (arg2[2]), (arg3[2])); + let mut x4: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x4, arg1, (arg2[3]), (arg3[3])); + let mut x5: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x5, arg1, (arg2[4]), (arg3[4])); + let mut x6: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x6, arg1, (arg2[5]), (arg3[5])); + let mut x7: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x7, arg1, (arg2[6]), (arg3[6])); + let mut x8: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x8, arg1, (arg2[7]), (arg3[7])); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; + out1[3] = x4; + out1[4] = x5; + out1[5] = x6; + out1[6] = x7; + out1[7] = x8; +} + +/// The function fiat_25519_scalar_to_bytes serializes a field element NOT in the Montgomery domain to bytes in little-endian order. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..31] +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0x1fffffff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0x1f]] +#[inline] +pub fn fiat_25519_scalar_to_bytes(out1: &mut [u8; 32], arg1: &[u32; 8]) -> () { + let x1: u32 = (arg1[7]); + let x2: u32 = (arg1[6]); + let x3: u32 = (arg1[5]); + let x4: u32 = (arg1[4]); + let x5: u32 = (arg1[3]); + let x6: u32 = (arg1[2]); + let x7: u32 = (arg1[1]); + let x8: u32 = (arg1[0]); + let x9: u8 = ((x8 & (0xff as u32)) as u8); + let x10: u32 = (x8 >> 8); + let x11: u8 = ((x10 & (0xff as u32)) as u8); + let x12: u32 = (x10 >> 8); + let x13: u8 = ((x12 & (0xff as u32)) as u8); + let x14: u8 = ((x12 >> 8) as u8); + let x15: u8 = ((x7 & (0xff as u32)) as u8); + let x16: u32 = (x7 >> 8); + let x17: u8 = ((x16 & (0xff as u32)) as u8); + let x18: u32 = (x16 >> 8); + let x19: u8 = ((x18 & (0xff as u32)) as u8); + let x20: u8 = ((x18 >> 8) as u8); + let x21: u8 = ((x6 & (0xff as u32)) as u8); + let x22: u32 = (x6 >> 8); + let x23: u8 = ((x22 & (0xff as u32)) as u8); + let x24: u32 = (x22 >> 8); + let x25: u8 = ((x24 & (0xff as u32)) as u8); + let x26: u8 = ((x24 >> 8) as u8); + let x27: u8 = ((x5 & (0xff as u32)) as u8); + let x28: u32 = (x5 >> 8); + let x29: u8 = ((x28 & (0xff as u32)) as u8); + let x30: u32 = (x28 >> 8); + let x31: u8 = ((x30 & (0xff as u32)) as u8); + let x32: u8 = ((x30 >> 8) as u8); + let x33: u8 = ((x4 & (0xff as u32)) as u8); + let x34: u32 = (x4 >> 8); + let x35: u8 = ((x34 & (0xff as u32)) as u8); + let x36: u32 = (x34 >> 8); + let x37: u8 = ((x36 & (0xff as u32)) as u8); + let x38: u8 = ((x36 >> 8) as u8); + let x39: u8 = ((x3 & (0xff as u32)) as u8); + let x40: u32 = (x3 >> 8); + let x41: u8 = ((x40 & (0xff as u32)) as u8); + let x42: u32 = (x40 >> 8); + let x43: u8 = ((x42 & (0xff as u32)) as u8); + let x44: u8 = ((x42 >> 8) as u8); + let x45: u8 = ((x2 & (0xff as u32)) as u8); + let x46: u32 = (x2 >> 8); + let x47: u8 = ((x46 & (0xff as u32)) as u8); + let x48: u32 = (x46 >> 8); + let x49: u8 = ((x48 & (0xff as u32)) as u8); + let x50: u8 = ((x48 >> 8) as u8); + let x51: u8 = ((x1 & (0xff as u32)) as u8); + let x52: u32 = (x1 >> 8); + let x53: u8 = ((x52 & (0xff as u32)) as u8); + let x54: u32 = (x52 >> 8); + let x55: u8 = ((x54 & (0xff as u32)) as u8); + let x56: u8 = ((x54 >> 8) as u8); + out1[0] = x9; + out1[1] = x11; + out1[2] = x13; + out1[3] = x14; + out1[4] = x15; + out1[5] = x17; + out1[6] = x19; + out1[7] = x20; + out1[8] = x21; + out1[9] = x23; + out1[10] = x25; + out1[11] = x26; + out1[12] = x27; + out1[13] = x29; + out1[14] = x31; + out1[15] = x32; + out1[16] = x33; + out1[17] = x35; + out1[18] = x37; + out1[19] = x38; + out1[20] = x39; + out1[21] = x41; + out1[22] = x43; + out1[23] = x44; + out1[24] = x45; + out1[25] = x47; + out1[26] = x49; + out1[27] = x50; + out1[28] = x51; + out1[29] = x53; + out1[30] = x55; + out1[31] = x56; +} + +/// The function fiat_25519_scalar_from_bytes deserializes a field element NOT in the Montgomery domain from bytes in little-endian order. +/// +/// Preconditions: +/// 0 ≤ bytes_eval arg1 < m +/// Postconditions: +/// eval out1 mod m = bytes_eval arg1 mod m +/// 0 ≤ eval out1 < m +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0x1f]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0x1fffffff]] +#[inline] +pub fn fiat_25519_scalar_from_bytes(out1: &mut [u32; 8], arg1: &[u8; 32]) -> () { + let x1: u32 = (((arg1[31]) as u32) << 24); + let x2: u32 = (((arg1[30]) as u32) << 16); + let x3: u32 = (((arg1[29]) as u32) << 8); + let x4: u8 = (arg1[28]); + let x5: u32 = (((arg1[27]) as u32) << 24); + let x6: u32 = (((arg1[26]) as u32) << 16); + let x7: u32 = (((arg1[25]) as u32) << 8); + let x8: u8 = (arg1[24]); + let x9: u32 = (((arg1[23]) as u32) << 24); + let x10: u32 = (((arg1[22]) as u32) << 16); + let x11: u32 = (((arg1[21]) as u32) << 8); + let x12: u8 = (arg1[20]); + let x13: u32 = (((arg1[19]) as u32) << 24); + let x14: u32 = (((arg1[18]) as u32) << 16); + let x15: u32 = (((arg1[17]) as u32) << 8); + let x16: u8 = (arg1[16]); + let x17: u32 = (((arg1[15]) as u32) << 24); + let x18: u32 = (((arg1[14]) as u32) << 16); + let x19: u32 = (((arg1[13]) as u32) << 8); + let x20: u8 = (arg1[12]); + let x21: u32 = (((arg1[11]) as u32) << 24); + let x22: u32 = (((arg1[10]) as u32) << 16); + let x23: u32 = (((arg1[9]) as u32) << 8); + let x24: u8 = (arg1[8]); + let x25: u32 = (((arg1[7]) as u32) << 24); + let x26: u32 = (((arg1[6]) as u32) << 16); + let x27: u32 = (((arg1[5]) as u32) << 8); + let x28: u8 = (arg1[4]); + let x29: u32 = (((arg1[3]) as u32) << 24); + let x30: u32 = (((arg1[2]) as u32) << 16); + let x31: u32 = (((arg1[1]) as u32) << 8); + let x32: u8 = (arg1[0]); + let x33: u32 = (x31 + (x32 as u32)); + let x34: u32 = (x30 + x33); + let x35: u32 = (x29 + x34); + let x36: u32 = (x27 + (x28 as u32)); + let x37: u32 = (x26 + x36); + let x38: u32 = (x25 + x37); + let x39: u32 = (x23 + (x24 as u32)); + let x40: u32 = (x22 + x39); + let x41: u32 = (x21 + x40); + let x42: u32 = (x19 + (x20 as u32)); + let x43: u32 = (x18 + x42); + let x44: u32 = (x17 + x43); + let x45: u32 = (x15 + (x16 as u32)); + let x46: u32 = (x14 + x45); + let x47: u32 = (x13 + x46); + let x48: u32 = (x11 + (x12 as u32)); + let x49: u32 = (x10 + x48); + let x50: u32 = (x9 + x49); + let x51: u32 = (x7 + (x8 as u32)); + let x52: u32 = (x6 + x51); + let x53: u32 = (x5 + x52); + let x54: u32 = (x3 + (x4 as u32)); + let x55: u32 = (x2 + x54); + let x56: u32 = (x1 + x55); + out1[0] = x35; + out1[1] = x38; + out1[2] = x41; + out1[3] = x44; + out1[4] = x47; + out1[5] = x50; + out1[6] = x53; + out1[7] = x56; +} + +/// The function fiat_25519_scalar_set_one returns the field element one in the Montgomery domain. +/// +/// Postconditions: +/// eval (from_montgomery out1) mod m = 1 mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_25519_scalar_set_one(out1: &mut fiat_25519_scalar_montgomery_domain_field_element) -> () { + out1[0] = 0x8d98951d; + out1[1] = 0xd6ec3174; + out1[2] = 0x737dcf70; + out1[3] = 0xc6ef5bf4; + out1[4] = 0xfffffffe; + out1[5] = 0xffffffff; + out1[6] = 0xffffffff; + out1[7] = 0xfffffff; +} + +/// The function fiat_25519_scalar_msat returns the saturated representation of the prime modulus. +/// +/// Postconditions: +/// twos_complement_eval out1 = m +/// 0 ≤ eval out1 < m +/// +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +#[inline] +pub fn fiat_25519_scalar_msat(out1: &mut [u32; 9]) -> () { + out1[0] = 0x5cf5d3ed; + out1[1] = 0x5812631a; + out1[2] = 0xa2f79cd6; + out1[3] = 0x14def9de; + out1[4] = (0x0 as u32); + out1[5] = (0x0 as u32); + out1[6] = (0x0 as u32); + out1[7] = 0x10000000; + out1[8] = (0x0 as u32); +} + +/// The function fiat_25519_scalar_divstep computes a divstep. +/// +/// Preconditions: +/// 0 ≤ eval arg4 < m +/// 0 ≤ eval arg5 < m +/// Postconditions: +/// out1 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then 1 - arg1 else 1 + arg1) +/// twos_complement_eval out2 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then twos_complement_eval arg3 else twos_complement_eval arg2) +/// twos_complement_eval out3 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then ⌊(twos_complement_eval arg3 - twos_complement_eval arg2) / 2⌋ else ⌊(twos_complement_eval arg3 + (twos_complement_eval arg3 mod 2) * twos_complement_eval arg2) / 2⌋) +/// eval (from_montgomery out4) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (2 * eval (from_montgomery arg5)) mod m else (2 * eval (from_montgomery arg4)) mod m) +/// eval (from_montgomery out5) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (eval (from_montgomery arg4) - eval (from_montgomery arg4)) mod m else (eval (from_montgomery arg5) + (twos_complement_eval arg3 mod 2) * eval (from_montgomery arg4)) mod m) +/// 0 ≤ eval out5 < m +/// 0 ≤ eval out5 < m +/// 0 ≤ eval out2 < m +/// 0 ≤ eval out3 < m +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0xffffffff] +/// arg2: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// arg3: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// arg4: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// arg5: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +/// out2: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// out3: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// out4: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// out5: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +#[inline] +pub fn fiat_25519_scalar_divstep(out1: &mut u32, out2: &mut [u32; 9], out3: &mut [u32; 9], out4: &mut [u32; 8], out5: &mut [u32; 8], arg1: u32, arg2: &[u32; 9], arg3: &[u32; 9], arg4: &[u32; 8], arg5: &[u32; 8]) -> () { + let mut x1: u32 = 0; + let mut x2: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x1, &mut x2, 0x0, (!arg1), (0x1 as u32)); + let x3: fiat_25519_scalar_u1 = (((x1 >> 31) as fiat_25519_scalar_u1) & (((arg3[0]) & (0x1 as u32)) as fiat_25519_scalar_u1)); + let mut x4: u32 = 0; + let mut x5: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x4, &mut x5, 0x0, (!arg1), (0x1 as u32)); + let mut x6: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x6, x3, arg1, x4); + let mut x7: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x7, x3, (arg2[0]), (arg3[0])); + let mut x8: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x8, x3, (arg2[1]), (arg3[1])); + let mut x9: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x9, x3, (arg2[2]), (arg3[2])); + let mut x10: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x10, x3, (arg2[3]), (arg3[3])); + let mut x11: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x11, x3, (arg2[4]), (arg3[4])); + let mut x12: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x12, x3, (arg2[5]), (arg3[5])); + let mut x13: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x13, x3, (arg2[6]), (arg3[6])); + let mut x14: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x14, x3, (arg2[7]), (arg3[7])); + let mut x15: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x15, x3, (arg2[8]), (arg3[8])); + let mut x16: u32 = 0; + let mut x17: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x16, &mut x17, 0x0, (0x1 as u32), (!(arg2[0]))); + let mut x18: u32 = 0; + let mut x19: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x18, &mut x19, x17, (0x0 as u32), (!(arg2[1]))); + let mut x20: u32 = 0; + let mut x21: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x20, &mut x21, x19, (0x0 as u32), (!(arg2[2]))); + let mut x22: u32 = 0; + let mut x23: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x22, &mut x23, x21, (0x0 as u32), (!(arg2[3]))); + let mut x24: u32 = 0; + let mut x25: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x24, &mut x25, x23, (0x0 as u32), (!(arg2[4]))); + let mut x26: u32 = 0; + let mut x27: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x26, &mut x27, x25, (0x0 as u32), (!(arg2[5]))); + let mut x28: u32 = 0; + let mut x29: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x28, &mut x29, x27, (0x0 as u32), (!(arg2[6]))); + let mut x30: u32 = 0; + let mut x31: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x30, &mut x31, x29, (0x0 as u32), (!(arg2[7]))); + let mut x32: u32 = 0; + let mut x33: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x32, &mut x33, x31, (0x0 as u32), (!(arg2[8]))); + let mut x34: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x34, x3, (arg3[0]), x16); + let mut x35: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x35, x3, (arg3[1]), x18); + let mut x36: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x36, x3, (arg3[2]), x20); + let mut x37: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x37, x3, (arg3[3]), x22); + let mut x38: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x38, x3, (arg3[4]), x24); + let mut x39: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x39, x3, (arg3[5]), x26); + let mut x40: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x40, x3, (arg3[6]), x28); + let mut x41: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x41, x3, (arg3[7]), x30); + let mut x42: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x42, x3, (arg3[8]), x32); + let mut x43: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x43, x3, (arg4[0]), (arg5[0])); + let mut x44: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x44, x3, (arg4[1]), (arg5[1])); + let mut x45: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x45, x3, (arg4[2]), (arg5[2])); + let mut x46: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x46, x3, (arg4[3]), (arg5[3])); + let mut x47: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x47, x3, (arg4[4]), (arg5[4])); + let mut x48: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x48, x3, (arg4[5]), (arg5[5])); + let mut x49: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x49, x3, (arg4[6]), (arg5[6])); + let mut x50: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x50, x3, (arg4[7]), (arg5[7])); + let mut x51: u32 = 0; + let mut x52: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x51, &mut x52, 0x0, x43, x43); + let mut x53: u32 = 0; + let mut x54: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x53, &mut x54, x52, x44, x44); + let mut x55: u32 = 0; + let mut x56: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x55, &mut x56, x54, x45, x45); + let mut x57: u32 = 0; + let mut x58: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x57, &mut x58, x56, x46, x46); + let mut x59: u32 = 0; + let mut x60: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x59, &mut x60, x58, x47, x47); + let mut x61: u32 = 0; + let mut x62: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x61, &mut x62, x60, x48, x48); + let mut x63: u32 = 0; + let mut x64: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x63, &mut x64, x62, x49, x49); + let mut x65: u32 = 0; + let mut x66: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x65, &mut x66, x64, x50, x50); + let mut x67: u32 = 0; + let mut x68: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x67, &mut x68, 0x0, x51, 0x5cf5d3ed); + let mut x69: u32 = 0; + let mut x70: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x69, &mut x70, x68, x53, 0x5812631a); + let mut x71: u32 = 0; + let mut x72: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x71, &mut x72, x70, x55, 0xa2f79cd6); + let mut x73: u32 = 0; + let mut x74: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x73, &mut x74, x72, x57, 0x14def9de); + let mut x75: u32 = 0; + let mut x76: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x75, &mut x76, x74, x59, (0x0 as u32)); + let mut x77: u32 = 0; + let mut x78: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x77, &mut x78, x76, x61, (0x0 as u32)); + let mut x79: u32 = 0; + let mut x80: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x79, &mut x80, x78, x63, (0x0 as u32)); + let mut x81: u32 = 0; + let mut x82: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x81, &mut x82, x80, x65, 0x10000000); + let mut x83: u32 = 0; + let mut x84: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x83, &mut x84, x82, (x66 as u32), (0x0 as u32)); + let x85: u32 = (arg4[7]); + let x86: u32 = (arg4[6]); + let x87: u32 = (arg4[5]); + let x88: u32 = (arg4[4]); + let x89: u32 = (arg4[3]); + let x90: u32 = (arg4[2]); + let x91: u32 = (arg4[1]); + let x92: u32 = (arg4[0]); + let mut x93: u32 = 0; + let mut x94: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x93, &mut x94, 0x0, (0x0 as u32), x92); + let mut x95: u32 = 0; + let mut x96: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x95, &mut x96, x94, (0x0 as u32), x91); + let mut x97: u32 = 0; + let mut x98: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x97, &mut x98, x96, (0x0 as u32), x90); + let mut x99: u32 = 0; + let mut x100: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x99, &mut x100, x98, (0x0 as u32), x89); + let mut x101: u32 = 0; + let mut x102: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x101, &mut x102, x100, (0x0 as u32), x88); + let mut x103: u32 = 0; + let mut x104: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x103, &mut x104, x102, (0x0 as u32), x87); + let mut x105: u32 = 0; + let mut x106: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x105, &mut x106, x104, (0x0 as u32), x86); + let mut x107: u32 = 0; + let mut x108: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x107, &mut x108, x106, (0x0 as u32), x85); + let mut x109: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x109, x108, (0x0 as u32), 0xffffffff); + let mut x110: u32 = 0; + let mut x111: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x110, &mut x111, 0x0, x93, (x109 & 0x5cf5d3ed)); + let mut x112: u32 = 0; + let mut x113: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x112, &mut x113, x111, x95, (x109 & 0x5812631a)); + let mut x114: u32 = 0; + let mut x115: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x114, &mut x115, x113, x97, (x109 & 0xa2f79cd6)); + let mut x116: u32 = 0; + let mut x117: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x116, &mut x117, x115, x99, (x109 & 0x14def9de)); + let mut x118: u32 = 0; + let mut x119: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x118, &mut x119, x117, x101, (0x0 as u32)); + let mut x120: u32 = 0; + let mut x121: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x120, &mut x121, x119, x103, (0x0 as u32)); + let mut x122: u32 = 0; + let mut x123: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x122, &mut x123, x121, x105, (0x0 as u32)); + let mut x124: u32 = 0; + let mut x125: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x124, &mut x125, x123, x107, (x109 & 0x10000000)); + let mut x126: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x126, x3, (arg5[0]), x110); + let mut x127: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x127, x3, (arg5[1]), x112); + let mut x128: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x128, x3, (arg5[2]), x114); + let mut x129: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x129, x3, (arg5[3]), x116); + let mut x130: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x130, x3, (arg5[4]), x118); + let mut x131: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x131, x3, (arg5[5]), x120); + let mut x132: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x132, x3, (arg5[6]), x122); + let mut x133: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x133, x3, (arg5[7]), x124); + let x134: fiat_25519_scalar_u1 = ((x34 & (0x1 as u32)) as fiat_25519_scalar_u1); + let mut x135: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x135, x134, (0x0 as u32), x7); + let mut x136: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x136, x134, (0x0 as u32), x8); + let mut x137: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x137, x134, (0x0 as u32), x9); + let mut x138: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x138, x134, (0x0 as u32), x10); + let mut x139: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x139, x134, (0x0 as u32), x11); + let mut x140: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x140, x134, (0x0 as u32), x12); + let mut x141: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x141, x134, (0x0 as u32), x13); + let mut x142: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x142, x134, (0x0 as u32), x14); + let mut x143: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x143, x134, (0x0 as u32), x15); + let mut x144: u32 = 0; + let mut x145: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x144, &mut x145, 0x0, x34, x135); + let mut x146: u32 = 0; + let mut x147: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x146, &mut x147, x145, x35, x136); + let mut x148: u32 = 0; + let mut x149: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x148, &mut x149, x147, x36, x137); + let mut x150: u32 = 0; + let mut x151: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x150, &mut x151, x149, x37, x138); + let mut x152: u32 = 0; + let mut x153: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x152, &mut x153, x151, x38, x139); + let mut x154: u32 = 0; + let mut x155: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x154, &mut x155, x153, x39, x140); + let mut x156: u32 = 0; + let mut x157: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x156, &mut x157, x155, x40, x141); + let mut x158: u32 = 0; + let mut x159: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x158, &mut x159, x157, x41, x142); + let mut x160: u32 = 0; + let mut x161: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x160, &mut x161, x159, x42, x143); + let mut x162: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x162, x134, (0x0 as u32), x43); + let mut x163: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x163, x134, (0x0 as u32), x44); + let mut x164: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x164, x134, (0x0 as u32), x45); + let mut x165: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x165, x134, (0x0 as u32), x46); + let mut x166: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x166, x134, (0x0 as u32), x47); + let mut x167: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x167, x134, (0x0 as u32), x48); + let mut x168: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x168, x134, (0x0 as u32), x49); + let mut x169: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x169, x134, (0x0 as u32), x50); + let mut x170: u32 = 0; + let mut x171: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x170, &mut x171, 0x0, x126, x162); + let mut x172: u32 = 0; + let mut x173: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x172, &mut x173, x171, x127, x163); + let mut x174: u32 = 0; + let mut x175: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x174, &mut x175, x173, x128, x164); + let mut x176: u32 = 0; + let mut x177: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x176, &mut x177, x175, x129, x165); + let mut x178: u32 = 0; + let mut x179: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x178, &mut x179, x177, x130, x166); + let mut x180: u32 = 0; + let mut x181: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x180, &mut x181, x179, x131, x167); + let mut x182: u32 = 0; + let mut x183: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x182, &mut x183, x181, x132, x168); + let mut x184: u32 = 0; + let mut x185: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x184, &mut x185, x183, x133, x169); + let mut x186: u32 = 0; + let mut x187: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x186, &mut x187, 0x0, x170, 0x5cf5d3ed); + let mut x188: u32 = 0; + let mut x189: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x188, &mut x189, x187, x172, 0x5812631a); + let mut x190: u32 = 0; + let mut x191: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x190, &mut x191, x189, x174, 0xa2f79cd6); + let mut x192: u32 = 0; + let mut x193: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x192, &mut x193, x191, x176, 0x14def9de); + let mut x194: u32 = 0; + let mut x195: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x194, &mut x195, x193, x178, (0x0 as u32)); + let mut x196: u32 = 0; + let mut x197: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x196, &mut x197, x195, x180, (0x0 as u32)); + let mut x198: u32 = 0; + let mut x199: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x198, &mut x199, x197, x182, (0x0 as u32)); + let mut x200: u32 = 0; + let mut x201: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x200, &mut x201, x199, x184, 0x10000000); + let mut x202: u32 = 0; + let mut x203: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u32(&mut x202, &mut x203, x201, (x185 as u32), (0x0 as u32)); + let mut x204: u32 = 0; + let mut x205: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u32(&mut x204, &mut x205, 0x0, x6, (0x1 as u32)); + let x206: u32 = ((x144 >> 1) | ((x146 << 31) & 0xffffffff)); + let x207: u32 = ((x146 >> 1) | ((x148 << 31) & 0xffffffff)); + let x208: u32 = ((x148 >> 1) | ((x150 << 31) & 0xffffffff)); + let x209: u32 = ((x150 >> 1) | ((x152 << 31) & 0xffffffff)); + let x210: u32 = ((x152 >> 1) | ((x154 << 31) & 0xffffffff)); + let x211: u32 = ((x154 >> 1) | ((x156 << 31) & 0xffffffff)); + let x212: u32 = ((x156 >> 1) | ((x158 << 31) & 0xffffffff)); + let x213: u32 = ((x158 >> 1) | ((x160 << 31) & 0xffffffff)); + let x214: u32 = ((x160 & 0x80000000) | (x160 >> 1)); + let mut x215: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x215, x84, x67, x51); + let mut x216: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x216, x84, x69, x53); + let mut x217: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x217, x84, x71, x55); + let mut x218: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x218, x84, x73, x57); + let mut x219: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x219, x84, x75, x59); + let mut x220: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x220, x84, x77, x61); + let mut x221: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x221, x84, x79, x63); + let mut x222: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x222, x84, x81, x65); + let mut x223: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x223, x203, x186, x170); + let mut x224: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x224, x203, x188, x172); + let mut x225: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x225, x203, x190, x174); + let mut x226: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x226, x203, x192, x176); + let mut x227: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x227, x203, x194, x178); + let mut x228: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x228, x203, x196, x180); + let mut x229: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x229, x203, x198, x182); + let mut x230: u32 = 0; + fiat_25519_scalar_cmovznz_u32(&mut x230, x203, x200, x184); + *out1 = x204; + out2[0] = x7; + out2[1] = x8; + out2[2] = x9; + out2[3] = x10; + out2[4] = x11; + out2[5] = x12; + out2[6] = x13; + out2[7] = x14; + out2[8] = x15; + out3[0] = x206; + out3[1] = x207; + out3[2] = x208; + out3[3] = x209; + out3[4] = x210; + out3[5] = x211; + out3[6] = x212; + out3[7] = x213; + out3[8] = x214; + out4[0] = x215; + out4[1] = x216; + out4[2] = x217; + out4[3] = x218; + out4[4] = x219; + out4[5] = x220; + out4[6] = x221; + out4[7] = x222; + out5[0] = x223; + out5[1] = x224; + out5[2] = x225; + out5[3] = x226; + out5[4] = x227; + out5[5] = x228; + out5[6] = x229; + out5[7] = x230; +} + +/// The function fiat_25519_scalar_divstep_precomp returns the precomputed value for Bernstein-Yang-inversion (in montgomery form). +/// +/// Postconditions: +/// eval (from_montgomery out1) = ⌊(m - 1) / 2⌋^(if ⌊log2 m⌋ + 1 < 46 then ⌊(49 * (⌊log2 m⌋ + 1) + 80) / 17⌋ else ⌊(49 * (⌊log2 m⌋ + 1) + 57) / 17⌋) +/// 0 ≤ eval out1 < m +/// +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +#[inline] +pub fn fiat_25519_scalar_divstep_precomp(out1: &mut [u32; 8]) -> () { + out1[0] = 0x36a7cb92; + out1[1] = 0xd70af844; + out1[2] = 0xb0b8b159; + out1[3] = 0x5f71c978; + out1[4] = 0x74947f1a; + out1[5] = 0xe76d8169; + out1[6] = 0xf193e4ff; + out1[7] = 0x19a2d36; +} diff --git a/vendor/fiat-crypto/src/curve25519_scalar_64.rs b/vendor/fiat-crypto/src/curve25519_scalar_64.rs new file mode 100644 index 000000000..dc45f1b8e --- /dev/null +++ b/vendor/fiat-crypto/src/curve25519_scalar_64.rs @@ -0,0 +1,1830 @@ +//! Autogenerated: 'src/ExtractionOCaml/word_by_word_montgomery' --lang Rust --inline 25519_scalar 64 '2^252 + 27742317777372353535851937790883648493' mul square add sub opp from_montgomery to_montgomery nonzero selectznz to_bytes from_bytes one msat divstep divstep_precomp +//! curve description: 25519_scalar +//! machine_wordsize = 64 (from "64") +//! requested operations: mul, square, add, sub, opp, from_montgomery, to_montgomery, nonzero, selectznz, to_bytes, from_bytes, one, msat, divstep, divstep_precomp +//! m = 0x1000000000000000000000000000000014def9dea2f79cd65812631a5cf5d3ed (from "2^252 + 27742317777372353535851937790883648493") +//! +//! NOTE: In addition to the bounds specified above each function, all +//! functions synthesized for this Montgomery arithmetic require the +//! input to be strictly less than the prime modulus (m), and also +//! require the input to be in the unique saturated representation. +//! All functions also ensure that these two properties are true of +//! return values. +//! +//! Computed values: +//! eval z = z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) +//! bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248) +//! twos_complement_eval z = let x1 := z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) in +//! if x1 & (2^256-1) < 2^255 then x1 & (2^256-1) else (x1 & (2^256-1)) - 2^256 + +#![allow(unused_parens)] +#![allow(non_camel_case_types)] + +pub type fiat_25519_scalar_u1 = u8; +pub type fiat_25519_scalar_i1 = i8; +pub type fiat_25519_scalar_u2 = u8; +pub type fiat_25519_scalar_i2 = i8; + +/* The type fiat_25519_scalar_montgomery_domain_field_element is a field element in the Montgomery domain. */ +/* Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] */ +pub type fiat_25519_scalar_montgomery_domain_field_element = [u64; 4]; + +/* The type fiat_25519_scalar_non_montgomery_domain_field_element is a field element NOT in the Montgomery domain. */ +/* Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] */ +pub type fiat_25519_scalar_non_montgomery_domain_field_element = [u64; 4]; + + +/// The function fiat_25519_scalar_addcarryx_u64 is an addition with carry. +/// +/// Postconditions: +/// out1 = (arg1 + arg2 + arg3) mod 2^64 +/// out2 = ⌊(arg1 + arg2 + arg3) / 2^64⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffffffffffff] +/// arg3: [0x0 ~> 0xffffffffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_25519_scalar_addcarryx_u64(out1: &mut u64, out2: &mut fiat_25519_scalar_u1, arg1: fiat_25519_scalar_u1, arg2: u64, arg3: u64) -> () { + let x1: u128 = (((arg1 as u128) + (arg2 as u128)) + (arg3 as u128)); + let x2: u64 = ((x1 & (0xffffffffffffffff as u128)) as u64); + let x3: fiat_25519_scalar_u1 = ((x1 >> 64) as fiat_25519_scalar_u1); + *out1 = x2; + *out2 = x3; +} + +/// The function fiat_25519_scalar_subborrowx_u64 is a subtraction with borrow. +/// +/// Postconditions: +/// out1 = (-arg1 + arg2 + -arg3) mod 2^64 +/// out2 = -⌊(-arg1 + arg2 + -arg3) / 2^64⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffffffffffff] +/// arg3: [0x0 ~> 0xffffffffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_25519_scalar_subborrowx_u64(out1: &mut u64, out2: &mut fiat_25519_scalar_u1, arg1: fiat_25519_scalar_u1, arg2: u64, arg3: u64) -> () { + let x1: i128 = (((arg2 as i128) - (arg1 as i128)) - (arg3 as i128)); + let x2: fiat_25519_scalar_i1 = ((x1 >> 64) as fiat_25519_scalar_i1); + let x3: u64 = ((x1 & (0xffffffffffffffff as i128)) as u64); + *out1 = x3; + *out2 = (((0x0 as fiat_25519_scalar_i2) - (x2 as fiat_25519_scalar_i2)) as fiat_25519_scalar_u1); +} + +/// The function fiat_25519_scalar_mulx_u64 is a multiplication, returning the full double-width result. +/// +/// Postconditions: +/// out1 = (arg1 * arg2) mod 2^64 +/// out2 = ⌊arg1 * arg2 / 2^64⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0xffffffffffffffff] +/// arg2: [0x0 ~> 0xffffffffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +/// out2: [0x0 ~> 0xffffffffffffffff] +#[inline] +pub fn fiat_25519_scalar_mulx_u64(out1: &mut u64, out2: &mut u64, arg1: u64, arg2: u64) -> () { + let x1: u128 = ((arg1 as u128) * (arg2 as u128)); + let x2: u64 = ((x1 & (0xffffffffffffffff as u128)) as u64); + let x3: u64 = ((x1 >> 64) as u64); + *out1 = x2; + *out2 = x3; +} + +/// The function fiat_25519_scalar_cmovznz_u64 is a single-word conditional move. +/// +/// Postconditions: +/// out1 = (if arg1 = 0 then arg2 else arg3) +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffffffffffff] +/// arg3: [0x0 ~> 0xffffffffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +#[inline] +pub fn fiat_25519_scalar_cmovznz_u64(out1: &mut u64, arg1: fiat_25519_scalar_u1, arg2: u64, arg3: u64) -> () { + let x1: fiat_25519_scalar_u1 = (!(!arg1)); + let x2: u64 = ((((((0x0 as fiat_25519_scalar_i2) - (x1 as fiat_25519_scalar_i2)) as fiat_25519_scalar_i1) as i128) & (0xffffffffffffffff as i128)) as u64); + let x3: u64 = ((x2 & arg3) | ((!x2) & arg2)); + *out1 = x3; +} + +/// The function fiat_25519_scalar_mul multiplies two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_25519_scalar_mul(out1: &mut fiat_25519_scalar_montgomery_domain_field_element, arg1: &fiat_25519_scalar_montgomery_domain_field_element, arg2: &fiat_25519_scalar_montgomery_domain_field_element) -> () { + let x1: u64 = (arg1[1]); + let x2: u64 = (arg1[2]); + let x3: u64 = (arg1[3]); + let x4: u64 = (arg1[0]); + let mut x5: u64 = 0; + let mut x6: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x5, &mut x6, x4, (arg2[3])); + let mut x7: u64 = 0; + let mut x8: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x7, &mut x8, x4, (arg2[2])); + let mut x9: u64 = 0; + let mut x10: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x9, &mut x10, x4, (arg2[1])); + let mut x11: u64 = 0; + let mut x12: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x11, &mut x12, x4, (arg2[0])); + let mut x13: u64 = 0; + let mut x14: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x13, &mut x14, 0x0, x12, x9); + let mut x15: u64 = 0; + let mut x16: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x15, &mut x16, x14, x10, x7); + let mut x17: u64 = 0; + let mut x18: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x17, &mut x18, x16, x8, x5); + let x19: u64 = ((x18 as u64) + x6); + let mut x20: u64 = 0; + let mut x21: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x20, &mut x21, x11, 0xd2b51da312547e1b); + let mut x22: u64 = 0; + let mut x23: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x22, &mut x23, x20, 0x1000000000000000); + let mut x24: u64 = 0; + let mut x25: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x24, &mut x25, x20, 0x14def9dea2f79cd6); + let mut x26: u64 = 0; + let mut x27: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x26, &mut x27, x20, 0x5812631a5cf5d3ed); + let mut x28: u64 = 0; + let mut x29: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x28, &mut x29, 0x0, x27, x24); + let x30: u64 = ((x29 as u64) + x25); + let mut x31: u64 = 0; + let mut x32: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x31, &mut x32, 0x0, x11, x26); + let mut x33: u64 = 0; + let mut x34: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x33, &mut x34, x32, x13, x28); + let mut x35: u64 = 0; + let mut x36: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x35, &mut x36, x34, x15, x30); + let mut x37: u64 = 0; + let mut x38: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x37, &mut x38, x36, x17, x22); + let mut x39: u64 = 0; + let mut x40: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x39, &mut x40, x38, x19, x23); + let mut x41: u64 = 0; + let mut x42: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x41, &mut x42, x1, (arg2[3])); + let mut x43: u64 = 0; + let mut x44: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x43, &mut x44, x1, (arg2[2])); + let mut x45: u64 = 0; + let mut x46: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x45, &mut x46, x1, (arg2[1])); + let mut x47: u64 = 0; + let mut x48: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x47, &mut x48, x1, (arg2[0])); + let mut x49: u64 = 0; + let mut x50: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x49, &mut x50, 0x0, x48, x45); + let mut x51: u64 = 0; + let mut x52: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x51, &mut x52, x50, x46, x43); + let mut x53: u64 = 0; + let mut x54: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x53, &mut x54, x52, x44, x41); + let x55: u64 = ((x54 as u64) + x42); + let mut x56: u64 = 0; + let mut x57: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x56, &mut x57, 0x0, x33, x47); + let mut x58: u64 = 0; + let mut x59: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x58, &mut x59, x57, x35, x49); + let mut x60: u64 = 0; + let mut x61: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x60, &mut x61, x59, x37, x51); + let mut x62: u64 = 0; + let mut x63: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x62, &mut x63, x61, x39, x53); + let mut x64: u64 = 0; + let mut x65: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x64, &mut x65, x63, (x40 as u64), x55); + let mut x66: u64 = 0; + let mut x67: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x66, &mut x67, x56, 0xd2b51da312547e1b); + let mut x68: u64 = 0; + let mut x69: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x68, &mut x69, x66, 0x1000000000000000); + let mut x70: u64 = 0; + let mut x71: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x70, &mut x71, x66, 0x14def9dea2f79cd6); + let mut x72: u64 = 0; + let mut x73: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x72, &mut x73, x66, 0x5812631a5cf5d3ed); + let mut x74: u64 = 0; + let mut x75: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x74, &mut x75, 0x0, x73, x70); + let x76: u64 = ((x75 as u64) + x71); + let mut x77: u64 = 0; + let mut x78: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x77, &mut x78, 0x0, x56, x72); + let mut x79: u64 = 0; + let mut x80: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x79, &mut x80, x78, x58, x74); + let mut x81: u64 = 0; + let mut x82: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x81, &mut x82, x80, x60, x76); + let mut x83: u64 = 0; + let mut x84: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x83, &mut x84, x82, x62, x68); + let mut x85: u64 = 0; + let mut x86: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x85, &mut x86, x84, x64, x69); + let x87: u64 = ((x86 as u64) + (x65 as u64)); + let mut x88: u64 = 0; + let mut x89: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x88, &mut x89, x2, (arg2[3])); + let mut x90: u64 = 0; + let mut x91: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x90, &mut x91, x2, (arg2[2])); + let mut x92: u64 = 0; + let mut x93: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x92, &mut x93, x2, (arg2[1])); + let mut x94: u64 = 0; + let mut x95: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x94, &mut x95, x2, (arg2[0])); + let mut x96: u64 = 0; + let mut x97: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x96, &mut x97, 0x0, x95, x92); + let mut x98: u64 = 0; + let mut x99: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x98, &mut x99, x97, x93, x90); + let mut x100: u64 = 0; + let mut x101: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x100, &mut x101, x99, x91, x88); + let x102: u64 = ((x101 as u64) + x89); + let mut x103: u64 = 0; + let mut x104: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x103, &mut x104, 0x0, x79, x94); + let mut x105: u64 = 0; + let mut x106: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x105, &mut x106, x104, x81, x96); + let mut x107: u64 = 0; + let mut x108: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x107, &mut x108, x106, x83, x98); + let mut x109: u64 = 0; + let mut x110: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x109, &mut x110, x108, x85, x100); + let mut x111: u64 = 0; + let mut x112: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x111, &mut x112, x110, x87, x102); + let mut x113: u64 = 0; + let mut x114: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x113, &mut x114, x103, 0xd2b51da312547e1b); + let mut x115: u64 = 0; + let mut x116: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x115, &mut x116, x113, 0x1000000000000000); + let mut x117: u64 = 0; + let mut x118: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x117, &mut x118, x113, 0x14def9dea2f79cd6); + let mut x119: u64 = 0; + let mut x120: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x119, &mut x120, x113, 0x5812631a5cf5d3ed); + let mut x121: u64 = 0; + let mut x122: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x121, &mut x122, 0x0, x120, x117); + let x123: u64 = ((x122 as u64) + x118); + let mut x124: u64 = 0; + let mut x125: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x124, &mut x125, 0x0, x103, x119); + let mut x126: u64 = 0; + let mut x127: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x126, &mut x127, x125, x105, x121); + let mut x128: u64 = 0; + let mut x129: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x128, &mut x129, x127, x107, x123); + let mut x130: u64 = 0; + let mut x131: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x130, &mut x131, x129, x109, x115); + let mut x132: u64 = 0; + let mut x133: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x132, &mut x133, x131, x111, x116); + let x134: u64 = ((x133 as u64) + (x112 as u64)); + let mut x135: u64 = 0; + let mut x136: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x135, &mut x136, x3, (arg2[3])); + let mut x137: u64 = 0; + let mut x138: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x137, &mut x138, x3, (arg2[2])); + let mut x139: u64 = 0; + let mut x140: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x139, &mut x140, x3, (arg2[1])); + let mut x141: u64 = 0; + let mut x142: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x141, &mut x142, x3, (arg2[0])); + let mut x143: u64 = 0; + let mut x144: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x143, &mut x144, 0x0, x142, x139); + let mut x145: u64 = 0; + let mut x146: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x145, &mut x146, x144, x140, x137); + let mut x147: u64 = 0; + let mut x148: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x147, &mut x148, x146, x138, x135); + let x149: u64 = ((x148 as u64) + x136); + let mut x150: u64 = 0; + let mut x151: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x150, &mut x151, 0x0, x126, x141); + let mut x152: u64 = 0; + let mut x153: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x152, &mut x153, x151, x128, x143); + let mut x154: u64 = 0; + let mut x155: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x154, &mut x155, x153, x130, x145); + let mut x156: u64 = 0; + let mut x157: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x156, &mut x157, x155, x132, x147); + let mut x158: u64 = 0; + let mut x159: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x158, &mut x159, x157, x134, x149); + let mut x160: u64 = 0; + let mut x161: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x160, &mut x161, x150, 0xd2b51da312547e1b); + let mut x162: u64 = 0; + let mut x163: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x162, &mut x163, x160, 0x1000000000000000); + let mut x164: u64 = 0; + let mut x165: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x164, &mut x165, x160, 0x14def9dea2f79cd6); + let mut x166: u64 = 0; + let mut x167: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x166, &mut x167, x160, 0x5812631a5cf5d3ed); + let mut x168: u64 = 0; + let mut x169: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x168, &mut x169, 0x0, x167, x164); + let x170: u64 = ((x169 as u64) + x165); + let mut x171: u64 = 0; + let mut x172: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x171, &mut x172, 0x0, x150, x166); + let mut x173: u64 = 0; + let mut x174: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x173, &mut x174, x172, x152, x168); + let mut x175: u64 = 0; + let mut x176: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x175, &mut x176, x174, x154, x170); + let mut x177: u64 = 0; + let mut x178: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x177, &mut x178, x176, x156, x162); + let mut x179: u64 = 0; + let mut x180: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x179, &mut x180, x178, x158, x163); + let x181: u64 = ((x180 as u64) + (x159 as u64)); + let mut x182: u64 = 0; + let mut x183: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u64(&mut x182, &mut x183, 0x0, x173, 0x5812631a5cf5d3ed); + let mut x184: u64 = 0; + let mut x185: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u64(&mut x184, &mut x185, x183, x175, 0x14def9dea2f79cd6); + let mut x186: u64 = 0; + let mut x187: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u64(&mut x186, &mut x187, x185, x177, (0x0 as u64)); + let mut x188: u64 = 0; + let mut x189: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u64(&mut x188, &mut x189, x187, x179, 0x1000000000000000); + let mut x190: u64 = 0; + let mut x191: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u64(&mut x190, &mut x191, x189, x181, (0x0 as u64)); + let mut x192: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x192, x191, x182, x173); + let mut x193: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x193, x191, x184, x175); + let mut x194: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x194, x191, x186, x177); + let mut x195: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x195, x191, x188, x179); + out1[0] = x192; + out1[1] = x193; + out1[2] = x194; + out1[3] = x195; +} + +/// The function fiat_25519_scalar_square squares a field element in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg1)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_25519_scalar_square(out1: &mut fiat_25519_scalar_montgomery_domain_field_element, arg1: &fiat_25519_scalar_montgomery_domain_field_element) -> () { + let x1: u64 = (arg1[1]); + let x2: u64 = (arg1[2]); + let x3: u64 = (arg1[3]); + let x4: u64 = (arg1[0]); + let mut x5: u64 = 0; + let mut x6: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x5, &mut x6, x4, (arg1[3])); + let mut x7: u64 = 0; + let mut x8: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x7, &mut x8, x4, (arg1[2])); + let mut x9: u64 = 0; + let mut x10: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x9, &mut x10, x4, (arg1[1])); + let mut x11: u64 = 0; + let mut x12: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x11, &mut x12, x4, (arg1[0])); + let mut x13: u64 = 0; + let mut x14: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x13, &mut x14, 0x0, x12, x9); + let mut x15: u64 = 0; + let mut x16: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x15, &mut x16, x14, x10, x7); + let mut x17: u64 = 0; + let mut x18: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x17, &mut x18, x16, x8, x5); + let x19: u64 = ((x18 as u64) + x6); + let mut x20: u64 = 0; + let mut x21: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x20, &mut x21, x11, 0xd2b51da312547e1b); + let mut x22: u64 = 0; + let mut x23: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x22, &mut x23, x20, 0x1000000000000000); + let mut x24: u64 = 0; + let mut x25: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x24, &mut x25, x20, 0x14def9dea2f79cd6); + let mut x26: u64 = 0; + let mut x27: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x26, &mut x27, x20, 0x5812631a5cf5d3ed); + let mut x28: u64 = 0; + let mut x29: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x28, &mut x29, 0x0, x27, x24); + let x30: u64 = ((x29 as u64) + x25); + let mut x31: u64 = 0; + let mut x32: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x31, &mut x32, 0x0, x11, x26); + let mut x33: u64 = 0; + let mut x34: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x33, &mut x34, x32, x13, x28); + let mut x35: u64 = 0; + let mut x36: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x35, &mut x36, x34, x15, x30); + let mut x37: u64 = 0; + let mut x38: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x37, &mut x38, x36, x17, x22); + let mut x39: u64 = 0; + let mut x40: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x39, &mut x40, x38, x19, x23); + let mut x41: u64 = 0; + let mut x42: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x41, &mut x42, x1, (arg1[3])); + let mut x43: u64 = 0; + let mut x44: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x43, &mut x44, x1, (arg1[2])); + let mut x45: u64 = 0; + let mut x46: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x45, &mut x46, x1, (arg1[1])); + let mut x47: u64 = 0; + let mut x48: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x47, &mut x48, x1, (arg1[0])); + let mut x49: u64 = 0; + let mut x50: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x49, &mut x50, 0x0, x48, x45); + let mut x51: u64 = 0; + let mut x52: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x51, &mut x52, x50, x46, x43); + let mut x53: u64 = 0; + let mut x54: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x53, &mut x54, x52, x44, x41); + let x55: u64 = ((x54 as u64) + x42); + let mut x56: u64 = 0; + let mut x57: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x56, &mut x57, 0x0, x33, x47); + let mut x58: u64 = 0; + let mut x59: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x58, &mut x59, x57, x35, x49); + let mut x60: u64 = 0; + let mut x61: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x60, &mut x61, x59, x37, x51); + let mut x62: u64 = 0; + let mut x63: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x62, &mut x63, x61, x39, x53); + let mut x64: u64 = 0; + let mut x65: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x64, &mut x65, x63, (x40 as u64), x55); + let mut x66: u64 = 0; + let mut x67: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x66, &mut x67, x56, 0xd2b51da312547e1b); + let mut x68: u64 = 0; + let mut x69: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x68, &mut x69, x66, 0x1000000000000000); + let mut x70: u64 = 0; + let mut x71: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x70, &mut x71, x66, 0x14def9dea2f79cd6); + let mut x72: u64 = 0; + let mut x73: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x72, &mut x73, x66, 0x5812631a5cf5d3ed); + let mut x74: u64 = 0; + let mut x75: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x74, &mut x75, 0x0, x73, x70); + let x76: u64 = ((x75 as u64) + x71); + let mut x77: u64 = 0; + let mut x78: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x77, &mut x78, 0x0, x56, x72); + let mut x79: u64 = 0; + let mut x80: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x79, &mut x80, x78, x58, x74); + let mut x81: u64 = 0; + let mut x82: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x81, &mut x82, x80, x60, x76); + let mut x83: u64 = 0; + let mut x84: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x83, &mut x84, x82, x62, x68); + let mut x85: u64 = 0; + let mut x86: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x85, &mut x86, x84, x64, x69); + let x87: u64 = ((x86 as u64) + (x65 as u64)); + let mut x88: u64 = 0; + let mut x89: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x88, &mut x89, x2, (arg1[3])); + let mut x90: u64 = 0; + let mut x91: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x90, &mut x91, x2, (arg1[2])); + let mut x92: u64 = 0; + let mut x93: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x92, &mut x93, x2, (arg1[1])); + let mut x94: u64 = 0; + let mut x95: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x94, &mut x95, x2, (arg1[0])); + let mut x96: u64 = 0; + let mut x97: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x96, &mut x97, 0x0, x95, x92); + let mut x98: u64 = 0; + let mut x99: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x98, &mut x99, x97, x93, x90); + let mut x100: u64 = 0; + let mut x101: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x100, &mut x101, x99, x91, x88); + let x102: u64 = ((x101 as u64) + x89); + let mut x103: u64 = 0; + let mut x104: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x103, &mut x104, 0x0, x79, x94); + let mut x105: u64 = 0; + let mut x106: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x105, &mut x106, x104, x81, x96); + let mut x107: u64 = 0; + let mut x108: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x107, &mut x108, x106, x83, x98); + let mut x109: u64 = 0; + let mut x110: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x109, &mut x110, x108, x85, x100); + let mut x111: u64 = 0; + let mut x112: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x111, &mut x112, x110, x87, x102); + let mut x113: u64 = 0; + let mut x114: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x113, &mut x114, x103, 0xd2b51da312547e1b); + let mut x115: u64 = 0; + let mut x116: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x115, &mut x116, x113, 0x1000000000000000); + let mut x117: u64 = 0; + let mut x118: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x117, &mut x118, x113, 0x14def9dea2f79cd6); + let mut x119: u64 = 0; + let mut x120: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x119, &mut x120, x113, 0x5812631a5cf5d3ed); + let mut x121: u64 = 0; + let mut x122: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x121, &mut x122, 0x0, x120, x117); + let x123: u64 = ((x122 as u64) + x118); + let mut x124: u64 = 0; + let mut x125: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x124, &mut x125, 0x0, x103, x119); + let mut x126: u64 = 0; + let mut x127: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x126, &mut x127, x125, x105, x121); + let mut x128: u64 = 0; + let mut x129: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x128, &mut x129, x127, x107, x123); + let mut x130: u64 = 0; + let mut x131: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x130, &mut x131, x129, x109, x115); + let mut x132: u64 = 0; + let mut x133: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x132, &mut x133, x131, x111, x116); + let x134: u64 = ((x133 as u64) + (x112 as u64)); + let mut x135: u64 = 0; + let mut x136: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x135, &mut x136, x3, (arg1[3])); + let mut x137: u64 = 0; + let mut x138: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x137, &mut x138, x3, (arg1[2])); + let mut x139: u64 = 0; + let mut x140: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x139, &mut x140, x3, (arg1[1])); + let mut x141: u64 = 0; + let mut x142: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x141, &mut x142, x3, (arg1[0])); + let mut x143: u64 = 0; + let mut x144: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x143, &mut x144, 0x0, x142, x139); + let mut x145: u64 = 0; + let mut x146: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x145, &mut x146, x144, x140, x137); + let mut x147: u64 = 0; + let mut x148: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x147, &mut x148, x146, x138, x135); + let x149: u64 = ((x148 as u64) + x136); + let mut x150: u64 = 0; + let mut x151: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x150, &mut x151, 0x0, x126, x141); + let mut x152: u64 = 0; + let mut x153: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x152, &mut x153, x151, x128, x143); + let mut x154: u64 = 0; + let mut x155: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x154, &mut x155, x153, x130, x145); + let mut x156: u64 = 0; + let mut x157: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x156, &mut x157, x155, x132, x147); + let mut x158: u64 = 0; + let mut x159: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x158, &mut x159, x157, x134, x149); + let mut x160: u64 = 0; + let mut x161: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x160, &mut x161, x150, 0xd2b51da312547e1b); + let mut x162: u64 = 0; + let mut x163: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x162, &mut x163, x160, 0x1000000000000000); + let mut x164: u64 = 0; + let mut x165: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x164, &mut x165, x160, 0x14def9dea2f79cd6); + let mut x166: u64 = 0; + let mut x167: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x166, &mut x167, x160, 0x5812631a5cf5d3ed); + let mut x168: u64 = 0; + let mut x169: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x168, &mut x169, 0x0, x167, x164); + let x170: u64 = ((x169 as u64) + x165); + let mut x171: u64 = 0; + let mut x172: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x171, &mut x172, 0x0, x150, x166); + let mut x173: u64 = 0; + let mut x174: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x173, &mut x174, x172, x152, x168); + let mut x175: u64 = 0; + let mut x176: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x175, &mut x176, x174, x154, x170); + let mut x177: u64 = 0; + let mut x178: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x177, &mut x178, x176, x156, x162); + let mut x179: u64 = 0; + let mut x180: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x179, &mut x180, x178, x158, x163); + let x181: u64 = ((x180 as u64) + (x159 as u64)); + let mut x182: u64 = 0; + let mut x183: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u64(&mut x182, &mut x183, 0x0, x173, 0x5812631a5cf5d3ed); + let mut x184: u64 = 0; + let mut x185: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u64(&mut x184, &mut x185, x183, x175, 0x14def9dea2f79cd6); + let mut x186: u64 = 0; + let mut x187: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u64(&mut x186, &mut x187, x185, x177, (0x0 as u64)); + let mut x188: u64 = 0; + let mut x189: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u64(&mut x188, &mut x189, x187, x179, 0x1000000000000000); + let mut x190: u64 = 0; + let mut x191: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u64(&mut x190, &mut x191, x189, x181, (0x0 as u64)); + let mut x192: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x192, x191, x182, x173); + let mut x193: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x193, x191, x184, x175); + let mut x194: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x194, x191, x186, x177); + let mut x195: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x195, x191, x188, x179); + out1[0] = x192; + out1[1] = x193; + out1[2] = x194; + out1[3] = x195; +} + +/// The function fiat_25519_scalar_add adds two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) + eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_25519_scalar_add(out1: &mut fiat_25519_scalar_montgomery_domain_field_element, arg1: &fiat_25519_scalar_montgomery_domain_field_element, arg2: &fiat_25519_scalar_montgomery_domain_field_element) -> () { + let mut x1: u64 = 0; + let mut x2: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x1, &mut x2, 0x0, (arg1[0]), (arg2[0])); + let mut x3: u64 = 0; + let mut x4: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x3, &mut x4, x2, (arg1[1]), (arg2[1])); + let mut x5: u64 = 0; + let mut x6: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x5, &mut x6, x4, (arg1[2]), (arg2[2])); + let mut x7: u64 = 0; + let mut x8: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x7, &mut x8, x6, (arg1[3]), (arg2[3])); + let mut x9: u64 = 0; + let mut x10: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u64(&mut x9, &mut x10, 0x0, x1, 0x5812631a5cf5d3ed); + let mut x11: u64 = 0; + let mut x12: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u64(&mut x11, &mut x12, x10, x3, 0x14def9dea2f79cd6); + let mut x13: u64 = 0; + let mut x14: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u64(&mut x13, &mut x14, x12, x5, (0x0 as u64)); + let mut x15: u64 = 0; + let mut x16: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u64(&mut x15, &mut x16, x14, x7, 0x1000000000000000); + let mut x17: u64 = 0; + let mut x18: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u64(&mut x17, &mut x18, x16, (x8 as u64), (0x0 as u64)); + let mut x19: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x19, x18, x9, x1); + let mut x20: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x20, x18, x11, x3); + let mut x21: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x21, x18, x13, x5); + let mut x22: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x22, x18, x15, x7); + out1[0] = x19; + out1[1] = x20; + out1[2] = x21; + out1[3] = x22; +} + +/// The function fiat_25519_scalar_sub subtracts two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) - eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_25519_scalar_sub(out1: &mut fiat_25519_scalar_montgomery_domain_field_element, arg1: &fiat_25519_scalar_montgomery_domain_field_element, arg2: &fiat_25519_scalar_montgomery_domain_field_element) -> () { + let mut x1: u64 = 0; + let mut x2: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u64(&mut x1, &mut x2, 0x0, (arg1[0]), (arg2[0])); + let mut x3: u64 = 0; + let mut x4: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u64(&mut x3, &mut x4, x2, (arg1[1]), (arg2[1])); + let mut x5: u64 = 0; + let mut x6: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u64(&mut x5, &mut x6, x4, (arg1[2]), (arg2[2])); + let mut x7: u64 = 0; + let mut x8: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u64(&mut x7, &mut x8, x6, (arg1[3]), (arg2[3])); + let mut x9: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x9, x8, (0x0 as u64), 0xffffffffffffffff); + let mut x10: u64 = 0; + let mut x11: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x10, &mut x11, 0x0, x1, (x9 & 0x5812631a5cf5d3ed)); + let mut x12: u64 = 0; + let mut x13: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x12, &mut x13, x11, x3, (x9 & 0x14def9dea2f79cd6)); + let mut x14: u64 = 0; + let mut x15: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x14, &mut x15, x13, x5, (0x0 as u64)); + let mut x16: u64 = 0; + let mut x17: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x16, &mut x17, x15, x7, (x9 & 0x1000000000000000)); + out1[0] = x10; + out1[1] = x12; + out1[2] = x14; + out1[3] = x16; +} + +/// The function fiat_25519_scalar_opp negates a field element in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = -eval (from_montgomery arg1) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_25519_scalar_opp(out1: &mut fiat_25519_scalar_montgomery_domain_field_element, arg1: &fiat_25519_scalar_montgomery_domain_field_element) -> () { + let mut x1: u64 = 0; + let mut x2: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u64(&mut x1, &mut x2, 0x0, (0x0 as u64), (arg1[0])); + let mut x3: u64 = 0; + let mut x4: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u64(&mut x3, &mut x4, x2, (0x0 as u64), (arg1[1])); + let mut x5: u64 = 0; + let mut x6: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u64(&mut x5, &mut x6, x4, (0x0 as u64), (arg1[2])); + let mut x7: u64 = 0; + let mut x8: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u64(&mut x7, &mut x8, x6, (0x0 as u64), (arg1[3])); + let mut x9: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x9, x8, (0x0 as u64), 0xffffffffffffffff); + let mut x10: u64 = 0; + let mut x11: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x10, &mut x11, 0x0, x1, (x9 & 0x5812631a5cf5d3ed)); + let mut x12: u64 = 0; + let mut x13: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x12, &mut x13, x11, x3, (x9 & 0x14def9dea2f79cd6)); + let mut x14: u64 = 0; + let mut x15: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x14, &mut x15, x13, x5, (0x0 as u64)); + let mut x16: u64 = 0; + let mut x17: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x16, &mut x17, x15, x7, (x9 & 0x1000000000000000)); + out1[0] = x10; + out1[1] = x12; + out1[2] = x14; + out1[3] = x16; +} + +/// The function fiat_25519_scalar_from_montgomery translates a field element out of the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval out1 mod m = (eval arg1 * ((2^64)⁻¹ mod m)^4) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_25519_scalar_from_montgomery(out1: &mut fiat_25519_scalar_non_montgomery_domain_field_element, arg1: &fiat_25519_scalar_montgomery_domain_field_element) -> () { + let x1: u64 = (arg1[0]); + let mut x2: u64 = 0; + let mut x3: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x2, &mut x3, x1, 0xd2b51da312547e1b); + let mut x4: u64 = 0; + let mut x5: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x4, &mut x5, x2, 0x1000000000000000); + let mut x6: u64 = 0; + let mut x7: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x6, &mut x7, x2, 0x14def9dea2f79cd6); + let mut x8: u64 = 0; + let mut x9: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x8, &mut x9, x2, 0x5812631a5cf5d3ed); + let mut x10: u64 = 0; + let mut x11: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x10, &mut x11, 0x0, x9, x6); + let mut x12: u64 = 0; + let mut x13: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x12, &mut x13, 0x0, x1, x8); + let mut x14: u64 = 0; + let mut x15: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x14, &mut x15, x13, (0x0 as u64), x10); + let mut x16: u64 = 0; + let mut x17: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x16, &mut x17, 0x0, x14, (arg1[1])); + let mut x18: u64 = 0; + let mut x19: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x18, &mut x19, x16, 0xd2b51da312547e1b); + let mut x20: u64 = 0; + let mut x21: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x20, &mut x21, x18, 0x1000000000000000); + let mut x22: u64 = 0; + let mut x23: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x22, &mut x23, x18, 0x14def9dea2f79cd6); + let mut x24: u64 = 0; + let mut x25: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x24, &mut x25, x18, 0x5812631a5cf5d3ed); + let mut x26: u64 = 0; + let mut x27: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x26, &mut x27, 0x0, x25, x22); + let mut x28: u64 = 0; + let mut x29: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x28, &mut x29, 0x0, x16, x24); + let mut x30: u64 = 0; + let mut x31: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x30, &mut x31, x29, ((x17 as u64) + ((x15 as u64) + ((x11 as u64) + x7))), x26); + let mut x32: u64 = 0; + let mut x33: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x32, &mut x33, x31, x4, ((x27 as u64) + x23)); + let mut x34: u64 = 0; + let mut x35: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x34, &mut x35, x33, x5, x20); + let mut x36: u64 = 0; + let mut x37: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x36, &mut x37, 0x0, x30, (arg1[2])); + let mut x38: u64 = 0; + let mut x39: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x38, &mut x39, x37, x32, (0x0 as u64)); + let mut x40: u64 = 0; + let mut x41: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x40, &mut x41, x39, x34, (0x0 as u64)); + let mut x42: u64 = 0; + let mut x43: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x42, &mut x43, x36, 0xd2b51da312547e1b); + let mut x44: u64 = 0; + let mut x45: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x44, &mut x45, x42, 0x1000000000000000); + let mut x46: u64 = 0; + let mut x47: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x46, &mut x47, x42, 0x14def9dea2f79cd6); + let mut x48: u64 = 0; + let mut x49: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x48, &mut x49, x42, 0x5812631a5cf5d3ed); + let mut x50: u64 = 0; + let mut x51: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x50, &mut x51, 0x0, x49, x46); + let mut x52: u64 = 0; + let mut x53: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x52, &mut x53, 0x0, x36, x48); + let mut x54: u64 = 0; + let mut x55: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x54, &mut x55, x53, x38, x50); + let mut x56: u64 = 0; + let mut x57: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x56, &mut x57, x55, x40, ((x51 as u64) + x47)); + let mut x58: u64 = 0; + let mut x59: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x58, &mut x59, x57, ((x41 as u64) + ((x35 as u64) + x21)), x44); + let mut x60: u64 = 0; + let mut x61: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x60, &mut x61, 0x0, x54, (arg1[3])); + let mut x62: u64 = 0; + let mut x63: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x62, &mut x63, x61, x56, (0x0 as u64)); + let mut x64: u64 = 0; + let mut x65: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x64, &mut x65, x63, x58, (0x0 as u64)); + let mut x66: u64 = 0; + let mut x67: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x66, &mut x67, x60, 0xd2b51da312547e1b); + let mut x68: u64 = 0; + let mut x69: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x68, &mut x69, x66, 0x1000000000000000); + let mut x70: u64 = 0; + let mut x71: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x70, &mut x71, x66, 0x14def9dea2f79cd6); + let mut x72: u64 = 0; + let mut x73: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x72, &mut x73, x66, 0x5812631a5cf5d3ed); + let mut x74: u64 = 0; + let mut x75: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x74, &mut x75, 0x0, x73, x70); + let mut x76: u64 = 0; + let mut x77: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x76, &mut x77, 0x0, x60, x72); + let mut x78: u64 = 0; + let mut x79: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x78, &mut x79, x77, x62, x74); + let mut x80: u64 = 0; + let mut x81: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x80, &mut x81, x79, x64, ((x75 as u64) + x71)); + let mut x82: u64 = 0; + let mut x83: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x82, &mut x83, x81, ((x65 as u64) + ((x59 as u64) + x45)), x68); + let x84: u64 = ((x83 as u64) + x69); + let mut x85: u64 = 0; + let mut x86: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u64(&mut x85, &mut x86, 0x0, x78, 0x5812631a5cf5d3ed); + let mut x87: u64 = 0; + let mut x88: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u64(&mut x87, &mut x88, x86, x80, 0x14def9dea2f79cd6); + let mut x89: u64 = 0; + let mut x90: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u64(&mut x89, &mut x90, x88, x82, (0x0 as u64)); + let mut x91: u64 = 0; + let mut x92: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u64(&mut x91, &mut x92, x90, x84, 0x1000000000000000); + let mut x93: u64 = 0; + let mut x94: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u64(&mut x93, &mut x94, x92, (0x0 as u64), (0x0 as u64)); + let mut x95: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x95, x94, x85, x78); + let mut x96: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x96, x94, x87, x80); + let mut x97: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x97, x94, x89, x82); + let mut x98: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x98, x94, x91, x84); + out1[0] = x95; + out1[1] = x96; + out1[2] = x97; + out1[3] = x98; +} + +/// The function fiat_25519_scalar_to_montgomery translates a field element into the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = eval arg1 mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_25519_scalar_to_montgomery(out1: &mut fiat_25519_scalar_montgomery_domain_field_element, arg1: &fiat_25519_scalar_non_montgomery_domain_field_element) -> () { + let x1: u64 = (arg1[1]); + let x2: u64 = (arg1[2]); + let x3: u64 = (arg1[3]); + let x4: u64 = (arg1[0]); + let mut x5: u64 = 0; + let mut x6: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x5, &mut x6, x4, 0x399411b7c309a3d); + let mut x7: u64 = 0; + let mut x8: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x7, &mut x8, x4, 0xceec73d217f5be65); + let mut x9: u64 = 0; + let mut x10: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x9, &mut x10, x4, 0xd00e1ba768859347); + let mut x11: u64 = 0; + let mut x12: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x11, &mut x12, x4, 0xa40611e3449c0f01); + let mut x13: u64 = 0; + let mut x14: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x13, &mut x14, 0x0, x12, x9); + let mut x15: u64 = 0; + let mut x16: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x15, &mut x16, x14, x10, x7); + let mut x17: u64 = 0; + let mut x18: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x17, &mut x18, x16, x8, x5); + let mut x19: u64 = 0; + let mut x20: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x19, &mut x20, x11, 0xd2b51da312547e1b); + let mut x21: u64 = 0; + let mut x22: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x21, &mut x22, x19, 0x1000000000000000); + let mut x23: u64 = 0; + let mut x24: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x23, &mut x24, x19, 0x14def9dea2f79cd6); + let mut x25: u64 = 0; + let mut x26: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x25, &mut x26, x19, 0x5812631a5cf5d3ed); + let mut x27: u64 = 0; + let mut x28: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x27, &mut x28, 0x0, x26, x23); + let mut x29: u64 = 0; + let mut x30: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x29, &mut x30, 0x0, x11, x25); + let mut x31: u64 = 0; + let mut x32: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x31, &mut x32, x30, x13, x27); + let mut x33: u64 = 0; + let mut x34: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x33, &mut x34, x32, x15, ((x28 as u64) + x24)); + let mut x35: u64 = 0; + let mut x36: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x35, &mut x36, x34, x17, x21); + let mut x37: u64 = 0; + let mut x38: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x37, &mut x38, x1, 0x399411b7c309a3d); + let mut x39: u64 = 0; + let mut x40: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x39, &mut x40, x1, 0xceec73d217f5be65); + let mut x41: u64 = 0; + let mut x42: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x41, &mut x42, x1, 0xd00e1ba768859347); + let mut x43: u64 = 0; + let mut x44: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x43, &mut x44, x1, 0xa40611e3449c0f01); + let mut x45: u64 = 0; + let mut x46: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x45, &mut x46, 0x0, x44, x41); + let mut x47: u64 = 0; + let mut x48: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x47, &mut x48, x46, x42, x39); + let mut x49: u64 = 0; + let mut x50: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x49, &mut x50, x48, x40, x37); + let mut x51: u64 = 0; + let mut x52: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x51, &mut x52, 0x0, x31, x43); + let mut x53: u64 = 0; + let mut x54: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x53, &mut x54, x52, x33, x45); + let mut x55: u64 = 0; + let mut x56: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x55, &mut x56, x54, x35, x47); + let mut x57: u64 = 0; + let mut x58: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x57, &mut x58, x56, (((x36 as u64) + ((x18 as u64) + x6)) + x22), x49); + let mut x59: u64 = 0; + let mut x60: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x59, &mut x60, x51, 0xd2b51da312547e1b); + let mut x61: u64 = 0; + let mut x62: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x61, &mut x62, x59, 0x1000000000000000); + let mut x63: u64 = 0; + let mut x64: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x63, &mut x64, x59, 0x14def9dea2f79cd6); + let mut x65: u64 = 0; + let mut x66: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x65, &mut x66, x59, 0x5812631a5cf5d3ed); + let mut x67: u64 = 0; + let mut x68: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x67, &mut x68, 0x0, x66, x63); + let mut x69: u64 = 0; + let mut x70: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x69, &mut x70, 0x0, x51, x65); + let mut x71: u64 = 0; + let mut x72: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x71, &mut x72, x70, x53, x67); + let mut x73: u64 = 0; + let mut x74: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x73, &mut x74, x72, x55, ((x68 as u64) + x64)); + let mut x75: u64 = 0; + let mut x76: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x75, &mut x76, x74, x57, x61); + let mut x77: u64 = 0; + let mut x78: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x77, &mut x78, x2, 0x399411b7c309a3d); + let mut x79: u64 = 0; + let mut x80: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x79, &mut x80, x2, 0xceec73d217f5be65); + let mut x81: u64 = 0; + let mut x82: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x81, &mut x82, x2, 0xd00e1ba768859347); + let mut x83: u64 = 0; + let mut x84: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x83, &mut x84, x2, 0xa40611e3449c0f01); + let mut x85: u64 = 0; + let mut x86: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x85, &mut x86, 0x0, x84, x81); + let mut x87: u64 = 0; + let mut x88: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x87, &mut x88, x86, x82, x79); + let mut x89: u64 = 0; + let mut x90: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x89, &mut x90, x88, x80, x77); + let mut x91: u64 = 0; + let mut x92: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x91, &mut x92, 0x0, x71, x83); + let mut x93: u64 = 0; + let mut x94: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x93, &mut x94, x92, x73, x85); + let mut x95: u64 = 0; + let mut x96: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x95, &mut x96, x94, x75, x87); + let mut x97: u64 = 0; + let mut x98: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x97, &mut x98, x96, (((x76 as u64) + ((x58 as u64) + ((x50 as u64) + x38))) + x62), x89); + let mut x99: u64 = 0; + let mut x100: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x99, &mut x100, x91, 0xd2b51da312547e1b); + let mut x101: u64 = 0; + let mut x102: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x101, &mut x102, x99, 0x1000000000000000); + let mut x103: u64 = 0; + let mut x104: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x103, &mut x104, x99, 0x14def9dea2f79cd6); + let mut x105: u64 = 0; + let mut x106: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x105, &mut x106, x99, 0x5812631a5cf5d3ed); + let mut x107: u64 = 0; + let mut x108: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x107, &mut x108, 0x0, x106, x103); + let mut x109: u64 = 0; + let mut x110: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x109, &mut x110, 0x0, x91, x105); + let mut x111: u64 = 0; + let mut x112: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x111, &mut x112, x110, x93, x107); + let mut x113: u64 = 0; + let mut x114: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x113, &mut x114, x112, x95, ((x108 as u64) + x104)); + let mut x115: u64 = 0; + let mut x116: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x115, &mut x116, x114, x97, x101); + let mut x117: u64 = 0; + let mut x118: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x117, &mut x118, x3, 0x399411b7c309a3d); + let mut x119: u64 = 0; + let mut x120: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x119, &mut x120, x3, 0xceec73d217f5be65); + let mut x121: u64 = 0; + let mut x122: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x121, &mut x122, x3, 0xd00e1ba768859347); + let mut x123: u64 = 0; + let mut x124: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x123, &mut x124, x3, 0xa40611e3449c0f01); + let mut x125: u64 = 0; + let mut x126: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x125, &mut x126, 0x0, x124, x121); + let mut x127: u64 = 0; + let mut x128: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x127, &mut x128, x126, x122, x119); + let mut x129: u64 = 0; + let mut x130: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x129, &mut x130, x128, x120, x117); + let mut x131: u64 = 0; + let mut x132: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x131, &mut x132, 0x0, x111, x123); + let mut x133: u64 = 0; + let mut x134: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x133, &mut x134, x132, x113, x125); + let mut x135: u64 = 0; + let mut x136: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x135, &mut x136, x134, x115, x127); + let mut x137: u64 = 0; + let mut x138: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x137, &mut x138, x136, (((x116 as u64) + ((x98 as u64) + ((x90 as u64) + x78))) + x102), x129); + let mut x139: u64 = 0; + let mut x140: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x139, &mut x140, x131, 0xd2b51da312547e1b); + let mut x141: u64 = 0; + let mut x142: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x141, &mut x142, x139, 0x1000000000000000); + let mut x143: u64 = 0; + let mut x144: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x143, &mut x144, x139, 0x14def9dea2f79cd6); + let mut x145: u64 = 0; + let mut x146: u64 = 0; + fiat_25519_scalar_mulx_u64(&mut x145, &mut x146, x139, 0x5812631a5cf5d3ed); + let mut x147: u64 = 0; + let mut x148: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x147, &mut x148, 0x0, x146, x143); + let mut x149: u64 = 0; + let mut x150: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x149, &mut x150, 0x0, x131, x145); + let mut x151: u64 = 0; + let mut x152: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x151, &mut x152, x150, x133, x147); + let mut x153: u64 = 0; + let mut x154: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x153, &mut x154, x152, x135, ((x148 as u64) + x144)); + let mut x155: u64 = 0; + let mut x156: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x155, &mut x156, x154, x137, x141); + let x157: u64 = (((x156 as u64) + ((x138 as u64) + ((x130 as u64) + x118))) + x142); + let mut x158: u64 = 0; + let mut x159: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u64(&mut x158, &mut x159, 0x0, x151, 0x5812631a5cf5d3ed); + let mut x160: u64 = 0; + let mut x161: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u64(&mut x160, &mut x161, x159, x153, 0x14def9dea2f79cd6); + let mut x162: u64 = 0; + let mut x163: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u64(&mut x162, &mut x163, x161, x155, (0x0 as u64)); + let mut x164: u64 = 0; + let mut x165: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u64(&mut x164, &mut x165, x163, x157, 0x1000000000000000); + let mut x166: u64 = 0; + let mut x167: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u64(&mut x166, &mut x167, x165, (0x0 as u64), (0x0 as u64)); + let mut x168: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x168, x167, x158, x151); + let mut x169: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x169, x167, x160, x153); + let mut x170: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x170, x167, x162, x155); + let mut x171: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x171, x167, x164, x157); + out1[0] = x168; + out1[1] = x169; + out1[2] = x170; + out1[3] = x171; +} + +/// The function fiat_25519_scalar_nonzero outputs a single non-zero word if the input is non-zero and zero otherwise. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// out1 = 0 ↔ eval (from_montgomery arg1) mod m = 0 +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +#[inline] +pub fn fiat_25519_scalar_nonzero(out1: &mut u64, arg1: &[u64; 4]) -> () { + let x1: u64 = ((arg1[0]) | ((arg1[1]) | ((arg1[2]) | (arg1[3])))); + *out1 = x1; +} + +/// The function fiat_25519_scalar_selectznz is a multi-limb conditional select. +/// +/// Postconditions: +/// out1 = (if arg1 = 0 then arg2 else arg3) +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +#[inline] +pub fn fiat_25519_scalar_selectznz(out1: &mut [u64; 4], arg1: fiat_25519_scalar_u1, arg2: &[u64; 4], arg3: &[u64; 4]) -> () { + let mut x1: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x1, arg1, (arg2[0]), (arg3[0])); + let mut x2: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x2, arg1, (arg2[1]), (arg3[1])); + let mut x3: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x3, arg1, (arg2[2]), (arg3[2])); + let mut x4: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x4, arg1, (arg2[3]), (arg3[3])); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; + out1[3] = x4; +} + +/// The function fiat_25519_scalar_to_bytes serializes a field element NOT in the Montgomery domain to bytes in little-endian order. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..31] +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0x1fffffffffffffff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0x1f]] +#[inline] +pub fn fiat_25519_scalar_to_bytes(out1: &mut [u8; 32], arg1: &[u64; 4]) -> () { + let x1: u64 = (arg1[3]); + let x2: u64 = (arg1[2]); + let x3: u64 = (arg1[1]); + let x4: u64 = (arg1[0]); + let x5: u8 = ((x4 & (0xff as u64)) as u8); + let x6: u64 = (x4 >> 8); + let x7: u8 = ((x6 & (0xff as u64)) as u8); + let x8: u64 = (x6 >> 8); + let x9: u8 = ((x8 & (0xff as u64)) as u8); + let x10: u64 = (x8 >> 8); + let x11: u8 = ((x10 & (0xff as u64)) as u8); + let x12: u64 = (x10 >> 8); + let x13: u8 = ((x12 & (0xff as u64)) as u8); + let x14: u64 = (x12 >> 8); + let x15: u8 = ((x14 & (0xff as u64)) as u8); + let x16: u64 = (x14 >> 8); + let x17: u8 = ((x16 & (0xff as u64)) as u8); + let x18: u8 = ((x16 >> 8) as u8); + let x19: u8 = ((x3 & (0xff as u64)) as u8); + let x20: u64 = (x3 >> 8); + let x21: u8 = ((x20 & (0xff as u64)) as u8); + let x22: u64 = (x20 >> 8); + let x23: u8 = ((x22 & (0xff as u64)) as u8); + let x24: u64 = (x22 >> 8); + let x25: u8 = ((x24 & (0xff as u64)) as u8); + let x26: u64 = (x24 >> 8); + let x27: u8 = ((x26 & (0xff as u64)) as u8); + let x28: u64 = (x26 >> 8); + let x29: u8 = ((x28 & (0xff as u64)) as u8); + let x30: u64 = (x28 >> 8); + let x31: u8 = ((x30 & (0xff as u64)) as u8); + let x32: u8 = ((x30 >> 8) as u8); + let x33: u8 = ((x2 & (0xff as u64)) as u8); + let x34: u64 = (x2 >> 8); + let x35: u8 = ((x34 & (0xff as u64)) as u8); + let x36: u64 = (x34 >> 8); + let x37: u8 = ((x36 & (0xff as u64)) as u8); + let x38: u64 = (x36 >> 8); + let x39: u8 = ((x38 & (0xff as u64)) as u8); + let x40: u64 = (x38 >> 8); + let x41: u8 = ((x40 & (0xff as u64)) as u8); + let x42: u64 = (x40 >> 8); + let x43: u8 = ((x42 & (0xff as u64)) as u8); + let x44: u64 = (x42 >> 8); + let x45: u8 = ((x44 & (0xff as u64)) as u8); + let x46: u8 = ((x44 >> 8) as u8); + let x47: u8 = ((x1 & (0xff as u64)) as u8); + let x48: u64 = (x1 >> 8); + let x49: u8 = ((x48 & (0xff as u64)) as u8); + let x50: u64 = (x48 >> 8); + let x51: u8 = ((x50 & (0xff as u64)) as u8); + let x52: u64 = (x50 >> 8); + let x53: u8 = ((x52 & (0xff as u64)) as u8); + let x54: u64 = (x52 >> 8); + let x55: u8 = ((x54 & (0xff as u64)) as u8); + let x56: u64 = (x54 >> 8); + let x57: u8 = ((x56 & (0xff as u64)) as u8); + let x58: u64 = (x56 >> 8); + let x59: u8 = ((x58 & (0xff as u64)) as u8); + let x60: u8 = ((x58 >> 8) as u8); + out1[0] = x5; + out1[1] = x7; + out1[2] = x9; + out1[3] = x11; + out1[4] = x13; + out1[5] = x15; + out1[6] = x17; + out1[7] = x18; + out1[8] = x19; + out1[9] = x21; + out1[10] = x23; + out1[11] = x25; + out1[12] = x27; + out1[13] = x29; + out1[14] = x31; + out1[15] = x32; + out1[16] = x33; + out1[17] = x35; + out1[18] = x37; + out1[19] = x39; + out1[20] = x41; + out1[21] = x43; + out1[22] = x45; + out1[23] = x46; + out1[24] = x47; + out1[25] = x49; + out1[26] = x51; + out1[27] = x53; + out1[28] = x55; + out1[29] = x57; + out1[30] = x59; + out1[31] = x60; +} + +/// The function fiat_25519_scalar_from_bytes deserializes a field element NOT in the Montgomery domain from bytes in little-endian order. +/// +/// Preconditions: +/// 0 ≤ bytes_eval arg1 < m +/// Postconditions: +/// eval out1 mod m = bytes_eval arg1 mod m +/// 0 ≤ eval out1 < m +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0x1f]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0x1fffffffffffffff]] +#[inline] +pub fn fiat_25519_scalar_from_bytes(out1: &mut [u64; 4], arg1: &[u8; 32]) -> () { + let x1: u64 = (((arg1[31]) as u64) << 56); + let x2: u64 = (((arg1[30]) as u64) << 48); + let x3: u64 = (((arg1[29]) as u64) << 40); + let x4: u64 = (((arg1[28]) as u64) << 32); + let x5: u64 = (((arg1[27]) as u64) << 24); + let x6: u64 = (((arg1[26]) as u64) << 16); + let x7: u64 = (((arg1[25]) as u64) << 8); + let x8: u8 = (arg1[24]); + let x9: u64 = (((arg1[23]) as u64) << 56); + let x10: u64 = (((arg1[22]) as u64) << 48); + let x11: u64 = (((arg1[21]) as u64) << 40); + let x12: u64 = (((arg1[20]) as u64) << 32); + let x13: u64 = (((arg1[19]) as u64) << 24); + let x14: u64 = (((arg1[18]) as u64) << 16); + let x15: u64 = (((arg1[17]) as u64) << 8); + let x16: u8 = (arg1[16]); + let x17: u64 = (((arg1[15]) as u64) << 56); + let x18: u64 = (((arg1[14]) as u64) << 48); + let x19: u64 = (((arg1[13]) as u64) << 40); + let x20: u64 = (((arg1[12]) as u64) << 32); + let x21: u64 = (((arg1[11]) as u64) << 24); + let x22: u64 = (((arg1[10]) as u64) << 16); + let x23: u64 = (((arg1[9]) as u64) << 8); + let x24: u8 = (arg1[8]); + let x25: u64 = (((arg1[7]) as u64) << 56); + let x26: u64 = (((arg1[6]) as u64) << 48); + let x27: u64 = (((arg1[5]) as u64) << 40); + let x28: u64 = (((arg1[4]) as u64) << 32); + let x29: u64 = (((arg1[3]) as u64) << 24); + let x30: u64 = (((arg1[2]) as u64) << 16); + let x31: u64 = (((arg1[1]) as u64) << 8); + let x32: u8 = (arg1[0]); + let x33: u64 = (x31 + (x32 as u64)); + let x34: u64 = (x30 + x33); + let x35: u64 = (x29 + x34); + let x36: u64 = (x28 + x35); + let x37: u64 = (x27 + x36); + let x38: u64 = (x26 + x37); + let x39: u64 = (x25 + x38); + let x40: u64 = (x23 + (x24 as u64)); + let x41: u64 = (x22 + x40); + let x42: u64 = (x21 + x41); + let x43: u64 = (x20 + x42); + let x44: u64 = (x19 + x43); + let x45: u64 = (x18 + x44); + let x46: u64 = (x17 + x45); + let x47: u64 = (x15 + (x16 as u64)); + let x48: u64 = (x14 + x47); + let x49: u64 = (x13 + x48); + let x50: u64 = (x12 + x49); + let x51: u64 = (x11 + x50); + let x52: u64 = (x10 + x51); + let x53: u64 = (x9 + x52); + let x54: u64 = (x7 + (x8 as u64)); + let x55: u64 = (x6 + x54); + let x56: u64 = (x5 + x55); + let x57: u64 = (x4 + x56); + let x58: u64 = (x3 + x57); + let x59: u64 = (x2 + x58); + let x60: u64 = (x1 + x59); + out1[0] = x39; + out1[1] = x46; + out1[2] = x53; + out1[3] = x60; +} + +/// The function fiat_25519_scalar_set_one returns the field element one in the Montgomery domain. +/// +/// Postconditions: +/// eval (from_montgomery out1) mod m = 1 mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_25519_scalar_set_one(out1: &mut fiat_25519_scalar_montgomery_domain_field_element) -> () { + out1[0] = 0xd6ec31748d98951d; + out1[1] = 0xc6ef5bf4737dcf70; + out1[2] = 0xfffffffffffffffe; + out1[3] = 0xfffffffffffffff; +} + +/// The function fiat_25519_scalar_msat returns the saturated representation of the prime modulus. +/// +/// Postconditions: +/// twos_complement_eval out1 = m +/// 0 ≤ eval out1 < m +/// +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +#[inline] +pub fn fiat_25519_scalar_msat(out1: &mut [u64; 5]) -> () { + out1[0] = 0x5812631a5cf5d3ed; + out1[1] = 0x14def9dea2f79cd6; + out1[2] = (0x0 as u64); + out1[3] = 0x1000000000000000; + out1[4] = (0x0 as u64); +} + +/// The function fiat_25519_scalar_divstep computes a divstep. +/// +/// Preconditions: +/// 0 ≤ eval arg4 < m +/// 0 ≤ eval arg5 < m +/// Postconditions: +/// out1 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then 1 - arg1 else 1 + arg1) +/// twos_complement_eval out2 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then twos_complement_eval arg3 else twos_complement_eval arg2) +/// twos_complement_eval out3 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then ⌊(twos_complement_eval arg3 - twos_complement_eval arg2) / 2⌋ else ⌊(twos_complement_eval arg3 + (twos_complement_eval arg3 mod 2) * twos_complement_eval arg2) / 2⌋) +/// eval (from_montgomery out4) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (2 * eval (from_montgomery arg5)) mod m else (2 * eval (from_montgomery arg4)) mod m) +/// eval (from_montgomery out5) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (eval (from_montgomery arg4) - eval (from_montgomery arg4)) mod m else (eval (from_montgomery arg5) + (twos_complement_eval arg3 mod 2) * eval (from_montgomery arg4)) mod m) +/// 0 ≤ eval out5 < m +/// 0 ≤ eval out5 < m +/// 0 ≤ eval out2 < m +/// 0 ≤ eval out3 < m +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0xffffffffffffffff] +/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// arg4: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// arg5: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +/// out2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// out3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// out4: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// out5: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +#[inline] +pub fn fiat_25519_scalar_divstep(out1: &mut u64, out2: &mut [u64; 5], out3: &mut [u64; 5], out4: &mut [u64; 4], out5: &mut [u64; 4], arg1: u64, arg2: &[u64; 5], arg3: &[u64; 5], arg4: &[u64; 4], arg5: &[u64; 4]) -> () { + let mut x1: u64 = 0; + let mut x2: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x1, &mut x2, 0x0, (!arg1), (0x1 as u64)); + let x3: fiat_25519_scalar_u1 = (((x1 >> 63) as fiat_25519_scalar_u1) & (((arg3[0]) & (0x1 as u64)) as fiat_25519_scalar_u1)); + let mut x4: u64 = 0; + let mut x5: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x4, &mut x5, 0x0, (!arg1), (0x1 as u64)); + let mut x6: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x6, x3, arg1, x4); + let mut x7: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x7, x3, (arg2[0]), (arg3[0])); + let mut x8: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x8, x3, (arg2[1]), (arg3[1])); + let mut x9: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x9, x3, (arg2[2]), (arg3[2])); + let mut x10: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x10, x3, (arg2[3]), (arg3[3])); + let mut x11: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x11, x3, (arg2[4]), (arg3[4])); + let mut x12: u64 = 0; + let mut x13: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x12, &mut x13, 0x0, (0x1 as u64), (!(arg2[0]))); + let mut x14: u64 = 0; + let mut x15: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x14, &mut x15, x13, (0x0 as u64), (!(arg2[1]))); + let mut x16: u64 = 0; + let mut x17: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x16, &mut x17, x15, (0x0 as u64), (!(arg2[2]))); + let mut x18: u64 = 0; + let mut x19: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x18, &mut x19, x17, (0x0 as u64), (!(arg2[3]))); + let mut x20: u64 = 0; + let mut x21: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x20, &mut x21, x19, (0x0 as u64), (!(arg2[4]))); + let mut x22: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x22, x3, (arg3[0]), x12); + let mut x23: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x23, x3, (arg3[1]), x14); + let mut x24: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x24, x3, (arg3[2]), x16); + let mut x25: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x25, x3, (arg3[3]), x18); + let mut x26: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x26, x3, (arg3[4]), x20); + let mut x27: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x27, x3, (arg4[0]), (arg5[0])); + let mut x28: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x28, x3, (arg4[1]), (arg5[1])); + let mut x29: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x29, x3, (arg4[2]), (arg5[2])); + let mut x30: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x30, x3, (arg4[3]), (arg5[3])); + let mut x31: u64 = 0; + let mut x32: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x31, &mut x32, 0x0, x27, x27); + let mut x33: u64 = 0; + let mut x34: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x33, &mut x34, x32, x28, x28); + let mut x35: u64 = 0; + let mut x36: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x35, &mut x36, x34, x29, x29); + let mut x37: u64 = 0; + let mut x38: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x37, &mut x38, x36, x30, x30); + let mut x39: u64 = 0; + let mut x40: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u64(&mut x39, &mut x40, 0x0, x31, 0x5812631a5cf5d3ed); + let mut x41: u64 = 0; + let mut x42: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u64(&mut x41, &mut x42, x40, x33, 0x14def9dea2f79cd6); + let mut x43: u64 = 0; + let mut x44: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u64(&mut x43, &mut x44, x42, x35, (0x0 as u64)); + let mut x45: u64 = 0; + let mut x46: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u64(&mut x45, &mut x46, x44, x37, 0x1000000000000000); + let mut x47: u64 = 0; + let mut x48: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u64(&mut x47, &mut x48, x46, (x38 as u64), (0x0 as u64)); + let x49: u64 = (arg4[3]); + let x50: u64 = (arg4[2]); + let x51: u64 = (arg4[1]); + let x52: u64 = (arg4[0]); + let mut x53: u64 = 0; + let mut x54: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u64(&mut x53, &mut x54, 0x0, (0x0 as u64), x52); + let mut x55: u64 = 0; + let mut x56: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u64(&mut x55, &mut x56, x54, (0x0 as u64), x51); + let mut x57: u64 = 0; + let mut x58: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u64(&mut x57, &mut x58, x56, (0x0 as u64), x50); + let mut x59: u64 = 0; + let mut x60: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u64(&mut x59, &mut x60, x58, (0x0 as u64), x49); + let mut x61: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x61, x60, (0x0 as u64), 0xffffffffffffffff); + let mut x62: u64 = 0; + let mut x63: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x62, &mut x63, 0x0, x53, (x61 & 0x5812631a5cf5d3ed)); + let mut x64: u64 = 0; + let mut x65: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x64, &mut x65, x63, x55, (x61 & 0x14def9dea2f79cd6)); + let mut x66: u64 = 0; + let mut x67: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x66, &mut x67, x65, x57, (0x0 as u64)); + let mut x68: u64 = 0; + let mut x69: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x68, &mut x69, x67, x59, (x61 & 0x1000000000000000)); + let mut x70: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x70, x3, (arg5[0]), x62); + let mut x71: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x71, x3, (arg5[1]), x64); + let mut x72: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x72, x3, (arg5[2]), x66); + let mut x73: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x73, x3, (arg5[3]), x68); + let x74: fiat_25519_scalar_u1 = ((x22 & (0x1 as u64)) as fiat_25519_scalar_u1); + let mut x75: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x75, x74, (0x0 as u64), x7); + let mut x76: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x76, x74, (0x0 as u64), x8); + let mut x77: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x77, x74, (0x0 as u64), x9); + let mut x78: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x78, x74, (0x0 as u64), x10); + let mut x79: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x79, x74, (0x0 as u64), x11); + let mut x80: u64 = 0; + let mut x81: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x80, &mut x81, 0x0, x22, x75); + let mut x82: u64 = 0; + let mut x83: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x82, &mut x83, x81, x23, x76); + let mut x84: u64 = 0; + let mut x85: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x84, &mut x85, x83, x24, x77); + let mut x86: u64 = 0; + let mut x87: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x86, &mut x87, x85, x25, x78); + let mut x88: u64 = 0; + let mut x89: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x88, &mut x89, x87, x26, x79); + let mut x90: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x90, x74, (0x0 as u64), x27); + let mut x91: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x91, x74, (0x0 as u64), x28); + let mut x92: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x92, x74, (0x0 as u64), x29); + let mut x93: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x93, x74, (0x0 as u64), x30); + let mut x94: u64 = 0; + let mut x95: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x94, &mut x95, 0x0, x70, x90); + let mut x96: u64 = 0; + let mut x97: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x96, &mut x97, x95, x71, x91); + let mut x98: u64 = 0; + let mut x99: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x98, &mut x99, x97, x72, x92); + let mut x100: u64 = 0; + let mut x101: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x100, &mut x101, x99, x73, x93); + let mut x102: u64 = 0; + let mut x103: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u64(&mut x102, &mut x103, 0x0, x94, 0x5812631a5cf5d3ed); + let mut x104: u64 = 0; + let mut x105: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u64(&mut x104, &mut x105, x103, x96, 0x14def9dea2f79cd6); + let mut x106: u64 = 0; + let mut x107: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u64(&mut x106, &mut x107, x105, x98, (0x0 as u64)); + let mut x108: u64 = 0; + let mut x109: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u64(&mut x108, &mut x109, x107, x100, 0x1000000000000000); + let mut x110: u64 = 0; + let mut x111: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_subborrowx_u64(&mut x110, &mut x111, x109, (x101 as u64), (0x0 as u64)); + let mut x112: u64 = 0; + let mut x113: fiat_25519_scalar_u1 = 0; + fiat_25519_scalar_addcarryx_u64(&mut x112, &mut x113, 0x0, x6, (0x1 as u64)); + let x114: u64 = ((x80 >> 1) | ((x82 << 63) & 0xffffffffffffffff)); + let x115: u64 = ((x82 >> 1) | ((x84 << 63) & 0xffffffffffffffff)); + let x116: u64 = ((x84 >> 1) | ((x86 << 63) & 0xffffffffffffffff)); + let x117: u64 = ((x86 >> 1) | ((x88 << 63) & 0xffffffffffffffff)); + let x118: u64 = ((x88 & 0x8000000000000000) | (x88 >> 1)); + let mut x119: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x119, x48, x39, x31); + let mut x120: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x120, x48, x41, x33); + let mut x121: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x121, x48, x43, x35); + let mut x122: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x122, x48, x45, x37); + let mut x123: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x123, x111, x102, x94); + let mut x124: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x124, x111, x104, x96); + let mut x125: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x125, x111, x106, x98); + let mut x126: u64 = 0; + fiat_25519_scalar_cmovznz_u64(&mut x126, x111, x108, x100); + *out1 = x112; + out2[0] = x7; + out2[1] = x8; + out2[2] = x9; + out2[3] = x10; + out2[4] = x11; + out3[0] = x114; + out3[1] = x115; + out3[2] = x116; + out3[3] = x117; + out3[4] = x118; + out4[0] = x119; + out4[1] = x120; + out4[2] = x121; + out4[3] = x122; + out5[0] = x123; + out5[1] = x124; + out5[2] = x125; + out5[3] = x126; +} + +/// The function fiat_25519_scalar_divstep_precomp returns the precomputed value for Bernstein-Yang-inversion (in montgomery form). +/// +/// Postconditions: +/// eval (from_montgomery out1) = ⌊(m - 1) / 2⌋^(if ⌊log2 m⌋ + 1 < 46 then ⌊(49 * (⌊log2 m⌋ + 1) + 80) / 17⌋ else ⌊(49 * (⌊log2 m⌋ + 1) + 57) / 17⌋) +/// 0 ≤ eval out1 < m +/// +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +#[inline] +pub fn fiat_25519_scalar_divstep_precomp(out1: &mut [u64; 4]) -> () { + out1[0] = 0xd70af84436a7cb92; + out1[1] = 0x5f71c978b0b8b159; + out1[2] = 0xe76d816974947f1a; + out1[3] = 0x19a2d36f193e4ff; +} diff --git a/vendor/fiat-crypto/src/lib.rs b/vendor/fiat-crypto/src/lib.rs new file mode 100644 index 000000000..3a0d1ca25 --- /dev/null +++ b/vendor/fiat-crypto/src/lib.rs @@ -0,0 +1,26 @@ +// AUTOGENERATED FILE: DO NOT EDIT +#![cfg_attr(not(feature = "std"), no_std)] +pub mod curve25519_32; +pub mod curve25519_64; +pub mod curve25519_scalar_32; +pub mod curve25519_scalar_64; +pub mod p224_32; +pub mod p224_64; +pub mod p256_32; +pub mod p256_64; +pub mod p256_scalar_32; +pub mod p256_scalar_64; +pub mod p384_32; +pub mod p384_64; +pub mod p384_scalar_32; +pub mod p384_scalar_64; +pub mod p434_64; +pub mod p448_solinas_32; +pub mod p448_solinas_64; +pub mod p521_64; +pub mod poly1305_32; +pub mod poly1305_64; +pub mod secp256k1_32; +pub mod secp256k1_64; +pub mod secp256k1_scalar_32; +pub mod secp256k1_scalar_64; diff --git a/vendor/fiat-crypto/src/p224_32.rs b/vendor/fiat-crypto/src/p224_32.rs new file mode 100644 index 000000000..ebe45dfd6 --- /dev/null +++ b/vendor/fiat-crypto/src/p224_32.rs @@ -0,0 +1,3752 @@ +//! Autogenerated: 'src/ExtractionOCaml/word_by_word_montgomery' --lang Rust --inline p224 32 '2^224 - 2^96 + 1' mul square add sub opp from_montgomery to_montgomery nonzero selectznz to_bytes from_bytes one msat divstep divstep_precomp +//! curve description: p224 +//! machine_wordsize = 32 (from "32") +//! requested operations: mul, square, add, sub, opp, from_montgomery, to_montgomery, nonzero, selectznz, to_bytes, from_bytes, one, msat, divstep, divstep_precomp +//! m = 0xffffffffffffffffffffffffffffffff000000000000000000000001 (from "2^224 - 2^96 + 1") +//! +//! NOTE: In addition to the bounds specified above each function, all +//! functions synthesized for this Montgomery arithmetic require the +//! input to be strictly less than the prime modulus (m), and also +//! require the input to be in the unique saturated representation. +//! All functions also ensure that these two properties are true of +//! return values. +//! +//! Computed values: +//! eval z = z[0] + (z[1] << 32) + (z[2] << 64) + (z[3] << 96) + (z[4] << 128) + (z[5] << 160) + (z[6] << 192) +//! bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) +//! twos_complement_eval z = let x1 := z[0] + (z[1] << 32) + (z[2] << 64) + (z[3] << 96) + (z[4] << 128) + (z[5] << 160) + (z[6] << 192) in +//! if x1 & (2^224-1) < 2^223 then x1 & (2^224-1) else (x1 & (2^224-1)) - 2^224 + +#![allow(unused_parens)] +#![allow(non_camel_case_types)] + +pub type fiat_p224_u1 = u8; +pub type fiat_p224_i1 = i8; +pub type fiat_p224_u2 = u8; +pub type fiat_p224_i2 = i8; + +/* The type fiat_p224_montgomery_domain_field_element is a field element in the Montgomery domain. */ +/* Bounds: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] */ +pub type fiat_p224_montgomery_domain_field_element = [u32; 7]; + +/* The type fiat_p224_non_montgomery_domain_field_element is a field element NOT in the Montgomery domain. */ +/* Bounds: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] */ +pub type fiat_p224_non_montgomery_domain_field_element = [u32; 7]; + + +/// The function fiat_p224_addcarryx_u32 is an addition with carry. +/// +/// Postconditions: +/// out1 = (arg1 + arg2 + arg3) mod 2^32 +/// out2 = ⌊(arg1 + arg2 + arg3) / 2^32⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffff] +/// arg3: [0x0 ~> 0xffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_p224_addcarryx_u32(out1: &mut u32, out2: &mut fiat_p224_u1, arg1: fiat_p224_u1, arg2: u32, arg3: u32) -> () { + let x1: u64 = (((arg1 as u64) + (arg2 as u64)) + (arg3 as u64)); + let x2: u32 = ((x1 & (0xffffffff as u64)) as u32); + let x3: fiat_p224_u1 = ((x1 >> 32) as fiat_p224_u1); + *out1 = x2; + *out2 = x3; +} + +/// The function fiat_p224_subborrowx_u32 is a subtraction with borrow. +/// +/// Postconditions: +/// out1 = (-arg1 + arg2 + -arg3) mod 2^32 +/// out2 = -⌊(-arg1 + arg2 + -arg3) / 2^32⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffff] +/// arg3: [0x0 ~> 0xffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_p224_subborrowx_u32(out1: &mut u32, out2: &mut fiat_p224_u1, arg1: fiat_p224_u1, arg2: u32, arg3: u32) -> () { + let x1: i64 = (((arg2 as i64) - (arg1 as i64)) - (arg3 as i64)); + let x2: fiat_p224_i1 = ((x1 >> 32) as fiat_p224_i1); + let x3: u32 = ((x1 & (0xffffffff as i64)) as u32); + *out1 = x3; + *out2 = (((0x0 as fiat_p224_i2) - (x2 as fiat_p224_i2)) as fiat_p224_u1); +} + +/// The function fiat_p224_mulx_u32 is a multiplication, returning the full double-width result. +/// +/// Postconditions: +/// out1 = (arg1 * arg2) mod 2^32 +/// out2 = ⌊arg1 * arg2 / 2^32⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0xffffffff] +/// arg2: [0x0 ~> 0xffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +/// out2: [0x0 ~> 0xffffffff] +#[inline] +pub fn fiat_p224_mulx_u32(out1: &mut u32, out2: &mut u32, arg1: u32, arg2: u32) -> () { + let x1: u64 = ((arg1 as u64) * (arg2 as u64)); + let x2: u32 = ((x1 & (0xffffffff as u64)) as u32); + let x3: u32 = ((x1 >> 32) as u32); + *out1 = x2; + *out2 = x3; +} + +/// The function fiat_p224_cmovznz_u32 is a single-word conditional move. +/// +/// Postconditions: +/// out1 = (if arg1 = 0 then arg2 else arg3) +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffff] +/// arg3: [0x0 ~> 0xffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +#[inline] +pub fn fiat_p224_cmovznz_u32(out1: &mut u32, arg1: fiat_p224_u1, arg2: u32, arg3: u32) -> () { + let x1: fiat_p224_u1 = (!(!arg1)); + let x2: u32 = ((((((0x0 as fiat_p224_i2) - (x1 as fiat_p224_i2)) as fiat_p224_i1) as i64) & (0xffffffff as i64)) as u32); + let x3: u32 = ((x2 & arg3) | ((!x2) & arg2)); + *out1 = x3; +} + +/// The function fiat_p224_mul multiplies two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p224_mul(out1: &mut fiat_p224_montgomery_domain_field_element, arg1: &fiat_p224_montgomery_domain_field_element, arg2: &fiat_p224_montgomery_domain_field_element) -> () { + let x1: u32 = (arg1[1]); + let x2: u32 = (arg1[2]); + let x3: u32 = (arg1[3]); + let x4: u32 = (arg1[4]); + let x5: u32 = (arg1[5]); + let x6: u32 = (arg1[6]); + let x7: u32 = (arg1[0]); + let mut x8: u32 = 0; + let mut x9: u32 = 0; + fiat_p224_mulx_u32(&mut x8, &mut x9, x7, (arg2[6])); + let mut x10: u32 = 0; + let mut x11: u32 = 0; + fiat_p224_mulx_u32(&mut x10, &mut x11, x7, (arg2[5])); + let mut x12: u32 = 0; + let mut x13: u32 = 0; + fiat_p224_mulx_u32(&mut x12, &mut x13, x7, (arg2[4])); + let mut x14: u32 = 0; + let mut x15: u32 = 0; + fiat_p224_mulx_u32(&mut x14, &mut x15, x7, (arg2[3])); + let mut x16: u32 = 0; + let mut x17: u32 = 0; + fiat_p224_mulx_u32(&mut x16, &mut x17, x7, (arg2[2])); + let mut x18: u32 = 0; + let mut x19: u32 = 0; + fiat_p224_mulx_u32(&mut x18, &mut x19, x7, (arg2[1])); + let mut x20: u32 = 0; + let mut x21: u32 = 0; + fiat_p224_mulx_u32(&mut x20, &mut x21, x7, (arg2[0])); + let mut x22: u32 = 0; + let mut x23: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x22, &mut x23, 0x0, x21, x18); + let mut x24: u32 = 0; + let mut x25: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x24, &mut x25, x23, x19, x16); + let mut x26: u32 = 0; + let mut x27: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x26, &mut x27, x25, x17, x14); + let mut x28: u32 = 0; + let mut x29: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x28, &mut x29, x27, x15, x12); + let mut x30: u32 = 0; + let mut x31: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x30, &mut x31, x29, x13, x10); + let mut x32: u32 = 0; + let mut x33: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x32, &mut x33, x31, x11, x8); + let x34: u32 = ((x33 as u32) + x9); + let mut x35: u32 = 0; + let mut x36: u32 = 0; + fiat_p224_mulx_u32(&mut x35, &mut x36, x20, 0xffffffff); + let mut x37: u32 = 0; + let mut x38: u32 = 0; + fiat_p224_mulx_u32(&mut x37, &mut x38, x35, 0xffffffff); + let mut x39: u32 = 0; + let mut x40: u32 = 0; + fiat_p224_mulx_u32(&mut x39, &mut x40, x35, 0xffffffff); + let mut x41: u32 = 0; + let mut x42: u32 = 0; + fiat_p224_mulx_u32(&mut x41, &mut x42, x35, 0xffffffff); + let mut x43: u32 = 0; + let mut x44: u32 = 0; + fiat_p224_mulx_u32(&mut x43, &mut x44, x35, 0xffffffff); + let mut x45: u32 = 0; + let mut x46: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x45, &mut x46, 0x0, x44, x41); + let mut x47: u32 = 0; + let mut x48: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x47, &mut x48, x46, x42, x39); + let mut x49: u32 = 0; + let mut x50: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x49, &mut x50, x48, x40, x37); + let x51: u32 = ((x50 as u32) + x38); + let mut x52: u32 = 0; + let mut x53: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x52, &mut x53, 0x0, x20, x35); + let mut x54: u32 = 0; + let mut x55: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x54, &mut x55, x53, x22, (0x0 as u32)); + let mut x56: u32 = 0; + let mut x57: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x56, &mut x57, x55, x24, (0x0 as u32)); + let mut x58: u32 = 0; + let mut x59: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x58, &mut x59, x57, x26, x43); + let mut x60: u32 = 0; + let mut x61: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x60, &mut x61, x59, x28, x45); + let mut x62: u32 = 0; + let mut x63: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x62, &mut x63, x61, x30, x47); + let mut x64: u32 = 0; + let mut x65: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x64, &mut x65, x63, x32, x49); + let mut x66: u32 = 0; + let mut x67: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x66, &mut x67, x65, x34, x51); + let mut x68: u32 = 0; + let mut x69: u32 = 0; + fiat_p224_mulx_u32(&mut x68, &mut x69, x1, (arg2[6])); + let mut x70: u32 = 0; + let mut x71: u32 = 0; + fiat_p224_mulx_u32(&mut x70, &mut x71, x1, (arg2[5])); + let mut x72: u32 = 0; + let mut x73: u32 = 0; + fiat_p224_mulx_u32(&mut x72, &mut x73, x1, (arg2[4])); + let mut x74: u32 = 0; + let mut x75: u32 = 0; + fiat_p224_mulx_u32(&mut x74, &mut x75, x1, (arg2[3])); + let mut x76: u32 = 0; + let mut x77: u32 = 0; + fiat_p224_mulx_u32(&mut x76, &mut x77, x1, (arg2[2])); + let mut x78: u32 = 0; + let mut x79: u32 = 0; + fiat_p224_mulx_u32(&mut x78, &mut x79, x1, (arg2[1])); + let mut x80: u32 = 0; + let mut x81: u32 = 0; + fiat_p224_mulx_u32(&mut x80, &mut x81, x1, (arg2[0])); + let mut x82: u32 = 0; + let mut x83: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x82, &mut x83, 0x0, x81, x78); + let mut x84: u32 = 0; + let mut x85: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x84, &mut x85, x83, x79, x76); + let mut x86: u32 = 0; + let mut x87: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x86, &mut x87, x85, x77, x74); + let mut x88: u32 = 0; + let mut x89: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x88, &mut x89, x87, x75, x72); + let mut x90: u32 = 0; + let mut x91: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x90, &mut x91, x89, x73, x70); + let mut x92: u32 = 0; + let mut x93: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x92, &mut x93, x91, x71, x68); + let x94: u32 = ((x93 as u32) + x69); + let mut x95: u32 = 0; + let mut x96: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x95, &mut x96, 0x0, x54, x80); + let mut x97: u32 = 0; + let mut x98: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x97, &mut x98, x96, x56, x82); + let mut x99: u32 = 0; + let mut x100: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x99, &mut x100, x98, x58, x84); + let mut x101: u32 = 0; + let mut x102: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x101, &mut x102, x100, x60, x86); + let mut x103: u32 = 0; + let mut x104: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x103, &mut x104, x102, x62, x88); + let mut x105: u32 = 0; + let mut x106: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x105, &mut x106, x104, x64, x90); + let mut x107: u32 = 0; + let mut x108: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x107, &mut x108, x106, x66, x92); + let mut x109: u32 = 0; + let mut x110: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x109, &mut x110, x108, (x67 as u32), x94); + let mut x111: u32 = 0; + let mut x112: u32 = 0; + fiat_p224_mulx_u32(&mut x111, &mut x112, x95, 0xffffffff); + let mut x113: u32 = 0; + let mut x114: u32 = 0; + fiat_p224_mulx_u32(&mut x113, &mut x114, x111, 0xffffffff); + let mut x115: u32 = 0; + let mut x116: u32 = 0; + fiat_p224_mulx_u32(&mut x115, &mut x116, x111, 0xffffffff); + let mut x117: u32 = 0; + let mut x118: u32 = 0; + fiat_p224_mulx_u32(&mut x117, &mut x118, x111, 0xffffffff); + let mut x119: u32 = 0; + let mut x120: u32 = 0; + fiat_p224_mulx_u32(&mut x119, &mut x120, x111, 0xffffffff); + let mut x121: u32 = 0; + let mut x122: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x121, &mut x122, 0x0, x120, x117); + let mut x123: u32 = 0; + let mut x124: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x123, &mut x124, x122, x118, x115); + let mut x125: u32 = 0; + let mut x126: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x125, &mut x126, x124, x116, x113); + let x127: u32 = ((x126 as u32) + x114); + let mut x128: u32 = 0; + let mut x129: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x128, &mut x129, 0x0, x95, x111); + let mut x130: u32 = 0; + let mut x131: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x130, &mut x131, x129, x97, (0x0 as u32)); + let mut x132: u32 = 0; + let mut x133: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x132, &mut x133, x131, x99, (0x0 as u32)); + let mut x134: u32 = 0; + let mut x135: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x134, &mut x135, x133, x101, x119); + let mut x136: u32 = 0; + let mut x137: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x136, &mut x137, x135, x103, x121); + let mut x138: u32 = 0; + let mut x139: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x138, &mut x139, x137, x105, x123); + let mut x140: u32 = 0; + let mut x141: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x140, &mut x141, x139, x107, x125); + let mut x142: u32 = 0; + let mut x143: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x142, &mut x143, x141, x109, x127); + let x144: u32 = ((x143 as u32) + (x110 as u32)); + let mut x145: u32 = 0; + let mut x146: u32 = 0; + fiat_p224_mulx_u32(&mut x145, &mut x146, x2, (arg2[6])); + let mut x147: u32 = 0; + let mut x148: u32 = 0; + fiat_p224_mulx_u32(&mut x147, &mut x148, x2, (arg2[5])); + let mut x149: u32 = 0; + let mut x150: u32 = 0; + fiat_p224_mulx_u32(&mut x149, &mut x150, x2, (arg2[4])); + let mut x151: u32 = 0; + let mut x152: u32 = 0; + fiat_p224_mulx_u32(&mut x151, &mut x152, x2, (arg2[3])); + let mut x153: u32 = 0; + let mut x154: u32 = 0; + fiat_p224_mulx_u32(&mut x153, &mut x154, x2, (arg2[2])); + let mut x155: u32 = 0; + let mut x156: u32 = 0; + fiat_p224_mulx_u32(&mut x155, &mut x156, x2, (arg2[1])); + let mut x157: u32 = 0; + let mut x158: u32 = 0; + fiat_p224_mulx_u32(&mut x157, &mut x158, x2, (arg2[0])); + let mut x159: u32 = 0; + let mut x160: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x159, &mut x160, 0x0, x158, x155); + let mut x161: u32 = 0; + let mut x162: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x161, &mut x162, x160, x156, x153); + let mut x163: u32 = 0; + let mut x164: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x163, &mut x164, x162, x154, x151); + let mut x165: u32 = 0; + let mut x166: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x165, &mut x166, x164, x152, x149); + let mut x167: u32 = 0; + let mut x168: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x167, &mut x168, x166, x150, x147); + let mut x169: u32 = 0; + let mut x170: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x169, &mut x170, x168, x148, x145); + let x171: u32 = ((x170 as u32) + x146); + let mut x172: u32 = 0; + let mut x173: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x172, &mut x173, 0x0, x130, x157); + let mut x174: u32 = 0; + let mut x175: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x174, &mut x175, x173, x132, x159); + let mut x176: u32 = 0; + let mut x177: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x176, &mut x177, x175, x134, x161); + let mut x178: u32 = 0; + let mut x179: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x178, &mut x179, x177, x136, x163); + let mut x180: u32 = 0; + let mut x181: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x180, &mut x181, x179, x138, x165); + let mut x182: u32 = 0; + let mut x183: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x182, &mut x183, x181, x140, x167); + let mut x184: u32 = 0; + let mut x185: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x184, &mut x185, x183, x142, x169); + let mut x186: u32 = 0; + let mut x187: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x186, &mut x187, x185, x144, x171); + let mut x188: u32 = 0; + let mut x189: u32 = 0; + fiat_p224_mulx_u32(&mut x188, &mut x189, x172, 0xffffffff); + let mut x190: u32 = 0; + let mut x191: u32 = 0; + fiat_p224_mulx_u32(&mut x190, &mut x191, x188, 0xffffffff); + let mut x192: u32 = 0; + let mut x193: u32 = 0; + fiat_p224_mulx_u32(&mut x192, &mut x193, x188, 0xffffffff); + let mut x194: u32 = 0; + let mut x195: u32 = 0; + fiat_p224_mulx_u32(&mut x194, &mut x195, x188, 0xffffffff); + let mut x196: u32 = 0; + let mut x197: u32 = 0; + fiat_p224_mulx_u32(&mut x196, &mut x197, x188, 0xffffffff); + let mut x198: u32 = 0; + let mut x199: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x198, &mut x199, 0x0, x197, x194); + let mut x200: u32 = 0; + let mut x201: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x200, &mut x201, x199, x195, x192); + let mut x202: u32 = 0; + let mut x203: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x202, &mut x203, x201, x193, x190); + let x204: u32 = ((x203 as u32) + x191); + let mut x205: u32 = 0; + let mut x206: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x205, &mut x206, 0x0, x172, x188); + let mut x207: u32 = 0; + let mut x208: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x207, &mut x208, x206, x174, (0x0 as u32)); + let mut x209: u32 = 0; + let mut x210: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x209, &mut x210, x208, x176, (0x0 as u32)); + let mut x211: u32 = 0; + let mut x212: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x211, &mut x212, x210, x178, x196); + let mut x213: u32 = 0; + let mut x214: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x213, &mut x214, x212, x180, x198); + let mut x215: u32 = 0; + let mut x216: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x215, &mut x216, x214, x182, x200); + let mut x217: u32 = 0; + let mut x218: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x217, &mut x218, x216, x184, x202); + let mut x219: u32 = 0; + let mut x220: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x219, &mut x220, x218, x186, x204); + let x221: u32 = ((x220 as u32) + (x187 as u32)); + let mut x222: u32 = 0; + let mut x223: u32 = 0; + fiat_p224_mulx_u32(&mut x222, &mut x223, x3, (arg2[6])); + let mut x224: u32 = 0; + let mut x225: u32 = 0; + fiat_p224_mulx_u32(&mut x224, &mut x225, x3, (arg2[5])); + let mut x226: u32 = 0; + let mut x227: u32 = 0; + fiat_p224_mulx_u32(&mut x226, &mut x227, x3, (arg2[4])); + let mut x228: u32 = 0; + let mut x229: u32 = 0; + fiat_p224_mulx_u32(&mut x228, &mut x229, x3, (arg2[3])); + let mut x230: u32 = 0; + let mut x231: u32 = 0; + fiat_p224_mulx_u32(&mut x230, &mut x231, x3, (arg2[2])); + let mut x232: u32 = 0; + let mut x233: u32 = 0; + fiat_p224_mulx_u32(&mut x232, &mut x233, x3, (arg2[1])); + let mut x234: u32 = 0; + let mut x235: u32 = 0; + fiat_p224_mulx_u32(&mut x234, &mut x235, x3, (arg2[0])); + let mut x236: u32 = 0; + let mut x237: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x236, &mut x237, 0x0, x235, x232); + let mut x238: u32 = 0; + let mut x239: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x238, &mut x239, x237, x233, x230); + let mut x240: u32 = 0; + let mut x241: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x240, &mut x241, x239, x231, x228); + let mut x242: u32 = 0; + let mut x243: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x242, &mut x243, x241, x229, x226); + let mut x244: u32 = 0; + let mut x245: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x244, &mut x245, x243, x227, x224); + let mut x246: u32 = 0; + let mut x247: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x246, &mut x247, x245, x225, x222); + let x248: u32 = ((x247 as u32) + x223); + let mut x249: u32 = 0; + let mut x250: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x249, &mut x250, 0x0, x207, x234); + let mut x251: u32 = 0; + let mut x252: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x251, &mut x252, x250, x209, x236); + let mut x253: u32 = 0; + let mut x254: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x253, &mut x254, x252, x211, x238); + let mut x255: u32 = 0; + let mut x256: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x255, &mut x256, x254, x213, x240); + let mut x257: u32 = 0; + let mut x258: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x257, &mut x258, x256, x215, x242); + let mut x259: u32 = 0; + let mut x260: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x259, &mut x260, x258, x217, x244); + let mut x261: u32 = 0; + let mut x262: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x261, &mut x262, x260, x219, x246); + let mut x263: u32 = 0; + let mut x264: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x263, &mut x264, x262, x221, x248); + let mut x265: u32 = 0; + let mut x266: u32 = 0; + fiat_p224_mulx_u32(&mut x265, &mut x266, x249, 0xffffffff); + let mut x267: u32 = 0; + let mut x268: u32 = 0; + fiat_p224_mulx_u32(&mut x267, &mut x268, x265, 0xffffffff); + let mut x269: u32 = 0; + let mut x270: u32 = 0; + fiat_p224_mulx_u32(&mut x269, &mut x270, x265, 0xffffffff); + let mut x271: u32 = 0; + let mut x272: u32 = 0; + fiat_p224_mulx_u32(&mut x271, &mut x272, x265, 0xffffffff); + let mut x273: u32 = 0; + let mut x274: u32 = 0; + fiat_p224_mulx_u32(&mut x273, &mut x274, x265, 0xffffffff); + let mut x275: u32 = 0; + let mut x276: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x275, &mut x276, 0x0, x274, x271); + let mut x277: u32 = 0; + let mut x278: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x277, &mut x278, x276, x272, x269); + let mut x279: u32 = 0; + let mut x280: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x279, &mut x280, x278, x270, x267); + let x281: u32 = ((x280 as u32) + x268); + let mut x282: u32 = 0; + let mut x283: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x282, &mut x283, 0x0, x249, x265); + let mut x284: u32 = 0; + let mut x285: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x284, &mut x285, x283, x251, (0x0 as u32)); + let mut x286: u32 = 0; + let mut x287: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x286, &mut x287, x285, x253, (0x0 as u32)); + let mut x288: u32 = 0; + let mut x289: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x288, &mut x289, x287, x255, x273); + let mut x290: u32 = 0; + let mut x291: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x290, &mut x291, x289, x257, x275); + let mut x292: u32 = 0; + let mut x293: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x292, &mut x293, x291, x259, x277); + let mut x294: u32 = 0; + let mut x295: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x294, &mut x295, x293, x261, x279); + let mut x296: u32 = 0; + let mut x297: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x296, &mut x297, x295, x263, x281); + let x298: u32 = ((x297 as u32) + (x264 as u32)); + let mut x299: u32 = 0; + let mut x300: u32 = 0; + fiat_p224_mulx_u32(&mut x299, &mut x300, x4, (arg2[6])); + let mut x301: u32 = 0; + let mut x302: u32 = 0; + fiat_p224_mulx_u32(&mut x301, &mut x302, x4, (arg2[5])); + let mut x303: u32 = 0; + let mut x304: u32 = 0; + fiat_p224_mulx_u32(&mut x303, &mut x304, x4, (arg2[4])); + let mut x305: u32 = 0; + let mut x306: u32 = 0; + fiat_p224_mulx_u32(&mut x305, &mut x306, x4, (arg2[3])); + let mut x307: u32 = 0; + let mut x308: u32 = 0; + fiat_p224_mulx_u32(&mut x307, &mut x308, x4, (arg2[2])); + let mut x309: u32 = 0; + let mut x310: u32 = 0; + fiat_p224_mulx_u32(&mut x309, &mut x310, x4, (arg2[1])); + let mut x311: u32 = 0; + let mut x312: u32 = 0; + fiat_p224_mulx_u32(&mut x311, &mut x312, x4, (arg2[0])); + let mut x313: u32 = 0; + let mut x314: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x313, &mut x314, 0x0, x312, x309); + let mut x315: u32 = 0; + let mut x316: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x315, &mut x316, x314, x310, x307); + let mut x317: u32 = 0; + let mut x318: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x317, &mut x318, x316, x308, x305); + let mut x319: u32 = 0; + let mut x320: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x319, &mut x320, x318, x306, x303); + let mut x321: u32 = 0; + let mut x322: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x321, &mut x322, x320, x304, x301); + let mut x323: u32 = 0; + let mut x324: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x323, &mut x324, x322, x302, x299); + let x325: u32 = ((x324 as u32) + x300); + let mut x326: u32 = 0; + let mut x327: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x326, &mut x327, 0x0, x284, x311); + let mut x328: u32 = 0; + let mut x329: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x328, &mut x329, x327, x286, x313); + let mut x330: u32 = 0; + let mut x331: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x330, &mut x331, x329, x288, x315); + let mut x332: u32 = 0; + let mut x333: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x332, &mut x333, x331, x290, x317); + let mut x334: u32 = 0; + let mut x335: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x334, &mut x335, x333, x292, x319); + let mut x336: u32 = 0; + let mut x337: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x336, &mut x337, x335, x294, x321); + let mut x338: u32 = 0; + let mut x339: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x338, &mut x339, x337, x296, x323); + let mut x340: u32 = 0; + let mut x341: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x340, &mut x341, x339, x298, x325); + let mut x342: u32 = 0; + let mut x343: u32 = 0; + fiat_p224_mulx_u32(&mut x342, &mut x343, x326, 0xffffffff); + let mut x344: u32 = 0; + let mut x345: u32 = 0; + fiat_p224_mulx_u32(&mut x344, &mut x345, x342, 0xffffffff); + let mut x346: u32 = 0; + let mut x347: u32 = 0; + fiat_p224_mulx_u32(&mut x346, &mut x347, x342, 0xffffffff); + let mut x348: u32 = 0; + let mut x349: u32 = 0; + fiat_p224_mulx_u32(&mut x348, &mut x349, x342, 0xffffffff); + let mut x350: u32 = 0; + let mut x351: u32 = 0; + fiat_p224_mulx_u32(&mut x350, &mut x351, x342, 0xffffffff); + let mut x352: u32 = 0; + let mut x353: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x352, &mut x353, 0x0, x351, x348); + let mut x354: u32 = 0; + let mut x355: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x354, &mut x355, x353, x349, x346); + let mut x356: u32 = 0; + let mut x357: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x356, &mut x357, x355, x347, x344); + let x358: u32 = ((x357 as u32) + x345); + let mut x359: u32 = 0; + let mut x360: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x359, &mut x360, 0x0, x326, x342); + let mut x361: u32 = 0; + let mut x362: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x361, &mut x362, x360, x328, (0x0 as u32)); + let mut x363: u32 = 0; + let mut x364: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x363, &mut x364, x362, x330, (0x0 as u32)); + let mut x365: u32 = 0; + let mut x366: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x365, &mut x366, x364, x332, x350); + let mut x367: u32 = 0; + let mut x368: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x367, &mut x368, x366, x334, x352); + let mut x369: u32 = 0; + let mut x370: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x369, &mut x370, x368, x336, x354); + let mut x371: u32 = 0; + let mut x372: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x371, &mut x372, x370, x338, x356); + let mut x373: u32 = 0; + let mut x374: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x373, &mut x374, x372, x340, x358); + let x375: u32 = ((x374 as u32) + (x341 as u32)); + let mut x376: u32 = 0; + let mut x377: u32 = 0; + fiat_p224_mulx_u32(&mut x376, &mut x377, x5, (arg2[6])); + let mut x378: u32 = 0; + let mut x379: u32 = 0; + fiat_p224_mulx_u32(&mut x378, &mut x379, x5, (arg2[5])); + let mut x380: u32 = 0; + let mut x381: u32 = 0; + fiat_p224_mulx_u32(&mut x380, &mut x381, x5, (arg2[4])); + let mut x382: u32 = 0; + let mut x383: u32 = 0; + fiat_p224_mulx_u32(&mut x382, &mut x383, x5, (arg2[3])); + let mut x384: u32 = 0; + let mut x385: u32 = 0; + fiat_p224_mulx_u32(&mut x384, &mut x385, x5, (arg2[2])); + let mut x386: u32 = 0; + let mut x387: u32 = 0; + fiat_p224_mulx_u32(&mut x386, &mut x387, x5, (arg2[1])); + let mut x388: u32 = 0; + let mut x389: u32 = 0; + fiat_p224_mulx_u32(&mut x388, &mut x389, x5, (arg2[0])); + let mut x390: u32 = 0; + let mut x391: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x390, &mut x391, 0x0, x389, x386); + let mut x392: u32 = 0; + let mut x393: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x392, &mut x393, x391, x387, x384); + let mut x394: u32 = 0; + let mut x395: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x394, &mut x395, x393, x385, x382); + let mut x396: u32 = 0; + let mut x397: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x396, &mut x397, x395, x383, x380); + let mut x398: u32 = 0; + let mut x399: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x398, &mut x399, x397, x381, x378); + let mut x400: u32 = 0; + let mut x401: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x400, &mut x401, x399, x379, x376); + let x402: u32 = ((x401 as u32) + x377); + let mut x403: u32 = 0; + let mut x404: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x403, &mut x404, 0x0, x361, x388); + let mut x405: u32 = 0; + let mut x406: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x405, &mut x406, x404, x363, x390); + let mut x407: u32 = 0; + let mut x408: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x407, &mut x408, x406, x365, x392); + let mut x409: u32 = 0; + let mut x410: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x409, &mut x410, x408, x367, x394); + let mut x411: u32 = 0; + let mut x412: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x411, &mut x412, x410, x369, x396); + let mut x413: u32 = 0; + let mut x414: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x413, &mut x414, x412, x371, x398); + let mut x415: u32 = 0; + let mut x416: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x415, &mut x416, x414, x373, x400); + let mut x417: u32 = 0; + let mut x418: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x417, &mut x418, x416, x375, x402); + let mut x419: u32 = 0; + let mut x420: u32 = 0; + fiat_p224_mulx_u32(&mut x419, &mut x420, x403, 0xffffffff); + let mut x421: u32 = 0; + let mut x422: u32 = 0; + fiat_p224_mulx_u32(&mut x421, &mut x422, x419, 0xffffffff); + let mut x423: u32 = 0; + let mut x424: u32 = 0; + fiat_p224_mulx_u32(&mut x423, &mut x424, x419, 0xffffffff); + let mut x425: u32 = 0; + let mut x426: u32 = 0; + fiat_p224_mulx_u32(&mut x425, &mut x426, x419, 0xffffffff); + let mut x427: u32 = 0; + let mut x428: u32 = 0; + fiat_p224_mulx_u32(&mut x427, &mut x428, x419, 0xffffffff); + let mut x429: u32 = 0; + let mut x430: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x429, &mut x430, 0x0, x428, x425); + let mut x431: u32 = 0; + let mut x432: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x431, &mut x432, x430, x426, x423); + let mut x433: u32 = 0; + let mut x434: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x433, &mut x434, x432, x424, x421); + let x435: u32 = ((x434 as u32) + x422); + let mut x436: u32 = 0; + let mut x437: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x436, &mut x437, 0x0, x403, x419); + let mut x438: u32 = 0; + let mut x439: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x438, &mut x439, x437, x405, (0x0 as u32)); + let mut x440: u32 = 0; + let mut x441: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x440, &mut x441, x439, x407, (0x0 as u32)); + let mut x442: u32 = 0; + let mut x443: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x442, &mut x443, x441, x409, x427); + let mut x444: u32 = 0; + let mut x445: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x444, &mut x445, x443, x411, x429); + let mut x446: u32 = 0; + let mut x447: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x446, &mut x447, x445, x413, x431); + let mut x448: u32 = 0; + let mut x449: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x448, &mut x449, x447, x415, x433); + let mut x450: u32 = 0; + let mut x451: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x450, &mut x451, x449, x417, x435); + let x452: u32 = ((x451 as u32) + (x418 as u32)); + let mut x453: u32 = 0; + let mut x454: u32 = 0; + fiat_p224_mulx_u32(&mut x453, &mut x454, x6, (arg2[6])); + let mut x455: u32 = 0; + let mut x456: u32 = 0; + fiat_p224_mulx_u32(&mut x455, &mut x456, x6, (arg2[5])); + let mut x457: u32 = 0; + let mut x458: u32 = 0; + fiat_p224_mulx_u32(&mut x457, &mut x458, x6, (arg2[4])); + let mut x459: u32 = 0; + let mut x460: u32 = 0; + fiat_p224_mulx_u32(&mut x459, &mut x460, x6, (arg2[3])); + let mut x461: u32 = 0; + let mut x462: u32 = 0; + fiat_p224_mulx_u32(&mut x461, &mut x462, x6, (arg2[2])); + let mut x463: u32 = 0; + let mut x464: u32 = 0; + fiat_p224_mulx_u32(&mut x463, &mut x464, x6, (arg2[1])); + let mut x465: u32 = 0; + let mut x466: u32 = 0; + fiat_p224_mulx_u32(&mut x465, &mut x466, x6, (arg2[0])); + let mut x467: u32 = 0; + let mut x468: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x467, &mut x468, 0x0, x466, x463); + let mut x469: u32 = 0; + let mut x470: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x469, &mut x470, x468, x464, x461); + let mut x471: u32 = 0; + let mut x472: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x471, &mut x472, x470, x462, x459); + let mut x473: u32 = 0; + let mut x474: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x473, &mut x474, x472, x460, x457); + let mut x475: u32 = 0; + let mut x476: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x475, &mut x476, x474, x458, x455); + let mut x477: u32 = 0; + let mut x478: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x477, &mut x478, x476, x456, x453); + let x479: u32 = ((x478 as u32) + x454); + let mut x480: u32 = 0; + let mut x481: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x480, &mut x481, 0x0, x438, x465); + let mut x482: u32 = 0; + let mut x483: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x482, &mut x483, x481, x440, x467); + let mut x484: u32 = 0; + let mut x485: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x484, &mut x485, x483, x442, x469); + let mut x486: u32 = 0; + let mut x487: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x486, &mut x487, x485, x444, x471); + let mut x488: u32 = 0; + let mut x489: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x488, &mut x489, x487, x446, x473); + let mut x490: u32 = 0; + let mut x491: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x490, &mut x491, x489, x448, x475); + let mut x492: u32 = 0; + let mut x493: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x492, &mut x493, x491, x450, x477); + let mut x494: u32 = 0; + let mut x495: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x494, &mut x495, x493, x452, x479); + let mut x496: u32 = 0; + let mut x497: u32 = 0; + fiat_p224_mulx_u32(&mut x496, &mut x497, x480, 0xffffffff); + let mut x498: u32 = 0; + let mut x499: u32 = 0; + fiat_p224_mulx_u32(&mut x498, &mut x499, x496, 0xffffffff); + let mut x500: u32 = 0; + let mut x501: u32 = 0; + fiat_p224_mulx_u32(&mut x500, &mut x501, x496, 0xffffffff); + let mut x502: u32 = 0; + let mut x503: u32 = 0; + fiat_p224_mulx_u32(&mut x502, &mut x503, x496, 0xffffffff); + let mut x504: u32 = 0; + let mut x505: u32 = 0; + fiat_p224_mulx_u32(&mut x504, &mut x505, x496, 0xffffffff); + let mut x506: u32 = 0; + let mut x507: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x506, &mut x507, 0x0, x505, x502); + let mut x508: u32 = 0; + let mut x509: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x508, &mut x509, x507, x503, x500); + let mut x510: u32 = 0; + let mut x511: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x510, &mut x511, x509, x501, x498); + let x512: u32 = ((x511 as u32) + x499); + let mut x513: u32 = 0; + let mut x514: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x513, &mut x514, 0x0, x480, x496); + let mut x515: u32 = 0; + let mut x516: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x515, &mut x516, x514, x482, (0x0 as u32)); + let mut x517: u32 = 0; + let mut x518: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x517, &mut x518, x516, x484, (0x0 as u32)); + let mut x519: u32 = 0; + let mut x520: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x519, &mut x520, x518, x486, x504); + let mut x521: u32 = 0; + let mut x522: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x521, &mut x522, x520, x488, x506); + let mut x523: u32 = 0; + let mut x524: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x523, &mut x524, x522, x490, x508); + let mut x525: u32 = 0; + let mut x526: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x525, &mut x526, x524, x492, x510); + let mut x527: u32 = 0; + let mut x528: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x527, &mut x528, x526, x494, x512); + let x529: u32 = ((x528 as u32) + (x495 as u32)); + let mut x530: u32 = 0; + let mut x531: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x530, &mut x531, 0x0, x515, (0x1 as u32)); + let mut x532: u32 = 0; + let mut x533: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x532, &mut x533, x531, x517, (0x0 as u32)); + let mut x534: u32 = 0; + let mut x535: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x534, &mut x535, x533, x519, (0x0 as u32)); + let mut x536: u32 = 0; + let mut x537: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x536, &mut x537, x535, x521, 0xffffffff); + let mut x538: u32 = 0; + let mut x539: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x538, &mut x539, x537, x523, 0xffffffff); + let mut x540: u32 = 0; + let mut x541: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x540, &mut x541, x539, x525, 0xffffffff); + let mut x542: u32 = 0; + let mut x543: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x542, &mut x543, x541, x527, 0xffffffff); + let mut x544: u32 = 0; + let mut x545: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x544, &mut x545, x543, x529, (0x0 as u32)); + let mut x546: u32 = 0; + fiat_p224_cmovznz_u32(&mut x546, x545, x530, x515); + let mut x547: u32 = 0; + fiat_p224_cmovznz_u32(&mut x547, x545, x532, x517); + let mut x548: u32 = 0; + fiat_p224_cmovznz_u32(&mut x548, x545, x534, x519); + let mut x549: u32 = 0; + fiat_p224_cmovznz_u32(&mut x549, x545, x536, x521); + let mut x550: u32 = 0; + fiat_p224_cmovznz_u32(&mut x550, x545, x538, x523); + let mut x551: u32 = 0; + fiat_p224_cmovznz_u32(&mut x551, x545, x540, x525); + let mut x552: u32 = 0; + fiat_p224_cmovznz_u32(&mut x552, x545, x542, x527); + out1[0] = x546; + out1[1] = x547; + out1[2] = x548; + out1[3] = x549; + out1[4] = x550; + out1[5] = x551; + out1[6] = x552; +} + +/// The function fiat_p224_square squares a field element in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg1)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p224_square(out1: &mut fiat_p224_montgomery_domain_field_element, arg1: &fiat_p224_montgomery_domain_field_element) -> () { + let x1: u32 = (arg1[1]); + let x2: u32 = (arg1[2]); + let x3: u32 = (arg1[3]); + let x4: u32 = (arg1[4]); + let x5: u32 = (arg1[5]); + let x6: u32 = (arg1[6]); + let x7: u32 = (arg1[0]); + let mut x8: u32 = 0; + let mut x9: u32 = 0; + fiat_p224_mulx_u32(&mut x8, &mut x9, x7, (arg1[6])); + let mut x10: u32 = 0; + let mut x11: u32 = 0; + fiat_p224_mulx_u32(&mut x10, &mut x11, x7, (arg1[5])); + let mut x12: u32 = 0; + let mut x13: u32 = 0; + fiat_p224_mulx_u32(&mut x12, &mut x13, x7, (arg1[4])); + let mut x14: u32 = 0; + let mut x15: u32 = 0; + fiat_p224_mulx_u32(&mut x14, &mut x15, x7, (arg1[3])); + let mut x16: u32 = 0; + let mut x17: u32 = 0; + fiat_p224_mulx_u32(&mut x16, &mut x17, x7, (arg1[2])); + let mut x18: u32 = 0; + let mut x19: u32 = 0; + fiat_p224_mulx_u32(&mut x18, &mut x19, x7, (arg1[1])); + let mut x20: u32 = 0; + let mut x21: u32 = 0; + fiat_p224_mulx_u32(&mut x20, &mut x21, x7, (arg1[0])); + let mut x22: u32 = 0; + let mut x23: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x22, &mut x23, 0x0, x21, x18); + let mut x24: u32 = 0; + let mut x25: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x24, &mut x25, x23, x19, x16); + let mut x26: u32 = 0; + let mut x27: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x26, &mut x27, x25, x17, x14); + let mut x28: u32 = 0; + let mut x29: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x28, &mut x29, x27, x15, x12); + let mut x30: u32 = 0; + let mut x31: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x30, &mut x31, x29, x13, x10); + let mut x32: u32 = 0; + let mut x33: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x32, &mut x33, x31, x11, x8); + let x34: u32 = ((x33 as u32) + x9); + let mut x35: u32 = 0; + let mut x36: u32 = 0; + fiat_p224_mulx_u32(&mut x35, &mut x36, x20, 0xffffffff); + let mut x37: u32 = 0; + let mut x38: u32 = 0; + fiat_p224_mulx_u32(&mut x37, &mut x38, x35, 0xffffffff); + let mut x39: u32 = 0; + let mut x40: u32 = 0; + fiat_p224_mulx_u32(&mut x39, &mut x40, x35, 0xffffffff); + let mut x41: u32 = 0; + let mut x42: u32 = 0; + fiat_p224_mulx_u32(&mut x41, &mut x42, x35, 0xffffffff); + let mut x43: u32 = 0; + let mut x44: u32 = 0; + fiat_p224_mulx_u32(&mut x43, &mut x44, x35, 0xffffffff); + let mut x45: u32 = 0; + let mut x46: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x45, &mut x46, 0x0, x44, x41); + let mut x47: u32 = 0; + let mut x48: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x47, &mut x48, x46, x42, x39); + let mut x49: u32 = 0; + let mut x50: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x49, &mut x50, x48, x40, x37); + let x51: u32 = ((x50 as u32) + x38); + let mut x52: u32 = 0; + let mut x53: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x52, &mut x53, 0x0, x20, x35); + let mut x54: u32 = 0; + let mut x55: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x54, &mut x55, x53, x22, (0x0 as u32)); + let mut x56: u32 = 0; + let mut x57: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x56, &mut x57, x55, x24, (0x0 as u32)); + let mut x58: u32 = 0; + let mut x59: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x58, &mut x59, x57, x26, x43); + let mut x60: u32 = 0; + let mut x61: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x60, &mut x61, x59, x28, x45); + let mut x62: u32 = 0; + let mut x63: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x62, &mut x63, x61, x30, x47); + let mut x64: u32 = 0; + let mut x65: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x64, &mut x65, x63, x32, x49); + let mut x66: u32 = 0; + let mut x67: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x66, &mut x67, x65, x34, x51); + let mut x68: u32 = 0; + let mut x69: u32 = 0; + fiat_p224_mulx_u32(&mut x68, &mut x69, x1, (arg1[6])); + let mut x70: u32 = 0; + let mut x71: u32 = 0; + fiat_p224_mulx_u32(&mut x70, &mut x71, x1, (arg1[5])); + let mut x72: u32 = 0; + let mut x73: u32 = 0; + fiat_p224_mulx_u32(&mut x72, &mut x73, x1, (arg1[4])); + let mut x74: u32 = 0; + let mut x75: u32 = 0; + fiat_p224_mulx_u32(&mut x74, &mut x75, x1, (arg1[3])); + let mut x76: u32 = 0; + let mut x77: u32 = 0; + fiat_p224_mulx_u32(&mut x76, &mut x77, x1, (arg1[2])); + let mut x78: u32 = 0; + let mut x79: u32 = 0; + fiat_p224_mulx_u32(&mut x78, &mut x79, x1, (arg1[1])); + let mut x80: u32 = 0; + let mut x81: u32 = 0; + fiat_p224_mulx_u32(&mut x80, &mut x81, x1, (arg1[0])); + let mut x82: u32 = 0; + let mut x83: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x82, &mut x83, 0x0, x81, x78); + let mut x84: u32 = 0; + let mut x85: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x84, &mut x85, x83, x79, x76); + let mut x86: u32 = 0; + let mut x87: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x86, &mut x87, x85, x77, x74); + let mut x88: u32 = 0; + let mut x89: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x88, &mut x89, x87, x75, x72); + let mut x90: u32 = 0; + let mut x91: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x90, &mut x91, x89, x73, x70); + let mut x92: u32 = 0; + let mut x93: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x92, &mut x93, x91, x71, x68); + let x94: u32 = ((x93 as u32) + x69); + let mut x95: u32 = 0; + let mut x96: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x95, &mut x96, 0x0, x54, x80); + let mut x97: u32 = 0; + let mut x98: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x97, &mut x98, x96, x56, x82); + let mut x99: u32 = 0; + let mut x100: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x99, &mut x100, x98, x58, x84); + let mut x101: u32 = 0; + let mut x102: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x101, &mut x102, x100, x60, x86); + let mut x103: u32 = 0; + let mut x104: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x103, &mut x104, x102, x62, x88); + let mut x105: u32 = 0; + let mut x106: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x105, &mut x106, x104, x64, x90); + let mut x107: u32 = 0; + let mut x108: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x107, &mut x108, x106, x66, x92); + let mut x109: u32 = 0; + let mut x110: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x109, &mut x110, x108, (x67 as u32), x94); + let mut x111: u32 = 0; + let mut x112: u32 = 0; + fiat_p224_mulx_u32(&mut x111, &mut x112, x95, 0xffffffff); + let mut x113: u32 = 0; + let mut x114: u32 = 0; + fiat_p224_mulx_u32(&mut x113, &mut x114, x111, 0xffffffff); + let mut x115: u32 = 0; + let mut x116: u32 = 0; + fiat_p224_mulx_u32(&mut x115, &mut x116, x111, 0xffffffff); + let mut x117: u32 = 0; + let mut x118: u32 = 0; + fiat_p224_mulx_u32(&mut x117, &mut x118, x111, 0xffffffff); + let mut x119: u32 = 0; + let mut x120: u32 = 0; + fiat_p224_mulx_u32(&mut x119, &mut x120, x111, 0xffffffff); + let mut x121: u32 = 0; + let mut x122: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x121, &mut x122, 0x0, x120, x117); + let mut x123: u32 = 0; + let mut x124: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x123, &mut x124, x122, x118, x115); + let mut x125: u32 = 0; + let mut x126: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x125, &mut x126, x124, x116, x113); + let x127: u32 = ((x126 as u32) + x114); + let mut x128: u32 = 0; + let mut x129: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x128, &mut x129, 0x0, x95, x111); + let mut x130: u32 = 0; + let mut x131: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x130, &mut x131, x129, x97, (0x0 as u32)); + let mut x132: u32 = 0; + let mut x133: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x132, &mut x133, x131, x99, (0x0 as u32)); + let mut x134: u32 = 0; + let mut x135: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x134, &mut x135, x133, x101, x119); + let mut x136: u32 = 0; + let mut x137: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x136, &mut x137, x135, x103, x121); + let mut x138: u32 = 0; + let mut x139: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x138, &mut x139, x137, x105, x123); + let mut x140: u32 = 0; + let mut x141: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x140, &mut x141, x139, x107, x125); + let mut x142: u32 = 0; + let mut x143: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x142, &mut x143, x141, x109, x127); + let x144: u32 = ((x143 as u32) + (x110 as u32)); + let mut x145: u32 = 0; + let mut x146: u32 = 0; + fiat_p224_mulx_u32(&mut x145, &mut x146, x2, (arg1[6])); + let mut x147: u32 = 0; + let mut x148: u32 = 0; + fiat_p224_mulx_u32(&mut x147, &mut x148, x2, (arg1[5])); + let mut x149: u32 = 0; + let mut x150: u32 = 0; + fiat_p224_mulx_u32(&mut x149, &mut x150, x2, (arg1[4])); + let mut x151: u32 = 0; + let mut x152: u32 = 0; + fiat_p224_mulx_u32(&mut x151, &mut x152, x2, (arg1[3])); + let mut x153: u32 = 0; + let mut x154: u32 = 0; + fiat_p224_mulx_u32(&mut x153, &mut x154, x2, (arg1[2])); + let mut x155: u32 = 0; + let mut x156: u32 = 0; + fiat_p224_mulx_u32(&mut x155, &mut x156, x2, (arg1[1])); + let mut x157: u32 = 0; + let mut x158: u32 = 0; + fiat_p224_mulx_u32(&mut x157, &mut x158, x2, (arg1[0])); + let mut x159: u32 = 0; + let mut x160: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x159, &mut x160, 0x0, x158, x155); + let mut x161: u32 = 0; + let mut x162: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x161, &mut x162, x160, x156, x153); + let mut x163: u32 = 0; + let mut x164: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x163, &mut x164, x162, x154, x151); + let mut x165: u32 = 0; + let mut x166: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x165, &mut x166, x164, x152, x149); + let mut x167: u32 = 0; + let mut x168: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x167, &mut x168, x166, x150, x147); + let mut x169: u32 = 0; + let mut x170: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x169, &mut x170, x168, x148, x145); + let x171: u32 = ((x170 as u32) + x146); + let mut x172: u32 = 0; + let mut x173: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x172, &mut x173, 0x0, x130, x157); + let mut x174: u32 = 0; + let mut x175: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x174, &mut x175, x173, x132, x159); + let mut x176: u32 = 0; + let mut x177: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x176, &mut x177, x175, x134, x161); + let mut x178: u32 = 0; + let mut x179: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x178, &mut x179, x177, x136, x163); + let mut x180: u32 = 0; + let mut x181: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x180, &mut x181, x179, x138, x165); + let mut x182: u32 = 0; + let mut x183: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x182, &mut x183, x181, x140, x167); + let mut x184: u32 = 0; + let mut x185: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x184, &mut x185, x183, x142, x169); + let mut x186: u32 = 0; + let mut x187: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x186, &mut x187, x185, x144, x171); + let mut x188: u32 = 0; + let mut x189: u32 = 0; + fiat_p224_mulx_u32(&mut x188, &mut x189, x172, 0xffffffff); + let mut x190: u32 = 0; + let mut x191: u32 = 0; + fiat_p224_mulx_u32(&mut x190, &mut x191, x188, 0xffffffff); + let mut x192: u32 = 0; + let mut x193: u32 = 0; + fiat_p224_mulx_u32(&mut x192, &mut x193, x188, 0xffffffff); + let mut x194: u32 = 0; + let mut x195: u32 = 0; + fiat_p224_mulx_u32(&mut x194, &mut x195, x188, 0xffffffff); + let mut x196: u32 = 0; + let mut x197: u32 = 0; + fiat_p224_mulx_u32(&mut x196, &mut x197, x188, 0xffffffff); + let mut x198: u32 = 0; + let mut x199: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x198, &mut x199, 0x0, x197, x194); + let mut x200: u32 = 0; + let mut x201: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x200, &mut x201, x199, x195, x192); + let mut x202: u32 = 0; + let mut x203: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x202, &mut x203, x201, x193, x190); + let x204: u32 = ((x203 as u32) + x191); + let mut x205: u32 = 0; + let mut x206: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x205, &mut x206, 0x0, x172, x188); + let mut x207: u32 = 0; + let mut x208: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x207, &mut x208, x206, x174, (0x0 as u32)); + let mut x209: u32 = 0; + let mut x210: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x209, &mut x210, x208, x176, (0x0 as u32)); + let mut x211: u32 = 0; + let mut x212: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x211, &mut x212, x210, x178, x196); + let mut x213: u32 = 0; + let mut x214: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x213, &mut x214, x212, x180, x198); + let mut x215: u32 = 0; + let mut x216: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x215, &mut x216, x214, x182, x200); + let mut x217: u32 = 0; + let mut x218: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x217, &mut x218, x216, x184, x202); + let mut x219: u32 = 0; + let mut x220: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x219, &mut x220, x218, x186, x204); + let x221: u32 = ((x220 as u32) + (x187 as u32)); + let mut x222: u32 = 0; + let mut x223: u32 = 0; + fiat_p224_mulx_u32(&mut x222, &mut x223, x3, (arg1[6])); + let mut x224: u32 = 0; + let mut x225: u32 = 0; + fiat_p224_mulx_u32(&mut x224, &mut x225, x3, (arg1[5])); + let mut x226: u32 = 0; + let mut x227: u32 = 0; + fiat_p224_mulx_u32(&mut x226, &mut x227, x3, (arg1[4])); + let mut x228: u32 = 0; + let mut x229: u32 = 0; + fiat_p224_mulx_u32(&mut x228, &mut x229, x3, (arg1[3])); + let mut x230: u32 = 0; + let mut x231: u32 = 0; + fiat_p224_mulx_u32(&mut x230, &mut x231, x3, (arg1[2])); + let mut x232: u32 = 0; + let mut x233: u32 = 0; + fiat_p224_mulx_u32(&mut x232, &mut x233, x3, (arg1[1])); + let mut x234: u32 = 0; + let mut x235: u32 = 0; + fiat_p224_mulx_u32(&mut x234, &mut x235, x3, (arg1[0])); + let mut x236: u32 = 0; + let mut x237: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x236, &mut x237, 0x0, x235, x232); + let mut x238: u32 = 0; + let mut x239: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x238, &mut x239, x237, x233, x230); + let mut x240: u32 = 0; + let mut x241: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x240, &mut x241, x239, x231, x228); + let mut x242: u32 = 0; + let mut x243: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x242, &mut x243, x241, x229, x226); + let mut x244: u32 = 0; + let mut x245: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x244, &mut x245, x243, x227, x224); + let mut x246: u32 = 0; + let mut x247: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x246, &mut x247, x245, x225, x222); + let x248: u32 = ((x247 as u32) + x223); + let mut x249: u32 = 0; + let mut x250: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x249, &mut x250, 0x0, x207, x234); + let mut x251: u32 = 0; + let mut x252: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x251, &mut x252, x250, x209, x236); + let mut x253: u32 = 0; + let mut x254: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x253, &mut x254, x252, x211, x238); + let mut x255: u32 = 0; + let mut x256: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x255, &mut x256, x254, x213, x240); + let mut x257: u32 = 0; + let mut x258: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x257, &mut x258, x256, x215, x242); + let mut x259: u32 = 0; + let mut x260: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x259, &mut x260, x258, x217, x244); + let mut x261: u32 = 0; + let mut x262: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x261, &mut x262, x260, x219, x246); + let mut x263: u32 = 0; + let mut x264: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x263, &mut x264, x262, x221, x248); + let mut x265: u32 = 0; + let mut x266: u32 = 0; + fiat_p224_mulx_u32(&mut x265, &mut x266, x249, 0xffffffff); + let mut x267: u32 = 0; + let mut x268: u32 = 0; + fiat_p224_mulx_u32(&mut x267, &mut x268, x265, 0xffffffff); + let mut x269: u32 = 0; + let mut x270: u32 = 0; + fiat_p224_mulx_u32(&mut x269, &mut x270, x265, 0xffffffff); + let mut x271: u32 = 0; + let mut x272: u32 = 0; + fiat_p224_mulx_u32(&mut x271, &mut x272, x265, 0xffffffff); + let mut x273: u32 = 0; + let mut x274: u32 = 0; + fiat_p224_mulx_u32(&mut x273, &mut x274, x265, 0xffffffff); + let mut x275: u32 = 0; + let mut x276: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x275, &mut x276, 0x0, x274, x271); + let mut x277: u32 = 0; + let mut x278: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x277, &mut x278, x276, x272, x269); + let mut x279: u32 = 0; + let mut x280: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x279, &mut x280, x278, x270, x267); + let x281: u32 = ((x280 as u32) + x268); + let mut x282: u32 = 0; + let mut x283: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x282, &mut x283, 0x0, x249, x265); + let mut x284: u32 = 0; + let mut x285: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x284, &mut x285, x283, x251, (0x0 as u32)); + let mut x286: u32 = 0; + let mut x287: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x286, &mut x287, x285, x253, (0x0 as u32)); + let mut x288: u32 = 0; + let mut x289: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x288, &mut x289, x287, x255, x273); + let mut x290: u32 = 0; + let mut x291: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x290, &mut x291, x289, x257, x275); + let mut x292: u32 = 0; + let mut x293: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x292, &mut x293, x291, x259, x277); + let mut x294: u32 = 0; + let mut x295: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x294, &mut x295, x293, x261, x279); + let mut x296: u32 = 0; + let mut x297: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x296, &mut x297, x295, x263, x281); + let x298: u32 = ((x297 as u32) + (x264 as u32)); + let mut x299: u32 = 0; + let mut x300: u32 = 0; + fiat_p224_mulx_u32(&mut x299, &mut x300, x4, (arg1[6])); + let mut x301: u32 = 0; + let mut x302: u32 = 0; + fiat_p224_mulx_u32(&mut x301, &mut x302, x4, (arg1[5])); + let mut x303: u32 = 0; + let mut x304: u32 = 0; + fiat_p224_mulx_u32(&mut x303, &mut x304, x4, (arg1[4])); + let mut x305: u32 = 0; + let mut x306: u32 = 0; + fiat_p224_mulx_u32(&mut x305, &mut x306, x4, (arg1[3])); + let mut x307: u32 = 0; + let mut x308: u32 = 0; + fiat_p224_mulx_u32(&mut x307, &mut x308, x4, (arg1[2])); + let mut x309: u32 = 0; + let mut x310: u32 = 0; + fiat_p224_mulx_u32(&mut x309, &mut x310, x4, (arg1[1])); + let mut x311: u32 = 0; + let mut x312: u32 = 0; + fiat_p224_mulx_u32(&mut x311, &mut x312, x4, (arg1[0])); + let mut x313: u32 = 0; + let mut x314: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x313, &mut x314, 0x0, x312, x309); + let mut x315: u32 = 0; + let mut x316: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x315, &mut x316, x314, x310, x307); + let mut x317: u32 = 0; + let mut x318: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x317, &mut x318, x316, x308, x305); + let mut x319: u32 = 0; + let mut x320: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x319, &mut x320, x318, x306, x303); + let mut x321: u32 = 0; + let mut x322: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x321, &mut x322, x320, x304, x301); + let mut x323: u32 = 0; + let mut x324: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x323, &mut x324, x322, x302, x299); + let x325: u32 = ((x324 as u32) + x300); + let mut x326: u32 = 0; + let mut x327: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x326, &mut x327, 0x0, x284, x311); + let mut x328: u32 = 0; + let mut x329: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x328, &mut x329, x327, x286, x313); + let mut x330: u32 = 0; + let mut x331: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x330, &mut x331, x329, x288, x315); + let mut x332: u32 = 0; + let mut x333: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x332, &mut x333, x331, x290, x317); + let mut x334: u32 = 0; + let mut x335: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x334, &mut x335, x333, x292, x319); + let mut x336: u32 = 0; + let mut x337: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x336, &mut x337, x335, x294, x321); + let mut x338: u32 = 0; + let mut x339: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x338, &mut x339, x337, x296, x323); + let mut x340: u32 = 0; + let mut x341: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x340, &mut x341, x339, x298, x325); + let mut x342: u32 = 0; + let mut x343: u32 = 0; + fiat_p224_mulx_u32(&mut x342, &mut x343, x326, 0xffffffff); + let mut x344: u32 = 0; + let mut x345: u32 = 0; + fiat_p224_mulx_u32(&mut x344, &mut x345, x342, 0xffffffff); + let mut x346: u32 = 0; + let mut x347: u32 = 0; + fiat_p224_mulx_u32(&mut x346, &mut x347, x342, 0xffffffff); + let mut x348: u32 = 0; + let mut x349: u32 = 0; + fiat_p224_mulx_u32(&mut x348, &mut x349, x342, 0xffffffff); + let mut x350: u32 = 0; + let mut x351: u32 = 0; + fiat_p224_mulx_u32(&mut x350, &mut x351, x342, 0xffffffff); + let mut x352: u32 = 0; + let mut x353: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x352, &mut x353, 0x0, x351, x348); + let mut x354: u32 = 0; + let mut x355: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x354, &mut x355, x353, x349, x346); + let mut x356: u32 = 0; + let mut x357: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x356, &mut x357, x355, x347, x344); + let x358: u32 = ((x357 as u32) + x345); + let mut x359: u32 = 0; + let mut x360: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x359, &mut x360, 0x0, x326, x342); + let mut x361: u32 = 0; + let mut x362: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x361, &mut x362, x360, x328, (0x0 as u32)); + let mut x363: u32 = 0; + let mut x364: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x363, &mut x364, x362, x330, (0x0 as u32)); + let mut x365: u32 = 0; + let mut x366: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x365, &mut x366, x364, x332, x350); + let mut x367: u32 = 0; + let mut x368: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x367, &mut x368, x366, x334, x352); + let mut x369: u32 = 0; + let mut x370: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x369, &mut x370, x368, x336, x354); + let mut x371: u32 = 0; + let mut x372: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x371, &mut x372, x370, x338, x356); + let mut x373: u32 = 0; + let mut x374: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x373, &mut x374, x372, x340, x358); + let x375: u32 = ((x374 as u32) + (x341 as u32)); + let mut x376: u32 = 0; + let mut x377: u32 = 0; + fiat_p224_mulx_u32(&mut x376, &mut x377, x5, (arg1[6])); + let mut x378: u32 = 0; + let mut x379: u32 = 0; + fiat_p224_mulx_u32(&mut x378, &mut x379, x5, (arg1[5])); + let mut x380: u32 = 0; + let mut x381: u32 = 0; + fiat_p224_mulx_u32(&mut x380, &mut x381, x5, (arg1[4])); + let mut x382: u32 = 0; + let mut x383: u32 = 0; + fiat_p224_mulx_u32(&mut x382, &mut x383, x5, (arg1[3])); + let mut x384: u32 = 0; + let mut x385: u32 = 0; + fiat_p224_mulx_u32(&mut x384, &mut x385, x5, (arg1[2])); + let mut x386: u32 = 0; + let mut x387: u32 = 0; + fiat_p224_mulx_u32(&mut x386, &mut x387, x5, (arg1[1])); + let mut x388: u32 = 0; + let mut x389: u32 = 0; + fiat_p224_mulx_u32(&mut x388, &mut x389, x5, (arg1[0])); + let mut x390: u32 = 0; + let mut x391: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x390, &mut x391, 0x0, x389, x386); + let mut x392: u32 = 0; + let mut x393: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x392, &mut x393, x391, x387, x384); + let mut x394: u32 = 0; + let mut x395: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x394, &mut x395, x393, x385, x382); + let mut x396: u32 = 0; + let mut x397: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x396, &mut x397, x395, x383, x380); + let mut x398: u32 = 0; + let mut x399: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x398, &mut x399, x397, x381, x378); + let mut x400: u32 = 0; + let mut x401: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x400, &mut x401, x399, x379, x376); + let x402: u32 = ((x401 as u32) + x377); + let mut x403: u32 = 0; + let mut x404: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x403, &mut x404, 0x0, x361, x388); + let mut x405: u32 = 0; + let mut x406: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x405, &mut x406, x404, x363, x390); + let mut x407: u32 = 0; + let mut x408: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x407, &mut x408, x406, x365, x392); + let mut x409: u32 = 0; + let mut x410: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x409, &mut x410, x408, x367, x394); + let mut x411: u32 = 0; + let mut x412: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x411, &mut x412, x410, x369, x396); + let mut x413: u32 = 0; + let mut x414: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x413, &mut x414, x412, x371, x398); + let mut x415: u32 = 0; + let mut x416: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x415, &mut x416, x414, x373, x400); + let mut x417: u32 = 0; + let mut x418: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x417, &mut x418, x416, x375, x402); + let mut x419: u32 = 0; + let mut x420: u32 = 0; + fiat_p224_mulx_u32(&mut x419, &mut x420, x403, 0xffffffff); + let mut x421: u32 = 0; + let mut x422: u32 = 0; + fiat_p224_mulx_u32(&mut x421, &mut x422, x419, 0xffffffff); + let mut x423: u32 = 0; + let mut x424: u32 = 0; + fiat_p224_mulx_u32(&mut x423, &mut x424, x419, 0xffffffff); + let mut x425: u32 = 0; + let mut x426: u32 = 0; + fiat_p224_mulx_u32(&mut x425, &mut x426, x419, 0xffffffff); + let mut x427: u32 = 0; + let mut x428: u32 = 0; + fiat_p224_mulx_u32(&mut x427, &mut x428, x419, 0xffffffff); + let mut x429: u32 = 0; + let mut x430: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x429, &mut x430, 0x0, x428, x425); + let mut x431: u32 = 0; + let mut x432: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x431, &mut x432, x430, x426, x423); + let mut x433: u32 = 0; + let mut x434: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x433, &mut x434, x432, x424, x421); + let x435: u32 = ((x434 as u32) + x422); + let mut x436: u32 = 0; + let mut x437: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x436, &mut x437, 0x0, x403, x419); + let mut x438: u32 = 0; + let mut x439: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x438, &mut x439, x437, x405, (0x0 as u32)); + let mut x440: u32 = 0; + let mut x441: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x440, &mut x441, x439, x407, (0x0 as u32)); + let mut x442: u32 = 0; + let mut x443: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x442, &mut x443, x441, x409, x427); + let mut x444: u32 = 0; + let mut x445: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x444, &mut x445, x443, x411, x429); + let mut x446: u32 = 0; + let mut x447: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x446, &mut x447, x445, x413, x431); + let mut x448: u32 = 0; + let mut x449: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x448, &mut x449, x447, x415, x433); + let mut x450: u32 = 0; + let mut x451: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x450, &mut x451, x449, x417, x435); + let x452: u32 = ((x451 as u32) + (x418 as u32)); + let mut x453: u32 = 0; + let mut x454: u32 = 0; + fiat_p224_mulx_u32(&mut x453, &mut x454, x6, (arg1[6])); + let mut x455: u32 = 0; + let mut x456: u32 = 0; + fiat_p224_mulx_u32(&mut x455, &mut x456, x6, (arg1[5])); + let mut x457: u32 = 0; + let mut x458: u32 = 0; + fiat_p224_mulx_u32(&mut x457, &mut x458, x6, (arg1[4])); + let mut x459: u32 = 0; + let mut x460: u32 = 0; + fiat_p224_mulx_u32(&mut x459, &mut x460, x6, (arg1[3])); + let mut x461: u32 = 0; + let mut x462: u32 = 0; + fiat_p224_mulx_u32(&mut x461, &mut x462, x6, (arg1[2])); + let mut x463: u32 = 0; + let mut x464: u32 = 0; + fiat_p224_mulx_u32(&mut x463, &mut x464, x6, (arg1[1])); + let mut x465: u32 = 0; + let mut x466: u32 = 0; + fiat_p224_mulx_u32(&mut x465, &mut x466, x6, (arg1[0])); + let mut x467: u32 = 0; + let mut x468: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x467, &mut x468, 0x0, x466, x463); + let mut x469: u32 = 0; + let mut x470: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x469, &mut x470, x468, x464, x461); + let mut x471: u32 = 0; + let mut x472: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x471, &mut x472, x470, x462, x459); + let mut x473: u32 = 0; + let mut x474: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x473, &mut x474, x472, x460, x457); + let mut x475: u32 = 0; + let mut x476: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x475, &mut x476, x474, x458, x455); + let mut x477: u32 = 0; + let mut x478: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x477, &mut x478, x476, x456, x453); + let x479: u32 = ((x478 as u32) + x454); + let mut x480: u32 = 0; + let mut x481: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x480, &mut x481, 0x0, x438, x465); + let mut x482: u32 = 0; + let mut x483: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x482, &mut x483, x481, x440, x467); + let mut x484: u32 = 0; + let mut x485: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x484, &mut x485, x483, x442, x469); + let mut x486: u32 = 0; + let mut x487: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x486, &mut x487, x485, x444, x471); + let mut x488: u32 = 0; + let mut x489: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x488, &mut x489, x487, x446, x473); + let mut x490: u32 = 0; + let mut x491: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x490, &mut x491, x489, x448, x475); + let mut x492: u32 = 0; + let mut x493: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x492, &mut x493, x491, x450, x477); + let mut x494: u32 = 0; + let mut x495: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x494, &mut x495, x493, x452, x479); + let mut x496: u32 = 0; + let mut x497: u32 = 0; + fiat_p224_mulx_u32(&mut x496, &mut x497, x480, 0xffffffff); + let mut x498: u32 = 0; + let mut x499: u32 = 0; + fiat_p224_mulx_u32(&mut x498, &mut x499, x496, 0xffffffff); + let mut x500: u32 = 0; + let mut x501: u32 = 0; + fiat_p224_mulx_u32(&mut x500, &mut x501, x496, 0xffffffff); + let mut x502: u32 = 0; + let mut x503: u32 = 0; + fiat_p224_mulx_u32(&mut x502, &mut x503, x496, 0xffffffff); + let mut x504: u32 = 0; + let mut x505: u32 = 0; + fiat_p224_mulx_u32(&mut x504, &mut x505, x496, 0xffffffff); + let mut x506: u32 = 0; + let mut x507: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x506, &mut x507, 0x0, x505, x502); + let mut x508: u32 = 0; + let mut x509: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x508, &mut x509, x507, x503, x500); + let mut x510: u32 = 0; + let mut x511: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x510, &mut x511, x509, x501, x498); + let x512: u32 = ((x511 as u32) + x499); + let mut x513: u32 = 0; + let mut x514: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x513, &mut x514, 0x0, x480, x496); + let mut x515: u32 = 0; + let mut x516: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x515, &mut x516, x514, x482, (0x0 as u32)); + let mut x517: u32 = 0; + let mut x518: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x517, &mut x518, x516, x484, (0x0 as u32)); + let mut x519: u32 = 0; + let mut x520: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x519, &mut x520, x518, x486, x504); + let mut x521: u32 = 0; + let mut x522: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x521, &mut x522, x520, x488, x506); + let mut x523: u32 = 0; + let mut x524: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x523, &mut x524, x522, x490, x508); + let mut x525: u32 = 0; + let mut x526: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x525, &mut x526, x524, x492, x510); + let mut x527: u32 = 0; + let mut x528: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x527, &mut x528, x526, x494, x512); + let x529: u32 = ((x528 as u32) + (x495 as u32)); + let mut x530: u32 = 0; + let mut x531: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x530, &mut x531, 0x0, x515, (0x1 as u32)); + let mut x532: u32 = 0; + let mut x533: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x532, &mut x533, x531, x517, (0x0 as u32)); + let mut x534: u32 = 0; + let mut x535: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x534, &mut x535, x533, x519, (0x0 as u32)); + let mut x536: u32 = 0; + let mut x537: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x536, &mut x537, x535, x521, 0xffffffff); + let mut x538: u32 = 0; + let mut x539: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x538, &mut x539, x537, x523, 0xffffffff); + let mut x540: u32 = 0; + let mut x541: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x540, &mut x541, x539, x525, 0xffffffff); + let mut x542: u32 = 0; + let mut x543: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x542, &mut x543, x541, x527, 0xffffffff); + let mut x544: u32 = 0; + let mut x545: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x544, &mut x545, x543, x529, (0x0 as u32)); + let mut x546: u32 = 0; + fiat_p224_cmovznz_u32(&mut x546, x545, x530, x515); + let mut x547: u32 = 0; + fiat_p224_cmovznz_u32(&mut x547, x545, x532, x517); + let mut x548: u32 = 0; + fiat_p224_cmovznz_u32(&mut x548, x545, x534, x519); + let mut x549: u32 = 0; + fiat_p224_cmovznz_u32(&mut x549, x545, x536, x521); + let mut x550: u32 = 0; + fiat_p224_cmovznz_u32(&mut x550, x545, x538, x523); + let mut x551: u32 = 0; + fiat_p224_cmovznz_u32(&mut x551, x545, x540, x525); + let mut x552: u32 = 0; + fiat_p224_cmovznz_u32(&mut x552, x545, x542, x527); + out1[0] = x546; + out1[1] = x547; + out1[2] = x548; + out1[3] = x549; + out1[4] = x550; + out1[5] = x551; + out1[6] = x552; +} + +/// The function fiat_p224_add adds two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) + eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p224_add(out1: &mut fiat_p224_montgomery_domain_field_element, arg1: &fiat_p224_montgomery_domain_field_element, arg2: &fiat_p224_montgomery_domain_field_element) -> () { + let mut x1: u32 = 0; + let mut x2: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x1, &mut x2, 0x0, (arg1[0]), (arg2[0])); + let mut x3: u32 = 0; + let mut x4: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x3, &mut x4, x2, (arg1[1]), (arg2[1])); + let mut x5: u32 = 0; + let mut x6: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x5, &mut x6, x4, (arg1[2]), (arg2[2])); + let mut x7: u32 = 0; + let mut x8: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x7, &mut x8, x6, (arg1[3]), (arg2[3])); + let mut x9: u32 = 0; + let mut x10: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x9, &mut x10, x8, (arg1[4]), (arg2[4])); + let mut x11: u32 = 0; + let mut x12: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x11, &mut x12, x10, (arg1[5]), (arg2[5])); + let mut x13: u32 = 0; + let mut x14: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x13, &mut x14, x12, (arg1[6]), (arg2[6])); + let mut x15: u32 = 0; + let mut x16: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x15, &mut x16, 0x0, x1, (0x1 as u32)); + let mut x17: u32 = 0; + let mut x18: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x17, &mut x18, x16, x3, (0x0 as u32)); + let mut x19: u32 = 0; + let mut x20: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x19, &mut x20, x18, x5, (0x0 as u32)); + let mut x21: u32 = 0; + let mut x22: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x21, &mut x22, x20, x7, 0xffffffff); + let mut x23: u32 = 0; + let mut x24: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x23, &mut x24, x22, x9, 0xffffffff); + let mut x25: u32 = 0; + let mut x26: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x25, &mut x26, x24, x11, 0xffffffff); + let mut x27: u32 = 0; + let mut x28: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x27, &mut x28, x26, x13, 0xffffffff); + let mut x29: u32 = 0; + let mut x30: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x29, &mut x30, x28, (x14 as u32), (0x0 as u32)); + let mut x31: u32 = 0; + fiat_p224_cmovznz_u32(&mut x31, x30, x15, x1); + let mut x32: u32 = 0; + fiat_p224_cmovznz_u32(&mut x32, x30, x17, x3); + let mut x33: u32 = 0; + fiat_p224_cmovznz_u32(&mut x33, x30, x19, x5); + let mut x34: u32 = 0; + fiat_p224_cmovznz_u32(&mut x34, x30, x21, x7); + let mut x35: u32 = 0; + fiat_p224_cmovznz_u32(&mut x35, x30, x23, x9); + let mut x36: u32 = 0; + fiat_p224_cmovznz_u32(&mut x36, x30, x25, x11); + let mut x37: u32 = 0; + fiat_p224_cmovznz_u32(&mut x37, x30, x27, x13); + out1[0] = x31; + out1[1] = x32; + out1[2] = x33; + out1[3] = x34; + out1[4] = x35; + out1[5] = x36; + out1[6] = x37; +} + +/// The function fiat_p224_sub subtracts two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) - eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p224_sub(out1: &mut fiat_p224_montgomery_domain_field_element, arg1: &fiat_p224_montgomery_domain_field_element, arg2: &fiat_p224_montgomery_domain_field_element) -> () { + let mut x1: u32 = 0; + let mut x2: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x1, &mut x2, 0x0, (arg1[0]), (arg2[0])); + let mut x3: u32 = 0; + let mut x4: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x3, &mut x4, x2, (arg1[1]), (arg2[1])); + let mut x5: u32 = 0; + let mut x6: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x5, &mut x6, x4, (arg1[2]), (arg2[2])); + let mut x7: u32 = 0; + let mut x8: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x7, &mut x8, x6, (arg1[3]), (arg2[3])); + let mut x9: u32 = 0; + let mut x10: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x9, &mut x10, x8, (arg1[4]), (arg2[4])); + let mut x11: u32 = 0; + let mut x12: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x11, &mut x12, x10, (arg1[5]), (arg2[5])); + let mut x13: u32 = 0; + let mut x14: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x13, &mut x14, x12, (arg1[6]), (arg2[6])); + let mut x15: u32 = 0; + fiat_p224_cmovznz_u32(&mut x15, x14, (0x0 as u32), 0xffffffff); + let mut x16: u32 = 0; + let mut x17: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x16, &mut x17, 0x0, x1, (((x15 & (0x1 as u32)) as fiat_p224_u1) as u32)); + let mut x18: u32 = 0; + let mut x19: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x18, &mut x19, x17, x3, (0x0 as u32)); + let mut x20: u32 = 0; + let mut x21: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x20, &mut x21, x19, x5, (0x0 as u32)); + let mut x22: u32 = 0; + let mut x23: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x22, &mut x23, x21, x7, x15); + let mut x24: u32 = 0; + let mut x25: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x24, &mut x25, x23, x9, x15); + let mut x26: u32 = 0; + let mut x27: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x26, &mut x27, x25, x11, x15); + let mut x28: u32 = 0; + let mut x29: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x28, &mut x29, x27, x13, x15); + out1[0] = x16; + out1[1] = x18; + out1[2] = x20; + out1[3] = x22; + out1[4] = x24; + out1[5] = x26; + out1[6] = x28; +} + +/// The function fiat_p224_opp negates a field element in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = -eval (from_montgomery arg1) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p224_opp(out1: &mut fiat_p224_montgomery_domain_field_element, arg1: &fiat_p224_montgomery_domain_field_element) -> () { + let mut x1: u32 = 0; + let mut x2: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x1, &mut x2, 0x0, (0x0 as u32), (arg1[0])); + let mut x3: u32 = 0; + let mut x4: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x3, &mut x4, x2, (0x0 as u32), (arg1[1])); + let mut x5: u32 = 0; + let mut x6: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x5, &mut x6, x4, (0x0 as u32), (arg1[2])); + let mut x7: u32 = 0; + let mut x8: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x7, &mut x8, x6, (0x0 as u32), (arg1[3])); + let mut x9: u32 = 0; + let mut x10: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x9, &mut x10, x8, (0x0 as u32), (arg1[4])); + let mut x11: u32 = 0; + let mut x12: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x11, &mut x12, x10, (0x0 as u32), (arg1[5])); + let mut x13: u32 = 0; + let mut x14: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x13, &mut x14, x12, (0x0 as u32), (arg1[6])); + let mut x15: u32 = 0; + fiat_p224_cmovznz_u32(&mut x15, x14, (0x0 as u32), 0xffffffff); + let mut x16: u32 = 0; + let mut x17: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x16, &mut x17, 0x0, x1, (((x15 & (0x1 as u32)) as fiat_p224_u1) as u32)); + let mut x18: u32 = 0; + let mut x19: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x18, &mut x19, x17, x3, (0x0 as u32)); + let mut x20: u32 = 0; + let mut x21: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x20, &mut x21, x19, x5, (0x0 as u32)); + let mut x22: u32 = 0; + let mut x23: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x22, &mut x23, x21, x7, x15); + let mut x24: u32 = 0; + let mut x25: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x24, &mut x25, x23, x9, x15); + let mut x26: u32 = 0; + let mut x27: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x26, &mut x27, x25, x11, x15); + let mut x28: u32 = 0; + let mut x29: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x28, &mut x29, x27, x13, x15); + out1[0] = x16; + out1[1] = x18; + out1[2] = x20; + out1[3] = x22; + out1[4] = x24; + out1[5] = x26; + out1[6] = x28; +} + +/// The function fiat_p224_from_montgomery translates a field element out of the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval out1 mod m = (eval arg1 * ((2^32)⁻¹ mod m)^7) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p224_from_montgomery(out1: &mut fiat_p224_non_montgomery_domain_field_element, arg1: &fiat_p224_montgomery_domain_field_element) -> () { + let x1: u32 = (arg1[0]); + let mut x2: u32 = 0; + let mut x3: u32 = 0; + fiat_p224_mulx_u32(&mut x2, &mut x3, x1, 0xffffffff); + let mut x4: u32 = 0; + let mut x5: u32 = 0; + fiat_p224_mulx_u32(&mut x4, &mut x5, x2, 0xffffffff); + let mut x6: u32 = 0; + let mut x7: u32 = 0; + fiat_p224_mulx_u32(&mut x6, &mut x7, x2, 0xffffffff); + let mut x8: u32 = 0; + let mut x9: u32 = 0; + fiat_p224_mulx_u32(&mut x8, &mut x9, x2, 0xffffffff); + let mut x10: u32 = 0; + let mut x11: u32 = 0; + fiat_p224_mulx_u32(&mut x10, &mut x11, x2, 0xffffffff); + let mut x12: u32 = 0; + let mut x13: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x12, &mut x13, 0x0, x11, x8); + let mut x14: u32 = 0; + let mut x15: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x14, &mut x15, x13, x9, x6); + let mut x16: u32 = 0; + let mut x17: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x16, &mut x17, x15, x7, x4); + let mut x18: u32 = 0; + let mut x19: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x18, &mut x19, 0x0, x1, x2); + let mut x20: u32 = 0; + let mut x21: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x20, &mut x21, 0x0, (x19 as u32), (arg1[1])); + let mut x22: u32 = 0; + let mut x23: u32 = 0; + fiat_p224_mulx_u32(&mut x22, &mut x23, x20, 0xffffffff); + let mut x24: u32 = 0; + let mut x25: u32 = 0; + fiat_p224_mulx_u32(&mut x24, &mut x25, x22, 0xffffffff); + let mut x26: u32 = 0; + let mut x27: u32 = 0; + fiat_p224_mulx_u32(&mut x26, &mut x27, x22, 0xffffffff); + let mut x28: u32 = 0; + let mut x29: u32 = 0; + fiat_p224_mulx_u32(&mut x28, &mut x29, x22, 0xffffffff); + let mut x30: u32 = 0; + let mut x31: u32 = 0; + fiat_p224_mulx_u32(&mut x30, &mut x31, x22, 0xffffffff); + let mut x32: u32 = 0; + let mut x33: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x32, &mut x33, 0x0, x31, x28); + let mut x34: u32 = 0; + let mut x35: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x34, &mut x35, x33, x29, x26); + let mut x36: u32 = 0; + let mut x37: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x36, &mut x37, x35, x27, x24); + let mut x38: u32 = 0; + let mut x39: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x38, &mut x39, 0x0, x12, x30); + let mut x40: u32 = 0; + let mut x41: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x40, &mut x41, x39, x14, x32); + let mut x42: u32 = 0; + let mut x43: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x42, &mut x43, x41, x16, x34); + let mut x44: u32 = 0; + let mut x45: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x44, &mut x45, x43, ((x17 as u32) + x5), x36); + let mut x46: u32 = 0; + let mut x47: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x46, &mut x47, x45, (0x0 as u32), ((x37 as u32) + x25)); + let mut x48: u32 = 0; + let mut x49: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x48, &mut x49, 0x0, x20, x22); + let mut x50: u32 = 0; + let mut x51: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x50, &mut x51, 0x0, ((x49 as u32) + (x21 as u32)), (arg1[2])); + let mut x52: u32 = 0; + let mut x53: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x52, &mut x53, x51, x10, (0x0 as u32)); + let mut x54: u32 = 0; + let mut x55: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x54, &mut x55, x53, x38, (0x0 as u32)); + let mut x56: u32 = 0; + let mut x57: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x56, &mut x57, x55, x40, (0x0 as u32)); + let mut x58: u32 = 0; + let mut x59: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x58, &mut x59, x57, x42, (0x0 as u32)); + let mut x60: u32 = 0; + let mut x61: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x60, &mut x61, x59, x44, (0x0 as u32)); + let mut x62: u32 = 0; + let mut x63: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x62, &mut x63, x61, x46, (0x0 as u32)); + let mut x64: u32 = 0; + let mut x65: u32 = 0; + fiat_p224_mulx_u32(&mut x64, &mut x65, x50, 0xffffffff); + let mut x66: u32 = 0; + let mut x67: u32 = 0; + fiat_p224_mulx_u32(&mut x66, &mut x67, x64, 0xffffffff); + let mut x68: u32 = 0; + let mut x69: u32 = 0; + fiat_p224_mulx_u32(&mut x68, &mut x69, x64, 0xffffffff); + let mut x70: u32 = 0; + let mut x71: u32 = 0; + fiat_p224_mulx_u32(&mut x70, &mut x71, x64, 0xffffffff); + let mut x72: u32 = 0; + let mut x73: u32 = 0; + fiat_p224_mulx_u32(&mut x72, &mut x73, x64, 0xffffffff); + let mut x74: u32 = 0; + let mut x75: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x74, &mut x75, 0x0, x73, x70); + let mut x76: u32 = 0; + let mut x77: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x76, &mut x77, x75, x71, x68); + let mut x78: u32 = 0; + let mut x79: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x78, &mut x79, x77, x69, x66); + let mut x80: u32 = 0; + let mut x81: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x80, &mut x81, 0x0, x50, x64); + let mut x82: u32 = 0; + let mut x83: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x82, &mut x83, x81, x52, (0x0 as u32)); + let mut x84: u32 = 0; + let mut x85: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x84, &mut x85, x83, x54, (0x0 as u32)); + let mut x86: u32 = 0; + let mut x87: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x86, &mut x87, x85, x56, x72); + let mut x88: u32 = 0; + let mut x89: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x88, &mut x89, x87, x58, x74); + let mut x90: u32 = 0; + let mut x91: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x90, &mut x91, x89, x60, x76); + let mut x92: u32 = 0; + let mut x93: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x92, &mut x93, x91, x62, x78); + let mut x94: u32 = 0; + let mut x95: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x94, &mut x95, x93, ((x63 as u32) + (x47 as u32)), ((x79 as u32) + x67)); + let mut x96: u32 = 0; + let mut x97: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x96, &mut x97, 0x0, x82, (arg1[3])); + let mut x98: u32 = 0; + let mut x99: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x98, &mut x99, x97, x84, (0x0 as u32)); + let mut x100: u32 = 0; + let mut x101: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x100, &mut x101, x99, x86, (0x0 as u32)); + let mut x102: u32 = 0; + let mut x103: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x102, &mut x103, x101, x88, (0x0 as u32)); + let mut x104: u32 = 0; + let mut x105: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x104, &mut x105, x103, x90, (0x0 as u32)); + let mut x106: u32 = 0; + let mut x107: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x106, &mut x107, x105, x92, (0x0 as u32)); + let mut x108: u32 = 0; + let mut x109: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x108, &mut x109, x107, x94, (0x0 as u32)); + let mut x110: u32 = 0; + let mut x111: u32 = 0; + fiat_p224_mulx_u32(&mut x110, &mut x111, x96, 0xffffffff); + let mut x112: u32 = 0; + let mut x113: u32 = 0; + fiat_p224_mulx_u32(&mut x112, &mut x113, x110, 0xffffffff); + let mut x114: u32 = 0; + let mut x115: u32 = 0; + fiat_p224_mulx_u32(&mut x114, &mut x115, x110, 0xffffffff); + let mut x116: u32 = 0; + let mut x117: u32 = 0; + fiat_p224_mulx_u32(&mut x116, &mut x117, x110, 0xffffffff); + let mut x118: u32 = 0; + let mut x119: u32 = 0; + fiat_p224_mulx_u32(&mut x118, &mut x119, x110, 0xffffffff); + let mut x120: u32 = 0; + let mut x121: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x120, &mut x121, 0x0, x119, x116); + let mut x122: u32 = 0; + let mut x123: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x122, &mut x123, x121, x117, x114); + let mut x124: u32 = 0; + let mut x125: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x124, &mut x125, x123, x115, x112); + let mut x126: u32 = 0; + let mut x127: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x126, &mut x127, 0x0, x96, x110); + let mut x128: u32 = 0; + let mut x129: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x128, &mut x129, x127, x98, (0x0 as u32)); + let mut x130: u32 = 0; + let mut x131: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x130, &mut x131, x129, x100, (0x0 as u32)); + let mut x132: u32 = 0; + let mut x133: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x132, &mut x133, x131, x102, x118); + let mut x134: u32 = 0; + let mut x135: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x134, &mut x135, x133, x104, x120); + let mut x136: u32 = 0; + let mut x137: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x136, &mut x137, x135, x106, x122); + let mut x138: u32 = 0; + let mut x139: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x138, &mut x139, x137, x108, x124); + let mut x140: u32 = 0; + let mut x141: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x140, &mut x141, x139, ((x109 as u32) + (x95 as u32)), ((x125 as u32) + x113)); + let mut x142: u32 = 0; + let mut x143: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x142, &mut x143, 0x0, x128, (arg1[4])); + let mut x144: u32 = 0; + let mut x145: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x144, &mut x145, x143, x130, (0x0 as u32)); + let mut x146: u32 = 0; + let mut x147: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x146, &mut x147, x145, x132, (0x0 as u32)); + let mut x148: u32 = 0; + let mut x149: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x148, &mut x149, x147, x134, (0x0 as u32)); + let mut x150: u32 = 0; + let mut x151: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x150, &mut x151, x149, x136, (0x0 as u32)); + let mut x152: u32 = 0; + let mut x153: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x152, &mut x153, x151, x138, (0x0 as u32)); + let mut x154: u32 = 0; + let mut x155: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x154, &mut x155, x153, x140, (0x0 as u32)); + let mut x156: u32 = 0; + let mut x157: u32 = 0; + fiat_p224_mulx_u32(&mut x156, &mut x157, x142, 0xffffffff); + let mut x158: u32 = 0; + let mut x159: u32 = 0; + fiat_p224_mulx_u32(&mut x158, &mut x159, x156, 0xffffffff); + let mut x160: u32 = 0; + let mut x161: u32 = 0; + fiat_p224_mulx_u32(&mut x160, &mut x161, x156, 0xffffffff); + let mut x162: u32 = 0; + let mut x163: u32 = 0; + fiat_p224_mulx_u32(&mut x162, &mut x163, x156, 0xffffffff); + let mut x164: u32 = 0; + let mut x165: u32 = 0; + fiat_p224_mulx_u32(&mut x164, &mut x165, x156, 0xffffffff); + let mut x166: u32 = 0; + let mut x167: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x166, &mut x167, 0x0, x165, x162); + let mut x168: u32 = 0; + let mut x169: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x168, &mut x169, x167, x163, x160); + let mut x170: u32 = 0; + let mut x171: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x170, &mut x171, x169, x161, x158); + let mut x172: u32 = 0; + let mut x173: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x172, &mut x173, 0x0, x142, x156); + let mut x174: u32 = 0; + let mut x175: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x174, &mut x175, x173, x144, (0x0 as u32)); + let mut x176: u32 = 0; + let mut x177: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x176, &mut x177, x175, x146, (0x0 as u32)); + let mut x178: u32 = 0; + let mut x179: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x178, &mut x179, x177, x148, x164); + let mut x180: u32 = 0; + let mut x181: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x180, &mut x181, x179, x150, x166); + let mut x182: u32 = 0; + let mut x183: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x182, &mut x183, x181, x152, x168); + let mut x184: u32 = 0; + let mut x185: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x184, &mut x185, x183, x154, x170); + let mut x186: u32 = 0; + let mut x187: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x186, &mut x187, x185, ((x155 as u32) + (x141 as u32)), ((x171 as u32) + x159)); + let mut x188: u32 = 0; + let mut x189: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x188, &mut x189, 0x0, x174, (arg1[5])); + let mut x190: u32 = 0; + let mut x191: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x190, &mut x191, x189, x176, (0x0 as u32)); + let mut x192: u32 = 0; + let mut x193: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x192, &mut x193, x191, x178, (0x0 as u32)); + let mut x194: u32 = 0; + let mut x195: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x194, &mut x195, x193, x180, (0x0 as u32)); + let mut x196: u32 = 0; + let mut x197: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x196, &mut x197, x195, x182, (0x0 as u32)); + let mut x198: u32 = 0; + let mut x199: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x198, &mut x199, x197, x184, (0x0 as u32)); + let mut x200: u32 = 0; + let mut x201: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x200, &mut x201, x199, x186, (0x0 as u32)); + let mut x202: u32 = 0; + let mut x203: u32 = 0; + fiat_p224_mulx_u32(&mut x202, &mut x203, x188, 0xffffffff); + let mut x204: u32 = 0; + let mut x205: u32 = 0; + fiat_p224_mulx_u32(&mut x204, &mut x205, x202, 0xffffffff); + let mut x206: u32 = 0; + let mut x207: u32 = 0; + fiat_p224_mulx_u32(&mut x206, &mut x207, x202, 0xffffffff); + let mut x208: u32 = 0; + let mut x209: u32 = 0; + fiat_p224_mulx_u32(&mut x208, &mut x209, x202, 0xffffffff); + let mut x210: u32 = 0; + let mut x211: u32 = 0; + fiat_p224_mulx_u32(&mut x210, &mut x211, x202, 0xffffffff); + let mut x212: u32 = 0; + let mut x213: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x212, &mut x213, 0x0, x211, x208); + let mut x214: u32 = 0; + let mut x215: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x214, &mut x215, x213, x209, x206); + let mut x216: u32 = 0; + let mut x217: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x216, &mut x217, x215, x207, x204); + let mut x218: u32 = 0; + let mut x219: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x218, &mut x219, 0x0, x188, x202); + let mut x220: u32 = 0; + let mut x221: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x220, &mut x221, x219, x190, (0x0 as u32)); + let mut x222: u32 = 0; + let mut x223: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x222, &mut x223, x221, x192, (0x0 as u32)); + let mut x224: u32 = 0; + let mut x225: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x224, &mut x225, x223, x194, x210); + let mut x226: u32 = 0; + let mut x227: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x226, &mut x227, x225, x196, x212); + let mut x228: u32 = 0; + let mut x229: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x228, &mut x229, x227, x198, x214); + let mut x230: u32 = 0; + let mut x231: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x230, &mut x231, x229, x200, x216); + let mut x232: u32 = 0; + let mut x233: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x232, &mut x233, x231, ((x201 as u32) + (x187 as u32)), ((x217 as u32) + x205)); + let mut x234: u32 = 0; + let mut x235: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x234, &mut x235, 0x0, x220, (arg1[6])); + let mut x236: u32 = 0; + let mut x237: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x236, &mut x237, x235, x222, (0x0 as u32)); + let mut x238: u32 = 0; + let mut x239: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x238, &mut x239, x237, x224, (0x0 as u32)); + let mut x240: u32 = 0; + let mut x241: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x240, &mut x241, x239, x226, (0x0 as u32)); + let mut x242: u32 = 0; + let mut x243: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x242, &mut x243, x241, x228, (0x0 as u32)); + let mut x244: u32 = 0; + let mut x245: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x244, &mut x245, x243, x230, (0x0 as u32)); + let mut x246: u32 = 0; + let mut x247: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x246, &mut x247, x245, x232, (0x0 as u32)); + let mut x248: u32 = 0; + let mut x249: u32 = 0; + fiat_p224_mulx_u32(&mut x248, &mut x249, x234, 0xffffffff); + let mut x250: u32 = 0; + let mut x251: u32 = 0; + fiat_p224_mulx_u32(&mut x250, &mut x251, x248, 0xffffffff); + let mut x252: u32 = 0; + let mut x253: u32 = 0; + fiat_p224_mulx_u32(&mut x252, &mut x253, x248, 0xffffffff); + let mut x254: u32 = 0; + let mut x255: u32 = 0; + fiat_p224_mulx_u32(&mut x254, &mut x255, x248, 0xffffffff); + let mut x256: u32 = 0; + let mut x257: u32 = 0; + fiat_p224_mulx_u32(&mut x256, &mut x257, x248, 0xffffffff); + let mut x258: u32 = 0; + let mut x259: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x258, &mut x259, 0x0, x257, x254); + let mut x260: u32 = 0; + let mut x261: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x260, &mut x261, x259, x255, x252); + let mut x262: u32 = 0; + let mut x263: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x262, &mut x263, x261, x253, x250); + let mut x264: u32 = 0; + let mut x265: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x264, &mut x265, 0x0, x234, x248); + let mut x266: u32 = 0; + let mut x267: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x266, &mut x267, x265, x236, (0x0 as u32)); + let mut x268: u32 = 0; + let mut x269: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x268, &mut x269, x267, x238, (0x0 as u32)); + let mut x270: u32 = 0; + let mut x271: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x270, &mut x271, x269, x240, x256); + let mut x272: u32 = 0; + let mut x273: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x272, &mut x273, x271, x242, x258); + let mut x274: u32 = 0; + let mut x275: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x274, &mut x275, x273, x244, x260); + let mut x276: u32 = 0; + let mut x277: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x276, &mut x277, x275, x246, x262); + let mut x278: u32 = 0; + let mut x279: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x278, &mut x279, x277, ((x247 as u32) + (x233 as u32)), ((x263 as u32) + x251)); + let mut x280: u32 = 0; + let mut x281: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x280, &mut x281, 0x0, x266, (0x1 as u32)); + let mut x282: u32 = 0; + let mut x283: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x282, &mut x283, x281, x268, (0x0 as u32)); + let mut x284: u32 = 0; + let mut x285: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x284, &mut x285, x283, x270, (0x0 as u32)); + let mut x286: u32 = 0; + let mut x287: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x286, &mut x287, x285, x272, 0xffffffff); + let mut x288: u32 = 0; + let mut x289: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x288, &mut x289, x287, x274, 0xffffffff); + let mut x290: u32 = 0; + let mut x291: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x290, &mut x291, x289, x276, 0xffffffff); + let mut x292: u32 = 0; + let mut x293: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x292, &mut x293, x291, x278, 0xffffffff); + let mut x294: u32 = 0; + let mut x295: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x294, &mut x295, x293, (x279 as u32), (0x0 as u32)); + let mut x296: u32 = 0; + fiat_p224_cmovznz_u32(&mut x296, x295, x280, x266); + let mut x297: u32 = 0; + fiat_p224_cmovznz_u32(&mut x297, x295, x282, x268); + let mut x298: u32 = 0; + fiat_p224_cmovznz_u32(&mut x298, x295, x284, x270); + let mut x299: u32 = 0; + fiat_p224_cmovznz_u32(&mut x299, x295, x286, x272); + let mut x300: u32 = 0; + fiat_p224_cmovznz_u32(&mut x300, x295, x288, x274); + let mut x301: u32 = 0; + fiat_p224_cmovznz_u32(&mut x301, x295, x290, x276); + let mut x302: u32 = 0; + fiat_p224_cmovznz_u32(&mut x302, x295, x292, x278); + out1[0] = x296; + out1[1] = x297; + out1[2] = x298; + out1[3] = x299; + out1[4] = x300; + out1[5] = x301; + out1[6] = x302; +} + +/// The function fiat_p224_to_montgomery translates a field element into the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = eval arg1 mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p224_to_montgomery(out1: &mut fiat_p224_montgomery_domain_field_element, arg1: &fiat_p224_non_montgomery_domain_field_element) -> () { + let x1: u32 = (arg1[1]); + let x2: u32 = (arg1[2]); + let x3: u32 = (arg1[3]); + let x4: u32 = (arg1[4]); + let x5: u32 = (arg1[5]); + let x6: u32 = (arg1[6]); + let x7: u32 = (arg1[0]); + let mut x8: u32 = 0; + let mut x9: u32 = 0; + fiat_p224_mulx_u32(&mut x8, &mut x9, x7, 0xffffffff); + let mut x10: u32 = 0; + let mut x11: u32 = 0; + fiat_p224_mulx_u32(&mut x10, &mut x11, x7, 0xffffffff); + let mut x12: u32 = 0; + let mut x13: u32 = 0; + fiat_p224_mulx_u32(&mut x12, &mut x13, x7, 0xfffffffe); + let mut x14: u32 = 0; + let mut x15: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x14, &mut x15, 0x0, x13, x10); + let mut x16: u32 = 0; + let mut x17: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x16, &mut x17, x15, x11, x8); + let mut x18: u32 = 0; + let mut x19: u32 = 0; + fiat_p224_mulx_u32(&mut x18, &mut x19, x7, 0xffffffff); + let mut x20: u32 = 0; + let mut x21: u32 = 0; + fiat_p224_mulx_u32(&mut x20, &mut x21, x18, 0xffffffff); + let mut x22: u32 = 0; + let mut x23: u32 = 0; + fiat_p224_mulx_u32(&mut x22, &mut x23, x18, 0xffffffff); + let mut x24: u32 = 0; + let mut x25: u32 = 0; + fiat_p224_mulx_u32(&mut x24, &mut x25, x18, 0xffffffff); + let mut x26: u32 = 0; + let mut x27: u32 = 0; + fiat_p224_mulx_u32(&mut x26, &mut x27, x18, 0xffffffff); + let mut x28: u32 = 0; + let mut x29: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x28, &mut x29, 0x0, x27, x24); + let mut x30: u32 = 0; + let mut x31: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x30, &mut x31, x29, x25, x22); + let mut x32: u32 = 0; + let mut x33: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x32, &mut x33, x31, x23, x20); + let mut x34: u32 = 0; + let mut x35: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x34, &mut x35, 0x0, x12, x26); + let mut x36: u32 = 0; + let mut x37: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x36, &mut x37, x35, x14, x28); + let mut x38: u32 = 0; + let mut x39: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x38, &mut x39, x37, x16, x30); + let mut x40: u32 = 0; + let mut x41: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x40, &mut x41, x39, ((x17 as u32) + x9), x32); + let mut x42: u32 = 0; + let mut x43: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x42, &mut x43, x41, (0x0 as u32), ((x33 as u32) + x21)); + let mut x44: u32 = 0; + let mut x45: u32 = 0; + fiat_p224_mulx_u32(&mut x44, &mut x45, x1, 0xffffffff); + let mut x46: u32 = 0; + let mut x47: u32 = 0; + fiat_p224_mulx_u32(&mut x46, &mut x47, x1, 0xffffffff); + let mut x48: u32 = 0; + let mut x49: u32 = 0; + fiat_p224_mulx_u32(&mut x48, &mut x49, x1, 0xfffffffe); + let mut x50: u32 = 0; + let mut x51: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x50, &mut x51, 0x0, x49, x46); + let mut x52: u32 = 0; + let mut x53: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x52, &mut x53, x51, x47, x44); + let mut x54: u32 = 0; + let mut x55: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x54, &mut x55, 0x0, x7, x18); + let mut x56: u32 = 0; + let mut x57: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x56, &mut x57, 0x0, (x55 as u32), x1); + let mut x58: u32 = 0; + let mut x59: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x58, &mut x59, 0x0, x36, x48); + let mut x60: u32 = 0; + let mut x61: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x60, &mut x61, x59, x38, x50); + let mut x62: u32 = 0; + let mut x63: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x62, &mut x63, x61, x40, x52); + let mut x64: u32 = 0; + let mut x65: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x64, &mut x65, x63, x42, ((x53 as u32) + x45)); + let mut x66: u32 = 0; + let mut x67: u32 = 0; + fiat_p224_mulx_u32(&mut x66, &mut x67, x56, 0xffffffff); + let mut x68: u32 = 0; + let mut x69: u32 = 0; + fiat_p224_mulx_u32(&mut x68, &mut x69, x66, 0xffffffff); + let mut x70: u32 = 0; + let mut x71: u32 = 0; + fiat_p224_mulx_u32(&mut x70, &mut x71, x66, 0xffffffff); + let mut x72: u32 = 0; + let mut x73: u32 = 0; + fiat_p224_mulx_u32(&mut x72, &mut x73, x66, 0xffffffff); + let mut x74: u32 = 0; + let mut x75: u32 = 0; + fiat_p224_mulx_u32(&mut x74, &mut x75, x66, 0xffffffff); + let mut x76: u32 = 0; + let mut x77: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x76, &mut x77, 0x0, x75, x72); + let mut x78: u32 = 0; + let mut x79: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x78, &mut x79, x77, x73, x70); + let mut x80: u32 = 0; + let mut x81: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x80, &mut x81, x79, x71, x68); + let mut x82: u32 = 0; + let mut x83: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x82, &mut x83, 0x0, x58, x74); + let mut x84: u32 = 0; + let mut x85: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x84, &mut x85, x83, x60, x76); + let mut x86: u32 = 0; + let mut x87: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x86, &mut x87, x85, x62, x78); + let mut x88: u32 = 0; + let mut x89: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x88, &mut x89, x87, x64, x80); + let mut x90: u32 = 0; + let mut x91: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x90, &mut x91, x89, ((x65 as u32) + (x43 as u32)), ((x81 as u32) + x69)); + let mut x92: u32 = 0; + let mut x93: u32 = 0; + fiat_p224_mulx_u32(&mut x92, &mut x93, x2, 0xffffffff); + let mut x94: u32 = 0; + let mut x95: u32 = 0; + fiat_p224_mulx_u32(&mut x94, &mut x95, x2, 0xffffffff); + let mut x96: u32 = 0; + let mut x97: u32 = 0; + fiat_p224_mulx_u32(&mut x96, &mut x97, x2, 0xfffffffe); + let mut x98: u32 = 0; + let mut x99: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x98, &mut x99, 0x0, x97, x94); + let mut x100: u32 = 0; + let mut x101: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x100, &mut x101, x99, x95, x92); + let mut x102: u32 = 0; + let mut x103: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x102, &mut x103, 0x0, x56, x66); + let mut x104: u32 = 0; + let mut x105: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x104, &mut x105, 0x0, ((x103 as u32) + (x57 as u32)), x2); + let mut x106: u32 = 0; + let mut x107: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x106, &mut x107, x105, x34, (0x0 as u32)); + let mut x108: u32 = 0; + let mut x109: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x108, &mut x109, x107, x82, (0x0 as u32)); + let mut x110: u32 = 0; + let mut x111: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x110, &mut x111, x109, x84, x96); + let mut x112: u32 = 0; + let mut x113: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x112, &mut x113, x111, x86, x98); + let mut x114: u32 = 0; + let mut x115: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x114, &mut x115, x113, x88, x100); + let mut x116: u32 = 0; + let mut x117: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x116, &mut x117, x115, x90, ((x101 as u32) + x93)); + let mut x118: u32 = 0; + let mut x119: u32 = 0; + fiat_p224_mulx_u32(&mut x118, &mut x119, x104, 0xffffffff); + let mut x120: u32 = 0; + let mut x121: u32 = 0; + fiat_p224_mulx_u32(&mut x120, &mut x121, x118, 0xffffffff); + let mut x122: u32 = 0; + let mut x123: u32 = 0; + fiat_p224_mulx_u32(&mut x122, &mut x123, x118, 0xffffffff); + let mut x124: u32 = 0; + let mut x125: u32 = 0; + fiat_p224_mulx_u32(&mut x124, &mut x125, x118, 0xffffffff); + let mut x126: u32 = 0; + let mut x127: u32 = 0; + fiat_p224_mulx_u32(&mut x126, &mut x127, x118, 0xffffffff); + let mut x128: u32 = 0; + let mut x129: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x128, &mut x129, 0x0, x127, x124); + let mut x130: u32 = 0; + let mut x131: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x130, &mut x131, x129, x125, x122); + let mut x132: u32 = 0; + let mut x133: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x132, &mut x133, x131, x123, x120); + let mut x134: u32 = 0; + let mut x135: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x134, &mut x135, 0x0, x104, x118); + let mut x136: u32 = 0; + let mut x137: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x136, &mut x137, x135, x106, (0x0 as u32)); + let mut x138: u32 = 0; + let mut x139: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x138, &mut x139, x137, x108, (0x0 as u32)); + let mut x140: u32 = 0; + let mut x141: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x140, &mut x141, x139, x110, x126); + let mut x142: u32 = 0; + let mut x143: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x142, &mut x143, x141, x112, x128); + let mut x144: u32 = 0; + let mut x145: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x144, &mut x145, x143, x114, x130); + let mut x146: u32 = 0; + let mut x147: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x146, &mut x147, x145, x116, x132); + let mut x148: u32 = 0; + let mut x149: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x148, &mut x149, x147, ((x117 as u32) + (x91 as u32)), ((x133 as u32) + x121)); + let mut x150: u32 = 0; + let mut x151: u32 = 0; + fiat_p224_mulx_u32(&mut x150, &mut x151, x3, 0xffffffff); + let mut x152: u32 = 0; + let mut x153: u32 = 0; + fiat_p224_mulx_u32(&mut x152, &mut x153, x3, 0xffffffff); + let mut x154: u32 = 0; + let mut x155: u32 = 0; + fiat_p224_mulx_u32(&mut x154, &mut x155, x3, 0xfffffffe); + let mut x156: u32 = 0; + let mut x157: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x156, &mut x157, 0x0, x155, x152); + let mut x158: u32 = 0; + let mut x159: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x158, &mut x159, x157, x153, x150); + let mut x160: u32 = 0; + let mut x161: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x160, &mut x161, 0x0, x136, x3); + let mut x162: u32 = 0; + let mut x163: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x162, &mut x163, x161, x138, (0x0 as u32)); + let mut x164: u32 = 0; + let mut x165: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x164, &mut x165, x163, x140, (0x0 as u32)); + let mut x166: u32 = 0; + let mut x167: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x166, &mut x167, x165, x142, x154); + let mut x168: u32 = 0; + let mut x169: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x168, &mut x169, x167, x144, x156); + let mut x170: u32 = 0; + let mut x171: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x170, &mut x171, x169, x146, x158); + let mut x172: u32 = 0; + let mut x173: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x172, &mut x173, x171, x148, ((x159 as u32) + x151)); + let mut x174: u32 = 0; + let mut x175: u32 = 0; + fiat_p224_mulx_u32(&mut x174, &mut x175, x160, 0xffffffff); + let mut x176: u32 = 0; + let mut x177: u32 = 0; + fiat_p224_mulx_u32(&mut x176, &mut x177, x174, 0xffffffff); + let mut x178: u32 = 0; + let mut x179: u32 = 0; + fiat_p224_mulx_u32(&mut x178, &mut x179, x174, 0xffffffff); + let mut x180: u32 = 0; + let mut x181: u32 = 0; + fiat_p224_mulx_u32(&mut x180, &mut x181, x174, 0xffffffff); + let mut x182: u32 = 0; + let mut x183: u32 = 0; + fiat_p224_mulx_u32(&mut x182, &mut x183, x174, 0xffffffff); + let mut x184: u32 = 0; + let mut x185: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x184, &mut x185, 0x0, x183, x180); + let mut x186: u32 = 0; + let mut x187: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x186, &mut x187, x185, x181, x178); + let mut x188: u32 = 0; + let mut x189: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x188, &mut x189, x187, x179, x176); + let mut x190: u32 = 0; + let mut x191: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x190, &mut x191, 0x0, x160, x174); + let mut x192: u32 = 0; + let mut x193: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x192, &mut x193, x191, x162, (0x0 as u32)); + let mut x194: u32 = 0; + let mut x195: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x194, &mut x195, x193, x164, (0x0 as u32)); + let mut x196: u32 = 0; + let mut x197: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x196, &mut x197, x195, x166, x182); + let mut x198: u32 = 0; + let mut x199: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x198, &mut x199, x197, x168, x184); + let mut x200: u32 = 0; + let mut x201: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x200, &mut x201, x199, x170, x186); + let mut x202: u32 = 0; + let mut x203: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x202, &mut x203, x201, x172, x188); + let mut x204: u32 = 0; + let mut x205: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x204, &mut x205, x203, ((x173 as u32) + (x149 as u32)), ((x189 as u32) + x177)); + let mut x206: u32 = 0; + let mut x207: u32 = 0; + fiat_p224_mulx_u32(&mut x206, &mut x207, x4, 0xffffffff); + let mut x208: u32 = 0; + let mut x209: u32 = 0; + fiat_p224_mulx_u32(&mut x208, &mut x209, x4, 0xffffffff); + let mut x210: u32 = 0; + let mut x211: u32 = 0; + fiat_p224_mulx_u32(&mut x210, &mut x211, x4, 0xfffffffe); + let mut x212: u32 = 0; + let mut x213: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x212, &mut x213, 0x0, x211, x208); + let mut x214: u32 = 0; + let mut x215: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x214, &mut x215, x213, x209, x206); + let mut x216: u32 = 0; + let mut x217: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x216, &mut x217, 0x0, x192, x4); + let mut x218: u32 = 0; + let mut x219: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x218, &mut x219, x217, x194, (0x0 as u32)); + let mut x220: u32 = 0; + let mut x221: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x220, &mut x221, x219, x196, (0x0 as u32)); + let mut x222: u32 = 0; + let mut x223: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x222, &mut x223, x221, x198, x210); + let mut x224: u32 = 0; + let mut x225: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x224, &mut x225, x223, x200, x212); + let mut x226: u32 = 0; + let mut x227: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x226, &mut x227, x225, x202, x214); + let mut x228: u32 = 0; + let mut x229: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x228, &mut x229, x227, x204, ((x215 as u32) + x207)); + let mut x230: u32 = 0; + let mut x231: u32 = 0; + fiat_p224_mulx_u32(&mut x230, &mut x231, x216, 0xffffffff); + let mut x232: u32 = 0; + let mut x233: u32 = 0; + fiat_p224_mulx_u32(&mut x232, &mut x233, x230, 0xffffffff); + let mut x234: u32 = 0; + let mut x235: u32 = 0; + fiat_p224_mulx_u32(&mut x234, &mut x235, x230, 0xffffffff); + let mut x236: u32 = 0; + let mut x237: u32 = 0; + fiat_p224_mulx_u32(&mut x236, &mut x237, x230, 0xffffffff); + let mut x238: u32 = 0; + let mut x239: u32 = 0; + fiat_p224_mulx_u32(&mut x238, &mut x239, x230, 0xffffffff); + let mut x240: u32 = 0; + let mut x241: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x240, &mut x241, 0x0, x239, x236); + let mut x242: u32 = 0; + let mut x243: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x242, &mut x243, x241, x237, x234); + let mut x244: u32 = 0; + let mut x245: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x244, &mut x245, x243, x235, x232); + let mut x246: u32 = 0; + let mut x247: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x246, &mut x247, 0x0, x216, x230); + let mut x248: u32 = 0; + let mut x249: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x248, &mut x249, x247, x218, (0x0 as u32)); + let mut x250: u32 = 0; + let mut x251: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x250, &mut x251, x249, x220, (0x0 as u32)); + let mut x252: u32 = 0; + let mut x253: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x252, &mut x253, x251, x222, x238); + let mut x254: u32 = 0; + let mut x255: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x254, &mut x255, x253, x224, x240); + let mut x256: u32 = 0; + let mut x257: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x256, &mut x257, x255, x226, x242); + let mut x258: u32 = 0; + let mut x259: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x258, &mut x259, x257, x228, x244); + let mut x260: u32 = 0; + let mut x261: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x260, &mut x261, x259, ((x229 as u32) + (x205 as u32)), ((x245 as u32) + x233)); + let mut x262: u32 = 0; + let mut x263: u32 = 0; + fiat_p224_mulx_u32(&mut x262, &mut x263, x5, 0xffffffff); + let mut x264: u32 = 0; + let mut x265: u32 = 0; + fiat_p224_mulx_u32(&mut x264, &mut x265, x5, 0xffffffff); + let mut x266: u32 = 0; + let mut x267: u32 = 0; + fiat_p224_mulx_u32(&mut x266, &mut x267, x5, 0xfffffffe); + let mut x268: u32 = 0; + let mut x269: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x268, &mut x269, 0x0, x267, x264); + let mut x270: u32 = 0; + let mut x271: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x270, &mut x271, x269, x265, x262); + let mut x272: u32 = 0; + let mut x273: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x272, &mut x273, 0x0, x248, x5); + let mut x274: u32 = 0; + let mut x275: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x274, &mut x275, x273, x250, (0x0 as u32)); + let mut x276: u32 = 0; + let mut x277: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x276, &mut x277, x275, x252, (0x0 as u32)); + let mut x278: u32 = 0; + let mut x279: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x278, &mut x279, x277, x254, x266); + let mut x280: u32 = 0; + let mut x281: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x280, &mut x281, x279, x256, x268); + let mut x282: u32 = 0; + let mut x283: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x282, &mut x283, x281, x258, x270); + let mut x284: u32 = 0; + let mut x285: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x284, &mut x285, x283, x260, ((x271 as u32) + x263)); + let mut x286: u32 = 0; + let mut x287: u32 = 0; + fiat_p224_mulx_u32(&mut x286, &mut x287, x272, 0xffffffff); + let mut x288: u32 = 0; + let mut x289: u32 = 0; + fiat_p224_mulx_u32(&mut x288, &mut x289, x286, 0xffffffff); + let mut x290: u32 = 0; + let mut x291: u32 = 0; + fiat_p224_mulx_u32(&mut x290, &mut x291, x286, 0xffffffff); + let mut x292: u32 = 0; + let mut x293: u32 = 0; + fiat_p224_mulx_u32(&mut x292, &mut x293, x286, 0xffffffff); + let mut x294: u32 = 0; + let mut x295: u32 = 0; + fiat_p224_mulx_u32(&mut x294, &mut x295, x286, 0xffffffff); + let mut x296: u32 = 0; + let mut x297: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x296, &mut x297, 0x0, x295, x292); + let mut x298: u32 = 0; + let mut x299: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x298, &mut x299, x297, x293, x290); + let mut x300: u32 = 0; + let mut x301: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x300, &mut x301, x299, x291, x288); + let mut x302: u32 = 0; + let mut x303: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x302, &mut x303, 0x0, x272, x286); + let mut x304: u32 = 0; + let mut x305: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x304, &mut x305, x303, x274, (0x0 as u32)); + let mut x306: u32 = 0; + let mut x307: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x306, &mut x307, x305, x276, (0x0 as u32)); + let mut x308: u32 = 0; + let mut x309: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x308, &mut x309, x307, x278, x294); + let mut x310: u32 = 0; + let mut x311: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x310, &mut x311, x309, x280, x296); + let mut x312: u32 = 0; + let mut x313: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x312, &mut x313, x311, x282, x298); + let mut x314: u32 = 0; + let mut x315: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x314, &mut x315, x313, x284, x300); + let mut x316: u32 = 0; + let mut x317: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x316, &mut x317, x315, ((x285 as u32) + (x261 as u32)), ((x301 as u32) + x289)); + let mut x318: u32 = 0; + let mut x319: u32 = 0; + fiat_p224_mulx_u32(&mut x318, &mut x319, x6, 0xffffffff); + let mut x320: u32 = 0; + let mut x321: u32 = 0; + fiat_p224_mulx_u32(&mut x320, &mut x321, x6, 0xffffffff); + let mut x322: u32 = 0; + let mut x323: u32 = 0; + fiat_p224_mulx_u32(&mut x322, &mut x323, x6, 0xfffffffe); + let mut x324: u32 = 0; + let mut x325: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x324, &mut x325, 0x0, x323, x320); + let mut x326: u32 = 0; + let mut x327: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x326, &mut x327, x325, x321, x318); + let mut x328: u32 = 0; + let mut x329: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x328, &mut x329, 0x0, x304, x6); + let mut x330: u32 = 0; + let mut x331: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x330, &mut x331, x329, x306, (0x0 as u32)); + let mut x332: u32 = 0; + let mut x333: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x332, &mut x333, x331, x308, (0x0 as u32)); + let mut x334: u32 = 0; + let mut x335: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x334, &mut x335, x333, x310, x322); + let mut x336: u32 = 0; + let mut x337: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x336, &mut x337, x335, x312, x324); + let mut x338: u32 = 0; + let mut x339: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x338, &mut x339, x337, x314, x326); + let mut x340: u32 = 0; + let mut x341: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x340, &mut x341, x339, x316, ((x327 as u32) + x319)); + let mut x342: u32 = 0; + let mut x343: u32 = 0; + fiat_p224_mulx_u32(&mut x342, &mut x343, x328, 0xffffffff); + let mut x344: u32 = 0; + let mut x345: u32 = 0; + fiat_p224_mulx_u32(&mut x344, &mut x345, x342, 0xffffffff); + let mut x346: u32 = 0; + let mut x347: u32 = 0; + fiat_p224_mulx_u32(&mut x346, &mut x347, x342, 0xffffffff); + let mut x348: u32 = 0; + let mut x349: u32 = 0; + fiat_p224_mulx_u32(&mut x348, &mut x349, x342, 0xffffffff); + let mut x350: u32 = 0; + let mut x351: u32 = 0; + fiat_p224_mulx_u32(&mut x350, &mut x351, x342, 0xffffffff); + let mut x352: u32 = 0; + let mut x353: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x352, &mut x353, 0x0, x351, x348); + let mut x354: u32 = 0; + let mut x355: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x354, &mut x355, x353, x349, x346); + let mut x356: u32 = 0; + let mut x357: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x356, &mut x357, x355, x347, x344); + let mut x358: u32 = 0; + let mut x359: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x358, &mut x359, 0x0, x328, x342); + let mut x360: u32 = 0; + let mut x361: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x360, &mut x361, x359, x330, (0x0 as u32)); + let mut x362: u32 = 0; + let mut x363: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x362, &mut x363, x361, x332, (0x0 as u32)); + let mut x364: u32 = 0; + let mut x365: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x364, &mut x365, x363, x334, x350); + let mut x366: u32 = 0; + let mut x367: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x366, &mut x367, x365, x336, x352); + let mut x368: u32 = 0; + let mut x369: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x368, &mut x369, x367, x338, x354); + let mut x370: u32 = 0; + let mut x371: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x370, &mut x371, x369, x340, x356); + let mut x372: u32 = 0; + let mut x373: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x372, &mut x373, x371, ((x341 as u32) + (x317 as u32)), ((x357 as u32) + x345)); + let mut x374: u32 = 0; + let mut x375: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x374, &mut x375, 0x0, x360, (0x1 as u32)); + let mut x376: u32 = 0; + let mut x377: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x376, &mut x377, x375, x362, (0x0 as u32)); + let mut x378: u32 = 0; + let mut x379: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x378, &mut x379, x377, x364, (0x0 as u32)); + let mut x380: u32 = 0; + let mut x381: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x380, &mut x381, x379, x366, 0xffffffff); + let mut x382: u32 = 0; + let mut x383: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x382, &mut x383, x381, x368, 0xffffffff); + let mut x384: u32 = 0; + let mut x385: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x384, &mut x385, x383, x370, 0xffffffff); + let mut x386: u32 = 0; + let mut x387: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x386, &mut x387, x385, x372, 0xffffffff); + let mut x388: u32 = 0; + let mut x389: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x388, &mut x389, x387, (x373 as u32), (0x0 as u32)); + let mut x390: u32 = 0; + fiat_p224_cmovznz_u32(&mut x390, x389, x374, x360); + let mut x391: u32 = 0; + fiat_p224_cmovznz_u32(&mut x391, x389, x376, x362); + let mut x392: u32 = 0; + fiat_p224_cmovznz_u32(&mut x392, x389, x378, x364); + let mut x393: u32 = 0; + fiat_p224_cmovznz_u32(&mut x393, x389, x380, x366); + let mut x394: u32 = 0; + fiat_p224_cmovznz_u32(&mut x394, x389, x382, x368); + let mut x395: u32 = 0; + fiat_p224_cmovznz_u32(&mut x395, x389, x384, x370); + let mut x396: u32 = 0; + fiat_p224_cmovznz_u32(&mut x396, x389, x386, x372); + out1[0] = x390; + out1[1] = x391; + out1[2] = x392; + out1[3] = x393; + out1[4] = x394; + out1[5] = x395; + out1[6] = x396; +} + +/// The function fiat_p224_nonzero outputs a single non-zero word if the input is non-zero and zero otherwise. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// out1 = 0 ↔ eval (from_montgomery arg1) mod m = 0 +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +#[inline] +pub fn fiat_p224_nonzero(out1: &mut u32, arg1: &[u32; 7]) -> () { + let x1: u32 = ((arg1[0]) | ((arg1[1]) | ((arg1[2]) | ((arg1[3]) | ((arg1[4]) | ((arg1[5]) | (arg1[6]))))))); + *out1 = x1; +} + +/// The function fiat_p224_selectznz is a multi-limb conditional select. +/// +/// Postconditions: +/// out1 = (if arg1 = 0 then arg2 else arg3) +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// arg3: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +#[inline] +pub fn fiat_p224_selectznz(out1: &mut [u32; 7], arg1: fiat_p224_u1, arg2: &[u32; 7], arg3: &[u32; 7]) -> () { + let mut x1: u32 = 0; + fiat_p224_cmovznz_u32(&mut x1, arg1, (arg2[0]), (arg3[0])); + let mut x2: u32 = 0; + fiat_p224_cmovznz_u32(&mut x2, arg1, (arg2[1]), (arg3[1])); + let mut x3: u32 = 0; + fiat_p224_cmovznz_u32(&mut x3, arg1, (arg2[2]), (arg3[2])); + let mut x4: u32 = 0; + fiat_p224_cmovznz_u32(&mut x4, arg1, (arg2[3]), (arg3[3])); + let mut x5: u32 = 0; + fiat_p224_cmovznz_u32(&mut x5, arg1, (arg2[4]), (arg3[4])); + let mut x6: u32 = 0; + fiat_p224_cmovznz_u32(&mut x6, arg1, (arg2[5]), (arg3[5])); + let mut x7: u32 = 0; + fiat_p224_cmovznz_u32(&mut x7, arg1, (arg2[6]), (arg3[6])); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; + out1[3] = x4; + out1[4] = x5; + out1[5] = x6; + out1[6] = x7; +} + +/// The function fiat_p224_to_bytes serializes a field element NOT in the Montgomery domain to bytes in little-endian order. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..27] +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] +#[inline] +pub fn fiat_p224_to_bytes(out1: &mut [u8; 28], arg1: &[u32; 7]) -> () { + let x1: u32 = (arg1[6]); + let x2: u32 = (arg1[5]); + let x3: u32 = (arg1[4]); + let x4: u32 = (arg1[3]); + let x5: u32 = (arg1[2]); + let x6: u32 = (arg1[1]); + let x7: u32 = (arg1[0]); + let x8: u8 = ((x7 & (0xff as u32)) as u8); + let x9: u32 = (x7 >> 8); + let x10: u8 = ((x9 & (0xff as u32)) as u8); + let x11: u32 = (x9 >> 8); + let x12: u8 = ((x11 & (0xff as u32)) as u8); + let x13: u8 = ((x11 >> 8) as u8); + let x14: u8 = ((x6 & (0xff as u32)) as u8); + let x15: u32 = (x6 >> 8); + let x16: u8 = ((x15 & (0xff as u32)) as u8); + let x17: u32 = (x15 >> 8); + let x18: u8 = ((x17 & (0xff as u32)) as u8); + let x19: u8 = ((x17 >> 8) as u8); + let x20: u8 = ((x5 & (0xff as u32)) as u8); + let x21: u32 = (x5 >> 8); + let x22: u8 = ((x21 & (0xff as u32)) as u8); + let x23: u32 = (x21 >> 8); + let x24: u8 = ((x23 & (0xff as u32)) as u8); + let x25: u8 = ((x23 >> 8) as u8); + let x26: u8 = ((x4 & (0xff as u32)) as u8); + let x27: u32 = (x4 >> 8); + let x28: u8 = ((x27 & (0xff as u32)) as u8); + let x29: u32 = (x27 >> 8); + let x30: u8 = ((x29 & (0xff as u32)) as u8); + let x31: u8 = ((x29 >> 8) as u8); + let x32: u8 = ((x3 & (0xff as u32)) as u8); + let x33: u32 = (x3 >> 8); + let x34: u8 = ((x33 & (0xff as u32)) as u8); + let x35: u32 = (x33 >> 8); + let x36: u8 = ((x35 & (0xff as u32)) as u8); + let x37: u8 = ((x35 >> 8) as u8); + let x38: u8 = ((x2 & (0xff as u32)) as u8); + let x39: u32 = (x2 >> 8); + let x40: u8 = ((x39 & (0xff as u32)) as u8); + let x41: u32 = (x39 >> 8); + let x42: u8 = ((x41 & (0xff as u32)) as u8); + let x43: u8 = ((x41 >> 8) as u8); + let x44: u8 = ((x1 & (0xff as u32)) as u8); + let x45: u32 = (x1 >> 8); + let x46: u8 = ((x45 & (0xff as u32)) as u8); + let x47: u32 = (x45 >> 8); + let x48: u8 = ((x47 & (0xff as u32)) as u8); + let x49: u8 = ((x47 >> 8) as u8); + out1[0] = x8; + out1[1] = x10; + out1[2] = x12; + out1[3] = x13; + out1[4] = x14; + out1[5] = x16; + out1[6] = x18; + out1[7] = x19; + out1[8] = x20; + out1[9] = x22; + out1[10] = x24; + out1[11] = x25; + out1[12] = x26; + out1[13] = x28; + out1[14] = x30; + out1[15] = x31; + out1[16] = x32; + out1[17] = x34; + out1[18] = x36; + out1[19] = x37; + out1[20] = x38; + out1[21] = x40; + out1[22] = x42; + out1[23] = x43; + out1[24] = x44; + out1[25] = x46; + out1[26] = x48; + out1[27] = x49; +} + +/// The function fiat_p224_from_bytes deserializes a field element NOT in the Montgomery domain from bytes in little-endian order. +/// +/// Preconditions: +/// 0 ≤ bytes_eval arg1 < m +/// Postconditions: +/// eval out1 mod m = bytes_eval arg1 mod m +/// 0 ≤ eval out1 < m +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +#[inline] +pub fn fiat_p224_from_bytes(out1: &mut [u32; 7], arg1: &[u8; 28]) -> () { + let x1: u32 = (((arg1[27]) as u32) << 24); + let x2: u32 = (((arg1[26]) as u32) << 16); + let x3: u32 = (((arg1[25]) as u32) << 8); + let x4: u8 = (arg1[24]); + let x5: u32 = (((arg1[23]) as u32) << 24); + let x6: u32 = (((arg1[22]) as u32) << 16); + let x7: u32 = (((arg1[21]) as u32) << 8); + let x8: u8 = (arg1[20]); + let x9: u32 = (((arg1[19]) as u32) << 24); + let x10: u32 = (((arg1[18]) as u32) << 16); + let x11: u32 = (((arg1[17]) as u32) << 8); + let x12: u8 = (arg1[16]); + let x13: u32 = (((arg1[15]) as u32) << 24); + let x14: u32 = (((arg1[14]) as u32) << 16); + let x15: u32 = (((arg1[13]) as u32) << 8); + let x16: u8 = (arg1[12]); + let x17: u32 = (((arg1[11]) as u32) << 24); + let x18: u32 = (((arg1[10]) as u32) << 16); + let x19: u32 = (((arg1[9]) as u32) << 8); + let x20: u8 = (arg1[8]); + let x21: u32 = (((arg1[7]) as u32) << 24); + let x22: u32 = (((arg1[6]) as u32) << 16); + let x23: u32 = (((arg1[5]) as u32) << 8); + let x24: u8 = (arg1[4]); + let x25: u32 = (((arg1[3]) as u32) << 24); + let x26: u32 = (((arg1[2]) as u32) << 16); + let x27: u32 = (((arg1[1]) as u32) << 8); + let x28: u8 = (arg1[0]); + let x29: u32 = (x27 + (x28 as u32)); + let x30: u32 = (x26 + x29); + let x31: u32 = (x25 + x30); + let x32: u32 = (x23 + (x24 as u32)); + let x33: u32 = (x22 + x32); + let x34: u32 = (x21 + x33); + let x35: u32 = (x19 + (x20 as u32)); + let x36: u32 = (x18 + x35); + let x37: u32 = (x17 + x36); + let x38: u32 = (x15 + (x16 as u32)); + let x39: u32 = (x14 + x38); + let x40: u32 = (x13 + x39); + let x41: u32 = (x11 + (x12 as u32)); + let x42: u32 = (x10 + x41); + let x43: u32 = (x9 + x42); + let x44: u32 = (x7 + (x8 as u32)); + let x45: u32 = (x6 + x44); + let x46: u32 = (x5 + x45); + let x47: u32 = (x3 + (x4 as u32)); + let x48: u32 = (x2 + x47); + let x49: u32 = (x1 + x48); + out1[0] = x31; + out1[1] = x34; + out1[2] = x37; + out1[3] = x40; + out1[4] = x43; + out1[5] = x46; + out1[6] = x49; +} + +/// The function fiat_p224_set_one returns the field element one in the Montgomery domain. +/// +/// Postconditions: +/// eval (from_montgomery out1) mod m = 1 mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p224_set_one(out1: &mut fiat_p224_montgomery_domain_field_element) -> () { + out1[0] = 0xffffffff; + out1[1] = 0xffffffff; + out1[2] = 0xffffffff; + out1[3] = (0x0 as u32); + out1[4] = (0x0 as u32); + out1[5] = (0x0 as u32); + out1[6] = (0x0 as u32); +} + +/// The function fiat_p224_msat returns the saturated representation of the prime modulus. +/// +/// Postconditions: +/// twos_complement_eval out1 = m +/// 0 ≤ eval out1 < m +/// +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +#[inline] +pub fn fiat_p224_msat(out1: &mut [u32; 8]) -> () { + out1[0] = (0x1 as u32); + out1[1] = (0x0 as u32); + out1[2] = (0x0 as u32); + out1[3] = 0xffffffff; + out1[4] = 0xffffffff; + out1[5] = 0xffffffff; + out1[6] = 0xffffffff; + out1[7] = (0x0 as u32); +} + +/// The function fiat_p224_divstep computes a divstep. +/// +/// Preconditions: +/// 0 ≤ eval arg4 < m +/// 0 ≤ eval arg5 < m +/// Postconditions: +/// out1 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then 1 - arg1 else 1 + arg1) +/// twos_complement_eval out2 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then twos_complement_eval arg3 else twos_complement_eval arg2) +/// twos_complement_eval out3 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then ⌊(twos_complement_eval arg3 - twos_complement_eval arg2) / 2⌋ else ⌊(twos_complement_eval arg3 + (twos_complement_eval arg3 mod 2) * twos_complement_eval arg2) / 2⌋) +/// eval (from_montgomery out4) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (2 * eval (from_montgomery arg5)) mod m else (2 * eval (from_montgomery arg4)) mod m) +/// eval (from_montgomery out5) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (eval (from_montgomery arg4) - eval (from_montgomery arg4)) mod m else (eval (from_montgomery arg5) + (twos_complement_eval arg3 mod 2) * eval (from_montgomery arg4)) mod m) +/// 0 ≤ eval out5 < m +/// 0 ≤ eval out5 < m +/// 0 ≤ eval out2 < m +/// 0 ≤ eval out3 < m +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0xffffffff] +/// arg2: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// arg3: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// arg4: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// arg5: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +/// out2: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// out3: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// out4: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// out5: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +#[inline] +pub fn fiat_p224_divstep(out1: &mut u32, out2: &mut [u32; 8], out3: &mut [u32; 8], out4: &mut [u32; 7], out5: &mut [u32; 7], arg1: u32, arg2: &[u32; 8], arg3: &[u32; 8], arg4: &[u32; 7], arg5: &[u32; 7]) -> () { + let mut x1: u32 = 0; + let mut x2: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x1, &mut x2, 0x0, (!arg1), (0x1 as u32)); + let x3: fiat_p224_u1 = (((x1 >> 31) as fiat_p224_u1) & (((arg3[0]) & (0x1 as u32)) as fiat_p224_u1)); + let mut x4: u32 = 0; + let mut x5: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x4, &mut x5, 0x0, (!arg1), (0x1 as u32)); + let mut x6: u32 = 0; + fiat_p224_cmovznz_u32(&mut x6, x3, arg1, x4); + let mut x7: u32 = 0; + fiat_p224_cmovznz_u32(&mut x7, x3, (arg2[0]), (arg3[0])); + let mut x8: u32 = 0; + fiat_p224_cmovznz_u32(&mut x8, x3, (arg2[1]), (arg3[1])); + let mut x9: u32 = 0; + fiat_p224_cmovznz_u32(&mut x9, x3, (arg2[2]), (arg3[2])); + let mut x10: u32 = 0; + fiat_p224_cmovznz_u32(&mut x10, x3, (arg2[3]), (arg3[3])); + let mut x11: u32 = 0; + fiat_p224_cmovznz_u32(&mut x11, x3, (arg2[4]), (arg3[4])); + let mut x12: u32 = 0; + fiat_p224_cmovznz_u32(&mut x12, x3, (arg2[5]), (arg3[5])); + let mut x13: u32 = 0; + fiat_p224_cmovznz_u32(&mut x13, x3, (arg2[6]), (arg3[6])); + let mut x14: u32 = 0; + fiat_p224_cmovznz_u32(&mut x14, x3, (arg2[7]), (arg3[7])); + let mut x15: u32 = 0; + let mut x16: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x15, &mut x16, 0x0, (0x1 as u32), (!(arg2[0]))); + let mut x17: u32 = 0; + let mut x18: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x17, &mut x18, x16, (0x0 as u32), (!(arg2[1]))); + let mut x19: u32 = 0; + let mut x20: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x19, &mut x20, x18, (0x0 as u32), (!(arg2[2]))); + let mut x21: u32 = 0; + let mut x22: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x21, &mut x22, x20, (0x0 as u32), (!(arg2[3]))); + let mut x23: u32 = 0; + let mut x24: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x23, &mut x24, x22, (0x0 as u32), (!(arg2[4]))); + let mut x25: u32 = 0; + let mut x26: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x25, &mut x26, x24, (0x0 as u32), (!(arg2[5]))); + let mut x27: u32 = 0; + let mut x28: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x27, &mut x28, x26, (0x0 as u32), (!(arg2[6]))); + let mut x29: u32 = 0; + let mut x30: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x29, &mut x30, x28, (0x0 as u32), (!(arg2[7]))); + let mut x31: u32 = 0; + fiat_p224_cmovznz_u32(&mut x31, x3, (arg3[0]), x15); + let mut x32: u32 = 0; + fiat_p224_cmovznz_u32(&mut x32, x3, (arg3[1]), x17); + let mut x33: u32 = 0; + fiat_p224_cmovznz_u32(&mut x33, x3, (arg3[2]), x19); + let mut x34: u32 = 0; + fiat_p224_cmovznz_u32(&mut x34, x3, (arg3[3]), x21); + let mut x35: u32 = 0; + fiat_p224_cmovznz_u32(&mut x35, x3, (arg3[4]), x23); + let mut x36: u32 = 0; + fiat_p224_cmovznz_u32(&mut x36, x3, (arg3[5]), x25); + let mut x37: u32 = 0; + fiat_p224_cmovznz_u32(&mut x37, x3, (arg3[6]), x27); + let mut x38: u32 = 0; + fiat_p224_cmovznz_u32(&mut x38, x3, (arg3[7]), x29); + let mut x39: u32 = 0; + fiat_p224_cmovznz_u32(&mut x39, x3, (arg4[0]), (arg5[0])); + let mut x40: u32 = 0; + fiat_p224_cmovznz_u32(&mut x40, x3, (arg4[1]), (arg5[1])); + let mut x41: u32 = 0; + fiat_p224_cmovznz_u32(&mut x41, x3, (arg4[2]), (arg5[2])); + let mut x42: u32 = 0; + fiat_p224_cmovznz_u32(&mut x42, x3, (arg4[3]), (arg5[3])); + let mut x43: u32 = 0; + fiat_p224_cmovznz_u32(&mut x43, x3, (arg4[4]), (arg5[4])); + let mut x44: u32 = 0; + fiat_p224_cmovznz_u32(&mut x44, x3, (arg4[5]), (arg5[5])); + let mut x45: u32 = 0; + fiat_p224_cmovznz_u32(&mut x45, x3, (arg4[6]), (arg5[6])); + let mut x46: u32 = 0; + let mut x47: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x46, &mut x47, 0x0, x39, x39); + let mut x48: u32 = 0; + let mut x49: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x48, &mut x49, x47, x40, x40); + let mut x50: u32 = 0; + let mut x51: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x50, &mut x51, x49, x41, x41); + let mut x52: u32 = 0; + let mut x53: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x52, &mut x53, x51, x42, x42); + let mut x54: u32 = 0; + let mut x55: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x54, &mut x55, x53, x43, x43); + let mut x56: u32 = 0; + let mut x57: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x56, &mut x57, x55, x44, x44); + let mut x58: u32 = 0; + let mut x59: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x58, &mut x59, x57, x45, x45); + let mut x60: u32 = 0; + let mut x61: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x60, &mut x61, 0x0, x46, (0x1 as u32)); + let mut x62: u32 = 0; + let mut x63: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x62, &mut x63, x61, x48, (0x0 as u32)); + let mut x64: u32 = 0; + let mut x65: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x64, &mut x65, x63, x50, (0x0 as u32)); + let mut x66: u32 = 0; + let mut x67: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x66, &mut x67, x65, x52, 0xffffffff); + let mut x68: u32 = 0; + let mut x69: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x68, &mut x69, x67, x54, 0xffffffff); + let mut x70: u32 = 0; + let mut x71: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x70, &mut x71, x69, x56, 0xffffffff); + let mut x72: u32 = 0; + let mut x73: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x72, &mut x73, x71, x58, 0xffffffff); + let mut x74: u32 = 0; + let mut x75: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x74, &mut x75, x73, (x59 as u32), (0x0 as u32)); + let x76: u32 = (arg4[6]); + let x77: u32 = (arg4[5]); + let x78: u32 = (arg4[4]); + let x79: u32 = (arg4[3]); + let x80: u32 = (arg4[2]); + let x81: u32 = (arg4[1]); + let x82: u32 = (arg4[0]); + let mut x83: u32 = 0; + let mut x84: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x83, &mut x84, 0x0, (0x0 as u32), x82); + let mut x85: u32 = 0; + let mut x86: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x85, &mut x86, x84, (0x0 as u32), x81); + let mut x87: u32 = 0; + let mut x88: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x87, &mut x88, x86, (0x0 as u32), x80); + let mut x89: u32 = 0; + let mut x90: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x89, &mut x90, x88, (0x0 as u32), x79); + let mut x91: u32 = 0; + let mut x92: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x91, &mut x92, x90, (0x0 as u32), x78); + let mut x93: u32 = 0; + let mut x94: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x93, &mut x94, x92, (0x0 as u32), x77); + let mut x95: u32 = 0; + let mut x96: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x95, &mut x96, x94, (0x0 as u32), x76); + let mut x97: u32 = 0; + fiat_p224_cmovznz_u32(&mut x97, x96, (0x0 as u32), 0xffffffff); + let mut x98: u32 = 0; + let mut x99: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x98, &mut x99, 0x0, x83, (((x97 & (0x1 as u32)) as fiat_p224_u1) as u32)); + let mut x100: u32 = 0; + let mut x101: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x100, &mut x101, x99, x85, (0x0 as u32)); + let mut x102: u32 = 0; + let mut x103: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x102, &mut x103, x101, x87, (0x0 as u32)); + let mut x104: u32 = 0; + let mut x105: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x104, &mut x105, x103, x89, x97); + let mut x106: u32 = 0; + let mut x107: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x106, &mut x107, x105, x91, x97); + let mut x108: u32 = 0; + let mut x109: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x108, &mut x109, x107, x93, x97); + let mut x110: u32 = 0; + let mut x111: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x110, &mut x111, x109, x95, x97); + let mut x112: u32 = 0; + fiat_p224_cmovznz_u32(&mut x112, x3, (arg5[0]), x98); + let mut x113: u32 = 0; + fiat_p224_cmovznz_u32(&mut x113, x3, (arg5[1]), x100); + let mut x114: u32 = 0; + fiat_p224_cmovznz_u32(&mut x114, x3, (arg5[2]), x102); + let mut x115: u32 = 0; + fiat_p224_cmovznz_u32(&mut x115, x3, (arg5[3]), x104); + let mut x116: u32 = 0; + fiat_p224_cmovznz_u32(&mut x116, x3, (arg5[4]), x106); + let mut x117: u32 = 0; + fiat_p224_cmovznz_u32(&mut x117, x3, (arg5[5]), x108); + let mut x118: u32 = 0; + fiat_p224_cmovznz_u32(&mut x118, x3, (arg5[6]), x110); + let x119: fiat_p224_u1 = ((x31 & (0x1 as u32)) as fiat_p224_u1); + let mut x120: u32 = 0; + fiat_p224_cmovznz_u32(&mut x120, x119, (0x0 as u32), x7); + let mut x121: u32 = 0; + fiat_p224_cmovznz_u32(&mut x121, x119, (0x0 as u32), x8); + let mut x122: u32 = 0; + fiat_p224_cmovznz_u32(&mut x122, x119, (0x0 as u32), x9); + let mut x123: u32 = 0; + fiat_p224_cmovznz_u32(&mut x123, x119, (0x0 as u32), x10); + let mut x124: u32 = 0; + fiat_p224_cmovznz_u32(&mut x124, x119, (0x0 as u32), x11); + let mut x125: u32 = 0; + fiat_p224_cmovznz_u32(&mut x125, x119, (0x0 as u32), x12); + let mut x126: u32 = 0; + fiat_p224_cmovznz_u32(&mut x126, x119, (0x0 as u32), x13); + let mut x127: u32 = 0; + fiat_p224_cmovznz_u32(&mut x127, x119, (0x0 as u32), x14); + let mut x128: u32 = 0; + let mut x129: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x128, &mut x129, 0x0, x31, x120); + let mut x130: u32 = 0; + let mut x131: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x130, &mut x131, x129, x32, x121); + let mut x132: u32 = 0; + let mut x133: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x132, &mut x133, x131, x33, x122); + let mut x134: u32 = 0; + let mut x135: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x134, &mut x135, x133, x34, x123); + let mut x136: u32 = 0; + let mut x137: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x136, &mut x137, x135, x35, x124); + let mut x138: u32 = 0; + let mut x139: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x138, &mut x139, x137, x36, x125); + let mut x140: u32 = 0; + let mut x141: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x140, &mut x141, x139, x37, x126); + let mut x142: u32 = 0; + let mut x143: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x142, &mut x143, x141, x38, x127); + let mut x144: u32 = 0; + fiat_p224_cmovznz_u32(&mut x144, x119, (0x0 as u32), x39); + let mut x145: u32 = 0; + fiat_p224_cmovznz_u32(&mut x145, x119, (0x0 as u32), x40); + let mut x146: u32 = 0; + fiat_p224_cmovznz_u32(&mut x146, x119, (0x0 as u32), x41); + let mut x147: u32 = 0; + fiat_p224_cmovznz_u32(&mut x147, x119, (0x0 as u32), x42); + let mut x148: u32 = 0; + fiat_p224_cmovznz_u32(&mut x148, x119, (0x0 as u32), x43); + let mut x149: u32 = 0; + fiat_p224_cmovznz_u32(&mut x149, x119, (0x0 as u32), x44); + let mut x150: u32 = 0; + fiat_p224_cmovznz_u32(&mut x150, x119, (0x0 as u32), x45); + let mut x151: u32 = 0; + let mut x152: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x151, &mut x152, 0x0, x112, x144); + let mut x153: u32 = 0; + let mut x154: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x153, &mut x154, x152, x113, x145); + let mut x155: u32 = 0; + let mut x156: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x155, &mut x156, x154, x114, x146); + let mut x157: u32 = 0; + let mut x158: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x157, &mut x158, x156, x115, x147); + let mut x159: u32 = 0; + let mut x160: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x159, &mut x160, x158, x116, x148); + let mut x161: u32 = 0; + let mut x162: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x161, &mut x162, x160, x117, x149); + let mut x163: u32 = 0; + let mut x164: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x163, &mut x164, x162, x118, x150); + let mut x165: u32 = 0; + let mut x166: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x165, &mut x166, 0x0, x151, (0x1 as u32)); + let mut x167: u32 = 0; + let mut x168: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x167, &mut x168, x166, x153, (0x0 as u32)); + let mut x169: u32 = 0; + let mut x170: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x169, &mut x170, x168, x155, (0x0 as u32)); + let mut x171: u32 = 0; + let mut x172: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x171, &mut x172, x170, x157, 0xffffffff); + let mut x173: u32 = 0; + let mut x174: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x173, &mut x174, x172, x159, 0xffffffff); + let mut x175: u32 = 0; + let mut x176: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x175, &mut x176, x174, x161, 0xffffffff); + let mut x177: u32 = 0; + let mut x178: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x177, &mut x178, x176, x163, 0xffffffff); + let mut x179: u32 = 0; + let mut x180: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u32(&mut x179, &mut x180, x178, (x164 as u32), (0x0 as u32)); + let mut x181: u32 = 0; + let mut x182: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u32(&mut x181, &mut x182, 0x0, x6, (0x1 as u32)); + let x183: u32 = ((x128 >> 1) | ((x130 << 31) & 0xffffffff)); + let x184: u32 = ((x130 >> 1) | ((x132 << 31) & 0xffffffff)); + let x185: u32 = ((x132 >> 1) | ((x134 << 31) & 0xffffffff)); + let x186: u32 = ((x134 >> 1) | ((x136 << 31) & 0xffffffff)); + let x187: u32 = ((x136 >> 1) | ((x138 << 31) & 0xffffffff)); + let x188: u32 = ((x138 >> 1) | ((x140 << 31) & 0xffffffff)); + let x189: u32 = ((x140 >> 1) | ((x142 << 31) & 0xffffffff)); + let x190: u32 = ((x142 & 0x80000000) | (x142 >> 1)); + let mut x191: u32 = 0; + fiat_p224_cmovznz_u32(&mut x191, x75, x60, x46); + let mut x192: u32 = 0; + fiat_p224_cmovznz_u32(&mut x192, x75, x62, x48); + let mut x193: u32 = 0; + fiat_p224_cmovznz_u32(&mut x193, x75, x64, x50); + let mut x194: u32 = 0; + fiat_p224_cmovznz_u32(&mut x194, x75, x66, x52); + let mut x195: u32 = 0; + fiat_p224_cmovznz_u32(&mut x195, x75, x68, x54); + let mut x196: u32 = 0; + fiat_p224_cmovznz_u32(&mut x196, x75, x70, x56); + let mut x197: u32 = 0; + fiat_p224_cmovznz_u32(&mut x197, x75, x72, x58); + let mut x198: u32 = 0; + fiat_p224_cmovznz_u32(&mut x198, x180, x165, x151); + let mut x199: u32 = 0; + fiat_p224_cmovznz_u32(&mut x199, x180, x167, x153); + let mut x200: u32 = 0; + fiat_p224_cmovznz_u32(&mut x200, x180, x169, x155); + let mut x201: u32 = 0; + fiat_p224_cmovznz_u32(&mut x201, x180, x171, x157); + let mut x202: u32 = 0; + fiat_p224_cmovznz_u32(&mut x202, x180, x173, x159); + let mut x203: u32 = 0; + fiat_p224_cmovznz_u32(&mut x203, x180, x175, x161); + let mut x204: u32 = 0; + fiat_p224_cmovznz_u32(&mut x204, x180, x177, x163); + *out1 = x181; + out2[0] = x7; + out2[1] = x8; + out2[2] = x9; + out2[3] = x10; + out2[4] = x11; + out2[5] = x12; + out2[6] = x13; + out2[7] = x14; + out3[0] = x183; + out3[1] = x184; + out3[2] = x185; + out3[3] = x186; + out3[4] = x187; + out3[5] = x188; + out3[6] = x189; + out3[7] = x190; + out4[0] = x191; + out4[1] = x192; + out4[2] = x193; + out4[3] = x194; + out4[4] = x195; + out4[5] = x196; + out4[6] = x197; + out5[0] = x198; + out5[1] = x199; + out5[2] = x200; + out5[3] = x201; + out5[4] = x202; + out5[5] = x203; + out5[6] = x204; +} + +/// The function fiat_p224_divstep_precomp returns the precomputed value for Bernstein-Yang-inversion (in montgomery form). +/// +/// Postconditions: +/// eval (from_montgomery out1) = ⌊(m - 1) / 2⌋^(if ⌊log2 m⌋ + 1 < 46 then ⌊(49 * (⌊log2 m⌋ + 1) + 80) / 17⌋ else ⌊(49 * (⌊log2 m⌋ + 1) + 57) / 17⌋) +/// 0 ≤ eval out1 < m +/// +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +#[inline] +pub fn fiat_p224_divstep_precomp(out1: &mut [u32; 7]) -> () { + out1[0] = 0x800000; + out1[1] = 0x800000; + out1[2] = 0xfe000000; + out1[3] = 0xffffff; + out1[4] = (0x0 as u32); + out1[5] = 0xff800000; + out1[6] = 0x17fffff; +} diff --git a/vendor/fiat-crypto/src/p224_64.rs b/vendor/fiat-crypto/src/p224_64.rs new file mode 100644 index 000000000..785eac405 --- /dev/null +++ b/vendor/fiat-crypto/src/p224_64.rs @@ -0,0 +1,1870 @@ +//! Autogenerated: 'src/ExtractionOCaml/word_by_word_montgomery' --lang Rust --inline p224 64 '2^224 - 2^96 + 1' mul square add sub opp from_montgomery to_montgomery nonzero selectznz to_bytes from_bytes one msat divstep divstep_precomp +//! curve description: p224 +//! machine_wordsize = 64 (from "64") +//! requested operations: mul, square, add, sub, opp, from_montgomery, to_montgomery, nonzero, selectznz, to_bytes, from_bytes, one, msat, divstep, divstep_precomp +//! m = 0xffffffffffffffffffffffffffffffff000000000000000000000001 (from "2^224 - 2^96 + 1") +//! +//! NOTE: In addition to the bounds specified above each function, all +//! functions synthesized for this Montgomery arithmetic require the +//! input to be strictly less than the prime modulus (m), and also +//! require the input to be in the unique saturated representation. +//! All functions also ensure that these two properties are true of +//! return values. +//! +//! Computed values: +//! eval z = z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) +//! bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) +//! twos_complement_eval z = let x1 := z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) in +//! if x1 & (2^256-1) < 2^255 then x1 & (2^256-1) else (x1 & (2^256-1)) - 2^256 + +#![allow(unused_parens)] +#![allow(non_camel_case_types)] + +pub type fiat_p224_u1 = u8; +pub type fiat_p224_i1 = i8; +pub type fiat_p224_u2 = u8; +pub type fiat_p224_i2 = i8; + +/* The type fiat_p224_montgomery_domain_field_element is a field element in the Montgomery domain. */ +/* Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] */ +pub type fiat_p224_montgomery_domain_field_element = [u64; 4]; + +/* The type fiat_p224_non_montgomery_domain_field_element is a field element NOT in the Montgomery domain. */ +/* Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] */ +pub type fiat_p224_non_montgomery_domain_field_element = [u64; 4]; + + +/// The function fiat_p224_addcarryx_u64 is an addition with carry. +/// +/// Postconditions: +/// out1 = (arg1 + arg2 + arg3) mod 2^64 +/// out2 = ⌊(arg1 + arg2 + arg3) / 2^64⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffffffffffff] +/// arg3: [0x0 ~> 0xffffffffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_p224_addcarryx_u64(out1: &mut u64, out2: &mut fiat_p224_u1, arg1: fiat_p224_u1, arg2: u64, arg3: u64) -> () { + let x1: u128 = (((arg1 as u128) + (arg2 as u128)) + (arg3 as u128)); + let x2: u64 = ((x1 & (0xffffffffffffffff as u128)) as u64); + let x3: fiat_p224_u1 = ((x1 >> 64) as fiat_p224_u1); + *out1 = x2; + *out2 = x3; +} + +/// The function fiat_p224_subborrowx_u64 is a subtraction with borrow. +/// +/// Postconditions: +/// out1 = (-arg1 + arg2 + -arg3) mod 2^64 +/// out2 = -⌊(-arg1 + arg2 + -arg3) / 2^64⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffffffffffff] +/// arg3: [0x0 ~> 0xffffffffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_p224_subborrowx_u64(out1: &mut u64, out2: &mut fiat_p224_u1, arg1: fiat_p224_u1, arg2: u64, arg3: u64) -> () { + let x1: i128 = (((arg2 as i128) - (arg1 as i128)) - (arg3 as i128)); + let x2: fiat_p224_i1 = ((x1 >> 64) as fiat_p224_i1); + let x3: u64 = ((x1 & (0xffffffffffffffff as i128)) as u64); + *out1 = x3; + *out2 = (((0x0 as fiat_p224_i2) - (x2 as fiat_p224_i2)) as fiat_p224_u1); +} + +/// The function fiat_p224_mulx_u64 is a multiplication, returning the full double-width result. +/// +/// Postconditions: +/// out1 = (arg1 * arg2) mod 2^64 +/// out2 = ⌊arg1 * arg2 / 2^64⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0xffffffffffffffff] +/// arg2: [0x0 ~> 0xffffffffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +/// out2: [0x0 ~> 0xffffffffffffffff] +#[inline] +pub fn fiat_p224_mulx_u64(out1: &mut u64, out2: &mut u64, arg1: u64, arg2: u64) -> () { + let x1: u128 = ((arg1 as u128) * (arg2 as u128)); + let x2: u64 = ((x1 & (0xffffffffffffffff as u128)) as u64); + let x3: u64 = ((x1 >> 64) as u64); + *out1 = x2; + *out2 = x3; +} + +/// The function fiat_p224_cmovznz_u64 is a single-word conditional move. +/// +/// Postconditions: +/// out1 = (if arg1 = 0 then arg2 else arg3) +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffffffffffff] +/// arg3: [0x0 ~> 0xffffffffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +#[inline] +pub fn fiat_p224_cmovznz_u64(out1: &mut u64, arg1: fiat_p224_u1, arg2: u64, arg3: u64) -> () { + let x1: fiat_p224_u1 = (!(!arg1)); + let x2: u64 = ((((((0x0 as fiat_p224_i2) - (x1 as fiat_p224_i2)) as fiat_p224_i1) as i128) & (0xffffffffffffffff as i128)) as u64); + let x3: u64 = ((x2 & arg3) | ((!x2) & arg2)); + *out1 = x3; +} + +/// The function fiat_p224_mul multiplies two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p224_mul(out1: &mut fiat_p224_montgomery_domain_field_element, arg1: &fiat_p224_montgomery_domain_field_element, arg2: &fiat_p224_montgomery_domain_field_element) -> () { + let x1: u64 = (arg1[1]); + let x2: u64 = (arg1[2]); + let x3: u64 = (arg1[3]); + let x4: u64 = (arg1[0]); + let mut x5: u64 = 0; + let mut x6: u64 = 0; + fiat_p224_mulx_u64(&mut x5, &mut x6, x4, (arg2[3])); + let mut x7: u64 = 0; + let mut x8: u64 = 0; + fiat_p224_mulx_u64(&mut x7, &mut x8, x4, (arg2[2])); + let mut x9: u64 = 0; + let mut x10: u64 = 0; + fiat_p224_mulx_u64(&mut x9, &mut x10, x4, (arg2[1])); + let mut x11: u64 = 0; + let mut x12: u64 = 0; + fiat_p224_mulx_u64(&mut x11, &mut x12, x4, (arg2[0])); + let mut x13: u64 = 0; + let mut x14: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x13, &mut x14, 0x0, x12, x9); + let mut x15: u64 = 0; + let mut x16: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x15, &mut x16, x14, x10, x7); + let mut x17: u64 = 0; + let mut x18: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x17, &mut x18, x16, x8, x5); + let x19: u64 = ((x18 as u64) + x6); + let mut x20: u64 = 0; + let mut x21: u64 = 0; + fiat_p224_mulx_u64(&mut x20, &mut x21, x11, 0xffffffffffffffff); + let mut x22: u64 = 0; + let mut x23: u64 = 0; + fiat_p224_mulx_u64(&mut x22, &mut x23, x20, 0xffffffff); + let mut x24: u64 = 0; + let mut x25: u64 = 0; + fiat_p224_mulx_u64(&mut x24, &mut x25, x20, 0xffffffffffffffff); + let mut x26: u64 = 0; + let mut x27: u64 = 0; + fiat_p224_mulx_u64(&mut x26, &mut x27, x20, 0xffffffff00000000); + let mut x28: u64 = 0; + let mut x29: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x28, &mut x29, 0x0, x27, x24); + let mut x30: u64 = 0; + let mut x31: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x30, &mut x31, x29, x25, x22); + let x32: u64 = ((x31 as u64) + x23); + let mut x33: u64 = 0; + let mut x34: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x33, &mut x34, 0x0, x11, x20); + let mut x35: u64 = 0; + let mut x36: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x35, &mut x36, x34, x13, x26); + let mut x37: u64 = 0; + let mut x38: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x37, &mut x38, x36, x15, x28); + let mut x39: u64 = 0; + let mut x40: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x39, &mut x40, x38, x17, x30); + let mut x41: u64 = 0; + let mut x42: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x41, &mut x42, x40, x19, x32); + let mut x43: u64 = 0; + let mut x44: u64 = 0; + fiat_p224_mulx_u64(&mut x43, &mut x44, x1, (arg2[3])); + let mut x45: u64 = 0; + let mut x46: u64 = 0; + fiat_p224_mulx_u64(&mut x45, &mut x46, x1, (arg2[2])); + let mut x47: u64 = 0; + let mut x48: u64 = 0; + fiat_p224_mulx_u64(&mut x47, &mut x48, x1, (arg2[1])); + let mut x49: u64 = 0; + let mut x50: u64 = 0; + fiat_p224_mulx_u64(&mut x49, &mut x50, x1, (arg2[0])); + let mut x51: u64 = 0; + let mut x52: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x51, &mut x52, 0x0, x50, x47); + let mut x53: u64 = 0; + let mut x54: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x53, &mut x54, x52, x48, x45); + let mut x55: u64 = 0; + let mut x56: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x55, &mut x56, x54, x46, x43); + let x57: u64 = ((x56 as u64) + x44); + let mut x58: u64 = 0; + let mut x59: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x58, &mut x59, 0x0, x35, x49); + let mut x60: u64 = 0; + let mut x61: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x60, &mut x61, x59, x37, x51); + let mut x62: u64 = 0; + let mut x63: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x62, &mut x63, x61, x39, x53); + let mut x64: u64 = 0; + let mut x65: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x64, &mut x65, x63, x41, x55); + let mut x66: u64 = 0; + let mut x67: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x66, &mut x67, x65, (x42 as u64), x57); + let mut x68: u64 = 0; + let mut x69: u64 = 0; + fiat_p224_mulx_u64(&mut x68, &mut x69, x58, 0xffffffffffffffff); + let mut x70: u64 = 0; + let mut x71: u64 = 0; + fiat_p224_mulx_u64(&mut x70, &mut x71, x68, 0xffffffff); + let mut x72: u64 = 0; + let mut x73: u64 = 0; + fiat_p224_mulx_u64(&mut x72, &mut x73, x68, 0xffffffffffffffff); + let mut x74: u64 = 0; + let mut x75: u64 = 0; + fiat_p224_mulx_u64(&mut x74, &mut x75, x68, 0xffffffff00000000); + let mut x76: u64 = 0; + let mut x77: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x76, &mut x77, 0x0, x75, x72); + let mut x78: u64 = 0; + let mut x79: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x78, &mut x79, x77, x73, x70); + let x80: u64 = ((x79 as u64) + x71); + let mut x81: u64 = 0; + let mut x82: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x81, &mut x82, 0x0, x58, x68); + let mut x83: u64 = 0; + let mut x84: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x83, &mut x84, x82, x60, x74); + let mut x85: u64 = 0; + let mut x86: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x85, &mut x86, x84, x62, x76); + let mut x87: u64 = 0; + let mut x88: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x87, &mut x88, x86, x64, x78); + let mut x89: u64 = 0; + let mut x90: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x89, &mut x90, x88, x66, x80); + let x91: u64 = ((x90 as u64) + (x67 as u64)); + let mut x92: u64 = 0; + let mut x93: u64 = 0; + fiat_p224_mulx_u64(&mut x92, &mut x93, x2, (arg2[3])); + let mut x94: u64 = 0; + let mut x95: u64 = 0; + fiat_p224_mulx_u64(&mut x94, &mut x95, x2, (arg2[2])); + let mut x96: u64 = 0; + let mut x97: u64 = 0; + fiat_p224_mulx_u64(&mut x96, &mut x97, x2, (arg2[1])); + let mut x98: u64 = 0; + let mut x99: u64 = 0; + fiat_p224_mulx_u64(&mut x98, &mut x99, x2, (arg2[0])); + let mut x100: u64 = 0; + let mut x101: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x100, &mut x101, 0x0, x99, x96); + let mut x102: u64 = 0; + let mut x103: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x102, &mut x103, x101, x97, x94); + let mut x104: u64 = 0; + let mut x105: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x104, &mut x105, x103, x95, x92); + let x106: u64 = ((x105 as u64) + x93); + let mut x107: u64 = 0; + let mut x108: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x107, &mut x108, 0x0, x83, x98); + let mut x109: u64 = 0; + let mut x110: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x109, &mut x110, x108, x85, x100); + let mut x111: u64 = 0; + let mut x112: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x111, &mut x112, x110, x87, x102); + let mut x113: u64 = 0; + let mut x114: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x113, &mut x114, x112, x89, x104); + let mut x115: u64 = 0; + let mut x116: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x115, &mut x116, x114, x91, x106); + let mut x117: u64 = 0; + let mut x118: u64 = 0; + fiat_p224_mulx_u64(&mut x117, &mut x118, x107, 0xffffffffffffffff); + let mut x119: u64 = 0; + let mut x120: u64 = 0; + fiat_p224_mulx_u64(&mut x119, &mut x120, x117, 0xffffffff); + let mut x121: u64 = 0; + let mut x122: u64 = 0; + fiat_p224_mulx_u64(&mut x121, &mut x122, x117, 0xffffffffffffffff); + let mut x123: u64 = 0; + let mut x124: u64 = 0; + fiat_p224_mulx_u64(&mut x123, &mut x124, x117, 0xffffffff00000000); + let mut x125: u64 = 0; + let mut x126: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x125, &mut x126, 0x0, x124, x121); + let mut x127: u64 = 0; + let mut x128: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x127, &mut x128, x126, x122, x119); + let x129: u64 = ((x128 as u64) + x120); + let mut x130: u64 = 0; + let mut x131: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x130, &mut x131, 0x0, x107, x117); + let mut x132: u64 = 0; + let mut x133: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x132, &mut x133, x131, x109, x123); + let mut x134: u64 = 0; + let mut x135: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x134, &mut x135, x133, x111, x125); + let mut x136: u64 = 0; + let mut x137: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x136, &mut x137, x135, x113, x127); + let mut x138: u64 = 0; + let mut x139: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x138, &mut x139, x137, x115, x129); + let x140: u64 = ((x139 as u64) + (x116 as u64)); + let mut x141: u64 = 0; + let mut x142: u64 = 0; + fiat_p224_mulx_u64(&mut x141, &mut x142, x3, (arg2[3])); + let mut x143: u64 = 0; + let mut x144: u64 = 0; + fiat_p224_mulx_u64(&mut x143, &mut x144, x3, (arg2[2])); + let mut x145: u64 = 0; + let mut x146: u64 = 0; + fiat_p224_mulx_u64(&mut x145, &mut x146, x3, (arg2[1])); + let mut x147: u64 = 0; + let mut x148: u64 = 0; + fiat_p224_mulx_u64(&mut x147, &mut x148, x3, (arg2[0])); + let mut x149: u64 = 0; + let mut x150: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x149, &mut x150, 0x0, x148, x145); + let mut x151: u64 = 0; + let mut x152: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x151, &mut x152, x150, x146, x143); + let mut x153: u64 = 0; + let mut x154: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x153, &mut x154, x152, x144, x141); + let x155: u64 = ((x154 as u64) + x142); + let mut x156: u64 = 0; + let mut x157: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x156, &mut x157, 0x0, x132, x147); + let mut x158: u64 = 0; + let mut x159: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x158, &mut x159, x157, x134, x149); + let mut x160: u64 = 0; + let mut x161: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x160, &mut x161, x159, x136, x151); + let mut x162: u64 = 0; + let mut x163: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x162, &mut x163, x161, x138, x153); + let mut x164: u64 = 0; + let mut x165: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x164, &mut x165, x163, x140, x155); + let mut x166: u64 = 0; + let mut x167: u64 = 0; + fiat_p224_mulx_u64(&mut x166, &mut x167, x156, 0xffffffffffffffff); + let mut x168: u64 = 0; + let mut x169: u64 = 0; + fiat_p224_mulx_u64(&mut x168, &mut x169, x166, 0xffffffff); + let mut x170: u64 = 0; + let mut x171: u64 = 0; + fiat_p224_mulx_u64(&mut x170, &mut x171, x166, 0xffffffffffffffff); + let mut x172: u64 = 0; + let mut x173: u64 = 0; + fiat_p224_mulx_u64(&mut x172, &mut x173, x166, 0xffffffff00000000); + let mut x174: u64 = 0; + let mut x175: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x174, &mut x175, 0x0, x173, x170); + let mut x176: u64 = 0; + let mut x177: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x176, &mut x177, x175, x171, x168); + let x178: u64 = ((x177 as u64) + x169); + let mut x179: u64 = 0; + let mut x180: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x179, &mut x180, 0x0, x156, x166); + let mut x181: u64 = 0; + let mut x182: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x181, &mut x182, x180, x158, x172); + let mut x183: u64 = 0; + let mut x184: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x183, &mut x184, x182, x160, x174); + let mut x185: u64 = 0; + let mut x186: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x185, &mut x186, x184, x162, x176); + let mut x187: u64 = 0; + let mut x188: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x187, &mut x188, x186, x164, x178); + let x189: u64 = ((x188 as u64) + (x165 as u64)); + let mut x190: u64 = 0; + let mut x191: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u64(&mut x190, &mut x191, 0x0, x181, (0x1 as u64)); + let mut x192: u64 = 0; + let mut x193: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u64(&mut x192, &mut x193, x191, x183, 0xffffffff00000000); + let mut x194: u64 = 0; + let mut x195: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u64(&mut x194, &mut x195, x193, x185, 0xffffffffffffffff); + let mut x196: u64 = 0; + let mut x197: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u64(&mut x196, &mut x197, x195, x187, 0xffffffff); + let mut x198: u64 = 0; + let mut x199: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u64(&mut x198, &mut x199, x197, x189, (0x0 as u64)); + let mut x200: u64 = 0; + fiat_p224_cmovznz_u64(&mut x200, x199, x190, x181); + let mut x201: u64 = 0; + fiat_p224_cmovznz_u64(&mut x201, x199, x192, x183); + let mut x202: u64 = 0; + fiat_p224_cmovznz_u64(&mut x202, x199, x194, x185); + let mut x203: u64 = 0; + fiat_p224_cmovznz_u64(&mut x203, x199, x196, x187); + out1[0] = x200; + out1[1] = x201; + out1[2] = x202; + out1[3] = x203; +} + +/// The function fiat_p224_square squares a field element in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg1)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p224_square(out1: &mut fiat_p224_montgomery_domain_field_element, arg1: &fiat_p224_montgomery_domain_field_element) -> () { + let x1: u64 = (arg1[1]); + let x2: u64 = (arg1[2]); + let x3: u64 = (arg1[3]); + let x4: u64 = (arg1[0]); + let mut x5: u64 = 0; + let mut x6: u64 = 0; + fiat_p224_mulx_u64(&mut x5, &mut x6, x4, (arg1[3])); + let mut x7: u64 = 0; + let mut x8: u64 = 0; + fiat_p224_mulx_u64(&mut x7, &mut x8, x4, (arg1[2])); + let mut x9: u64 = 0; + let mut x10: u64 = 0; + fiat_p224_mulx_u64(&mut x9, &mut x10, x4, (arg1[1])); + let mut x11: u64 = 0; + let mut x12: u64 = 0; + fiat_p224_mulx_u64(&mut x11, &mut x12, x4, (arg1[0])); + let mut x13: u64 = 0; + let mut x14: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x13, &mut x14, 0x0, x12, x9); + let mut x15: u64 = 0; + let mut x16: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x15, &mut x16, x14, x10, x7); + let mut x17: u64 = 0; + let mut x18: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x17, &mut x18, x16, x8, x5); + let x19: u64 = ((x18 as u64) + x6); + let mut x20: u64 = 0; + let mut x21: u64 = 0; + fiat_p224_mulx_u64(&mut x20, &mut x21, x11, 0xffffffffffffffff); + let mut x22: u64 = 0; + let mut x23: u64 = 0; + fiat_p224_mulx_u64(&mut x22, &mut x23, x20, 0xffffffff); + let mut x24: u64 = 0; + let mut x25: u64 = 0; + fiat_p224_mulx_u64(&mut x24, &mut x25, x20, 0xffffffffffffffff); + let mut x26: u64 = 0; + let mut x27: u64 = 0; + fiat_p224_mulx_u64(&mut x26, &mut x27, x20, 0xffffffff00000000); + let mut x28: u64 = 0; + let mut x29: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x28, &mut x29, 0x0, x27, x24); + let mut x30: u64 = 0; + let mut x31: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x30, &mut x31, x29, x25, x22); + let x32: u64 = ((x31 as u64) + x23); + let mut x33: u64 = 0; + let mut x34: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x33, &mut x34, 0x0, x11, x20); + let mut x35: u64 = 0; + let mut x36: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x35, &mut x36, x34, x13, x26); + let mut x37: u64 = 0; + let mut x38: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x37, &mut x38, x36, x15, x28); + let mut x39: u64 = 0; + let mut x40: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x39, &mut x40, x38, x17, x30); + let mut x41: u64 = 0; + let mut x42: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x41, &mut x42, x40, x19, x32); + let mut x43: u64 = 0; + let mut x44: u64 = 0; + fiat_p224_mulx_u64(&mut x43, &mut x44, x1, (arg1[3])); + let mut x45: u64 = 0; + let mut x46: u64 = 0; + fiat_p224_mulx_u64(&mut x45, &mut x46, x1, (arg1[2])); + let mut x47: u64 = 0; + let mut x48: u64 = 0; + fiat_p224_mulx_u64(&mut x47, &mut x48, x1, (arg1[1])); + let mut x49: u64 = 0; + let mut x50: u64 = 0; + fiat_p224_mulx_u64(&mut x49, &mut x50, x1, (arg1[0])); + let mut x51: u64 = 0; + let mut x52: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x51, &mut x52, 0x0, x50, x47); + let mut x53: u64 = 0; + let mut x54: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x53, &mut x54, x52, x48, x45); + let mut x55: u64 = 0; + let mut x56: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x55, &mut x56, x54, x46, x43); + let x57: u64 = ((x56 as u64) + x44); + let mut x58: u64 = 0; + let mut x59: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x58, &mut x59, 0x0, x35, x49); + let mut x60: u64 = 0; + let mut x61: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x60, &mut x61, x59, x37, x51); + let mut x62: u64 = 0; + let mut x63: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x62, &mut x63, x61, x39, x53); + let mut x64: u64 = 0; + let mut x65: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x64, &mut x65, x63, x41, x55); + let mut x66: u64 = 0; + let mut x67: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x66, &mut x67, x65, (x42 as u64), x57); + let mut x68: u64 = 0; + let mut x69: u64 = 0; + fiat_p224_mulx_u64(&mut x68, &mut x69, x58, 0xffffffffffffffff); + let mut x70: u64 = 0; + let mut x71: u64 = 0; + fiat_p224_mulx_u64(&mut x70, &mut x71, x68, 0xffffffff); + let mut x72: u64 = 0; + let mut x73: u64 = 0; + fiat_p224_mulx_u64(&mut x72, &mut x73, x68, 0xffffffffffffffff); + let mut x74: u64 = 0; + let mut x75: u64 = 0; + fiat_p224_mulx_u64(&mut x74, &mut x75, x68, 0xffffffff00000000); + let mut x76: u64 = 0; + let mut x77: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x76, &mut x77, 0x0, x75, x72); + let mut x78: u64 = 0; + let mut x79: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x78, &mut x79, x77, x73, x70); + let x80: u64 = ((x79 as u64) + x71); + let mut x81: u64 = 0; + let mut x82: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x81, &mut x82, 0x0, x58, x68); + let mut x83: u64 = 0; + let mut x84: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x83, &mut x84, x82, x60, x74); + let mut x85: u64 = 0; + let mut x86: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x85, &mut x86, x84, x62, x76); + let mut x87: u64 = 0; + let mut x88: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x87, &mut x88, x86, x64, x78); + let mut x89: u64 = 0; + let mut x90: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x89, &mut x90, x88, x66, x80); + let x91: u64 = ((x90 as u64) + (x67 as u64)); + let mut x92: u64 = 0; + let mut x93: u64 = 0; + fiat_p224_mulx_u64(&mut x92, &mut x93, x2, (arg1[3])); + let mut x94: u64 = 0; + let mut x95: u64 = 0; + fiat_p224_mulx_u64(&mut x94, &mut x95, x2, (arg1[2])); + let mut x96: u64 = 0; + let mut x97: u64 = 0; + fiat_p224_mulx_u64(&mut x96, &mut x97, x2, (arg1[1])); + let mut x98: u64 = 0; + let mut x99: u64 = 0; + fiat_p224_mulx_u64(&mut x98, &mut x99, x2, (arg1[0])); + let mut x100: u64 = 0; + let mut x101: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x100, &mut x101, 0x0, x99, x96); + let mut x102: u64 = 0; + let mut x103: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x102, &mut x103, x101, x97, x94); + let mut x104: u64 = 0; + let mut x105: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x104, &mut x105, x103, x95, x92); + let x106: u64 = ((x105 as u64) + x93); + let mut x107: u64 = 0; + let mut x108: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x107, &mut x108, 0x0, x83, x98); + let mut x109: u64 = 0; + let mut x110: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x109, &mut x110, x108, x85, x100); + let mut x111: u64 = 0; + let mut x112: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x111, &mut x112, x110, x87, x102); + let mut x113: u64 = 0; + let mut x114: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x113, &mut x114, x112, x89, x104); + let mut x115: u64 = 0; + let mut x116: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x115, &mut x116, x114, x91, x106); + let mut x117: u64 = 0; + let mut x118: u64 = 0; + fiat_p224_mulx_u64(&mut x117, &mut x118, x107, 0xffffffffffffffff); + let mut x119: u64 = 0; + let mut x120: u64 = 0; + fiat_p224_mulx_u64(&mut x119, &mut x120, x117, 0xffffffff); + let mut x121: u64 = 0; + let mut x122: u64 = 0; + fiat_p224_mulx_u64(&mut x121, &mut x122, x117, 0xffffffffffffffff); + let mut x123: u64 = 0; + let mut x124: u64 = 0; + fiat_p224_mulx_u64(&mut x123, &mut x124, x117, 0xffffffff00000000); + let mut x125: u64 = 0; + let mut x126: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x125, &mut x126, 0x0, x124, x121); + let mut x127: u64 = 0; + let mut x128: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x127, &mut x128, x126, x122, x119); + let x129: u64 = ((x128 as u64) + x120); + let mut x130: u64 = 0; + let mut x131: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x130, &mut x131, 0x0, x107, x117); + let mut x132: u64 = 0; + let mut x133: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x132, &mut x133, x131, x109, x123); + let mut x134: u64 = 0; + let mut x135: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x134, &mut x135, x133, x111, x125); + let mut x136: u64 = 0; + let mut x137: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x136, &mut x137, x135, x113, x127); + let mut x138: u64 = 0; + let mut x139: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x138, &mut x139, x137, x115, x129); + let x140: u64 = ((x139 as u64) + (x116 as u64)); + let mut x141: u64 = 0; + let mut x142: u64 = 0; + fiat_p224_mulx_u64(&mut x141, &mut x142, x3, (arg1[3])); + let mut x143: u64 = 0; + let mut x144: u64 = 0; + fiat_p224_mulx_u64(&mut x143, &mut x144, x3, (arg1[2])); + let mut x145: u64 = 0; + let mut x146: u64 = 0; + fiat_p224_mulx_u64(&mut x145, &mut x146, x3, (arg1[1])); + let mut x147: u64 = 0; + let mut x148: u64 = 0; + fiat_p224_mulx_u64(&mut x147, &mut x148, x3, (arg1[0])); + let mut x149: u64 = 0; + let mut x150: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x149, &mut x150, 0x0, x148, x145); + let mut x151: u64 = 0; + let mut x152: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x151, &mut x152, x150, x146, x143); + let mut x153: u64 = 0; + let mut x154: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x153, &mut x154, x152, x144, x141); + let x155: u64 = ((x154 as u64) + x142); + let mut x156: u64 = 0; + let mut x157: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x156, &mut x157, 0x0, x132, x147); + let mut x158: u64 = 0; + let mut x159: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x158, &mut x159, x157, x134, x149); + let mut x160: u64 = 0; + let mut x161: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x160, &mut x161, x159, x136, x151); + let mut x162: u64 = 0; + let mut x163: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x162, &mut x163, x161, x138, x153); + let mut x164: u64 = 0; + let mut x165: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x164, &mut x165, x163, x140, x155); + let mut x166: u64 = 0; + let mut x167: u64 = 0; + fiat_p224_mulx_u64(&mut x166, &mut x167, x156, 0xffffffffffffffff); + let mut x168: u64 = 0; + let mut x169: u64 = 0; + fiat_p224_mulx_u64(&mut x168, &mut x169, x166, 0xffffffff); + let mut x170: u64 = 0; + let mut x171: u64 = 0; + fiat_p224_mulx_u64(&mut x170, &mut x171, x166, 0xffffffffffffffff); + let mut x172: u64 = 0; + let mut x173: u64 = 0; + fiat_p224_mulx_u64(&mut x172, &mut x173, x166, 0xffffffff00000000); + let mut x174: u64 = 0; + let mut x175: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x174, &mut x175, 0x0, x173, x170); + let mut x176: u64 = 0; + let mut x177: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x176, &mut x177, x175, x171, x168); + let x178: u64 = ((x177 as u64) + x169); + let mut x179: u64 = 0; + let mut x180: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x179, &mut x180, 0x0, x156, x166); + let mut x181: u64 = 0; + let mut x182: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x181, &mut x182, x180, x158, x172); + let mut x183: u64 = 0; + let mut x184: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x183, &mut x184, x182, x160, x174); + let mut x185: u64 = 0; + let mut x186: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x185, &mut x186, x184, x162, x176); + let mut x187: u64 = 0; + let mut x188: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x187, &mut x188, x186, x164, x178); + let x189: u64 = ((x188 as u64) + (x165 as u64)); + let mut x190: u64 = 0; + let mut x191: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u64(&mut x190, &mut x191, 0x0, x181, (0x1 as u64)); + let mut x192: u64 = 0; + let mut x193: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u64(&mut x192, &mut x193, x191, x183, 0xffffffff00000000); + let mut x194: u64 = 0; + let mut x195: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u64(&mut x194, &mut x195, x193, x185, 0xffffffffffffffff); + let mut x196: u64 = 0; + let mut x197: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u64(&mut x196, &mut x197, x195, x187, 0xffffffff); + let mut x198: u64 = 0; + let mut x199: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u64(&mut x198, &mut x199, x197, x189, (0x0 as u64)); + let mut x200: u64 = 0; + fiat_p224_cmovznz_u64(&mut x200, x199, x190, x181); + let mut x201: u64 = 0; + fiat_p224_cmovznz_u64(&mut x201, x199, x192, x183); + let mut x202: u64 = 0; + fiat_p224_cmovznz_u64(&mut x202, x199, x194, x185); + let mut x203: u64 = 0; + fiat_p224_cmovznz_u64(&mut x203, x199, x196, x187); + out1[0] = x200; + out1[1] = x201; + out1[2] = x202; + out1[3] = x203; +} + +/// The function fiat_p224_add adds two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) + eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p224_add(out1: &mut fiat_p224_montgomery_domain_field_element, arg1: &fiat_p224_montgomery_domain_field_element, arg2: &fiat_p224_montgomery_domain_field_element) -> () { + let mut x1: u64 = 0; + let mut x2: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x1, &mut x2, 0x0, (arg1[0]), (arg2[0])); + let mut x3: u64 = 0; + let mut x4: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x3, &mut x4, x2, (arg1[1]), (arg2[1])); + let mut x5: u64 = 0; + let mut x6: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x5, &mut x6, x4, (arg1[2]), (arg2[2])); + let mut x7: u64 = 0; + let mut x8: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x7, &mut x8, x6, (arg1[3]), (arg2[3])); + let mut x9: u64 = 0; + let mut x10: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u64(&mut x9, &mut x10, 0x0, x1, (0x1 as u64)); + let mut x11: u64 = 0; + let mut x12: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u64(&mut x11, &mut x12, x10, x3, 0xffffffff00000000); + let mut x13: u64 = 0; + let mut x14: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u64(&mut x13, &mut x14, x12, x5, 0xffffffffffffffff); + let mut x15: u64 = 0; + let mut x16: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u64(&mut x15, &mut x16, x14, x7, 0xffffffff); + let mut x17: u64 = 0; + let mut x18: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u64(&mut x17, &mut x18, x16, (x8 as u64), (0x0 as u64)); + let mut x19: u64 = 0; + fiat_p224_cmovznz_u64(&mut x19, x18, x9, x1); + let mut x20: u64 = 0; + fiat_p224_cmovznz_u64(&mut x20, x18, x11, x3); + let mut x21: u64 = 0; + fiat_p224_cmovznz_u64(&mut x21, x18, x13, x5); + let mut x22: u64 = 0; + fiat_p224_cmovznz_u64(&mut x22, x18, x15, x7); + out1[0] = x19; + out1[1] = x20; + out1[2] = x21; + out1[3] = x22; +} + +/// The function fiat_p224_sub subtracts two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) - eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p224_sub(out1: &mut fiat_p224_montgomery_domain_field_element, arg1: &fiat_p224_montgomery_domain_field_element, arg2: &fiat_p224_montgomery_domain_field_element) -> () { + let mut x1: u64 = 0; + let mut x2: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u64(&mut x1, &mut x2, 0x0, (arg1[0]), (arg2[0])); + let mut x3: u64 = 0; + let mut x4: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u64(&mut x3, &mut x4, x2, (arg1[1]), (arg2[1])); + let mut x5: u64 = 0; + let mut x6: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u64(&mut x5, &mut x6, x4, (arg1[2]), (arg2[2])); + let mut x7: u64 = 0; + let mut x8: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u64(&mut x7, &mut x8, x6, (arg1[3]), (arg2[3])); + let mut x9: u64 = 0; + fiat_p224_cmovznz_u64(&mut x9, x8, (0x0 as u64), 0xffffffffffffffff); + let mut x10: u64 = 0; + let mut x11: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x10, &mut x11, 0x0, x1, (((x9 & (0x1 as u64)) as fiat_p224_u1) as u64)); + let mut x12: u64 = 0; + let mut x13: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x12, &mut x13, x11, x3, (x9 & 0xffffffff00000000)); + let mut x14: u64 = 0; + let mut x15: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x14, &mut x15, x13, x5, x9); + let mut x16: u64 = 0; + let mut x17: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x16, &mut x17, x15, x7, (x9 & 0xffffffff)); + out1[0] = x10; + out1[1] = x12; + out1[2] = x14; + out1[3] = x16; +} + +/// The function fiat_p224_opp negates a field element in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = -eval (from_montgomery arg1) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p224_opp(out1: &mut fiat_p224_montgomery_domain_field_element, arg1: &fiat_p224_montgomery_domain_field_element) -> () { + let mut x1: u64 = 0; + let mut x2: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u64(&mut x1, &mut x2, 0x0, (0x0 as u64), (arg1[0])); + let mut x3: u64 = 0; + let mut x4: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u64(&mut x3, &mut x4, x2, (0x0 as u64), (arg1[1])); + let mut x5: u64 = 0; + let mut x6: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u64(&mut x5, &mut x6, x4, (0x0 as u64), (arg1[2])); + let mut x7: u64 = 0; + let mut x8: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u64(&mut x7, &mut x8, x6, (0x0 as u64), (arg1[3])); + let mut x9: u64 = 0; + fiat_p224_cmovznz_u64(&mut x9, x8, (0x0 as u64), 0xffffffffffffffff); + let mut x10: u64 = 0; + let mut x11: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x10, &mut x11, 0x0, x1, (((x9 & (0x1 as u64)) as fiat_p224_u1) as u64)); + let mut x12: u64 = 0; + let mut x13: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x12, &mut x13, x11, x3, (x9 & 0xffffffff00000000)); + let mut x14: u64 = 0; + let mut x15: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x14, &mut x15, x13, x5, x9); + let mut x16: u64 = 0; + let mut x17: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x16, &mut x17, x15, x7, (x9 & 0xffffffff)); + out1[0] = x10; + out1[1] = x12; + out1[2] = x14; + out1[3] = x16; +} + +/// The function fiat_p224_from_montgomery translates a field element out of the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval out1 mod m = (eval arg1 * ((2^64)⁻¹ mod m)^4) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p224_from_montgomery(out1: &mut fiat_p224_non_montgomery_domain_field_element, arg1: &fiat_p224_montgomery_domain_field_element) -> () { + let x1: u64 = (arg1[0]); + let mut x2: u64 = 0; + let mut x3: u64 = 0; + fiat_p224_mulx_u64(&mut x2, &mut x3, x1, 0xffffffffffffffff); + let mut x4: u64 = 0; + let mut x5: u64 = 0; + fiat_p224_mulx_u64(&mut x4, &mut x5, x2, 0xffffffff); + let mut x6: u64 = 0; + let mut x7: u64 = 0; + fiat_p224_mulx_u64(&mut x6, &mut x7, x2, 0xffffffffffffffff); + let mut x8: u64 = 0; + let mut x9: u64 = 0; + fiat_p224_mulx_u64(&mut x8, &mut x9, x2, 0xffffffff00000000); + let mut x10: u64 = 0; + let mut x11: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x10, &mut x11, 0x0, x9, x6); + let mut x12: u64 = 0; + let mut x13: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x12, &mut x13, x11, x7, x4); + let mut x14: u64 = 0; + let mut x15: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x14, &mut x15, 0x0, x1, x2); + let mut x16: u64 = 0; + let mut x17: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x16, &mut x17, x15, (0x0 as u64), x8); + let mut x18: u64 = 0; + let mut x19: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x18, &mut x19, x17, (0x0 as u64), x10); + let mut x20: u64 = 0; + let mut x21: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x20, &mut x21, x19, (0x0 as u64), x12); + let mut x22: u64 = 0; + let mut x23: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x22, &mut x23, 0x0, x16, (arg1[1])); + let mut x24: u64 = 0; + let mut x25: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x24, &mut x25, x23, x18, (0x0 as u64)); + let mut x26: u64 = 0; + let mut x27: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x26, &mut x27, x25, x20, (0x0 as u64)); + let mut x28: u64 = 0; + let mut x29: u64 = 0; + fiat_p224_mulx_u64(&mut x28, &mut x29, x22, 0xffffffffffffffff); + let mut x30: u64 = 0; + let mut x31: u64 = 0; + fiat_p224_mulx_u64(&mut x30, &mut x31, x28, 0xffffffff); + let mut x32: u64 = 0; + let mut x33: u64 = 0; + fiat_p224_mulx_u64(&mut x32, &mut x33, x28, 0xffffffffffffffff); + let mut x34: u64 = 0; + let mut x35: u64 = 0; + fiat_p224_mulx_u64(&mut x34, &mut x35, x28, 0xffffffff00000000); + let mut x36: u64 = 0; + let mut x37: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x36, &mut x37, 0x0, x35, x32); + let mut x38: u64 = 0; + let mut x39: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x38, &mut x39, x37, x33, x30); + let mut x40: u64 = 0; + let mut x41: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x40, &mut x41, 0x0, x22, x28); + let mut x42: u64 = 0; + let mut x43: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x42, &mut x43, x41, x24, x34); + let mut x44: u64 = 0; + let mut x45: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x44, &mut x45, x43, x26, x36); + let mut x46: u64 = 0; + let mut x47: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x46, &mut x47, x45, ((x27 as u64) + ((x21 as u64) + ((x13 as u64) + x5))), x38); + let mut x48: u64 = 0; + let mut x49: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x48, &mut x49, 0x0, x42, (arg1[2])); + let mut x50: u64 = 0; + let mut x51: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x50, &mut x51, x49, x44, (0x0 as u64)); + let mut x52: u64 = 0; + let mut x53: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x52, &mut x53, x51, x46, (0x0 as u64)); + let mut x54: u64 = 0; + let mut x55: u64 = 0; + fiat_p224_mulx_u64(&mut x54, &mut x55, x48, 0xffffffffffffffff); + let mut x56: u64 = 0; + let mut x57: u64 = 0; + fiat_p224_mulx_u64(&mut x56, &mut x57, x54, 0xffffffff); + let mut x58: u64 = 0; + let mut x59: u64 = 0; + fiat_p224_mulx_u64(&mut x58, &mut x59, x54, 0xffffffffffffffff); + let mut x60: u64 = 0; + let mut x61: u64 = 0; + fiat_p224_mulx_u64(&mut x60, &mut x61, x54, 0xffffffff00000000); + let mut x62: u64 = 0; + let mut x63: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x62, &mut x63, 0x0, x61, x58); + let mut x64: u64 = 0; + let mut x65: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x64, &mut x65, x63, x59, x56); + let mut x66: u64 = 0; + let mut x67: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x66, &mut x67, 0x0, x48, x54); + let mut x68: u64 = 0; + let mut x69: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x68, &mut x69, x67, x50, x60); + let mut x70: u64 = 0; + let mut x71: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x70, &mut x71, x69, x52, x62); + let mut x72: u64 = 0; + let mut x73: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x72, &mut x73, x71, ((x53 as u64) + ((x47 as u64) + ((x39 as u64) + x31))), x64); + let mut x74: u64 = 0; + let mut x75: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x74, &mut x75, 0x0, x68, (arg1[3])); + let mut x76: u64 = 0; + let mut x77: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x76, &mut x77, x75, x70, (0x0 as u64)); + let mut x78: u64 = 0; + let mut x79: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x78, &mut x79, x77, x72, (0x0 as u64)); + let mut x80: u64 = 0; + let mut x81: u64 = 0; + fiat_p224_mulx_u64(&mut x80, &mut x81, x74, 0xffffffffffffffff); + let mut x82: u64 = 0; + let mut x83: u64 = 0; + fiat_p224_mulx_u64(&mut x82, &mut x83, x80, 0xffffffff); + let mut x84: u64 = 0; + let mut x85: u64 = 0; + fiat_p224_mulx_u64(&mut x84, &mut x85, x80, 0xffffffffffffffff); + let mut x86: u64 = 0; + let mut x87: u64 = 0; + fiat_p224_mulx_u64(&mut x86, &mut x87, x80, 0xffffffff00000000); + let mut x88: u64 = 0; + let mut x89: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x88, &mut x89, 0x0, x87, x84); + let mut x90: u64 = 0; + let mut x91: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x90, &mut x91, x89, x85, x82); + let mut x92: u64 = 0; + let mut x93: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x92, &mut x93, 0x0, x74, x80); + let mut x94: u64 = 0; + let mut x95: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x94, &mut x95, x93, x76, x86); + let mut x96: u64 = 0; + let mut x97: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x96, &mut x97, x95, x78, x88); + let mut x98: u64 = 0; + let mut x99: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x98, &mut x99, x97, ((x79 as u64) + ((x73 as u64) + ((x65 as u64) + x57))), x90); + let x100: u64 = ((x99 as u64) + ((x91 as u64) + x83)); + let mut x101: u64 = 0; + let mut x102: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u64(&mut x101, &mut x102, 0x0, x94, (0x1 as u64)); + let mut x103: u64 = 0; + let mut x104: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u64(&mut x103, &mut x104, x102, x96, 0xffffffff00000000); + let mut x105: u64 = 0; + let mut x106: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u64(&mut x105, &mut x106, x104, x98, 0xffffffffffffffff); + let mut x107: u64 = 0; + let mut x108: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u64(&mut x107, &mut x108, x106, x100, 0xffffffff); + let mut x109: u64 = 0; + let mut x110: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u64(&mut x109, &mut x110, x108, (0x0 as u64), (0x0 as u64)); + let mut x111: u64 = 0; + fiat_p224_cmovznz_u64(&mut x111, x110, x101, x94); + let mut x112: u64 = 0; + fiat_p224_cmovznz_u64(&mut x112, x110, x103, x96); + let mut x113: u64 = 0; + fiat_p224_cmovznz_u64(&mut x113, x110, x105, x98); + let mut x114: u64 = 0; + fiat_p224_cmovznz_u64(&mut x114, x110, x107, x100); + out1[0] = x111; + out1[1] = x112; + out1[2] = x113; + out1[3] = x114; +} + +/// The function fiat_p224_to_montgomery translates a field element into the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = eval arg1 mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p224_to_montgomery(out1: &mut fiat_p224_montgomery_domain_field_element, arg1: &fiat_p224_non_montgomery_domain_field_element) -> () { + let x1: u64 = (arg1[1]); + let x2: u64 = (arg1[2]); + let x3: u64 = (arg1[3]); + let x4: u64 = (arg1[0]); + let mut x5: u64 = 0; + let mut x6: u64 = 0; + fiat_p224_mulx_u64(&mut x5, &mut x6, x4, 0xffffffff); + let mut x7: u64 = 0; + let mut x8: u64 = 0; + fiat_p224_mulx_u64(&mut x7, &mut x8, x4, 0xfffffffe00000000); + let mut x9: u64 = 0; + let mut x10: u64 = 0; + fiat_p224_mulx_u64(&mut x9, &mut x10, x4, 0xffffffff00000000); + let mut x11: u64 = 0; + let mut x12: u64 = 0; + fiat_p224_mulx_u64(&mut x11, &mut x12, x4, 0xffffffff00000001); + let mut x13: u64 = 0; + let mut x14: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x13, &mut x14, 0x0, x12, x9); + let mut x15: u64 = 0; + let mut x16: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x15, &mut x16, x14, x10, x7); + let mut x17: u64 = 0; + let mut x18: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x17, &mut x18, x16, x8, x5); + let mut x19: u64 = 0; + let mut x20: u64 = 0; + fiat_p224_mulx_u64(&mut x19, &mut x20, x11, 0xffffffffffffffff); + let mut x21: u64 = 0; + let mut x22: u64 = 0; + fiat_p224_mulx_u64(&mut x21, &mut x22, x19, 0xffffffff); + let mut x23: u64 = 0; + let mut x24: u64 = 0; + fiat_p224_mulx_u64(&mut x23, &mut x24, x19, 0xffffffffffffffff); + let mut x25: u64 = 0; + let mut x26: u64 = 0; + fiat_p224_mulx_u64(&mut x25, &mut x26, x19, 0xffffffff00000000); + let mut x27: u64 = 0; + let mut x28: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x27, &mut x28, 0x0, x26, x23); + let mut x29: u64 = 0; + let mut x30: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x29, &mut x30, x28, x24, x21); + let mut x31: u64 = 0; + let mut x32: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x31, &mut x32, 0x0, x11, x19); + let mut x33: u64 = 0; + let mut x34: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x33, &mut x34, x32, x13, x25); + let mut x35: u64 = 0; + let mut x36: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x35, &mut x36, x34, x15, x27); + let mut x37: u64 = 0; + let mut x38: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x37, &mut x38, x36, x17, x29); + let mut x39: u64 = 0; + let mut x40: u64 = 0; + fiat_p224_mulx_u64(&mut x39, &mut x40, x1, 0xffffffff); + let mut x41: u64 = 0; + let mut x42: u64 = 0; + fiat_p224_mulx_u64(&mut x41, &mut x42, x1, 0xfffffffe00000000); + let mut x43: u64 = 0; + let mut x44: u64 = 0; + fiat_p224_mulx_u64(&mut x43, &mut x44, x1, 0xffffffff00000000); + let mut x45: u64 = 0; + let mut x46: u64 = 0; + fiat_p224_mulx_u64(&mut x45, &mut x46, x1, 0xffffffff00000001); + let mut x47: u64 = 0; + let mut x48: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x47, &mut x48, 0x0, x46, x43); + let mut x49: u64 = 0; + let mut x50: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x49, &mut x50, x48, x44, x41); + let mut x51: u64 = 0; + let mut x52: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x51, &mut x52, x50, x42, x39); + let mut x53: u64 = 0; + let mut x54: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x53, &mut x54, 0x0, x33, x45); + let mut x55: u64 = 0; + let mut x56: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x55, &mut x56, x54, x35, x47); + let mut x57: u64 = 0; + let mut x58: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x57, &mut x58, x56, x37, x49); + let mut x59: u64 = 0; + let mut x60: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x59, &mut x60, x58, (((x38 as u64) + ((x18 as u64) + x6)) + ((x30 as u64) + x22)), x51); + let mut x61: u64 = 0; + let mut x62: u64 = 0; + fiat_p224_mulx_u64(&mut x61, &mut x62, x53, 0xffffffffffffffff); + let mut x63: u64 = 0; + let mut x64: u64 = 0; + fiat_p224_mulx_u64(&mut x63, &mut x64, x61, 0xffffffff); + let mut x65: u64 = 0; + let mut x66: u64 = 0; + fiat_p224_mulx_u64(&mut x65, &mut x66, x61, 0xffffffffffffffff); + let mut x67: u64 = 0; + let mut x68: u64 = 0; + fiat_p224_mulx_u64(&mut x67, &mut x68, x61, 0xffffffff00000000); + let mut x69: u64 = 0; + let mut x70: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x69, &mut x70, 0x0, x68, x65); + let mut x71: u64 = 0; + let mut x72: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x71, &mut x72, x70, x66, x63); + let mut x73: u64 = 0; + let mut x74: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x73, &mut x74, 0x0, x53, x61); + let mut x75: u64 = 0; + let mut x76: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x75, &mut x76, x74, x55, x67); + let mut x77: u64 = 0; + let mut x78: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x77, &mut x78, x76, x57, x69); + let mut x79: u64 = 0; + let mut x80: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x79, &mut x80, x78, x59, x71); + let mut x81: u64 = 0; + let mut x82: u64 = 0; + fiat_p224_mulx_u64(&mut x81, &mut x82, x2, 0xffffffff); + let mut x83: u64 = 0; + let mut x84: u64 = 0; + fiat_p224_mulx_u64(&mut x83, &mut x84, x2, 0xfffffffe00000000); + let mut x85: u64 = 0; + let mut x86: u64 = 0; + fiat_p224_mulx_u64(&mut x85, &mut x86, x2, 0xffffffff00000000); + let mut x87: u64 = 0; + let mut x88: u64 = 0; + fiat_p224_mulx_u64(&mut x87, &mut x88, x2, 0xffffffff00000001); + let mut x89: u64 = 0; + let mut x90: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x89, &mut x90, 0x0, x88, x85); + let mut x91: u64 = 0; + let mut x92: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x91, &mut x92, x90, x86, x83); + let mut x93: u64 = 0; + let mut x94: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x93, &mut x94, x92, x84, x81); + let mut x95: u64 = 0; + let mut x96: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x95, &mut x96, 0x0, x75, x87); + let mut x97: u64 = 0; + let mut x98: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x97, &mut x98, x96, x77, x89); + let mut x99: u64 = 0; + let mut x100: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x99, &mut x100, x98, x79, x91); + let mut x101: u64 = 0; + let mut x102: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x101, &mut x102, x100, (((x80 as u64) + ((x60 as u64) + ((x52 as u64) + x40))) + ((x72 as u64) + x64)), x93); + let mut x103: u64 = 0; + let mut x104: u64 = 0; + fiat_p224_mulx_u64(&mut x103, &mut x104, x95, 0xffffffffffffffff); + let mut x105: u64 = 0; + let mut x106: u64 = 0; + fiat_p224_mulx_u64(&mut x105, &mut x106, x103, 0xffffffff); + let mut x107: u64 = 0; + let mut x108: u64 = 0; + fiat_p224_mulx_u64(&mut x107, &mut x108, x103, 0xffffffffffffffff); + let mut x109: u64 = 0; + let mut x110: u64 = 0; + fiat_p224_mulx_u64(&mut x109, &mut x110, x103, 0xffffffff00000000); + let mut x111: u64 = 0; + let mut x112: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x111, &mut x112, 0x0, x110, x107); + let mut x113: u64 = 0; + let mut x114: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x113, &mut x114, x112, x108, x105); + let mut x115: u64 = 0; + let mut x116: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x115, &mut x116, 0x0, x95, x103); + let mut x117: u64 = 0; + let mut x118: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x117, &mut x118, x116, x97, x109); + let mut x119: u64 = 0; + let mut x120: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x119, &mut x120, x118, x99, x111); + let mut x121: u64 = 0; + let mut x122: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x121, &mut x122, x120, x101, x113); + let mut x123: u64 = 0; + let mut x124: u64 = 0; + fiat_p224_mulx_u64(&mut x123, &mut x124, x3, 0xffffffff); + let mut x125: u64 = 0; + let mut x126: u64 = 0; + fiat_p224_mulx_u64(&mut x125, &mut x126, x3, 0xfffffffe00000000); + let mut x127: u64 = 0; + let mut x128: u64 = 0; + fiat_p224_mulx_u64(&mut x127, &mut x128, x3, 0xffffffff00000000); + let mut x129: u64 = 0; + let mut x130: u64 = 0; + fiat_p224_mulx_u64(&mut x129, &mut x130, x3, 0xffffffff00000001); + let mut x131: u64 = 0; + let mut x132: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x131, &mut x132, 0x0, x130, x127); + let mut x133: u64 = 0; + let mut x134: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x133, &mut x134, x132, x128, x125); + let mut x135: u64 = 0; + let mut x136: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x135, &mut x136, x134, x126, x123); + let mut x137: u64 = 0; + let mut x138: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x137, &mut x138, 0x0, x117, x129); + let mut x139: u64 = 0; + let mut x140: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x139, &mut x140, x138, x119, x131); + let mut x141: u64 = 0; + let mut x142: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x141, &mut x142, x140, x121, x133); + let mut x143: u64 = 0; + let mut x144: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x143, &mut x144, x142, (((x122 as u64) + ((x102 as u64) + ((x94 as u64) + x82))) + ((x114 as u64) + x106)), x135); + let mut x145: u64 = 0; + let mut x146: u64 = 0; + fiat_p224_mulx_u64(&mut x145, &mut x146, x137, 0xffffffffffffffff); + let mut x147: u64 = 0; + let mut x148: u64 = 0; + fiat_p224_mulx_u64(&mut x147, &mut x148, x145, 0xffffffff); + let mut x149: u64 = 0; + let mut x150: u64 = 0; + fiat_p224_mulx_u64(&mut x149, &mut x150, x145, 0xffffffffffffffff); + let mut x151: u64 = 0; + let mut x152: u64 = 0; + fiat_p224_mulx_u64(&mut x151, &mut x152, x145, 0xffffffff00000000); + let mut x153: u64 = 0; + let mut x154: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x153, &mut x154, 0x0, x152, x149); + let mut x155: u64 = 0; + let mut x156: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x155, &mut x156, x154, x150, x147); + let mut x157: u64 = 0; + let mut x158: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x157, &mut x158, 0x0, x137, x145); + let mut x159: u64 = 0; + let mut x160: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x159, &mut x160, x158, x139, x151); + let mut x161: u64 = 0; + let mut x162: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x161, &mut x162, x160, x141, x153); + let mut x163: u64 = 0; + let mut x164: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x163, &mut x164, x162, x143, x155); + let x165: u64 = (((x164 as u64) + ((x144 as u64) + ((x136 as u64) + x124))) + ((x156 as u64) + x148)); + let mut x166: u64 = 0; + let mut x167: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u64(&mut x166, &mut x167, 0x0, x159, (0x1 as u64)); + let mut x168: u64 = 0; + let mut x169: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u64(&mut x168, &mut x169, x167, x161, 0xffffffff00000000); + let mut x170: u64 = 0; + let mut x171: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u64(&mut x170, &mut x171, x169, x163, 0xffffffffffffffff); + let mut x172: u64 = 0; + let mut x173: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u64(&mut x172, &mut x173, x171, x165, 0xffffffff); + let mut x174: u64 = 0; + let mut x175: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u64(&mut x174, &mut x175, x173, (0x0 as u64), (0x0 as u64)); + let mut x176: u64 = 0; + fiat_p224_cmovznz_u64(&mut x176, x175, x166, x159); + let mut x177: u64 = 0; + fiat_p224_cmovznz_u64(&mut x177, x175, x168, x161); + let mut x178: u64 = 0; + fiat_p224_cmovznz_u64(&mut x178, x175, x170, x163); + let mut x179: u64 = 0; + fiat_p224_cmovznz_u64(&mut x179, x175, x172, x165); + out1[0] = x176; + out1[1] = x177; + out1[2] = x178; + out1[3] = x179; +} + +/// The function fiat_p224_nonzero outputs a single non-zero word if the input is non-zero and zero otherwise. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// out1 = 0 ↔ eval (from_montgomery arg1) mod m = 0 +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +#[inline] +pub fn fiat_p224_nonzero(out1: &mut u64, arg1: &[u64; 4]) -> () { + let x1: u64 = ((arg1[0]) | ((arg1[1]) | ((arg1[2]) | (arg1[3])))); + *out1 = x1; +} + +/// The function fiat_p224_selectznz is a multi-limb conditional select. +/// +/// Postconditions: +/// out1 = (if arg1 = 0 then arg2 else arg3) +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +#[inline] +pub fn fiat_p224_selectznz(out1: &mut [u64; 4], arg1: fiat_p224_u1, arg2: &[u64; 4], arg3: &[u64; 4]) -> () { + let mut x1: u64 = 0; + fiat_p224_cmovznz_u64(&mut x1, arg1, (arg2[0]), (arg3[0])); + let mut x2: u64 = 0; + fiat_p224_cmovznz_u64(&mut x2, arg1, (arg2[1]), (arg3[1])); + let mut x3: u64 = 0; + fiat_p224_cmovznz_u64(&mut x3, arg1, (arg2[2]), (arg3[2])); + let mut x4: u64 = 0; + fiat_p224_cmovznz_u64(&mut x4, arg1, (arg2[3]), (arg3[3])); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; + out1[3] = x4; +} + +/// The function fiat_p224_to_bytes serializes a field element NOT in the Montgomery domain to bytes in little-endian order. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..27] +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] +#[inline] +pub fn fiat_p224_to_bytes(out1: &mut [u8; 28], arg1: &[u64; 4]) -> () { + let x1: u64 = (arg1[3]); + let x2: u64 = (arg1[2]); + let x3: u64 = (arg1[1]); + let x4: u64 = (arg1[0]); + let x5: u8 = ((x4 & (0xff as u64)) as u8); + let x6: u64 = (x4 >> 8); + let x7: u8 = ((x6 & (0xff as u64)) as u8); + let x8: u64 = (x6 >> 8); + let x9: u8 = ((x8 & (0xff as u64)) as u8); + let x10: u64 = (x8 >> 8); + let x11: u8 = ((x10 & (0xff as u64)) as u8); + let x12: u64 = (x10 >> 8); + let x13: u8 = ((x12 & (0xff as u64)) as u8); + let x14: u64 = (x12 >> 8); + let x15: u8 = ((x14 & (0xff as u64)) as u8); + let x16: u64 = (x14 >> 8); + let x17: u8 = ((x16 & (0xff as u64)) as u8); + let x18: u8 = ((x16 >> 8) as u8); + let x19: u8 = ((x3 & (0xff as u64)) as u8); + let x20: u64 = (x3 >> 8); + let x21: u8 = ((x20 & (0xff as u64)) as u8); + let x22: u64 = (x20 >> 8); + let x23: u8 = ((x22 & (0xff as u64)) as u8); + let x24: u64 = (x22 >> 8); + let x25: u8 = ((x24 & (0xff as u64)) as u8); + let x26: u64 = (x24 >> 8); + let x27: u8 = ((x26 & (0xff as u64)) as u8); + let x28: u64 = (x26 >> 8); + let x29: u8 = ((x28 & (0xff as u64)) as u8); + let x30: u64 = (x28 >> 8); + let x31: u8 = ((x30 & (0xff as u64)) as u8); + let x32: u8 = ((x30 >> 8) as u8); + let x33: u8 = ((x2 & (0xff as u64)) as u8); + let x34: u64 = (x2 >> 8); + let x35: u8 = ((x34 & (0xff as u64)) as u8); + let x36: u64 = (x34 >> 8); + let x37: u8 = ((x36 & (0xff as u64)) as u8); + let x38: u64 = (x36 >> 8); + let x39: u8 = ((x38 & (0xff as u64)) as u8); + let x40: u64 = (x38 >> 8); + let x41: u8 = ((x40 & (0xff as u64)) as u8); + let x42: u64 = (x40 >> 8); + let x43: u8 = ((x42 & (0xff as u64)) as u8); + let x44: u64 = (x42 >> 8); + let x45: u8 = ((x44 & (0xff as u64)) as u8); + let x46: u8 = ((x44 >> 8) as u8); + let x47: u8 = ((x1 & (0xff as u64)) as u8); + let x48: u64 = (x1 >> 8); + let x49: u8 = ((x48 & (0xff as u64)) as u8); + let x50: u64 = (x48 >> 8); + let x51: u8 = ((x50 & (0xff as u64)) as u8); + let x52: u8 = ((x50 >> 8) as u8); + out1[0] = x5; + out1[1] = x7; + out1[2] = x9; + out1[3] = x11; + out1[4] = x13; + out1[5] = x15; + out1[6] = x17; + out1[7] = x18; + out1[8] = x19; + out1[9] = x21; + out1[10] = x23; + out1[11] = x25; + out1[12] = x27; + out1[13] = x29; + out1[14] = x31; + out1[15] = x32; + out1[16] = x33; + out1[17] = x35; + out1[18] = x37; + out1[19] = x39; + out1[20] = x41; + out1[21] = x43; + out1[22] = x45; + out1[23] = x46; + out1[24] = x47; + out1[25] = x49; + out1[26] = x51; + out1[27] = x52; +} + +/// The function fiat_p224_from_bytes deserializes a field element NOT in the Montgomery domain from bytes in little-endian order. +/// +/// Preconditions: +/// 0 ≤ bytes_eval arg1 < m +/// Postconditions: +/// eval out1 mod m = bytes_eval arg1 mod m +/// 0 ≤ eval out1 < m +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffff]] +#[inline] +pub fn fiat_p224_from_bytes(out1: &mut [u64; 4], arg1: &[u8; 28]) -> () { + let x1: u64 = (((arg1[27]) as u64) << 24); + let x2: u64 = (((arg1[26]) as u64) << 16); + let x3: u64 = (((arg1[25]) as u64) << 8); + let x4: u8 = (arg1[24]); + let x5: u64 = (((arg1[23]) as u64) << 56); + let x6: u64 = (((arg1[22]) as u64) << 48); + let x7: u64 = (((arg1[21]) as u64) << 40); + let x8: u64 = (((arg1[20]) as u64) << 32); + let x9: u64 = (((arg1[19]) as u64) << 24); + let x10: u64 = (((arg1[18]) as u64) << 16); + let x11: u64 = (((arg1[17]) as u64) << 8); + let x12: u8 = (arg1[16]); + let x13: u64 = (((arg1[15]) as u64) << 56); + let x14: u64 = (((arg1[14]) as u64) << 48); + let x15: u64 = (((arg1[13]) as u64) << 40); + let x16: u64 = (((arg1[12]) as u64) << 32); + let x17: u64 = (((arg1[11]) as u64) << 24); + let x18: u64 = (((arg1[10]) as u64) << 16); + let x19: u64 = (((arg1[9]) as u64) << 8); + let x20: u8 = (arg1[8]); + let x21: u64 = (((arg1[7]) as u64) << 56); + let x22: u64 = (((arg1[6]) as u64) << 48); + let x23: u64 = (((arg1[5]) as u64) << 40); + let x24: u64 = (((arg1[4]) as u64) << 32); + let x25: u64 = (((arg1[3]) as u64) << 24); + let x26: u64 = (((arg1[2]) as u64) << 16); + let x27: u64 = (((arg1[1]) as u64) << 8); + let x28: u8 = (arg1[0]); + let x29: u64 = (x27 + (x28 as u64)); + let x30: u64 = (x26 + x29); + let x31: u64 = (x25 + x30); + let x32: u64 = (x24 + x31); + let x33: u64 = (x23 + x32); + let x34: u64 = (x22 + x33); + let x35: u64 = (x21 + x34); + let x36: u64 = (x19 + (x20 as u64)); + let x37: u64 = (x18 + x36); + let x38: u64 = (x17 + x37); + let x39: u64 = (x16 + x38); + let x40: u64 = (x15 + x39); + let x41: u64 = (x14 + x40); + let x42: u64 = (x13 + x41); + let x43: u64 = (x11 + (x12 as u64)); + let x44: u64 = (x10 + x43); + let x45: u64 = (x9 + x44); + let x46: u64 = (x8 + x45); + let x47: u64 = (x7 + x46); + let x48: u64 = (x6 + x47); + let x49: u64 = (x5 + x48); + let x50: u64 = (x3 + (x4 as u64)); + let x51: u64 = (x2 + x50); + let x52: u64 = (x1 + x51); + out1[0] = x35; + out1[1] = x42; + out1[2] = x49; + out1[3] = x52; +} + +/// The function fiat_p224_set_one returns the field element one in the Montgomery domain. +/// +/// Postconditions: +/// eval (from_montgomery out1) mod m = 1 mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p224_set_one(out1: &mut fiat_p224_montgomery_domain_field_element) -> () { + out1[0] = 0xffffffff00000000; + out1[1] = 0xffffffffffffffff; + out1[2] = (0x0 as u64); + out1[3] = (0x0 as u64); +} + +/// The function fiat_p224_msat returns the saturated representation of the prime modulus. +/// +/// Postconditions: +/// twos_complement_eval out1 = m +/// 0 ≤ eval out1 < m +/// +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +#[inline] +pub fn fiat_p224_msat(out1: &mut [u64; 5]) -> () { + out1[0] = (0x1 as u64); + out1[1] = 0xffffffff00000000; + out1[2] = 0xffffffffffffffff; + out1[3] = 0xffffffff; + out1[4] = (0x0 as u64); +} + +/// The function fiat_p224_divstep computes a divstep. +/// +/// Preconditions: +/// 0 ≤ eval arg4 < m +/// 0 ≤ eval arg5 < m +/// Postconditions: +/// out1 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then 1 - arg1 else 1 + arg1) +/// twos_complement_eval out2 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then twos_complement_eval arg3 else twos_complement_eval arg2) +/// twos_complement_eval out3 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then ⌊(twos_complement_eval arg3 - twos_complement_eval arg2) / 2⌋ else ⌊(twos_complement_eval arg3 + (twos_complement_eval arg3 mod 2) * twos_complement_eval arg2) / 2⌋) +/// eval (from_montgomery out4) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (2 * eval (from_montgomery arg5)) mod m else (2 * eval (from_montgomery arg4)) mod m) +/// eval (from_montgomery out5) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (eval (from_montgomery arg4) - eval (from_montgomery arg4)) mod m else (eval (from_montgomery arg5) + (twos_complement_eval arg3 mod 2) * eval (from_montgomery arg4)) mod m) +/// 0 ≤ eval out5 < m +/// 0 ≤ eval out5 < m +/// 0 ≤ eval out2 < m +/// 0 ≤ eval out3 < m +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0xffffffffffffffff] +/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// arg4: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// arg5: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +/// out2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// out3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// out4: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// out5: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +#[inline] +pub fn fiat_p224_divstep(out1: &mut u64, out2: &mut [u64; 5], out3: &mut [u64; 5], out4: &mut [u64; 4], out5: &mut [u64; 4], arg1: u64, arg2: &[u64; 5], arg3: &[u64; 5], arg4: &[u64; 4], arg5: &[u64; 4]) -> () { + let mut x1: u64 = 0; + let mut x2: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x1, &mut x2, 0x0, (!arg1), (0x1 as u64)); + let x3: fiat_p224_u1 = (((x1 >> 63) as fiat_p224_u1) & (((arg3[0]) & (0x1 as u64)) as fiat_p224_u1)); + let mut x4: u64 = 0; + let mut x5: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x4, &mut x5, 0x0, (!arg1), (0x1 as u64)); + let mut x6: u64 = 0; + fiat_p224_cmovznz_u64(&mut x6, x3, arg1, x4); + let mut x7: u64 = 0; + fiat_p224_cmovznz_u64(&mut x7, x3, (arg2[0]), (arg3[0])); + let mut x8: u64 = 0; + fiat_p224_cmovznz_u64(&mut x8, x3, (arg2[1]), (arg3[1])); + let mut x9: u64 = 0; + fiat_p224_cmovznz_u64(&mut x9, x3, (arg2[2]), (arg3[2])); + let mut x10: u64 = 0; + fiat_p224_cmovznz_u64(&mut x10, x3, (arg2[3]), (arg3[3])); + let mut x11: u64 = 0; + fiat_p224_cmovznz_u64(&mut x11, x3, (arg2[4]), (arg3[4])); + let mut x12: u64 = 0; + let mut x13: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x12, &mut x13, 0x0, (0x1 as u64), (!(arg2[0]))); + let mut x14: u64 = 0; + let mut x15: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x14, &mut x15, x13, (0x0 as u64), (!(arg2[1]))); + let mut x16: u64 = 0; + let mut x17: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x16, &mut x17, x15, (0x0 as u64), (!(arg2[2]))); + let mut x18: u64 = 0; + let mut x19: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x18, &mut x19, x17, (0x0 as u64), (!(arg2[3]))); + let mut x20: u64 = 0; + let mut x21: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x20, &mut x21, x19, (0x0 as u64), (!(arg2[4]))); + let mut x22: u64 = 0; + fiat_p224_cmovznz_u64(&mut x22, x3, (arg3[0]), x12); + let mut x23: u64 = 0; + fiat_p224_cmovznz_u64(&mut x23, x3, (arg3[1]), x14); + let mut x24: u64 = 0; + fiat_p224_cmovznz_u64(&mut x24, x3, (arg3[2]), x16); + let mut x25: u64 = 0; + fiat_p224_cmovznz_u64(&mut x25, x3, (arg3[3]), x18); + let mut x26: u64 = 0; + fiat_p224_cmovznz_u64(&mut x26, x3, (arg3[4]), x20); + let mut x27: u64 = 0; + fiat_p224_cmovznz_u64(&mut x27, x3, (arg4[0]), (arg5[0])); + let mut x28: u64 = 0; + fiat_p224_cmovznz_u64(&mut x28, x3, (arg4[1]), (arg5[1])); + let mut x29: u64 = 0; + fiat_p224_cmovznz_u64(&mut x29, x3, (arg4[2]), (arg5[2])); + let mut x30: u64 = 0; + fiat_p224_cmovznz_u64(&mut x30, x3, (arg4[3]), (arg5[3])); + let mut x31: u64 = 0; + let mut x32: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x31, &mut x32, 0x0, x27, x27); + let mut x33: u64 = 0; + let mut x34: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x33, &mut x34, x32, x28, x28); + let mut x35: u64 = 0; + let mut x36: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x35, &mut x36, x34, x29, x29); + let mut x37: u64 = 0; + let mut x38: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x37, &mut x38, x36, x30, x30); + let mut x39: u64 = 0; + let mut x40: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u64(&mut x39, &mut x40, 0x0, x31, (0x1 as u64)); + let mut x41: u64 = 0; + let mut x42: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u64(&mut x41, &mut x42, x40, x33, 0xffffffff00000000); + let mut x43: u64 = 0; + let mut x44: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u64(&mut x43, &mut x44, x42, x35, 0xffffffffffffffff); + let mut x45: u64 = 0; + let mut x46: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u64(&mut x45, &mut x46, x44, x37, 0xffffffff); + let mut x47: u64 = 0; + let mut x48: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u64(&mut x47, &mut x48, x46, (x38 as u64), (0x0 as u64)); + let x49: u64 = (arg4[3]); + let x50: u64 = (arg4[2]); + let x51: u64 = (arg4[1]); + let x52: u64 = (arg4[0]); + let mut x53: u64 = 0; + let mut x54: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u64(&mut x53, &mut x54, 0x0, (0x0 as u64), x52); + let mut x55: u64 = 0; + let mut x56: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u64(&mut x55, &mut x56, x54, (0x0 as u64), x51); + let mut x57: u64 = 0; + let mut x58: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u64(&mut x57, &mut x58, x56, (0x0 as u64), x50); + let mut x59: u64 = 0; + let mut x60: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u64(&mut x59, &mut x60, x58, (0x0 as u64), x49); + let mut x61: u64 = 0; + fiat_p224_cmovznz_u64(&mut x61, x60, (0x0 as u64), 0xffffffffffffffff); + let mut x62: u64 = 0; + let mut x63: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x62, &mut x63, 0x0, x53, (((x61 & (0x1 as u64)) as fiat_p224_u1) as u64)); + let mut x64: u64 = 0; + let mut x65: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x64, &mut x65, x63, x55, (x61 & 0xffffffff00000000)); + let mut x66: u64 = 0; + let mut x67: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x66, &mut x67, x65, x57, x61); + let mut x68: u64 = 0; + let mut x69: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x68, &mut x69, x67, x59, (x61 & 0xffffffff)); + let mut x70: u64 = 0; + fiat_p224_cmovznz_u64(&mut x70, x3, (arg5[0]), x62); + let mut x71: u64 = 0; + fiat_p224_cmovznz_u64(&mut x71, x3, (arg5[1]), x64); + let mut x72: u64 = 0; + fiat_p224_cmovznz_u64(&mut x72, x3, (arg5[2]), x66); + let mut x73: u64 = 0; + fiat_p224_cmovznz_u64(&mut x73, x3, (arg5[3]), x68); + let x74: fiat_p224_u1 = ((x22 & (0x1 as u64)) as fiat_p224_u1); + let mut x75: u64 = 0; + fiat_p224_cmovznz_u64(&mut x75, x74, (0x0 as u64), x7); + let mut x76: u64 = 0; + fiat_p224_cmovznz_u64(&mut x76, x74, (0x0 as u64), x8); + let mut x77: u64 = 0; + fiat_p224_cmovznz_u64(&mut x77, x74, (0x0 as u64), x9); + let mut x78: u64 = 0; + fiat_p224_cmovznz_u64(&mut x78, x74, (0x0 as u64), x10); + let mut x79: u64 = 0; + fiat_p224_cmovznz_u64(&mut x79, x74, (0x0 as u64), x11); + let mut x80: u64 = 0; + let mut x81: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x80, &mut x81, 0x0, x22, x75); + let mut x82: u64 = 0; + let mut x83: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x82, &mut x83, x81, x23, x76); + let mut x84: u64 = 0; + let mut x85: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x84, &mut x85, x83, x24, x77); + let mut x86: u64 = 0; + let mut x87: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x86, &mut x87, x85, x25, x78); + let mut x88: u64 = 0; + let mut x89: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x88, &mut x89, x87, x26, x79); + let mut x90: u64 = 0; + fiat_p224_cmovznz_u64(&mut x90, x74, (0x0 as u64), x27); + let mut x91: u64 = 0; + fiat_p224_cmovznz_u64(&mut x91, x74, (0x0 as u64), x28); + let mut x92: u64 = 0; + fiat_p224_cmovznz_u64(&mut x92, x74, (0x0 as u64), x29); + let mut x93: u64 = 0; + fiat_p224_cmovznz_u64(&mut x93, x74, (0x0 as u64), x30); + let mut x94: u64 = 0; + let mut x95: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x94, &mut x95, 0x0, x70, x90); + let mut x96: u64 = 0; + let mut x97: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x96, &mut x97, x95, x71, x91); + let mut x98: u64 = 0; + let mut x99: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x98, &mut x99, x97, x72, x92); + let mut x100: u64 = 0; + let mut x101: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x100, &mut x101, x99, x73, x93); + let mut x102: u64 = 0; + let mut x103: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u64(&mut x102, &mut x103, 0x0, x94, (0x1 as u64)); + let mut x104: u64 = 0; + let mut x105: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u64(&mut x104, &mut x105, x103, x96, 0xffffffff00000000); + let mut x106: u64 = 0; + let mut x107: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u64(&mut x106, &mut x107, x105, x98, 0xffffffffffffffff); + let mut x108: u64 = 0; + let mut x109: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u64(&mut x108, &mut x109, x107, x100, 0xffffffff); + let mut x110: u64 = 0; + let mut x111: fiat_p224_u1 = 0; + fiat_p224_subborrowx_u64(&mut x110, &mut x111, x109, (x101 as u64), (0x0 as u64)); + let mut x112: u64 = 0; + let mut x113: fiat_p224_u1 = 0; + fiat_p224_addcarryx_u64(&mut x112, &mut x113, 0x0, x6, (0x1 as u64)); + let x114: u64 = ((x80 >> 1) | ((x82 << 63) & 0xffffffffffffffff)); + let x115: u64 = ((x82 >> 1) | ((x84 << 63) & 0xffffffffffffffff)); + let x116: u64 = ((x84 >> 1) | ((x86 << 63) & 0xffffffffffffffff)); + let x117: u64 = ((x86 >> 1) | ((x88 << 63) & 0xffffffffffffffff)); + let x118: u64 = ((x88 & 0x8000000000000000) | (x88 >> 1)); + let mut x119: u64 = 0; + fiat_p224_cmovznz_u64(&mut x119, x48, x39, x31); + let mut x120: u64 = 0; + fiat_p224_cmovznz_u64(&mut x120, x48, x41, x33); + let mut x121: u64 = 0; + fiat_p224_cmovznz_u64(&mut x121, x48, x43, x35); + let mut x122: u64 = 0; + fiat_p224_cmovznz_u64(&mut x122, x48, x45, x37); + let mut x123: u64 = 0; + fiat_p224_cmovznz_u64(&mut x123, x111, x102, x94); + let mut x124: u64 = 0; + fiat_p224_cmovznz_u64(&mut x124, x111, x104, x96); + let mut x125: u64 = 0; + fiat_p224_cmovznz_u64(&mut x125, x111, x106, x98); + let mut x126: u64 = 0; + fiat_p224_cmovznz_u64(&mut x126, x111, x108, x100); + *out1 = x112; + out2[0] = x7; + out2[1] = x8; + out2[2] = x9; + out2[3] = x10; + out2[4] = x11; + out3[0] = x114; + out3[1] = x115; + out3[2] = x116; + out3[3] = x117; + out3[4] = x118; + out4[0] = x119; + out4[1] = x120; + out4[2] = x121; + out4[3] = x122; + out5[0] = x123; + out5[1] = x124; + out5[2] = x125; + out5[3] = x126; +} + +/// The function fiat_p224_divstep_precomp returns the precomputed value for Bernstein-Yang-inversion (in montgomery form). +/// +/// Postconditions: +/// eval (from_montgomery out1) = ⌊(m - 1) / 2⌋^(if ⌊log2 m⌋ + 1 < 46 then ⌊(49 * (⌊log2 m⌋ + 1) + 80) / 17⌋ else ⌊(49 * (⌊log2 m⌋ + 1) + 57) / 17⌋) +/// 0 ≤ eval out1 < m +/// +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +#[inline] +pub fn fiat_p224_divstep_precomp(out1: &mut [u64; 4]) -> () { + out1[0] = 0x7ffffffe800001; + out1[1] = 0xff7fffff00800000; + out1[2] = 0xffffff; + out1[3] = 0xff800000; +} diff --git a/vendor/fiat-crypto/src/p256_32.rs b/vendor/fiat-crypto/src/p256_32.rs new file mode 100644 index 000000000..5eb80994d --- /dev/null +++ b/vendor/fiat-crypto/src/p256_32.rs @@ -0,0 +1,4512 @@ +//! Autogenerated: 'src/ExtractionOCaml/word_by_word_montgomery' --lang Rust --inline p256 32 '2^256 - 2^224 + 2^192 + 2^96 - 1' mul square add sub opp from_montgomery to_montgomery nonzero selectznz to_bytes from_bytes one msat divstep divstep_precomp +//! curve description: p256 +//! machine_wordsize = 32 (from "32") +//! requested operations: mul, square, add, sub, opp, from_montgomery, to_montgomery, nonzero, selectznz, to_bytes, from_bytes, one, msat, divstep, divstep_precomp +//! m = 0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff (from "2^256 - 2^224 + 2^192 + 2^96 - 1") +//! +//! NOTE: In addition to the bounds specified above each function, all +//! functions synthesized for this Montgomery arithmetic require the +//! input to be strictly less than the prime modulus (m), and also +//! require the input to be in the unique saturated representation. +//! All functions also ensure that these two properties are true of +//! return values. +//! +//! Computed values: +//! eval z = z[0] + (z[1] << 32) + (z[2] << 64) + (z[3] << 96) + (z[4] << 128) + (z[5] << 160) + (z[6] << 192) + (z[7] << 224) +//! bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248) +//! twos_complement_eval z = let x1 := z[0] + (z[1] << 32) + (z[2] << 64) + (z[3] << 96) + (z[4] << 128) + (z[5] << 160) + (z[6] << 192) + (z[7] << 224) in +//! if x1 & (2^256-1) < 2^255 then x1 & (2^256-1) else (x1 & (2^256-1)) - 2^256 + +#![allow(unused_parens)] +#![allow(non_camel_case_types)] + +pub type fiat_p256_u1 = u8; +pub type fiat_p256_i1 = i8; +pub type fiat_p256_u2 = u8; +pub type fiat_p256_i2 = i8; + +/* The type fiat_p256_montgomery_domain_field_element is a field element in the Montgomery domain. */ +/* Bounds: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] */ +pub type fiat_p256_montgomery_domain_field_element = [u32; 8]; + +/* The type fiat_p256_non_montgomery_domain_field_element is a field element NOT in the Montgomery domain. */ +/* Bounds: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] */ +pub type fiat_p256_non_montgomery_domain_field_element = [u32; 8]; + + +/// The function fiat_p256_addcarryx_u32 is an addition with carry. +/// +/// Postconditions: +/// out1 = (arg1 + arg2 + arg3) mod 2^32 +/// out2 = ⌊(arg1 + arg2 + arg3) / 2^32⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffff] +/// arg3: [0x0 ~> 0xffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_p256_addcarryx_u32(out1: &mut u32, out2: &mut fiat_p256_u1, arg1: fiat_p256_u1, arg2: u32, arg3: u32) -> () { + let x1: u64 = (((arg1 as u64) + (arg2 as u64)) + (arg3 as u64)); + let x2: u32 = ((x1 & (0xffffffff as u64)) as u32); + let x3: fiat_p256_u1 = ((x1 >> 32) as fiat_p256_u1); + *out1 = x2; + *out2 = x3; +} + +/// The function fiat_p256_subborrowx_u32 is a subtraction with borrow. +/// +/// Postconditions: +/// out1 = (-arg1 + arg2 + -arg3) mod 2^32 +/// out2 = -⌊(-arg1 + arg2 + -arg3) / 2^32⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffff] +/// arg3: [0x0 ~> 0xffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_p256_subborrowx_u32(out1: &mut u32, out2: &mut fiat_p256_u1, arg1: fiat_p256_u1, arg2: u32, arg3: u32) -> () { + let x1: i64 = (((arg2 as i64) - (arg1 as i64)) - (arg3 as i64)); + let x2: fiat_p256_i1 = ((x1 >> 32) as fiat_p256_i1); + let x3: u32 = ((x1 & (0xffffffff as i64)) as u32); + *out1 = x3; + *out2 = (((0x0 as fiat_p256_i2) - (x2 as fiat_p256_i2)) as fiat_p256_u1); +} + +/// The function fiat_p256_mulx_u32 is a multiplication, returning the full double-width result. +/// +/// Postconditions: +/// out1 = (arg1 * arg2) mod 2^32 +/// out2 = ⌊arg1 * arg2 / 2^32⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0xffffffff] +/// arg2: [0x0 ~> 0xffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +/// out2: [0x0 ~> 0xffffffff] +#[inline] +pub fn fiat_p256_mulx_u32(out1: &mut u32, out2: &mut u32, arg1: u32, arg2: u32) -> () { + let x1: u64 = ((arg1 as u64) * (arg2 as u64)); + let x2: u32 = ((x1 & (0xffffffff as u64)) as u32); + let x3: u32 = ((x1 >> 32) as u32); + *out1 = x2; + *out2 = x3; +} + +/// The function fiat_p256_cmovznz_u32 is a single-word conditional move. +/// +/// Postconditions: +/// out1 = (if arg1 = 0 then arg2 else arg3) +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffff] +/// arg3: [0x0 ~> 0xffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +#[inline] +pub fn fiat_p256_cmovznz_u32(out1: &mut u32, arg1: fiat_p256_u1, arg2: u32, arg3: u32) -> () { + let x1: fiat_p256_u1 = (!(!arg1)); + let x2: u32 = ((((((0x0 as fiat_p256_i2) - (x1 as fiat_p256_i2)) as fiat_p256_i1) as i64) & (0xffffffff as i64)) as u32); + let x3: u32 = ((x2 & arg3) | ((!x2) & arg2)); + *out1 = x3; +} + +/// The function fiat_p256_mul multiplies two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p256_mul(out1: &mut fiat_p256_montgomery_domain_field_element, arg1: &fiat_p256_montgomery_domain_field_element, arg2: &fiat_p256_montgomery_domain_field_element) -> () { + let x1: u32 = (arg1[1]); + let x2: u32 = (arg1[2]); + let x3: u32 = (arg1[3]); + let x4: u32 = (arg1[4]); + let x5: u32 = (arg1[5]); + let x6: u32 = (arg1[6]); + let x7: u32 = (arg1[7]); + let x8: u32 = (arg1[0]); + let mut x9: u32 = 0; + let mut x10: u32 = 0; + fiat_p256_mulx_u32(&mut x9, &mut x10, x8, (arg2[7])); + let mut x11: u32 = 0; + let mut x12: u32 = 0; + fiat_p256_mulx_u32(&mut x11, &mut x12, x8, (arg2[6])); + let mut x13: u32 = 0; + let mut x14: u32 = 0; + fiat_p256_mulx_u32(&mut x13, &mut x14, x8, (arg2[5])); + let mut x15: u32 = 0; + let mut x16: u32 = 0; + fiat_p256_mulx_u32(&mut x15, &mut x16, x8, (arg2[4])); + let mut x17: u32 = 0; + let mut x18: u32 = 0; + fiat_p256_mulx_u32(&mut x17, &mut x18, x8, (arg2[3])); + let mut x19: u32 = 0; + let mut x20: u32 = 0; + fiat_p256_mulx_u32(&mut x19, &mut x20, x8, (arg2[2])); + let mut x21: u32 = 0; + let mut x22: u32 = 0; + fiat_p256_mulx_u32(&mut x21, &mut x22, x8, (arg2[1])); + let mut x23: u32 = 0; + let mut x24: u32 = 0; + fiat_p256_mulx_u32(&mut x23, &mut x24, x8, (arg2[0])); + let mut x25: u32 = 0; + let mut x26: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x25, &mut x26, 0x0, x24, x21); + let mut x27: u32 = 0; + let mut x28: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x27, &mut x28, x26, x22, x19); + let mut x29: u32 = 0; + let mut x30: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x29, &mut x30, x28, x20, x17); + let mut x31: u32 = 0; + let mut x32: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x31, &mut x32, x30, x18, x15); + let mut x33: u32 = 0; + let mut x34: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x33, &mut x34, x32, x16, x13); + let mut x35: u32 = 0; + let mut x36: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x35, &mut x36, x34, x14, x11); + let mut x37: u32 = 0; + let mut x38: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x37, &mut x38, x36, x12, x9); + let x39: u32 = ((x38 as u32) + x10); + let mut x40: u32 = 0; + let mut x41: u32 = 0; + fiat_p256_mulx_u32(&mut x40, &mut x41, x23, 0xffffffff); + let mut x42: u32 = 0; + let mut x43: u32 = 0; + fiat_p256_mulx_u32(&mut x42, &mut x43, x23, 0xffffffff); + let mut x44: u32 = 0; + let mut x45: u32 = 0; + fiat_p256_mulx_u32(&mut x44, &mut x45, x23, 0xffffffff); + let mut x46: u32 = 0; + let mut x47: u32 = 0; + fiat_p256_mulx_u32(&mut x46, &mut x47, x23, 0xffffffff); + let mut x48: u32 = 0; + let mut x49: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x48, &mut x49, 0x0, x47, x44); + let mut x50: u32 = 0; + let mut x51: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x50, &mut x51, x49, x45, x42); + let x52: u32 = ((x51 as u32) + x43); + let mut x53: u32 = 0; + let mut x54: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x53, &mut x54, 0x0, x23, x46); + let mut x55: u32 = 0; + let mut x56: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x55, &mut x56, x54, x25, x48); + let mut x57: u32 = 0; + let mut x58: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x57, &mut x58, x56, x27, x50); + let mut x59: u32 = 0; + let mut x60: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x59, &mut x60, x58, x29, x52); + let mut x61: u32 = 0; + let mut x62: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x61, &mut x62, x60, x31, (0x0 as u32)); + let mut x63: u32 = 0; + let mut x64: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x63, &mut x64, x62, x33, (0x0 as u32)); + let mut x65: u32 = 0; + let mut x66: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x65, &mut x66, x64, x35, x23); + let mut x67: u32 = 0; + let mut x68: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x67, &mut x68, x66, x37, x40); + let mut x69: u32 = 0; + let mut x70: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x69, &mut x70, x68, x39, x41); + let mut x71: u32 = 0; + let mut x72: u32 = 0; + fiat_p256_mulx_u32(&mut x71, &mut x72, x1, (arg2[7])); + let mut x73: u32 = 0; + let mut x74: u32 = 0; + fiat_p256_mulx_u32(&mut x73, &mut x74, x1, (arg2[6])); + let mut x75: u32 = 0; + let mut x76: u32 = 0; + fiat_p256_mulx_u32(&mut x75, &mut x76, x1, (arg2[5])); + let mut x77: u32 = 0; + let mut x78: u32 = 0; + fiat_p256_mulx_u32(&mut x77, &mut x78, x1, (arg2[4])); + let mut x79: u32 = 0; + let mut x80: u32 = 0; + fiat_p256_mulx_u32(&mut x79, &mut x80, x1, (arg2[3])); + let mut x81: u32 = 0; + let mut x82: u32 = 0; + fiat_p256_mulx_u32(&mut x81, &mut x82, x1, (arg2[2])); + let mut x83: u32 = 0; + let mut x84: u32 = 0; + fiat_p256_mulx_u32(&mut x83, &mut x84, x1, (arg2[1])); + let mut x85: u32 = 0; + let mut x86: u32 = 0; + fiat_p256_mulx_u32(&mut x85, &mut x86, x1, (arg2[0])); + let mut x87: u32 = 0; + let mut x88: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x87, &mut x88, 0x0, x86, x83); + let mut x89: u32 = 0; + let mut x90: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x89, &mut x90, x88, x84, x81); + let mut x91: u32 = 0; + let mut x92: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x91, &mut x92, x90, x82, x79); + let mut x93: u32 = 0; + let mut x94: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x93, &mut x94, x92, x80, x77); + let mut x95: u32 = 0; + let mut x96: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x95, &mut x96, x94, x78, x75); + let mut x97: u32 = 0; + let mut x98: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x97, &mut x98, x96, x76, x73); + let mut x99: u32 = 0; + let mut x100: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x99, &mut x100, x98, x74, x71); + let x101: u32 = ((x100 as u32) + x72); + let mut x102: u32 = 0; + let mut x103: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x102, &mut x103, 0x0, x55, x85); + let mut x104: u32 = 0; + let mut x105: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x104, &mut x105, x103, x57, x87); + let mut x106: u32 = 0; + let mut x107: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x106, &mut x107, x105, x59, x89); + let mut x108: u32 = 0; + let mut x109: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x108, &mut x109, x107, x61, x91); + let mut x110: u32 = 0; + let mut x111: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x110, &mut x111, x109, x63, x93); + let mut x112: u32 = 0; + let mut x113: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x112, &mut x113, x111, x65, x95); + let mut x114: u32 = 0; + let mut x115: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x114, &mut x115, x113, x67, x97); + let mut x116: u32 = 0; + let mut x117: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x116, &mut x117, x115, x69, x99); + let mut x118: u32 = 0; + let mut x119: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x118, &mut x119, x117, (x70 as u32), x101); + let mut x120: u32 = 0; + let mut x121: u32 = 0; + fiat_p256_mulx_u32(&mut x120, &mut x121, x102, 0xffffffff); + let mut x122: u32 = 0; + let mut x123: u32 = 0; + fiat_p256_mulx_u32(&mut x122, &mut x123, x102, 0xffffffff); + let mut x124: u32 = 0; + let mut x125: u32 = 0; + fiat_p256_mulx_u32(&mut x124, &mut x125, x102, 0xffffffff); + let mut x126: u32 = 0; + let mut x127: u32 = 0; + fiat_p256_mulx_u32(&mut x126, &mut x127, x102, 0xffffffff); + let mut x128: u32 = 0; + let mut x129: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x128, &mut x129, 0x0, x127, x124); + let mut x130: u32 = 0; + let mut x131: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x130, &mut x131, x129, x125, x122); + let x132: u32 = ((x131 as u32) + x123); + let mut x133: u32 = 0; + let mut x134: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x133, &mut x134, 0x0, x102, x126); + let mut x135: u32 = 0; + let mut x136: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x135, &mut x136, x134, x104, x128); + let mut x137: u32 = 0; + let mut x138: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x137, &mut x138, x136, x106, x130); + let mut x139: u32 = 0; + let mut x140: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x139, &mut x140, x138, x108, x132); + let mut x141: u32 = 0; + let mut x142: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x141, &mut x142, x140, x110, (0x0 as u32)); + let mut x143: u32 = 0; + let mut x144: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x143, &mut x144, x142, x112, (0x0 as u32)); + let mut x145: u32 = 0; + let mut x146: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x145, &mut x146, x144, x114, x102); + let mut x147: u32 = 0; + let mut x148: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x147, &mut x148, x146, x116, x120); + let mut x149: u32 = 0; + let mut x150: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x149, &mut x150, x148, x118, x121); + let x151: u32 = ((x150 as u32) + (x119 as u32)); + let mut x152: u32 = 0; + let mut x153: u32 = 0; + fiat_p256_mulx_u32(&mut x152, &mut x153, x2, (arg2[7])); + let mut x154: u32 = 0; + let mut x155: u32 = 0; + fiat_p256_mulx_u32(&mut x154, &mut x155, x2, (arg2[6])); + let mut x156: u32 = 0; + let mut x157: u32 = 0; + fiat_p256_mulx_u32(&mut x156, &mut x157, x2, (arg2[5])); + let mut x158: u32 = 0; + let mut x159: u32 = 0; + fiat_p256_mulx_u32(&mut x158, &mut x159, x2, (arg2[4])); + let mut x160: u32 = 0; + let mut x161: u32 = 0; + fiat_p256_mulx_u32(&mut x160, &mut x161, x2, (arg2[3])); + let mut x162: u32 = 0; + let mut x163: u32 = 0; + fiat_p256_mulx_u32(&mut x162, &mut x163, x2, (arg2[2])); + let mut x164: u32 = 0; + let mut x165: u32 = 0; + fiat_p256_mulx_u32(&mut x164, &mut x165, x2, (arg2[1])); + let mut x166: u32 = 0; + let mut x167: u32 = 0; + fiat_p256_mulx_u32(&mut x166, &mut x167, x2, (arg2[0])); + let mut x168: u32 = 0; + let mut x169: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x168, &mut x169, 0x0, x167, x164); + let mut x170: u32 = 0; + let mut x171: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x170, &mut x171, x169, x165, x162); + let mut x172: u32 = 0; + let mut x173: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x172, &mut x173, x171, x163, x160); + let mut x174: u32 = 0; + let mut x175: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x174, &mut x175, x173, x161, x158); + let mut x176: u32 = 0; + let mut x177: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x176, &mut x177, x175, x159, x156); + let mut x178: u32 = 0; + let mut x179: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x178, &mut x179, x177, x157, x154); + let mut x180: u32 = 0; + let mut x181: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x180, &mut x181, x179, x155, x152); + let x182: u32 = ((x181 as u32) + x153); + let mut x183: u32 = 0; + let mut x184: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x183, &mut x184, 0x0, x135, x166); + let mut x185: u32 = 0; + let mut x186: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x185, &mut x186, x184, x137, x168); + let mut x187: u32 = 0; + let mut x188: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x187, &mut x188, x186, x139, x170); + let mut x189: u32 = 0; + let mut x190: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x189, &mut x190, x188, x141, x172); + let mut x191: u32 = 0; + let mut x192: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x191, &mut x192, x190, x143, x174); + let mut x193: u32 = 0; + let mut x194: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x193, &mut x194, x192, x145, x176); + let mut x195: u32 = 0; + let mut x196: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x195, &mut x196, x194, x147, x178); + let mut x197: u32 = 0; + let mut x198: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x197, &mut x198, x196, x149, x180); + let mut x199: u32 = 0; + let mut x200: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x199, &mut x200, x198, x151, x182); + let mut x201: u32 = 0; + let mut x202: u32 = 0; + fiat_p256_mulx_u32(&mut x201, &mut x202, x183, 0xffffffff); + let mut x203: u32 = 0; + let mut x204: u32 = 0; + fiat_p256_mulx_u32(&mut x203, &mut x204, x183, 0xffffffff); + let mut x205: u32 = 0; + let mut x206: u32 = 0; + fiat_p256_mulx_u32(&mut x205, &mut x206, x183, 0xffffffff); + let mut x207: u32 = 0; + let mut x208: u32 = 0; + fiat_p256_mulx_u32(&mut x207, &mut x208, x183, 0xffffffff); + let mut x209: u32 = 0; + let mut x210: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x209, &mut x210, 0x0, x208, x205); + let mut x211: u32 = 0; + let mut x212: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x211, &mut x212, x210, x206, x203); + let x213: u32 = ((x212 as u32) + x204); + let mut x214: u32 = 0; + let mut x215: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x214, &mut x215, 0x0, x183, x207); + let mut x216: u32 = 0; + let mut x217: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x216, &mut x217, x215, x185, x209); + let mut x218: u32 = 0; + let mut x219: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x218, &mut x219, x217, x187, x211); + let mut x220: u32 = 0; + let mut x221: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x220, &mut x221, x219, x189, x213); + let mut x222: u32 = 0; + let mut x223: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x222, &mut x223, x221, x191, (0x0 as u32)); + let mut x224: u32 = 0; + let mut x225: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x224, &mut x225, x223, x193, (0x0 as u32)); + let mut x226: u32 = 0; + let mut x227: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x226, &mut x227, x225, x195, x183); + let mut x228: u32 = 0; + let mut x229: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x228, &mut x229, x227, x197, x201); + let mut x230: u32 = 0; + let mut x231: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x230, &mut x231, x229, x199, x202); + let x232: u32 = ((x231 as u32) + (x200 as u32)); + let mut x233: u32 = 0; + let mut x234: u32 = 0; + fiat_p256_mulx_u32(&mut x233, &mut x234, x3, (arg2[7])); + let mut x235: u32 = 0; + let mut x236: u32 = 0; + fiat_p256_mulx_u32(&mut x235, &mut x236, x3, (arg2[6])); + let mut x237: u32 = 0; + let mut x238: u32 = 0; + fiat_p256_mulx_u32(&mut x237, &mut x238, x3, (arg2[5])); + let mut x239: u32 = 0; + let mut x240: u32 = 0; + fiat_p256_mulx_u32(&mut x239, &mut x240, x3, (arg2[4])); + let mut x241: u32 = 0; + let mut x242: u32 = 0; + fiat_p256_mulx_u32(&mut x241, &mut x242, x3, (arg2[3])); + let mut x243: u32 = 0; + let mut x244: u32 = 0; + fiat_p256_mulx_u32(&mut x243, &mut x244, x3, (arg2[2])); + let mut x245: u32 = 0; + let mut x246: u32 = 0; + fiat_p256_mulx_u32(&mut x245, &mut x246, x3, (arg2[1])); + let mut x247: u32 = 0; + let mut x248: u32 = 0; + fiat_p256_mulx_u32(&mut x247, &mut x248, x3, (arg2[0])); + let mut x249: u32 = 0; + let mut x250: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x249, &mut x250, 0x0, x248, x245); + let mut x251: u32 = 0; + let mut x252: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x251, &mut x252, x250, x246, x243); + let mut x253: u32 = 0; + let mut x254: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x253, &mut x254, x252, x244, x241); + let mut x255: u32 = 0; + let mut x256: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x255, &mut x256, x254, x242, x239); + let mut x257: u32 = 0; + let mut x258: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x257, &mut x258, x256, x240, x237); + let mut x259: u32 = 0; + let mut x260: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x259, &mut x260, x258, x238, x235); + let mut x261: u32 = 0; + let mut x262: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x261, &mut x262, x260, x236, x233); + let x263: u32 = ((x262 as u32) + x234); + let mut x264: u32 = 0; + let mut x265: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x264, &mut x265, 0x0, x216, x247); + let mut x266: u32 = 0; + let mut x267: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x266, &mut x267, x265, x218, x249); + let mut x268: u32 = 0; + let mut x269: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x268, &mut x269, x267, x220, x251); + let mut x270: u32 = 0; + let mut x271: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x270, &mut x271, x269, x222, x253); + let mut x272: u32 = 0; + let mut x273: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x272, &mut x273, x271, x224, x255); + let mut x274: u32 = 0; + let mut x275: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x274, &mut x275, x273, x226, x257); + let mut x276: u32 = 0; + let mut x277: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x276, &mut x277, x275, x228, x259); + let mut x278: u32 = 0; + let mut x279: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x278, &mut x279, x277, x230, x261); + let mut x280: u32 = 0; + let mut x281: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x280, &mut x281, x279, x232, x263); + let mut x282: u32 = 0; + let mut x283: u32 = 0; + fiat_p256_mulx_u32(&mut x282, &mut x283, x264, 0xffffffff); + let mut x284: u32 = 0; + let mut x285: u32 = 0; + fiat_p256_mulx_u32(&mut x284, &mut x285, x264, 0xffffffff); + let mut x286: u32 = 0; + let mut x287: u32 = 0; + fiat_p256_mulx_u32(&mut x286, &mut x287, x264, 0xffffffff); + let mut x288: u32 = 0; + let mut x289: u32 = 0; + fiat_p256_mulx_u32(&mut x288, &mut x289, x264, 0xffffffff); + let mut x290: u32 = 0; + let mut x291: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x290, &mut x291, 0x0, x289, x286); + let mut x292: u32 = 0; + let mut x293: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x292, &mut x293, x291, x287, x284); + let x294: u32 = ((x293 as u32) + x285); + let mut x295: u32 = 0; + let mut x296: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x295, &mut x296, 0x0, x264, x288); + let mut x297: u32 = 0; + let mut x298: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x297, &mut x298, x296, x266, x290); + let mut x299: u32 = 0; + let mut x300: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x299, &mut x300, x298, x268, x292); + let mut x301: u32 = 0; + let mut x302: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x301, &mut x302, x300, x270, x294); + let mut x303: u32 = 0; + let mut x304: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x303, &mut x304, x302, x272, (0x0 as u32)); + let mut x305: u32 = 0; + let mut x306: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x305, &mut x306, x304, x274, (0x0 as u32)); + let mut x307: u32 = 0; + let mut x308: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x307, &mut x308, x306, x276, x264); + let mut x309: u32 = 0; + let mut x310: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x309, &mut x310, x308, x278, x282); + let mut x311: u32 = 0; + let mut x312: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x311, &mut x312, x310, x280, x283); + let x313: u32 = ((x312 as u32) + (x281 as u32)); + let mut x314: u32 = 0; + let mut x315: u32 = 0; + fiat_p256_mulx_u32(&mut x314, &mut x315, x4, (arg2[7])); + let mut x316: u32 = 0; + let mut x317: u32 = 0; + fiat_p256_mulx_u32(&mut x316, &mut x317, x4, (arg2[6])); + let mut x318: u32 = 0; + let mut x319: u32 = 0; + fiat_p256_mulx_u32(&mut x318, &mut x319, x4, (arg2[5])); + let mut x320: u32 = 0; + let mut x321: u32 = 0; + fiat_p256_mulx_u32(&mut x320, &mut x321, x4, (arg2[4])); + let mut x322: u32 = 0; + let mut x323: u32 = 0; + fiat_p256_mulx_u32(&mut x322, &mut x323, x4, (arg2[3])); + let mut x324: u32 = 0; + let mut x325: u32 = 0; + fiat_p256_mulx_u32(&mut x324, &mut x325, x4, (arg2[2])); + let mut x326: u32 = 0; + let mut x327: u32 = 0; + fiat_p256_mulx_u32(&mut x326, &mut x327, x4, (arg2[1])); + let mut x328: u32 = 0; + let mut x329: u32 = 0; + fiat_p256_mulx_u32(&mut x328, &mut x329, x4, (arg2[0])); + let mut x330: u32 = 0; + let mut x331: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x330, &mut x331, 0x0, x329, x326); + let mut x332: u32 = 0; + let mut x333: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x332, &mut x333, x331, x327, x324); + let mut x334: u32 = 0; + let mut x335: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x334, &mut x335, x333, x325, x322); + let mut x336: u32 = 0; + let mut x337: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x336, &mut x337, x335, x323, x320); + let mut x338: u32 = 0; + let mut x339: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x338, &mut x339, x337, x321, x318); + let mut x340: u32 = 0; + let mut x341: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x340, &mut x341, x339, x319, x316); + let mut x342: u32 = 0; + let mut x343: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x342, &mut x343, x341, x317, x314); + let x344: u32 = ((x343 as u32) + x315); + let mut x345: u32 = 0; + let mut x346: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x345, &mut x346, 0x0, x297, x328); + let mut x347: u32 = 0; + let mut x348: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x347, &mut x348, x346, x299, x330); + let mut x349: u32 = 0; + let mut x350: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x349, &mut x350, x348, x301, x332); + let mut x351: u32 = 0; + let mut x352: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x351, &mut x352, x350, x303, x334); + let mut x353: u32 = 0; + let mut x354: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x353, &mut x354, x352, x305, x336); + let mut x355: u32 = 0; + let mut x356: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x355, &mut x356, x354, x307, x338); + let mut x357: u32 = 0; + let mut x358: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x357, &mut x358, x356, x309, x340); + let mut x359: u32 = 0; + let mut x360: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x359, &mut x360, x358, x311, x342); + let mut x361: u32 = 0; + let mut x362: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x361, &mut x362, x360, x313, x344); + let mut x363: u32 = 0; + let mut x364: u32 = 0; + fiat_p256_mulx_u32(&mut x363, &mut x364, x345, 0xffffffff); + let mut x365: u32 = 0; + let mut x366: u32 = 0; + fiat_p256_mulx_u32(&mut x365, &mut x366, x345, 0xffffffff); + let mut x367: u32 = 0; + let mut x368: u32 = 0; + fiat_p256_mulx_u32(&mut x367, &mut x368, x345, 0xffffffff); + let mut x369: u32 = 0; + let mut x370: u32 = 0; + fiat_p256_mulx_u32(&mut x369, &mut x370, x345, 0xffffffff); + let mut x371: u32 = 0; + let mut x372: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x371, &mut x372, 0x0, x370, x367); + let mut x373: u32 = 0; + let mut x374: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x373, &mut x374, x372, x368, x365); + let x375: u32 = ((x374 as u32) + x366); + let mut x376: u32 = 0; + let mut x377: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x376, &mut x377, 0x0, x345, x369); + let mut x378: u32 = 0; + let mut x379: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x378, &mut x379, x377, x347, x371); + let mut x380: u32 = 0; + let mut x381: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x380, &mut x381, x379, x349, x373); + let mut x382: u32 = 0; + let mut x383: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x382, &mut x383, x381, x351, x375); + let mut x384: u32 = 0; + let mut x385: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x384, &mut x385, x383, x353, (0x0 as u32)); + let mut x386: u32 = 0; + let mut x387: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x386, &mut x387, x385, x355, (0x0 as u32)); + let mut x388: u32 = 0; + let mut x389: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x388, &mut x389, x387, x357, x345); + let mut x390: u32 = 0; + let mut x391: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x390, &mut x391, x389, x359, x363); + let mut x392: u32 = 0; + let mut x393: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x392, &mut x393, x391, x361, x364); + let x394: u32 = ((x393 as u32) + (x362 as u32)); + let mut x395: u32 = 0; + let mut x396: u32 = 0; + fiat_p256_mulx_u32(&mut x395, &mut x396, x5, (arg2[7])); + let mut x397: u32 = 0; + let mut x398: u32 = 0; + fiat_p256_mulx_u32(&mut x397, &mut x398, x5, (arg2[6])); + let mut x399: u32 = 0; + let mut x400: u32 = 0; + fiat_p256_mulx_u32(&mut x399, &mut x400, x5, (arg2[5])); + let mut x401: u32 = 0; + let mut x402: u32 = 0; + fiat_p256_mulx_u32(&mut x401, &mut x402, x5, (arg2[4])); + let mut x403: u32 = 0; + let mut x404: u32 = 0; + fiat_p256_mulx_u32(&mut x403, &mut x404, x5, (arg2[3])); + let mut x405: u32 = 0; + let mut x406: u32 = 0; + fiat_p256_mulx_u32(&mut x405, &mut x406, x5, (arg2[2])); + let mut x407: u32 = 0; + let mut x408: u32 = 0; + fiat_p256_mulx_u32(&mut x407, &mut x408, x5, (arg2[1])); + let mut x409: u32 = 0; + let mut x410: u32 = 0; + fiat_p256_mulx_u32(&mut x409, &mut x410, x5, (arg2[0])); + let mut x411: u32 = 0; + let mut x412: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x411, &mut x412, 0x0, x410, x407); + let mut x413: u32 = 0; + let mut x414: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x413, &mut x414, x412, x408, x405); + let mut x415: u32 = 0; + let mut x416: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x415, &mut x416, x414, x406, x403); + let mut x417: u32 = 0; + let mut x418: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x417, &mut x418, x416, x404, x401); + let mut x419: u32 = 0; + let mut x420: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x419, &mut x420, x418, x402, x399); + let mut x421: u32 = 0; + let mut x422: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x421, &mut x422, x420, x400, x397); + let mut x423: u32 = 0; + let mut x424: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x423, &mut x424, x422, x398, x395); + let x425: u32 = ((x424 as u32) + x396); + let mut x426: u32 = 0; + let mut x427: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x426, &mut x427, 0x0, x378, x409); + let mut x428: u32 = 0; + let mut x429: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x428, &mut x429, x427, x380, x411); + let mut x430: u32 = 0; + let mut x431: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x430, &mut x431, x429, x382, x413); + let mut x432: u32 = 0; + let mut x433: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x432, &mut x433, x431, x384, x415); + let mut x434: u32 = 0; + let mut x435: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x434, &mut x435, x433, x386, x417); + let mut x436: u32 = 0; + let mut x437: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x436, &mut x437, x435, x388, x419); + let mut x438: u32 = 0; + let mut x439: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x438, &mut x439, x437, x390, x421); + let mut x440: u32 = 0; + let mut x441: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x440, &mut x441, x439, x392, x423); + let mut x442: u32 = 0; + let mut x443: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x442, &mut x443, x441, x394, x425); + let mut x444: u32 = 0; + let mut x445: u32 = 0; + fiat_p256_mulx_u32(&mut x444, &mut x445, x426, 0xffffffff); + let mut x446: u32 = 0; + let mut x447: u32 = 0; + fiat_p256_mulx_u32(&mut x446, &mut x447, x426, 0xffffffff); + let mut x448: u32 = 0; + let mut x449: u32 = 0; + fiat_p256_mulx_u32(&mut x448, &mut x449, x426, 0xffffffff); + let mut x450: u32 = 0; + let mut x451: u32 = 0; + fiat_p256_mulx_u32(&mut x450, &mut x451, x426, 0xffffffff); + let mut x452: u32 = 0; + let mut x453: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x452, &mut x453, 0x0, x451, x448); + let mut x454: u32 = 0; + let mut x455: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x454, &mut x455, x453, x449, x446); + let x456: u32 = ((x455 as u32) + x447); + let mut x457: u32 = 0; + let mut x458: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x457, &mut x458, 0x0, x426, x450); + let mut x459: u32 = 0; + let mut x460: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x459, &mut x460, x458, x428, x452); + let mut x461: u32 = 0; + let mut x462: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x461, &mut x462, x460, x430, x454); + let mut x463: u32 = 0; + let mut x464: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x463, &mut x464, x462, x432, x456); + let mut x465: u32 = 0; + let mut x466: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x465, &mut x466, x464, x434, (0x0 as u32)); + let mut x467: u32 = 0; + let mut x468: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x467, &mut x468, x466, x436, (0x0 as u32)); + let mut x469: u32 = 0; + let mut x470: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x469, &mut x470, x468, x438, x426); + let mut x471: u32 = 0; + let mut x472: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x471, &mut x472, x470, x440, x444); + let mut x473: u32 = 0; + let mut x474: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x473, &mut x474, x472, x442, x445); + let x475: u32 = ((x474 as u32) + (x443 as u32)); + let mut x476: u32 = 0; + let mut x477: u32 = 0; + fiat_p256_mulx_u32(&mut x476, &mut x477, x6, (arg2[7])); + let mut x478: u32 = 0; + let mut x479: u32 = 0; + fiat_p256_mulx_u32(&mut x478, &mut x479, x6, (arg2[6])); + let mut x480: u32 = 0; + let mut x481: u32 = 0; + fiat_p256_mulx_u32(&mut x480, &mut x481, x6, (arg2[5])); + let mut x482: u32 = 0; + let mut x483: u32 = 0; + fiat_p256_mulx_u32(&mut x482, &mut x483, x6, (arg2[4])); + let mut x484: u32 = 0; + let mut x485: u32 = 0; + fiat_p256_mulx_u32(&mut x484, &mut x485, x6, (arg2[3])); + let mut x486: u32 = 0; + let mut x487: u32 = 0; + fiat_p256_mulx_u32(&mut x486, &mut x487, x6, (arg2[2])); + let mut x488: u32 = 0; + let mut x489: u32 = 0; + fiat_p256_mulx_u32(&mut x488, &mut x489, x6, (arg2[1])); + let mut x490: u32 = 0; + let mut x491: u32 = 0; + fiat_p256_mulx_u32(&mut x490, &mut x491, x6, (arg2[0])); + let mut x492: u32 = 0; + let mut x493: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x492, &mut x493, 0x0, x491, x488); + let mut x494: u32 = 0; + let mut x495: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x494, &mut x495, x493, x489, x486); + let mut x496: u32 = 0; + let mut x497: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x496, &mut x497, x495, x487, x484); + let mut x498: u32 = 0; + let mut x499: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x498, &mut x499, x497, x485, x482); + let mut x500: u32 = 0; + let mut x501: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x500, &mut x501, x499, x483, x480); + let mut x502: u32 = 0; + let mut x503: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x502, &mut x503, x501, x481, x478); + let mut x504: u32 = 0; + let mut x505: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x504, &mut x505, x503, x479, x476); + let x506: u32 = ((x505 as u32) + x477); + let mut x507: u32 = 0; + let mut x508: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x507, &mut x508, 0x0, x459, x490); + let mut x509: u32 = 0; + let mut x510: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x509, &mut x510, x508, x461, x492); + let mut x511: u32 = 0; + let mut x512: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x511, &mut x512, x510, x463, x494); + let mut x513: u32 = 0; + let mut x514: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x513, &mut x514, x512, x465, x496); + let mut x515: u32 = 0; + let mut x516: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x515, &mut x516, x514, x467, x498); + let mut x517: u32 = 0; + let mut x518: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x517, &mut x518, x516, x469, x500); + let mut x519: u32 = 0; + let mut x520: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x519, &mut x520, x518, x471, x502); + let mut x521: u32 = 0; + let mut x522: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x521, &mut x522, x520, x473, x504); + let mut x523: u32 = 0; + let mut x524: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x523, &mut x524, x522, x475, x506); + let mut x525: u32 = 0; + let mut x526: u32 = 0; + fiat_p256_mulx_u32(&mut x525, &mut x526, x507, 0xffffffff); + let mut x527: u32 = 0; + let mut x528: u32 = 0; + fiat_p256_mulx_u32(&mut x527, &mut x528, x507, 0xffffffff); + let mut x529: u32 = 0; + let mut x530: u32 = 0; + fiat_p256_mulx_u32(&mut x529, &mut x530, x507, 0xffffffff); + let mut x531: u32 = 0; + let mut x532: u32 = 0; + fiat_p256_mulx_u32(&mut x531, &mut x532, x507, 0xffffffff); + let mut x533: u32 = 0; + let mut x534: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x533, &mut x534, 0x0, x532, x529); + let mut x535: u32 = 0; + let mut x536: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x535, &mut x536, x534, x530, x527); + let x537: u32 = ((x536 as u32) + x528); + let mut x538: u32 = 0; + let mut x539: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x538, &mut x539, 0x0, x507, x531); + let mut x540: u32 = 0; + let mut x541: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x540, &mut x541, x539, x509, x533); + let mut x542: u32 = 0; + let mut x543: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x542, &mut x543, x541, x511, x535); + let mut x544: u32 = 0; + let mut x545: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x544, &mut x545, x543, x513, x537); + let mut x546: u32 = 0; + let mut x547: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x546, &mut x547, x545, x515, (0x0 as u32)); + let mut x548: u32 = 0; + let mut x549: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x548, &mut x549, x547, x517, (0x0 as u32)); + let mut x550: u32 = 0; + let mut x551: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x550, &mut x551, x549, x519, x507); + let mut x552: u32 = 0; + let mut x553: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x552, &mut x553, x551, x521, x525); + let mut x554: u32 = 0; + let mut x555: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x554, &mut x555, x553, x523, x526); + let x556: u32 = ((x555 as u32) + (x524 as u32)); + let mut x557: u32 = 0; + let mut x558: u32 = 0; + fiat_p256_mulx_u32(&mut x557, &mut x558, x7, (arg2[7])); + let mut x559: u32 = 0; + let mut x560: u32 = 0; + fiat_p256_mulx_u32(&mut x559, &mut x560, x7, (arg2[6])); + let mut x561: u32 = 0; + let mut x562: u32 = 0; + fiat_p256_mulx_u32(&mut x561, &mut x562, x7, (arg2[5])); + let mut x563: u32 = 0; + let mut x564: u32 = 0; + fiat_p256_mulx_u32(&mut x563, &mut x564, x7, (arg2[4])); + let mut x565: u32 = 0; + let mut x566: u32 = 0; + fiat_p256_mulx_u32(&mut x565, &mut x566, x7, (arg2[3])); + let mut x567: u32 = 0; + let mut x568: u32 = 0; + fiat_p256_mulx_u32(&mut x567, &mut x568, x7, (arg2[2])); + let mut x569: u32 = 0; + let mut x570: u32 = 0; + fiat_p256_mulx_u32(&mut x569, &mut x570, x7, (arg2[1])); + let mut x571: u32 = 0; + let mut x572: u32 = 0; + fiat_p256_mulx_u32(&mut x571, &mut x572, x7, (arg2[0])); + let mut x573: u32 = 0; + let mut x574: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x573, &mut x574, 0x0, x572, x569); + let mut x575: u32 = 0; + let mut x576: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x575, &mut x576, x574, x570, x567); + let mut x577: u32 = 0; + let mut x578: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x577, &mut x578, x576, x568, x565); + let mut x579: u32 = 0; + let mut x580: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x579, &mut x580, x578, x566, x563); + let mut x581: u32 = 0; + let mut x582: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x581, &mut x582, x580, x564, x561); + let mut x583: u32 = 0; + let mut x584: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x583, &mut x584, x582, x562, x559); + let mut x585: u32 = 0; + let mut x586: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x585, &mut x586, x584, x560, x557); + let x587: u32 = ((x586 as u32) + x558); + let mut x588: u32 = 0; + let mut x589: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x588, &mut x589, 0x0, x540, x571); + let mut x590: u32 = 0; + let mut x591: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x590, &mut x591, x589, x542, x573); + let mut x592: u32 = 0; + let mut x593: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x592, &mut x593, x591, x544, x575); + let mut x594: u32 = 0; + let mut x595: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x594, &mut x595, x593, x546, x577); + let mut x596: u32 = 0; + let mut x597: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x596, &mut x597, x595, x548, x579); + let mut x598: u32 = 0; + let mut x599: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x598, &mut x599, x597, x550, x581); + let mut x600: u32 = 0; + let mut x601: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x600, &mut x601, x599, x552, x583); + let mut x602: u32 = 0; + let mut x603: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x602, &mut x603, x601, x554, x585); + let mut x604: u32 = 0; + let mut x605: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x604, &mut x605, x603, x556, x587); + let mut x606: u32 = 0; + let mut x607: u32 = 0; + fiat_p256_mulx_u32(&mut x606, &mut x607, x588, 0xffffffff); + let mut x608: u32 = 0; + let mut x609: u32 = 0; + fiat_p256_mulx_u32(&mut x608, &mut x609, x588, 0xffffffff); + let mut x610: u32 = 0; + let mut x611: u32 = 0; + fiat_p256_mulx_u32(&mut x610, &mut x611, x588, 0xffffffff); + let mut x612: u32 = 0; + let mut x613: u32 = 0; + fiat_p256_mulx_u32(&mut x612, &mut x613, x588, 0xffffffff); + let mut x614: u32 = 0; + let mut x615: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x614, &mut x615, 0x0, x613, x610); + let mut x616: u32 = 0; + let mut x617: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x616, &mut x617, x615, x611, x608); + let x618: u32 = ((x617 as u32) + x609); + let mut x619: u32 = 0; + let mut x620: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x619, &mut x620, 0x0, x588, x612); + let mut x621: u32 = 0; + let mut x622: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x621, &mut x622, x620, x590, x614); + let mut x623: u32 = 0; + let mut x624: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x623, &mut x624, x622, x592, x616); + let mut x625: u32 = 0; + let mut x626: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x625, &mut x626, x624, x594, x618); + let mut x627: u32 = 0; + let mut x628: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x627, &mut x628, x626, x596, (0x0 as u32)); + let mut x629: u32 = 0; + let mut x630: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x629, &mut x630, x628, x598, (0x0 as u32)); + let mut x631: u32 = 0; + let mut x632: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x631, &mut x632, x630, x600, x588); + let mut x633: u32 = 0; + let mut x634: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x633, &mut x634, x632, x602, x606); + let mut x635: u32 = 0; + let mut x636: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x635, &mut x636, x634, x604, x607); + let x637: u32 = ((x636 as u32) + (x605 as u32)); + let mut x638: u32 = 0; + let mut x639: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x638, &mut x639, 0x0, x621, 0xffffffff); + let mut x640: u32 = 0; + let mut x641: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x640, &mut x641, x639, x623, 0xffffffff); + let mut x642: u32 = 0; + let mut x643: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x642, &mut x643, x641, x625, 0xffffffff); + let mut x644: u32 = 0; + let mut x645: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x644, &mut x645, x643, x627, (0x0 as u32)); + let mut x646: u32 = 0; + let mut x647: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x646, &mut x647, x645, x629, (0x0 as u32)); + let mut x648: u32 = 0; + let mut x649: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x648, &mut x649, x647, x631, (0x0 as u32)); + let mut x650: u32 = 0; + let mut x651: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x650, &mut x651, x649, x633, (0x1 as u32)); + let mut x652: u32 = 0; + let mut x653: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x652, &mut x653, x651, x635, 0xffffffff); + let mut x654: u32 = 0; + let mut x655: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x654, &mut x655, x653, x637, (0x0 as u32)); + let mut x656: u32 = 0; + fiat_p256_cmovznz_u32(&mut x656, x655, x638, x621); + let mut x657: u32 = 0; + fiat_p256_cmovznz_u32(&mut x657, x655, x640, x623); + let mut x658: u32 = 0; + fiat_p256_cmovznz_u32(&mut x658, x655, x642, x625); + let mut x659: u32 = 0; + fiat_p256_cmovznz_u32(&mut x659, x655, x644, x627); + let mut x660: u32 = 0; + fiat_p256_cmovznz_u32(&mut x660, x655, x646, x629); + let mut x661: u32 = 0; + fiat_p256_cmovznz_u32(&mut x661, x655, x648, x631); + let mut x662: u32 = 0; + fiat_p256_cmovznz_u32(&mut x662, x655, x650, x633); + let mut x663: u32 = 0; + fiat_p256_cmovznz_u32(&mut x663, x655, x652, x635); + out1[0] = x656; + out1[1] = x657; + out1[2] = x658; + out1[3] = x659; + out1[4] = x660; + out1[5] = x661; + out1[6] = x662; + out1[7] = x663; +} + +/// The function fiat_p256_square squares a field element in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg1)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p256_square(out1: &mut fiat_p256_montgomery_domain_field_element, arg1: &fiat_p256_montgomery_domain_field_element) -> () { + let x1: u32 = (arg1[1]); + let x2: u32 = (arg1[2]); + let x3: u32 = (arg1[3]); + let x4: u32 = (arg1[4]); + let x5: u32 = (arg1[5]); + let x6: u32 = (arg1[6]); + let x7: u32 = (arg1[7]); + let x8: u32 = (arg1[0]); + let mut x9: u32 = 0; + let mut x10: u32 = 0; + fiat_p256_mulx_u32(&mut x9, &mut x10, x8, (arg1[7])); + let mut x11: u32 = 0; + let mut x12: u32 = 0; + fiat_p256_mulx_u32(&mut x11, &mut x12, x8, (arg1[6])); + let mut x13: u32 = 0; + let mut x14: u32 = 0; + fiat_p256_mulx_u32(&mut x13, &mut x14, x8, (arg1[5])); + let mut x15: u32 = 0; + let mut x16: u32 = 0; + fiat_p256_mulx_u32(&mut x15, &mut x16, x8, (arg1[4])); + let mut x17: u32 = 0; + let mut x18: u32 = 0; + fiat_p256_mulx_u32(&mut x17, &mut x18, x8, (arg1[3])); + let mut x19: u32 = 0; + let mut x20: u32 = 0; + fiat_p256_mulx_u32(&mut x19, &mut x20, x8, (arg1[2])); + let mut x21: u32 = 0; + let mut x22: u32 = 0; + fiat_p256_mulx_u32(&mut x21, &mut x22, x8, (arg1[1])); + let mut x23: u32 = 0; + let mut x24: u32 = 0; + fiat_p256_mulx_u32(&mut x23, &mut x24, x8, (arg1[0])); + let mut x25: u32 = 0; + let mut x26: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x25, &mut x26, 0x0, x24, x21); + let mut x27: u32 = 0; + let mut x28: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x27, &mut x28, x26, x22, x19); + let mut x29: u32 = 0; + let mut x30: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x29, &mut x30, x28, x20, x17); + let mut x31: u32 = 0; + let mut x32: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x31, &mut x32, x30, x18, x15); + let mut x33: u32 = 0; + let mut x34: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x33, &mut x34, x32, x16, x13); + let mut x35: u32 = 0; + let mut x36: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x35, &mut x36, x34, x14, x11); + let mut x37: u32 = 0; + let mut x38: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x37, &mut x38, x36, x12, x9); + let x39: u32 = ((x38 as u32) + x10); + let mut x40: u32 = 0; + let mut x41: u32 = 0; + fiat_p256_mulx_u32(&mut x40, &mut x41, x23, 0xffffffff); + let mut x42: u32 = 0; + let mut x43: u32 = 0; + fiat_p256_mulx_u32(&mut x42, &mut x43, x23, 0xffffffff); + let mut x44: u32 = 0; + let mut x45: u32 = 0; + fiat_p256_mulx_u32(&mut x44, &mut x45, x23, 0xffffffff); + let mut x46: u32 = 0; + let mut x47: u32 = 0; + fiat_p256_mulx_u32(&mut x46, &mut x47, x23, 0xffffffff); + let mut x48: u32 = 0; + let mut x49: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x48, &mut x49, 0x0, x47, x44); + let mut x50: u32 = 0; + let mut x51: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x50, &mut x51, x49, x45, x42); + let x52: u32 = ((x51 as u32) + x43); + let mut x53: u32 = 0; + let mut x54: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x53, &mut x54, 0x0, x23, x46); + let mut x55: u32 = 0; + let mut x56: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x55, &mut x56, x54, x25, x48); + let mut x57: u32 = 0; + let mut x58: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x57, &mut x58, x56, x27, x50); + let mut x59: u32 = 0; + let mut x60: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x59, &mut x60, x58, x29, x52); + let mut x61: u32 = 0; + let mut x62: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x61, &mut x62, x60, x31, (0x0 as u32)); + let mut x63: u32 = 0; + let mut x64: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x63, &mut x64, x62, x33, (0x0 as u32)); + let mut x65: u32 = 0; + let mut x66: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x65, &mut x66, x64, x35, x23); + let mut x67: u32 = 0; + let mut x68: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x67, &mut x68, x66, x37, x40); + let mut x69: u32 = 0; + let mut x70: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x69, &mut x70, x68, x39, x41); + let mut x71: u32 = 0; + let mut x72: u32 = 0; + fiat_p256_mulx_u32(&mut x71, &mut x72, x1, (arg1[7])); + let mut x73: u32 = 0; + let mut x74: u32 = 0; + fiat_p256_mulx_u32(&mut x73, &mut x74, x1, (arg1[6])); + let mut x75: u32 = 0; + let mut x76: u32 = 0; + fiat_p256_mulx_u32(&mut x75, &mut x76, x1, (arg1[5])); + let mut x77: u32 = 0; + let mut x78: u32 = 0; + fiat_p256_mulx_u32(&mut x77, &mut x78, x1, (arg1[4])); + let mut x79: u32 = 0; + let mut x80: u32 = 0; + fiat_p256_mulx_u32(&mut x79, &mut x80, x1, (arg1[3])); + let mut x81: u32 = 0; + let mut x82: u32 = 0; + fiat_p256_mulx_u32(&mut x81, &mut x82, x1, (arg1[2])); + let mut x83: u32 = 0; + let mut x84: u32 = 0; + fiat_p256_mulx_u32(&mut x83, &mut x84, x1, (arg1[1])); + let mut x85: u32 = 0; + let mut x86: u32 = 0; + fiat_p256_mulx_u32(&mut x85, &mut x86, x1, (arg1[0])); + let mut x87: u32 = 0; + let mut x88: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x87, &mut x88, 0x0, x86, x83); + let mut x89: u32 = 0; + let mut x90: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x89, &mut x90, x88, x84, x81); + let mut x91: u32 = 0; + let mut x92: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x91, &mut x92, x90, x82, x79); + let mut x93: u32 = 0; + let mut x94: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x93, &mut x94, x92, x80, x77); + let mut x95: u32 = 0; + let mut x96: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x95, &mut x96, x94, x78, x75); + let mut x97: u32 = 0; + let mut x98: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x97, &mut x98, x96, x76, x73); + let mut x99: u32 = 0; + let mut x100: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x99, &mut x100, x98, x74, x71); + let x101: u32 = ((x100 as u32) + x72); + let mut x102: u32 = 0; + let mut x103: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x102, &mut x103, 0x0, x55, x85); + let mut x104: u32 = 0; + let mut x105: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x104, &mut x105, x103, x57, x87); + let mut x106: u32 = 0; + let mut x107: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x106, &mut x107, x105, x59, x89); + let mut x108: u32 = 0; + let mut x109: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x108, &mut x109, x107, x61, x91); + let mut x110: u32 = 0; + let mut x111: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x110, &mut x111, x109, x63, x93); + let mut x112: u32 = 0; + let mut x113: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x112, &mut x113, x111, x65, x95); + let mut x114: u32 = 0; + let mut x115: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x114, &mut x115, x113, x67, x97); + let mut x116: u32 = 0; + let mut x117: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x116, &mut x117, x115, x69, x99); + let mut x118: u32 = 0; + let mut x119: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x118, &mut x119, x117, (x70 as u32), x101); + let mut x120: u32 = 0; + let mut x121: u32 = 0; + fiat_p256_mulx_u32(&mut x120, &mut x121, x102, 0xffffffff); + let mut x122: u32 = 0; + let mut x123: u32 = 0; + fiat_p256_mulx_u32(&mut x122, &mut x123, x102, 0xffffffff); + let mut x124: u32 = 0; + let mut x125: u32 = 0; + fiat_p256_mulx_u32(&mut x124, &mut x125, x102, 0xffffffff); + let mut x126: u32 = 0; + let mut x127: u32 = 0; + fiat_p256_mulx_u32(&mut x126, &mut x127, x102, 0xffffffff); + let mut x128: u32 = 0; + let mut x129: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x128, &mut x129, 0x0, x127, x124); + let mut x130: u32 = 0; + let mut x131: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x130, &mut x131, x129, x125, x122); + let x132: u32 = ((x131 as u32) + x123); + let mut x133: u32 = 0; + let mut x134: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x133, &mut x134, 0x0, x102, x126); + let mut x135: u32 = 0; + let mut x136: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x135, &mut x136, x134, x104, x128); + let mut x137: u32 = 0; + let mut x138: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x137, &mut x138, x136, x106, x130); + let mut x139: u32 = 0; + let mut x140: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x139, &mut x140, x138, x108, x132); + let mut x141: u32 = 0; + let mut x142: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x141, &mut x142, x140, x110, (0x0 as u32)); + let mut x143: u32 = 0; + let mut x144: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x143, &mut x144, x142, x112, (0x0 as u32)); + let mut x145: u32 = 0; + let mut x146: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x145, &mut x146, x144, x114, x102); + let mut x147: u32 = 0; + let mut x148: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x147, &mut x148, x146, x116, x120); + let mut x149: u32 = 0; + let mut x150: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x149, &mut x150, x148, x118, x121); + let x151: u32 = ((x150 as u32) + (x119 as u32)); + let mut x152: u32 = 0; + let mut x153: u32 = 0; + fiat_p256_mulx_u32(&mut x152, &mut x153, x2, (arg1[7])); + let mut x154: u32 = 0; + let mut x155: u32 = 0; + fiat_p256_mulx_u32(&mut x154, &mut x155, x2, (arg1[6])); + let mut x156: u32 = 0; + let mut x157: u32 = 0; + fiat_p256_mulx_u32(&mut x156, &mut x157, x2, (arg1[5])); + let mut x158: u32 = 0; + let mut x159: u32 = 0; + fiat_p256_mulx_u32(&mut x158, &mut x159, x2, (arg1[4])); + let mut x160: u32 = 0; + let mut x161: u32 = 0; + fiat_p256_mulx_u32(&mut x160, &mut x161, x2, (arg1[3])); + let mut x162: u32 = 0; + let mut x163: u32 = 0; + fiat_p256_mulx_u32(&mut x162, &mut x163, x2, (arg1[2])); + let mut x164: u32 = 0; + let mut x165: u32 = 0; + fiat_p256_mulx_u32(&mut x164, &mut x165, x2, (arg1[1])); + let mut x166: u32 = 0; + let mut x167: u32 = 0; + fiat_p256_mulx_u32(&mut x166, &mut x167, x2, (arg1[0])); + let mut x168: u32 = 0; + let mut x169: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x168, &mut x169, 0x0, x167, x164); + let mut x170: u32 = 0; + let mut x171: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x170, &mut x171, x169, x165, x162); + let mut x172: u32 = 0; + let mut x173: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x172, &mut x173, x171, x163, x160); + let mut x174: u32 = 0; + let mut x175: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x174, &mut x175, x173, x161, x158); + let mut x176: u32 = 0; + let mut x177: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x176, &mut x177, x175, x159, x156); + let mut x178: u32 = 0; + let mut x179: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x178, &mut x179, x177, x157, x154); + let mut x180: u32 = 0; + let mut x181: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x180, &mut x181, x179, x155, x152); + let x182: u32 = ((x181 as u32) + x153); + let mut x183: u32 = 0; + let mut x184: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x183, &mut x184, 0x0, x135, x166); + let mut x185: u32 = 0; + let mut x186: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x185, &mut x186, x184, x137, x168); + let mut x187: u32 = 0; + let mut x188: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x187, &mut x188, x186, x139, x170); + let mut x189: u32 = 0; + let mut x190: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x189, &mut x190, x188, x141, x172); + let mut x191: u32 = 0; + let mut x192: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x191, &mut x192, x190, x143, x174); + let mut x193: u32 = 0; + let mut x194: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x193, &mut x194, x192, x145, x176); + let mut x195: u32 = 0; + let mut x196: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x195, &mut x196, x194, x147, x178); + let mut x197: u32 = 0; + let mut x198: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x197, &mut x198, x196, x149, x180); + let mut x199: u32 = 0; + let mut x200: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x199, &mut x200, x198, x151, x182); + let mut x201: u32 = 0; + let mut x202: u32 = 0; + fiat_p256_mulx_u32(&mut x201, &mut x202, x183, 0xffffffff); + let mut x203: u32 = 0; + let mut x204: u32 = 0; + fiat_p256_mulx_u32(&mut x203, &mut x204, x183, 0xffffffff); + let mut x205: u32 = 0; + let mut x206: u32 = 0; + fiat_p256_mulx_u32(&mut x205, &mut x206, x183, 0xffffffff); + let mut x207: u32 = 0; + let mut x208: u32 = 0; + fiat_p256_mulx_u32(&mut x207, &mut x208, x183, 0xffffffff); + let mut x209: u32 = 0; + let mut x210: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x209, &mut x210, 0x0, x208, x205); + let mut x211: u32 = 0; + let mut x212: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x211, &mut x212, x210, x206, x203); + let x213: u32 = ((x212 as u32) + x204); + let mut x214: u32 = 0; + let mut x215: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x214, &mut x215, 0x0, x183, x207); + let mut x216: u32 = 0; + let mut x217: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x216, &mut x217, x215, x185, x209); + let mut x218: u32 = 0; + let mut x219: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x218, &mut x219, x217, x187, x211); + let mut x220: u32 = 0; + let mut x221: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x220, &mut x221, x219, x189, x213); + let mut x222: u32 = 0; + let mut x223: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x222, &mut x223, x221, x191, (0x0 as u32)); + let mut x224: u32 = 0; + let mut x225: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x224, &mut x225, x223, x193, (0x0 as u32)); + let mut x226: u32 = 0; + let mut x227: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x226, &mut x227, x225, x195, x183); + let mut x228: u32 = 0; + let mut x229: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x228, &mut x229, x227, x197, x201); + let mut x230: u32 = 0; + let mut x231: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x230, &mut x231, x229, x199, x202); + let x232: u32 = ((x231 as u32) + (x200 as u32)); + let mut x233: u32 = 0; + let mut x234: u32 = 0; + fiat_p256_mulx_u32(&mut x233, &mut x234, x3, (arg1[7])); + let mut x235: u32 = 0; + let mut x236: u32 = 0; + fiat_p256_mulx_u32(&mut x235, &mut x236, x3, (arg1[6])); + let mut x237: u32 = 0; + let mut x238: u32 = 0; + fiat_p256_mulx_u32(&mut x237, &mut x238, x3, (arg1[5])); + let mut x239: u32 = 0; + let mut x240: u32 = 0; + fiat_p256_mulx_u32(&mut x239, &mut x240, x3, (arg1[4])); + let mut x241: u32 = 0; + let mut x242: u32 = 0; + fiat_p256_mulx_u32(&mut x241, &mut x242, x3, (arg1[3])); + let mut x243: u32 = 0; + let mut x244: u32 = 0; + fiat_p256_mulx_u32(&mut x243, &mut x244, x3, (arg1[2])); + let mut x245: u32 = 0; + let mut x246: u32 = 0; + fiat_p256_mulx_u32(&mut x245, &mut x246, x3, (arg1[1])); + let mut x247: u32 = 0; + let mut x248: u32 = 0; + fiat_p256_mulx_u32(&mut x247, &mut x248, x3, (arg1[0])); + let mut x249: u32 = 0; + let mut x250: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x249, &mut x250, 0x0, x248, x245); + let mut x251: u32 = 0; + let mut x252: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x251, &mut x252, x250, x246, x243); + let mut x253: u32 = 0; + let mut x254: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x253, &mut x254, x252, x244, x241); + let mut x255: u32 = 0; + let mut x256: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x255, &mut x256, x254, x242, x239); + let mut x257: u32 = 0; + let mut x258: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x257, &mut x258, x256, x240, x237); + let mut x259: u32 = 0; + let mut x260: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x259, &mut x260, x258, x238, x235); + let mut x261: u32 = 0; + let mut x262: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x261, &mut x262, x260, x236, x233); + let x263: u32 = ((x262 as u32) + x234); + let mut x264: u32 = 0; + let mut x265: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x264, &mut x265, 0x0, x216, x247); + let mut x266: u32 = 0; + let mut x267: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x266, &mut x267, x265, x218, x249); + let mut x268: u32 = 0; + let mut x269: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x268, &mut x269, x267, x220, x251); + let mut x270: u32 = 0; + let mut x271: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x270, &mut x271, x269, x222, x253); + let mut x272: u32 = 0; + let mut x273: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x272, &mut x273, x271, x224, x255); + let mut x274: u32 = 0; + let mut x275: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x274, &mut x275, x273, x226, x257); + let mut x276: u32 = 0; + let mut x277: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x276, &mut x277, x275, x228, x259); + let mut x278: u32 = 0; + let mut x279: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x278, &mut x279, x277, x230, x261); + let mut x280: u32 = 0; + let mut x281: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x280, &mut x281, x279, x232, x263); + let mut x282: u32 = 0; + let mut x283: u32 = 0; + fiat_p256_mulx_u32(&mut x282, &mut x283, x264, 0xffffffff); + let mut x284: u32 = 0; + let mut x285: u32 = 0; + fiat_p256_mulx_u32(&mut x284, &mut x285, x264, 0xffffffff); + let mut x286: u32 = 0; + let mut x287: u32 = 0; + fiat_p256_mulx_u32(&mut x286, &mut x287, x264, 0xffffffff); + let mut x288: u32 = 0; + let mut x289: u32 = 0; + fiat_p256_mulx_u32(&mut x288, &mut x289, x264, 0xffffffff); + let mut x290: u32 = 0; + let mut x291: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x290, &mut x291, 0x0, x289, x286); + let mut x292: u32 = 0; + let mut x293: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x292, &mut x293, x291, x287, x284); + let x294: u32 = ((x293 as u32) + x285); + let mut x295: u32 = 0; + let mut x296: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x295, &mut x296, 0x0, x264, x288); + let mut x297: u32 = 0; + let mut x298: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x297, &mut x298, x296, x266, x290); + let mut x299: u32 = 0; + let mut x300: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x299, &mut x300, x298, x268, x292); + let mut x301: u32 = 0; + let mut x302: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x301, &mut x302, x300, x270, x294); + let mut x303: u32 = 0; + let mut x304: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x303, &mut x304, x302, x272, (0x0 as u32)); + let mut x305: u32 = 0; + let mut x306: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x305, &mut x306, x304, x274, (0x0 as u32)); + let mut x307: u32 = 0; + let mut x308: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x307, &mut x308, x306, x276, x264); + let mut x309: u32 = 0; + let mut x310: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x309, &mut x310, x308, x278, x282); + let mut x311: u32 = 0; + let mut x312: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x311, &mut x312, x310, x280, x283); + let x313: u32 = ((x312 as u32) + (x281 as u32)); + let mut x314: u32 = 0; + let mut x315: u32 = 0; + fiat_p256_mulx_u32(&mut x314, &mut x315, x4, (arg1[7])); + let mut x316: u32 = 0; + let mut x317: u32 = 0; + fiat_p256_mulx_u32(&mut x316, &mut x317, x4, (arg1[6])); + let mut x318: u32 = 0; + let mut x319: u32 = 0; + fiat_p256_mulx_u32(&mut x318, &mut x319, x4, (arg1[5])); + let mut x320: u32 = 0; + let mut x321: u32 = 0; + fiat_p256_mulx_u32(&mut x320, &mut x321, x4, (arg1[4])); + let mut x322: u32 = 0; + let mut x323: u32 = 0; + fiat_p256_mulx_u32(&mut x322, &mut x323, x4, (arg1[3])); + let mut x324: u32 = 0; + let mut x325: u32 = 0; + fiat_p256_mulx_u32(&mut x324, &mut x325, x4, (arg1[2])); + let mut x326: u32 = 0; + let mut x327: u32 = 0; + fiat_p256_mulx_u32(&mut x326, &mut x327, x4, (arg1[1])); + let mut x328: u32 = 0; + let mut x329: u32 = 0; + fiat_p256_mulx_u32(&mut x328, &mut x329, x4, (arg1[0])); + let mut x330: u32 = 0; + let mut x331: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x330, &mut x331, 0x0, x329, x326); + let mut x332: u32 = 0; + let mut x333: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x332, &mut x333, x331, x327, x324); + let mut x334: u32 = 0; + let mut x335: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x334, &mut x335, x333, x325, x322); + let mut x336: u32 = 0; + let mut x337: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x336, &mut x337, x335, x323, x320); + let mut x338: u32 = 0; + let mut x339: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x338, &mut x339, x337, x321, x318); + let mut x340: u32 = 0; + let mut x341: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x340, &mut x341, x339, x319, x316); + let mut x342: u32 = 0; + let mut x343: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x342, &mut x343, x341, x317, x314); + let x344: u32 = ((x343 as u32) + x315); + let mut x345: u32 = 0; + let mut x346: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x345, &mut x346, 0x0, x297, x328); + let mut x347: u32 = 0; + let mut x348: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x347, &mut x348, x346, x299, x330); + let mut x349: u32 = 0; + let mut x350: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x349, &mut x350, x348, x301, x332); + let mut x351: u32 = 0; + let mut x352: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x351, &mut x352, x350, x303, x334); + let mut x353: u32 = 0; + let mut x354: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x353, &mut x354, x352, x305, x336); + let mut x355: u32 = 0; + let mut x356: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x355, &mut x356, x354, x307, x338); + let mut x357: u32 = 0; + let mut x358: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x357, &mut x358, x356, x309, x340); + let mut x359: u32 = 0; + let mut x360: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x359, &mut x360, x358, x311, x342); + let mut x361: u32 = 0; + let mut x362: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x361, &mut x362, x360, x313, x344); + let mut x363: u32 = 0; + let mut x364: u32 = 0; + fiat_p256_mulx_u32(&mut x363, &mut x364, x345, 0xffffffff); + let mut x365: u32 = 0; + let mut x366: u32 = 0; + fiat_p256_mulx_u32(&mut x365, &mut x366, x345, 0xffffffff); + let mut x367: u32 = 0; + let mut x368: u32 = 0; + fiat_p256_mulx_u32(&mut x367, &mut x368, x345, 0xffffffff); + let mut x369: u32 = 0; + let mut x370: u32 = 0; + fiat_p256_mulx_u32(&mut x369, &mut x370, x345, 0xffffffff); + let mut x371: u32 = 0; + let mut x372: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x371, &mut x372, 0x0, x370, x367); + let mut x373: u32 = 0; + let mut x374: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x373, &mut x374, x372, x368, x365); + let x375: u32 = ((x374 as u32) + x366); + let mut x376: u32 = 0; + let mut x377: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x376, &mut x377, 0x0, x345, x369); + let mut x378: u32 = 0; + let mut x379: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x378, &mut x379, x377, x347, x371); + let mut x380: u32 = 0; + let mut x381: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x380, &mut x381, x379, x349, x373); + let mut x382: u32 = 0; + let mut x383: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x382, &mut x383, x381, x351, x375); + let mut x384: u32 = 0; + let mut x385: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x384, &mut x385, x383, x353, (0x0 as u32)); + let mut x386: u32 = 0; + let mut x387: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x386, &mut x387, x385, x355, (0x0 as u32)); + let mut x388: u32 = 0; + let mut x389: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x388, &mut x389, x387, x357, x345); + let mut x390: u32 = 0; + let mut x391: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x390, &mut x391, x389, x359, x363); + let mut x392: u32 = 0; + let mut x393: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x392, &mut x393, x391, x361, x364); + let x394: u32 = ((x393 as u32) + (x362 as u32)); + let mut x395: u32 = 0; + let mut x396: u32 = 0; + fiat_p256_mulx_u32(&mut x395, &mut x396, x5, (arg1[7])); + let mut x397: u32 = 0; + let mut x398: u32 = 0; + fiat_p256_mulx_u32(&mut x397, &mut x398, x5, (arg1[6])); + let mut x399: u32 = 0; + let mut x400: u32 = 0; + fiat_p256_mulx_u32(&mut x399, &mut x400, x5, (arg1[5])); + let mut x401: u32 = 0; + let mut x402: u32 = 0; + fiat_p256_mulx_u32(&mut x401, &mut x402, x5, (arg1[4])); + let mut x403: u32 = 0; + let mut x404: u32 = 0; + fiat_p256_mulx_u32(&mut x403, &mut x404, x5, (arg1[3])); + let mut x405: u32 = 0; + let mut x406: u32 = 0; + fiat_p256_mulx_u32(&mut x405, &mut x406, x5, (arg1[2])); + let mut x407: u32 = 0; + let mut x408: u32 = 0; + fiat_p256_mulx_u32(&mut x407, &mut x408, x5, (arg1[1])); + let mut x409: u32 = 0; + let mut x410: u32 = 0; + fiat_p256_mulx_u32(&mut x409, &mut x410, x5, (arg1[0])); + let mut x411: u32 = 0; + let mut x412: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x411, &mut x412, 0x0, x410, x407); + let mut x413: u32 = 0; + let mut x414: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x413, &mut x414, x412, x408, x405); + let mut x415: u32 = 0; + let mut x416: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x415, &mut x416, x414, x406, x403); + let mut x417: u32 = 0; + let mut x418: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x417, &mut x418, x416, x404, x401); + let mut x419: u32 = 0; + let mut x420: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x419, &mut x420, x418, x402, x399); + let mut x421: u32 = 0; + let mut x422: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x421, &mut x422, x420, x400, x397); + let mut x423: u32 = 0; + let mut x424: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x423, &mut x424, x422, x398, x395); + let x425: u32 = ((x424 as u32) + x396); + let mut x426: u32 = 0; + let mut x427: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x426, &mut x427, 0x0, x378, x409); + let mut x428: u32 = 0; + let mut x429: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x428, &mut x429, x427, x380, x411); + let mut x430: u32 = 0; + let mut x431: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x430, &mut x431, x429, x382, x413); + let mut x432: u32 = 0; + let mut x433: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x432, &mut x433, x431, x384, x415); + let mut x434: u32 = 0; + let mut x435: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x434, &mut x435, x433, x386, x417); + let mut x436: u32 = 0; + let mut x437: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x436, &mut x437, x435, x388, x419); + let mut x438: u32 = 0; + let mut x439: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x438, &mut x439, x437, x390, x421); + let mut x440: u32 = 0; + let mut x441: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x440, &mut x441, x439, x392, x423); + let mut x442: u32 = 0; + let mut x443: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x442, &mut x443, x441, x394, x425); + let mut x444: u32 = 0; + let mut x445: u32 = 0; + fiat_p256_mulx_u32(&mut x444, &mut x445, x426, 0xffffffff); + let mut x446: u32 = 0; + let mut x447: u32 = 0; + fiat_p256_mulx_u32(&mut x446, &mut x447, x426, 0xffffffff); + let mut x448: u32 = 0; + let mut x449: u32 = 0; + fiat_p256_mulx_u32(&mut x448, &mut x449, x426, 0xffffffff); + let mut x450: u32 = 0; + let mut x451: u32 = 0; + fiat_p256_mulx_u32(&mut x450, &mut x451, x426, 0xffffffff); + let mut x452: u32 = 0; + let mut x453: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x452, &mut x453, 0x0, x451, x448); + let mut x454: u32 = 0; + let mut x455: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x454, &mut x455, x453, x449, x446); + let x456: u32 = ((x455 as u32) + x447); + let mut x457: u32 = 0; + let mut x458: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x457, &mut x458, 0x0, x426, x450); + let mut x459: u32 = 0; + let mut x460: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x459, &mut x460, x458, x428, x452); + let mut x461: u32 = 0; + let mut x462: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x461, &mut x462, x460, x430, x454); + let mut x463: u32 = 0; + let mut x464: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x463, &mut x464, x462, x432, x456); + let mut x465: u32 = 0; + let mut x466: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x465, &mut x466, x464, x434, (0x0 as u32)); + let mut x467: u32 = 0; + let mut x468: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x467, &mut x468, x466, x436, (0x0 as u32)); + let mut x469: u32 = 0; + let mut x470: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x469, &mut x470, x468, x438, x426); + let mut x471: u32 = 0; + let mut x472: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x471, &mut x472, x470, x440, x444); + let mut x473: u32 = 0; + let mut x474: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x473, &mut x474, x472, x442, x445); + let x475: u32 = ((x474 as u32) + (x443 as u32)); + let mut x476: u32 = 0; + let mut x477: u32 = 0; + fiat_p256_mulx_u32(&mut x476, &mut x477, x6, (arg1[7])); + let mut x478: u32 = 0; + let mut x479: u32 = 0; + fiat_p256_mulx_u32(&mut x478, &mut x479, x6, (arg1[6])); + let mut x480: u32 = 0; + let mut x481: u32 = 0; + fiat_p256_mulx_u32(&mut x480, &mut x481, x6, (arg1[5])); + let mut x482: u32 = 0; + let mut x483: u32 = 0; + fiat_p256_mulx_u32(&mut x482, &mut x483, x6, (arg1[4])); + let mut x484: u32 = 0; + let mut x485: u32 = 0; + fiat_p256_mulx_u32(&mut x484, &mut x485, x6, (arg1[3])); + let mut x486: u32 = 0; + let mut x487: u32 = 0; + fiat_p256_mulx_u32(&mut x486, &mut x487, x6, (arg1[2])); + let mut x488: u32 = 0; + let mut x489: u32 = 0; + fiat_p256_mulx_u32(&mut x488, &mut x489, x6, (arg1[1])); + let mut x490: u32 = 0; + let mut x491: u32 = 0; + fiat_p256_mulx_u32(&mut x490, &mut x491, x6, (arg1[0])); + let mut x492: u32 = 0; + let mut x493: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x492, &mut x493, 0x0, x491, x488); + let mut x494: u32 = 0; + let mut x495: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x494, &mut x495, x493, x489, x486); + let mut x496: u32 = 0; + let mut x497: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x496, &mut x497, x495, x487, x484); + let mut x498: u32 = 0; + let mut x499: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x498, &mut x499, x497, x485, x482); + let mut x500: u32 = 0; + let mut x501: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x500, &mut x501, x499, x483, x480); + let mut x502: u32 = 0; + let mut x503: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x502, &mut x503, x501, x481, x478); + let mut x504: u32 = 0; + let mut x505: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x504, &mut x505, x503, x479, x476); + let x506: u32 = ((x505 as u32) + x477); + let mut x507: u32 = 0; + let mut x508: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x507, &mut x508, 0x0, x459, x490); + let mut x509: u32 = 0; + let mut x510: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x509, &mut x510, x508, x461, x492); + let mut x511: u32 = 0; + let mut x512: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x511, &mut x512, x510, x463, x494); + let mut x513: u32 = 0; + let mut x514: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x513, &mut x514, x512, x465, x496); + let mut x515: u32 = 0; + let mut x516: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x515, &mut x516, x514, x467, x498); + let mut x517: u32 = 0; + let mut x518: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x517, &mut x518, x516, x469, x500); + let mut x519: u32 = 0; + let mut x520: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x519, &mut x520, x518, x471, x502); + let mut x521: u32 = 0; + let mut x522: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x521, &mut x522, x520, x473, x504); + let mut x523: u32 = 0; + let mut x524: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x523, &mut x524, x522, x475, x506); + let mut x525: u32 = 0; + let mut x526: u32 = 0; + fiat_p256_mulx_u32(&mut x525, &mut x526, x507, 0xffffffff); + let mut x527: u32 = 0; + let mut x528: u32 = 0; + fiat_p256_mulx_u32(&mut x527, &mut x528, x507, 0xffffffff); + let mut x529: u32 = 0; + let mut x530: u32 = 0; + fiat_p256_mulx_u32(&mut x529, &mut x530, x507, 0xffffffff); + let mut x531: u32 = 0; + let mut x532: u32 = 0; + fiat_p256_mulx_u32(&mut x531, &mut x532, x507, 0xffffffff); + let mut x533: u32 = 0; + let mut x534: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x533, &mut x534, 0x0, x532, x529); + let mut x535: u32 = 0; + let mut x536: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x535, &mut x536, x534, x530, x527); + let x537: u32 = ((x536 as u32) + x528); + let mut x538: u32 = 0; + let mut x539: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x538, &mut x539, 0x0, x507, x531); + let mut x540: u32 = 0; + let mut x541: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x540, &mut x541, x539, x509, x533); + let mut x542: u32 = 0; + let mut x543: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x542, &mut x543, x541, x511, x535); + let mut x544: u32 = 0; + let mut x545: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x544, &mut x545, x543, x513, x537); + let mut x546: u32 = 0; + let mut x547: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x546, &mut x547, x545, x515, (0x0 as u32)); + let mut x548: u32 = 0; + let mut x549: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x548, &mut x549, x547, x517, (0x0 as u32)); + let mut x550: u32 = 0; + let mut x551: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x550, &mut x551, x549, x519, x507); + let mut x552: u32 = 0; + let mut x553: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x552, &mut x553, x551, x521, x525); + let mut x554: u32 = 0; + let mut x555: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x554, &mut x555, x553, x523, x526); + let x556: u32 = ((x555 as u32) + (x524 as u32)); + let mut x557: u32 = 0; + let mut x558: u32 = 0; + fiat_p256_mulx_u32(&mut x557, &mut x558, x7, (arg1[7])); + let mut x559: u32 = 0; + let mut x560: u32 = 0; + fiat_p256_mulx_u32(&mut x559, &mut x560, x7, (arg1[6])); + let mut x561: u32 = 0; + let mut x562: u32 = 0; + fiat_p256_mulx_u32(&mut x561, &mut x562, x7, (arg1[5])); + let mut x563: u32 = 0; + let mut x564: u32 = 0; + fiat_p256_mulx_u32(&mut x563, &mut x564, x7, (arg1[4])); + let mut x565: u32 = 0; + let mut x566: u32 = 0; + fiat_p256_mulx_u32(&mut x565, &mut x566, x7, (arg1[3])); + let mut x567: u32 = 0; + let mut x568: u32 = 0; + fiat_p256_mulx_u32(&mut x567, &mut x568, x7, (arg1[2])); + let mut x569: u32 = 0; + let mut x570: u32 = 0; + fiat_p256_mulx_u32(&mut x569, &mut x570, x7, (arg1[1])); + let mut x571: u32 = 0; + let mut x572: u32 = 0; + fiat_p256_mulx_u32(&mut x571, &mut x572, x7, (arg1[0])); + let mut x573: u32 = 0; + let mut x574: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x573, &mut x574, 0x0, x572, x569); + let mut x575: u32 = 0; + let mut x576: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x575, &mut x576, x574, x570, x567); + let mut x577: u32 = 0; + let mut x578: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x577, &mut x578, x576, x568, x565); + let mut x579: u32 = 0; + let mut x580: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x579, &mut x580, x578, x566, x563); + let mut x581: u32 = 0; + let mut x582: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x581, &mut x582, x580, x564, x561); + let mut x583: u32 = 0; + let mut x584: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x583, &mut x584, x582, x562, x559); + let mut x585: u32 = 0; + let mut x586: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x585, &mut x586, x584, x560, x557); + let x587: u32 = ((x586 as u32) + x558); + let mut x588: u32 = 0; + let mut x589: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x588, &mut x589, 0x0, x540, x571); + let mut x590: u32 = 0; + let mut x591: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x590, &mut x591, x589, x542, x573); + let mut x592: u32 = 0; + let mut x593: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x592, &mut x593, x591, x544, x575); + let mut x594: u32 = 0; + let mut x595: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x594, &mut x595, x593, x546, x577); + let mut x596: u32 = 0; + let mut x597: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x596, &mut x597, x595, x548, x579); + let mut x598: u32 = 0; + let mut x599: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x598, &mut x599, x597, x550, x581); + let mut x600: u32 = 0; + let mut x601: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x600, &mut x601, x599, x552, x583); + let mut x602: u32 = 0; + let mut x603: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x602, &mut x603, x601, x554, x585); + let mut x604: u32 = 0; + let mut x605: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x604, &mut x605, x603, x556, x587); + let mut x606: u32 = 0; + let mut x607: u32 = 0; + fiat_p256_mulx_u32(&mut x606, &mut x607, x588, 0xffffffff); + let mut x608: u32 = 0; + let mut x609: u32 = 0; + fiat_p256_mulx_u32(&mut x608, &mut x609, x588, 0xffffffff); + let mut x610: u32 = 0; + let mut x611: u32 = 0; + fiat_p256_mulx_u32(&mut x610, &mut x611, x588, 0xffffffff); + let mut x612: u32 = 0; + let mut x613: u32 = 0; + fiat_p256_mulx_u32(&mut x612, &mut x613, x588, 0xffffffff); + let mut x614: u32 = 0; + let mut x615: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x614, &mut x615, 0x0, x613, x610); + let mut x616: u32 = 0; + let mut x617: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x616, &mut x617, x615, x611, x608); + let x618: u32 = ((x617 as u32) + x609); + let mut x619: u32 = 0; + let mut x620: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x619, &mut x620, 0x0, x588, x612); + let mut x621: u32 = 0; + let mut x622: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x621, &mut x622, x620, x590, x614); + let mut x623: u32 = 0; + let mut x624: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x623, &mut x624, x622, x592, x616); + let mut x625: u32 = 0; + let mut x626: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x625, &mut x626, x624, x594, x618); + let mut x627: u32 = 0; + let mut x628: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x627, &mut x628, x626, x596, (0x0 as u32)); + let mut x629: u32 = 0; + let mut x630: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x629, &mut x630, x628, x598, (0x0 as u32)); + let mut x631: u32 = 0; + let mut x632: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x631, &mut x632, x630, x600, x588); + let mut x633: u32 = 0; + let mut x634: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x633, &mut x634, x632, x602, x606); + let mut x635: u32 = 0; + let mut x636: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x635, &mut x636, x634, x604, x607); + let x637: u32 = ((x636 as u32) + (x605 as u32)); + let mut x638: u32 = 0; + let mut x639: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x638, &mut x639, 0x0, x621, 0xffffffff); + let mut x640: u32 = 0; + let mut x641: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x640, &mut x641, x639, x623, 0xffffffff); + let mut x642: u32 = 0; + let mut x643: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x642, &mut x643, x641, x625, 0xffffffff); + let mut x644: u32 = 0; + let mut x645: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x644, &mut x645, x643, x627, (0x0 as u32)); + let mut x646: u32 = 0; + let mut x647: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x646, &mut x647, x645, x629, (0x0 as u32)); + let mut x648: u32 = 0; + let mut x649: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x648, &mut x649, x647, x631, (0x0 as u32)); + let mut x650: u32 = 0; + let mut x651: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x650, &mut x651, x649, x633, (0x1 as u32)); + let mut x652: u32 = 0; + let mut x653: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x652, &mut x653, x651, x635, 0xffffffff); + let mut x654: u32 = 0; + let mut x655: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x654, &mut x655, x653, x637, (0x0 as u32)); + let mut x656: u32 = 0; + fiat_p256_cmovznz_u32(&mut x656, x655, x638, x621); + let mut x657: u32 = 0; + fiat_p256_cmovznz_u32(&mut x657, x655, x640, x623); + let mut x658: u32 = 0; + fiat_p256_cmovznz_u32(&mut x658, x655, x642, x625); + let mut x659: u32 = 0; + fiat_p256_cmovznz_u32(&mut x659, x655, x644, x627); + let mut x660: u32 = 0; + fiat_p256_cmovznz_u32(&mut x660, x655, x646, x629); + let mut x661: u32 = 0; + fiat_p256_cmovznz_u32(&mut x661, x655, x648, x631); + let mut x662: u32 = 0; + fiat_p256_cmovznz_u32(&mut x662, x655, x650, x633); + let mut x663: u32 = 0; + fiat_p256_cmovznz_u32(&mut x663, x655, x652, x635); + out1[0] = x656; + out1[1] = x657; + out1[2] = x658; + out1[3] = x659; + out1[4] = x660; + out1[5] = x661; + out1[6] = x662; + out1[7] = x663; +} + +/// The function fiat_p256_add adds two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) + eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p256_add(out1: &mut fiat_p256_montgomery_domain_field_element, arg1: &fiat_p256_montgomery_domain_field_element, arg2: &fiat_p256_montgomery_domain_field_element) -> () { + let mut x1: u32 = 0; + let mut x2: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x1, &mut x2, 0x0, (arg1[0]), (arg2[0])); + let mut x3: u32 = 0; + let mut x4: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x3, &mut x4, x2, (arg1[1]), (arg2[1])); + let mut x5: u32 = 0; + let mut x6: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x5, &mut x6, x4, (arg1[2]), (arg2[2])); + let mut x7: u32 = 0; + let mut x8: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x7, &mut x8, x6, (arg1[3]), (arg2[3])); + let mut x9: u32 = 0; + let mut x10: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x9, &mut x10, x8, (arg1[4]), (arg2[4])); + let mut x11: u32 = 0; + let mut x12: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x11, &mut x12, x10, (arg1[5]), (arg2[5])); + let mut x13: u32 = 0; + let mut x14: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x13, &mut x14, x12, (arg1[6]), (arg2[6])); + let mut x15: u32 = 0; + let mut x16: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x15, &mut x16, x14, (arg1[7]), (arg2[7])); + let mut x17: u32 = 0; + let mut x18: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x17, &mut x18, 0x0, x1, 0xffffffff); + let mut x19: u32 = 0; + let mut x20: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x19, &mut x20, x18, x3, 0xffffffff); + let mut x21: u32 = 0; + let mut x22: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x21, &mut x22, x20, x5, 0xffffffff); + let mut x23: u32 = 0; + let mut x24: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x23, &mut x24, x22, x7, (0x0 as u32)); + let mut x25: u32 = 0; + let mut x26: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x25, &mut x26, x24, x9, (0x0 as u32)); + let mut x27: u32 = 0; + let mut x28: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x27, &mut x28, x26, x11, (0x0 as u32)); + let mut x29: u32 = 0; + let mut x30: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x29, &mut x30, x28, x13, (0x1 as u32)); + let mut x31: u32 = 0; + let mut x32: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x31, &mut x32, x30, x15, 0xffffffff); + let mut x33: u32 = 0; + let mut x34: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x33, &mut x34, x32, (x16 as u32), (0x0 as u32)); + let mut x35: u32 = 0; + fiat_p256_cmovznz_u32(&mut x35, x34, x17, x1); + let mut x36: u32 = 0; + fiat_p256_cmovznz_u32(&mut x36, x34, x19, x3); + let mut x37: u32 = 0; + fiat_p256_cmovznz_u32(&mut x37, x34, x21, x5); + let mut x38: u32 = 0; + fiat_p256_cmovznz_u32(&mut x38, x34, x23, x7); + let mut x39: u32 = 0; + fiat_p256_cmovznz_u32(&mut x39, x34, x25, x9); + let mut x40: u32 = 0; + fiat_p256_cmovznz_u32(&mut x40, x34, x27, x11); + let mut x41: u32 = 0; + fiat_p256_cmovznz_u32(&mut x41, x34, x29, x13); + let mut x42: u32 = 0; + fiat_p256_cmovznz_u32(&mut x42, x34, x31, x15); + out1[0] = x35; + out1[1] = x36; + out1[2] = x37; + out1[3] = x38; + out1[4] = x39; + out1[5] = x40; + out1[6] = x41; + out1[7] = x42; +} + +/// The function fiat_p256_sub subtracts two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) - eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p256_sub(out1: &mut fiat_p256_montgomery_domain_field_element, arg1: &fiat_p256_montgomery_domain_field_element, arg2: &fiat_p256_montgomery_domain_field_element) -> () { + let mut x1: u32 = 0; + let mut x2: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x1, &mut x2, 0x0, (arg1[0]), (arg2[0])); + let mut x3: u32 = 0; + let mut x4: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x3, &mut x4, x2, (arg1[1]), (arg2[1])); + let mut x5: u32 = 0; + let mut x6: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x5, &mut x6, x4, (arg1[2]), (arg2[2])); + let mut x7: u32 = 0; + let mut x8: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x7, &mut x8, x6, (arg1[3]), (arg2[3])); + let mut x9: u32 = 0; + let mut x10: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x9, &mut x10, x8, (arg1[4]), (arg2[4])); + let mut x11: u32 = 0; + let mut x12: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x11, &mut x12, x10, (arg1[5]), (arg2[5])); + let mut x13: u32 = 0; + let mut x14: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x13, &mut x14, x12, (arg1[6]), (arg2[6])); + let mut x15: u32 = 0; + let mut x16: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x15, &mut x16, x14, (arg1[7]), (arg2[7])); + let mut x17: u32 = 0; + fiat_p256_cmovznz_u32(&mut x17, x16, (0x0 as u32), 0xffffffff); + let mut x18: u32 = 0; + let mut x19: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x18, &mut x19, 0x0, x1, x17); + let mut x20: u32 = 0; + let mut x21: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x20, &mut x21, x19, x3, x17); + let mut x22: u32 = 0; + let mut x23: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x22, &mut x23, x21, x5, x17); + let mut x24: u32 = 0; + let mut x25: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x24, &mut x25, x23, x7, (0x0 as u32)); + let mut x26: u32 = 0; + let mut x27: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x26, &mut x27, x25, x9, (0x0 as u32)); + let mut x28: u32 = 0; + let mut x29: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x28, &mut x29, x27, x11, (0x0 as u32)); + let mut x30: u32 = 0; + let mut x31: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x30, &mut x31, x29, x13, (((x17 & (0x1 as u32)) as fiat_p256_u1) as u32)); + let mut x32: u32 = 0; + let mut x33: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x32, &mut x33, x31, x15, x17); + out1[0] = x18; + out1[1] = x20; + out1[2] = x22; + out1[3] = x24; + out1[4] = x26; + out1[5] = x28; + out1[6] = x30; + out1[7] = x32; +} + +/// The function fiat_p256_opp negates a field element in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = -eval (from_montgomery arg1) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p256_opp(out1: &mut fiat_p256_montgomery_domain_field_element, arg1: &fiat_p256_montgomery_domain_field_element) -> () { + let mut x1: u32 = 0; + let mut x2: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x1, &mut x2, 0x0, (0x0 as u32), (arg1[0])); + let mut x3: u32 = 0; + let mut x4: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x3, &mut x4, x2, (0x0 as u32), (arg1[1])); + let mut x5: u32 = 0; + let mut x6: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x5, &mut x6, x4, (0x0 as u32), (arg1[2])); + let mut x7: u32 = 0; + let mut x8: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x7, &mut x8, x6, (0x0 as u32), (arg1[3])); + let mut x9: u32 = 0; + let mut x10: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x9, &mut x10, x8, (0x0 as u32), (arg1[4])); + let mut x11: u32 = 0; + let mut x12: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x11, &mut x12, x10, (0x0 as u32), (arg1[5])); + let mut x13: u32 = 0; + let mut x14: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x13, &mut x14, x12, (0x0 as u32), (arg1[6])); + let mut x15: u32 = 0; + let mut x16: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x15, &mut x16, x14, (0x0 as u32), (arg1[7])); + let mut x17: u32 = 0; + fiat_p256_cmovznz_u32(&mut x17, x16, (0x0 as u32), 0xffffffff); + let mut x18: u32 = 0; + let mut x19: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x18, &mut x19, 0x0, x1, x17); + let mut x20: u32 = 0; + let mut x21: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x20, &mut x21, x19, x3, x17); + let mut x22: u32 = 0; + let mut x23: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x22, &mut x23, x21, x5, x17); + let mut x24: u32 = 0; + let mut x25: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x24, &mut x25, x23, x7, (0x0 as u32)); + let mut x26: u32 = 0; + let mut x27: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x26, &mut x27, x25, x9, (0x0 as u32)); + let mut x28: u32 = 0; + let mut x29: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x28, &mut x29, x27, x11, (0x0 as u32)); + let mut x30: u32 = 0; + let mut x31: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x30, &mut x31, x29, x13, (((x17 & (0x1 as u32)) as fiat_p256_u1) as u32)); + let mut x32: u32 = 0; + let mut x33: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x32, &mut x33, x31, x15, x17); + out1[0] = x18; + out1[1] = x20; + out1[2] = x22; + out1[3] = x24; + out1[4] = x26; + out1[5] = x28; + out1[6] = x30; + out1[7] = x32; +} + +/// The function fiat_p256_from_montgomery translates a field element out of the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval out1 mod m = (eval arg1 * ((2^32)⁻¹ mod m)^8) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p256_from_montgomery(out1: &mut fiat_p256_non_montgomery_domain_field_element, arg1: &fiat_p256_montgomery_domain_field_element) -> () { + let x1: u32 = (arg1[0]); + let mut x2: u32 = 0; + let mut x3: u32 = 0; + fiat_p256_mulx_u32(&mut x2, &mut x3, x1, 0xffffffff); + let mut x4: u32 = 0; + let mut x5: u32 = 0; + fiat_p256_mulx_u32(&mut x4, &mut x5, x1, 0xffffffff); + let mut x6: u32 = 0; + let mut x7: u32 = 0; + fiat_p256_mulx_u32(&mut x6, &mut x7, x1, 0xffffffff); + let mut x8: u32 = 0; + let mut x9: u32 = 0; + fiat_p256_mulx_u32(&mut x8, &mut x9, x1, 0xffffffff); + let mut x10: u32 = 0; + let mut x11: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x10, &mut x11, 0x0, x9, x6); + let mut x12: u32 = 0; + let mut x13: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x12, &mut x13, x11, x7, x4); + let mut x14: u32 = 0; + let mut x15: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x14, &mut x15, 0x0, x1, x8); + let mut x16: u32 = 0; + let mut x17: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x16, &mut x17, x15, (0x0 as u32), x10); + let mut x18: u32 = 0; + let mut x19: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x18, &mut x19, x17, (0x0 as u32), x12); + let mut x20: u32 = 0; + let mut x21: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x20, &mut x21, x19, (0x0 as u32), ((x13 as u32) + x5)); + let mut x22: u32 = 0; + let mut x23: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x22, &mut x23, 0x0, x16, (arg1[1])); + let mut x24: u32 = 0; + let mut x25: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x24, &mut x25, x23, x18, (0x0 as u32)); + let mut x26: u32 = 0; + let mut x27: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x26, &mut x27, x25, x20, (0x0 as u32)); + let mut x28: u32 = 0; + let mut x29: u32 = 0; + fiat_p256_mulx_u32(&mut x28, &mut x29, x22, 0xffffffff); + let mut x30: u32 = 0; + let mut x31: u32 = 0; + fiat_p256_mulx_u32(&mut x30, &mut x31, x22, 0xffffffff); + let mut x32: u32 = 0; + let mut x33: u32 = 0; + fiat_p256_mulx_u32(&mut x32, &mut x33, x22, 0xffffffff); + let mut x34: u32 = 0; + let mut x35: u32 = 0; + fiat_p256_mulx_u32(&mut x34, &mut x35, x22, 0xffffffff); + let mut x36: u32 = 0; + let mut x37: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x36, &mut x37, 0x0, x35, x32); + let mut x38: u32 = 0; + let mut x39: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x38, &mut x39, x37, x33, x30); + let mut x40: u32 = 0; + let mut x41: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x40, &mut x41, 0x0, x22, x34); + let mut x42: u32 = 0; + let mut x43: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x42, &mut x43, x41, x24, x36); + let mut x44: u32 = 0; + let mut x45: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x44, &mut x45, x43, x26, x38); + let mut x46: u32 = 0; + let mut x47: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x46, &mut x47, x45, ((x27 as u32) + (x21 as u32)), ((x39 as u32) + x31)); + let mut x48: u32 = 0; + let mut x49: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x48, &mut x49, 0x0, x2, x22); + let mut x50: u32 = 0; + let mut x51: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x50, &mut x51, x49, x3, x28); + let mut x52: u32 = 0; + let mut x53: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x52, &mut x53, 0x0, x42, (arg1[2])); + let mut x54: u32 = 0; + let mut x55: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x54, &mut x55, x53, x44, (0x0 as u32)); + let mut x56: u32 = 0; + let mut x57: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x56, &mut x57, x55, x46, (0x0 as u32)); + let mut x58: u32 = 0; + let mut x59: u32 = 0; + fiat_p256_mulx_u32(&mut x58, &mut x59, x52, 0xffffffff); + let mut x60: u32 = 0; + let mut x61: u32 = 0; + fiat_p256_mulx_u32(&mut x60, &mut x61, x52, 0xffffffff); + let mut x62: u32 = 0; + let mut x63: u32 = 0; + fiat_p256_mulx_u32(&mut x62, &mut x63, x52, 0xffffffff); + let mut x64: u32 = 0; + let mut x65: u32 = 0; + fiat_p256_mulx_u32(&mut x64, &mut x65, x52, 0xffffffff); + let mut x66: u32 = 0; + let mut x67: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x66, &mut x67, 0x0, x65, x62); + let mut x68: u32 = 0; + let mut x69: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x68, &mut x69, x67, x63, x60); + let mut x70: u32 = 0; + let mut x71: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x70, &mut x71, 0x0, x52, x64); + let mut x72: u32 = 0; + let mut x73: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x72, &mut x73, x71, x54, x66); + let mut x74: u32 = 0; + let mut x75: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x74, &mut x75, x73, x56, x68); + let mut x76: u32 = 0; + let mut x77: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x76, &mut x77, x75, ((x57 as u32) + (x47 as u32)), ((x69 as u32) + x61)); + let mut x78: u32 = 0; + let mut x79: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x78, &mut x79, x77, x1, (0x0 as u32)); + let mut x80: u32 = 0; + let mut x81: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x80, &mut x81, x79, x48, (0x0 as u32)); + let mut x82: u32 = 0; + let mut x83: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x82, &mut x83, x81, x50, x52); + let mut x84: u32 = 0; + let mut x85: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x84, &mut x85, x83, ((x51 as u32) + x29), x58); + let mut x86: u32 = 0; + let mut x87: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x86, &mut x87, 0x0, x72, (arg1[3])); + let mut x88: u32 = 0; + let mut x89: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x88, &mut x89, x87, x74, (0x0 as u32)); + let mut x90: u32 = 0; + let mut x91: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x90, &mut x91, x89, x76, (0x0 as u32)); + let mut x92: u32 = 0; + let mut x93: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x92, &mut x93, x91, x78, (0x0 as u32)); + let mut x94: u32 = 0; + let mut x95: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x94, &mut x95, x93, x80, (0x0 as u32)); + let mut x96: u32 = 0; + let mut x97: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x96, &mut x97, x95, x82, (0x0 as u32)); + let mut x98: u32 = 0; + let mut x99: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x98, &mut x99, x97, x84, (0x0 as u32)); + let mut x100: u32 = 0; + let mut x101: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x100, &mut x101, x99, ((x85 as u32) + x59), (0x0 as u32)); + let mut x102: u32 = 0; + let mut x103: u32 = 0; + fiat_p256_mulx_u32(&mut x102, &mut x103, x86, 0xffffffff); + let mut x104: u32 = 0; + let mut x105: u32 = 0; + fiat_p256_mulx_u32(&mut x104, &mut x105, x86, 0xffffffff); + let mut x106: u32 = 0; + let mut x107: u32 = 0; + fiat_p256_mulx_u32(&mut x106, &mut x107, x86, 0xffffffff); + let mut x108: u32 = 0; + let mut x109: u32 = 0; + fiat_p256_mulx_u32(&mut x108, &mut x109, x86, 0xffffffff); + let mut x110: u32 = 0; + let mut x111: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x110, &mut x111, 0x0, x109, x106); + let mut x112: u32 = 0; + let mut x113: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x112, &mut x113, x111, x107, x104); + let mut x114: u32 = 0; + let mut x115: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x114, &mut x115, 0x0, x86, x108); + let mut x116: u32 = 0; + let mut x117: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x116, &mut x117, x115, x88, x110); + let mut x118: u32 = 0; + let mut x119: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x118, &mut x119, x117, x90, x112); + let mut x120: u32 = 0; + let mut x121: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x120, &mut x121, x119, x92, ((x113 as u32) + x105)); + let mut x122: u32 = 0; + let mut x123: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x122, &mut x123, x121, x94, (0x0 as u32)); + let mut x124: u32 = 0; + let mut x125: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x124, &mut x125, x123, x96, (0x0 as u32)); + let mut x126: u32 = 0; + let mut x127: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x126, &mut x127, x125, x98, x86); + let mut x128: u32 = 0; + let mut x129: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x128, &mut x129, x127, x100, x102); + let mut x130: u32 = 0; + let mut x131: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x130, &mut x131, x129, (x101 as u32), x103); + let mut x132: u32 = 0; + let mut x133: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x132, &mut x133, 0x0, x116, (arg1[4])); + let mut x134: u32 = 0; + let mut x135: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x134, &mut x135, x133, x118, (0x0 as u32)); + let mut x136: u32 = 0; + let mut x137: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x136, &mut x137, x135, x120, (0x0 as u32)); + let mut x138: u32 = 0; + let mut x139: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x138, &mut x139, x137, x122, (0x0 as u32)); + let mut x140: u32 = 0; + let mut x141: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x140, &mut x141, x139, x124, (0x0 as u32)); + let mut x142: u32 = 0; + let mut x143: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x142, &mut x143, x141, x126, (0x0 as u32)); + let mut x144: u32 = 0; + let mut x145: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x144, &mut x145, x143, x128, (0x0 as u32)); + let mut x146: u32 = 0; + let mut x147: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x146, &mut x147, x145, x130, (0x0 as u32)); + let mut x148: u32 = 0; + let mut x149: u32 = 0; + fiat_p256_mulx_u32(&mut x148, &mut x149, x132, 0xffffffff); + let mut x150: u32 = 0; + let mut x151: u32 = 0; + fiat_p256_mulx_u32(&mut x150, &mut x151, x132, 0xffffffff); + let mut x152: u32 = 0; + let mut x153: u32 = 0; + fiat_p256_mulx_u32(&mut x152, &mut x153, x132, 0xffffffff); + let mut x154: u32 = 0; + let mut x155: u32 = 0; + fiat_p256_mulx_u32(&mut x154, &mut x155, x132, 0xffffffff); + let mut x156: u32 = 0; + let mut x157: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x156, &mut x157, 0x0, x155, x152); + let mut x158: u32 = 0; + let mut x159: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x158, &mut x159, x157, x153, x150); + let mut x160: u32 = 0; + let mut x161: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x160, &mut x161, 0x0, x132, x154); + let mut x162: u32 = 0; + let mut x163: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x162, &mut x163, x161, x134, x156); + let mut x164: u32 = 0; + let mut x165: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x164, &mut x165, x163, x136, x158); + let mut x166: u32 = 0; + let mut x167: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x166, &mut x167, x165, x138, ((x159 as u32) + x151)); + let mut x168: u32 = 0; + let mut x169: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x168, &mut x169, x167, x140, (0x0 as u32)); + let mut x170: u32 = 0; + let mut x171: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x170, &mut x171, x169, x142, (0x0 as u32)); + let mut x172: u32 = 0; + let mut x173: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x172, &mut x173, x171, x144, x132); + let mut x174: u32 = 0; + let mut x175: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x174, &mut x175, x173, x146, x148); + let mut x176: u32 = 0; + let mut x177: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x176, &mut x177, x175, ((x147 as u32) + (x131 as u32)), x149); + let mut x178: u32 = 0; + let mut x179: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x178, &mut x179, 0x0, x162, (arg1[5])); + let mut x180: u32 = 0; + let mut x181: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x180, &mut x181, x179, x164, (0x0 as u32)); + let mut x182: u32 = 0; + let mut x183: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x182, &mut x183, x181, x166, (0x0 as u32)); + let mut x184: u32 = 0; + let mut x185: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x184, &mut x185, x183, x168, (0x0 as u32)); + let mut x186: u32 = 0; + let mut x187: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x186, &mut x187, x185, x170, (0x0 as u32)); + let mut x188: u32 = 0; + let mut x189: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x188, &mut x189, x187, x172, (0x0 as u32)); + let mut x190: u32 = 0; + let mut x191: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x190, &mut x191, x189, x174, (0x0 as u32)); + let mut x192: u32 = 0; + let mut x193: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x192, &mut x193, x191, x176, (0x0 as u32)); + let mut x194: u32 = 0; + let mut x195: u32 = 0; + fiat_p256_mulx_u32(&mut x194, &mut x195, x178, 0xffffffff); + let mut x196: u32 = 0; + let mut x197: u32 = 0; + fiat_p256_mulx_u32(&mut x196, &mut x197, x178, 0xffffffff); + let mut x198: u32 = 0; + let mut x199: u32 = 0; + fiat_p256_mulx_u32(&mut x198, &mut x199, x178, 0xffffffff); + let mut x200: u32 = 0; + let mut x201: u32 = 0; + fiat_p256_mulx_u32(&mut x200, &mut x201, x178, 0xffffffff); + let mut x202: u32 = 0; + let mut x203: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x202, &mut x203, 0x0, x201, x198); + let mut x204: u32 = 0; + let mut x205: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x204, &mut x205, x203, x199, x196); + let mut x206: u32 = 0; + let mut x207: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x206, &mut x207, 0x0, x178, x200); + let mut x208: u32 = 0; + let mut x209: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x208, &mut x209, x207, x180, x202); + let mut x210: u32 = 0; + let mut x211: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x210, &mut x211, x209, x182, x204); + let mut x212: u32 = 0; + let mut x213: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x212, &mut x213, x211, x184, ((x205 as u32) + x197)); + let mut x214: u32 = 0; + let mut x215: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x214, &mut x215, x213, x186, (0x0 as u32)); + let mut x216: u32 = 0; + let mut x217: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x216, &mut x217, x215, x188, (0x0 as u32)); + let mut x218: u32 = 0; + let mut x219: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x218, &mut x219, x217, x190, x178); + let mut x220: u32 = 0; + let mut x221: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x220, &mut x221, x219, x192, x194); + let mut x222: u32 = 0; + let mut x223: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x222, &mut x223, x221, ((x193 as u32) + (x177 as u32)), x195); + let mut x224: u32 = 0; + let mut x225: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x224, &mut x225, 0x0, x208, (arg1[6])); + let mut x226: u32 = 0; + let mut x227: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x226, &mut x227, x225, x210, (0x0 as u32)); + let mut x228: u32 = 0; + let mut x229: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x228, &mut x229, x227, x212, (0x0 as u32)); + let mut x230: u32 = 0; + let mut x231: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x230, &mut x231, x229, x214, (0x0 as u32)); + let mut x232: u32 = 0; + let mut x233: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x232, &mut x233, x231, x216, (0x0 as u32)); + let mut x234: u32 = 0; + let mut x235: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x234, &mut x235, x233, x218, (0x0 as u32)); + let mut x236: u32 = 0; + let mut x237: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x236, &mut x237, x235, x220, (0x0 as u32)); + let mut x238: u32 = 0; + let mut x239: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x238, &mut x239, x237, x222, (0x0 as u32)); + let mut x240: u32 = 0; + let mut x241: u32 = 0; + fiat_p256_mulx_u32(&mut x240, &mut x241, x224, 0xffffffff); + let mut x242: u32 = 0; + let mut x243: u32 = 0; + fiat_p256_mulx_u32(&mut x242, &mut x243, x224, 0xffffffff); + let mut x244: u32 = 0; + let mut x245: u32 = 0; + fiat_p256_mulx_u32(&mut x244, &mut x245, x224, 0xffffffff); + let mut x246: u32 = 0; + let mut x247: u32 = 0; + fiat_p256_mulx_u32(&mut x246, &mut x247, x224, 0xffffffff); + let mut x248: u32 = 0; + let mut x249: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x248, &mut x249, 0x0, x247, x244); + let mut x250: u32 = 0; + let mut x251: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x250, &mut x251, x249, x245, x242); + let mut x252: u32 = 0; + let mut x253: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x252, &mut x253, 0x0, x224, x246); + let mut x254: u32 = 0; + let mut x255: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x254, &mut x255, x253, x226, x248); + let mut x256: u32 = 0; + let mut x257: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x256, &mut x257, x255, x228, x250); + let mut x258: u32 = 0; + let mut x259: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x258, &mut x259, x257, x230, ((x251 as u32) + x243)); + let mut x260: u32 = 0; + let mut x261: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x260, &mut x261, x259, x232, (0x0 as u32)); + let mut x262: u32 = 0; + let mut x263: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x262, &mut x263, x261, x234, (0x0 as u32)); + let mut x264: u32 = 0; + let mut x265: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x264, &mut x265, x263, x236, x224); + let mut x266: u32 = 0; + let mut x267: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x266, &mut x267, x265, x238, x240); + let mut x268: u32 = 0; + let mut x269: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x268, &mut x269, x267, ((x239 as u32) + (x223 as u32)), x241); + let mut x270: u32 = 0; + let mut x271: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x270, &mut x271, 0x0, x254, (arg1[7])); + let mut x272: u32 = 0; + let mut x273: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x272, &mut x273, x271, x256, (0x0 as u32)); + let mut x274: u32 = 0; + let mut x275: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x274, &mut x275, x273, x258, (0x0 as u32)); + let mut x276: u32 = 0; + let mut x277: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x276, &mut x277, x275, x260, (0x0 as u32)); + let mut x278: u32 = 0; + let mut x279: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x278, &mut x279, x277, x262, (0x0 as u32)); + let mut x280: u32 = 0; + let mut x281: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x280, &mut x281, x279, x264, (0x0 as u32)); + let mut x282: u32 = 0; + let mut x283: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x282, &mut x283, x281, x266, (0x0 as u32)); + let mut x284: u32 = 0; + let mut x285: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x284, &mut x285, x283, x268, (0x0 as u32)); + let mut x286: u32 = 0; + let mut x287: u32 = 0; + fiat_p256_mulx_u32(&mut x286, &mut x287, x270, 0xffffffff); + let mut x288: u32 = 0; + let mut x289: u32 = 0; + fiat_p256_mulx_u32(&mut x288, &mut x289, x270, 0xffffffff); + let mut x290: u32 = 0; + let mut x291: u32 = 0; + fiat_p256_mulx_u32(&mut x290, &mut x291, x270, 0xffffffff); + let mut x292: u32 = 0; + let mut x293: u32 = 0; + fiat_p256_mulx_u32(&mut x292, &mut x293, x270, 0xffffffff); + let mut x294: u32 = 0; + let mut x295: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x294, &mut x295, 0x0, x293, x290); + let mut x296: u32 = 0; + let mut x297: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x296, &mut x297, x295, x291, x288); + let mut x298: u32 = 0; + let mut x299: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x298, &mut x299, 0x0, x270, x292); + let mut x300: u32 = 0; + let mut x301: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x300, &mut x301, x299, x272, x294); + let mut x302: u32 = 0; + let mut x303: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x302, &mut x303, x301, x274, x296); + let mut x304: u32 = 0; + let mut x305: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x304, &mut x305, x303, x276, ((x297 as u32) + x289)); + let mut x306: u32 = 0; + let mut x307: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x306, &mut x307, x305, x278, (0x0 as u32)); + let mut x308: u32 = 0; + let mut x309: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x308, &mut x309, x307, x280, (0x0 as u32)); + let mut x310: u32 = 0; + let mut x311: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x310, &mut x311, x309, x282, x270); + let mut x312: u32 = 0; + let mut x313: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x312, &mut x313, x311, x284, x286); + let mut x314: u32 = 0; + let mut x315: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x314, &mut x315, x313, ((x285 as u32) + (x269 as u32)), x287); + let mut x316: u32 = 0; + let mut x317: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x316, &mut x317, 0x0, x300, 0xffffffff); + let mut x318: u32 = 0; + let mut x319: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x318, &mut x319, x317, x302, 0xffffffff); + let mut x320: u32 = 0; + let mut x321: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x320, &mut x321, x319, x304, 0xffffffff); + let mut x322: u32 = 0; + let mut x323: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x322, &mut x323, x321, x306, (0x0 as u32)); + let mut x324: u32 = 0; + let mut x325: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x324, &mut x325, x323, x308, (0x0 as u32)); + let mut x326: u32 = 0; + let mut x327: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x326, &mut x327, x325, x310, (0x0 as u32)); + let mut x328: u32 = 0; + let mut x329: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x328, &mut x329, x327, x312, (0x1 as u32)); + let mut x330: u32 = 0; + let mut x331: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x330, &mut x331, x329, x314, 0xffffffff); + let mut x332: u32 = 0; + let mut x333: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x332, &mut x333, x331, (x315 as u32), (0x0 as u32)); + let mut x334: u32 = 0; + fiat_p256_cmovznz_u32(&mut x334, x333, x316, x300); + let mut x335: u32 = 0; + fiat_p256_cmovznz_u32(&mut x335, x333, x318, x302); + let mut x336: u32 = 0; + fiat_p256_cmovznz_u32(&mut x336, x333, x320, x304); + let mut x337: u32 = 0; + fiat_p256_cmovznz_u32(&mut x337, x333, x322, x306); + let mut x338: u32 = 0; + fiat_p256_cmovznz_u32(&mut x338, x333, x324, x308); + let mut x339: u32 = 0; + fiat_p256_cmovznz_u32(&mut x339, x333, x326, x310); + let mut x340: u32 = 0; + fiat_p256_cmovznz_u32(&mut x340, x333, x328, x312); + let mut x341: u32 = 0; + fiat_p256_cmovznz_u32(&mut x341, x333, x330, x314); + out1[0] = x334; + out1[1] = x335; + out1[2] = x336; + out1[3] = x337; + out1[4] = x338; + out1[5] = x339; + out1[6] = x340; + out1[7] = x341; +} + +/// The function fiat_p256_to_montgomery translates a field element into the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = eval arg1 mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p256_to_montgomery(out1: &mut fiat_p256_montgomery_domain_field_element, arg1: &fiat_p256_non_montgomery_domain_field_element) -> () { + let x1: u32 = (arg1[1]); + let x2: u32 = (arg1[2]); + let x3: u32 = (arg1[3]); + let x4: u32 = (arg1[4]); + let x5: u32 = (arg1[5]); + let x6: u32 = (arg1[6]); + let x7: u32 = (arg1[7]); + let x8: u32 = (arg1[0]); + let mut x9: u32 = 0; + let mut x10: u32 = 0; + fiat_p256_mulx_u32(&mut x9, &mut x10, x8, 0x4); + let mut x11: u32 = 0; + let mut x12: u32 = 0; + fiat_p256_mulx_u32(&mut x11, &mut x12, x8, 0xfffffffd); + let mut x13: u32 = 0; + let mut x14: u32 = 0; + fiat_p256_mulx_u32(&mut x13, &mut x14, x8, 0xffffffff); + let mut x15: u32 = 0; + let mut x16: u32 = 0; + fiat_p256_mulx_u32(&mut x15, &mut x16, x8, 0xfffffffe); + let mut x17: u32 = 0; + let mut x18: u32 = 0; + fiat_p256_mulx_u32(&mut x17, &mut x18, x8, 0xfffffffb); + let mut x19: u32 = 0; + let mut x20: u32 = 0; + fiat_p256_mulx_u32(&mut x19, &mut x20, x8, 0xffffffff); + let mut x21: u32 = 0; + let mut x22: u32 = 0; + fiat_p256_mulx_u32(&mut x21, &mut x22, x8, 0x3); + let mut x23: u32 = 0; + let mut x24: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x23, &mut x24, 0x0, x20, x17); + let mut x25: u32 = 0; + let mut x26: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x25, &mut x26, x24, x18, x15); + let mut x27: u32 = 0; + let mut x28: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x27, &mut x28, x26, x16, x13); + let mut x29: u32 = 0; + let mut x30: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x29, &mut x30, x28, x14, x11); + let mut x31: u32 = 0; + let mut x32: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x31, &mut x32, x30, x12, x9); + let mut x33: u32 = 0; + let mut x34: u32 = 0; + fiat_p256_mulx_u32(&mut x33, &mut x34, x21, 0xffffffff); + let mut x35: u32 = 0; + let mut x36: u32 = 0; + fiat_p256_mulx_u32(&mut x35, &mut x36, x21, 0xffffffff); + let mut x37: u32 = 0; + let mut x38: u32 = 0; + fiat_p256_mulx_u32(&mut x37, &mut x38, x21, 0xffffffff); + let mut x39: u32 = 0; + let mut x40: u32 = 0; + fiat_p256_mulx_u32(&mut x39, &mut x40, x21, 0xffffffff); + let mut x41: u32 = 0; + let mut x42: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x41, &mut x42, 0x0, x40, x37); + let mut x43: u32 = 0; + let mut x44: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x43, &mut x44, x42, x38, x35); + let mut x45: u32 = 0; + let mut x46: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x45, &mut x46, 0x0, x21, x39); + let mut x47: u32 = 0; + let mut x48: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x47, &mut x48, x46, x22, x41); + let mut x49: u32 = 0; + let mut x50: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x49, &mut x50, x48, x19, x43); + let mut x51: u32 = 0; + let mut x52: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x51, &mut x52, x50, x23, ((x44 as u32) + x36)); + let mut x53: u32 = 0; + let mut x54: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x53, &mut x54, x52, x25, (0x0 as u32)); + let mut x55: u32 = 0; + let mut x56: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x55, &mut x56, x54, x27, (0x0 as u32)); + let mut x57: u32 = 0; + let mut x58: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x57, &mut x58, x56, x29, x21); + let mut x59: u32 = 0; + let mut x60: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x59, &mut x60, x58, x31, x33); + let mut x61: u32 = 0; + let mut x62: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x61, &mut x62, x60, ((x32 as u32) + x10), x34); + let mut x63: u32 = 0; + let mut x64: u32 = 0; + fiat_p256_mulx_u32(&mut x63, &mut x64, x1, 0x4); + let mut x65: u32 = 0; + let mut x66: u32 = 0; + fiat_p256_mulx_u32(&mut x65, &mut x66, x1, 0xfffffffd); + let mut x67: u32 = 0; + let mut x68: u32 = 0; + fiat_p256_mulx_u32(&mut x67, &mut x68, x1, 0xffffffff); + let mut x69: u32 = 0; + let mut x70: u32 = 0; + fiat_p256_mulx_u32(&mut x69, &mut x70, x1, 0xfffffffe); + let mut x71: u32 = 0; + let mut x72: u32 = 0; + fiat_p256_mulx_u32(&mut x71, &mut x72, x1, 0xfffffffb); + let mut x73: u32 = 0; + let mut x74: u32 = 0; + fiat_p256_mulx_u32(&mut x73, &mut x74, x1, 0xffffffff); + let mut x75: u32 = 0; + let mut x76: u32 = 0; + fiat_p256_mulx_u32(&mut x75, &mut x76, x1, 0x3); + let mut x77: u32 = 0; + let mut x78: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x77, &mut x78, 0x0, x74, x71); + let mut x79: u32 = 0; + let mut x80: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x79, &mut x80, x78, x72, x69); + let mut x81: u32 = 0; + let mut x82: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x81, &mut x82, x80, x70, x67); + let mut x83: u32 = 0; + let mut x84: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x83, &mut x84, x82, x68, x65); + let mut x85: u32 = 0; + let mut x86: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x85, &mut x86, x84, x66, x63); + let mut x87: u32 = 0; + let mut x88: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x87, &mut x88, 0x0, x47, x75); + let mut x89: u32 = 0; + let mut x90: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x89, &mut x90, x88, x49, x76); + let mut x91: u32 = 0; + let mut x92: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x91, &mut x92, x90, x51, x73); + let mut x93: u32 = 0; + let mut x94: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x93, &mut x94, x92, x53, x77); + let mut x95: u32 = 0; + let mut x96: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x95, &mut x96, x94, x55, x79); + let mut x97: u32 = 0; + let mut x98: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x97, &mut x98, x96, x57, x81); + let mut x99: u32 = 0; + let mut x100: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x99, &mut x100, x98, x59, x83); + let mut x101: u32 = 0; + let mut x102: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x101, &mut x102, x100, x61, x85); + let mut x103: u32 = 0; + let mut x104: u32 = 0; + fiat_p256_mulx_u32(&mut x103, &mut x104, x87, 0xffffffff); + let mut x105: u32 = 0; + let mut x106: u32 = 0; + fiat_p256_mulx_u32(&mut x105, &mut x106, x87, 0xffffffff); + let mut x107: u32 = 0; + let mut x108: u32 = 0; + fiat_p256_mulx_u32(&mut x107, &mut x108, x87, 0xffffffff); + let mut x109: u32 = 0; + let mut x110: u32 = 0; + fiat_p256_mulx_u32(&mut x109, &mut x110, x87, 0xffffffff); + let mut x111: u32 = 0; + let mut x112: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x111, &mut x112, 0x0, x110, x107); + let mut x113: u32 = 0; + let mut x114: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x113, &mut x114, x112, x108, x105); + let mut x115: u32 = 0; + let mut x116: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x115, &mut x116, 0x0, x87, x109); + let mut x117: u32 = 0; + let mut x118: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x117, &mut x118, x116, x89, x111); + let mut x119: u32 = 0; + let mut x120: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x119, &mut x120, x118, x91, x113); + let mut x121: u32 = 0; + let mut x122: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x121, &mut x122, x120, x93, ((x114 as u32) + x106)); + let mut x123: u32 = 0; + let mut x124: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x123, &mut x124, x122, x95, (0x0 as u32)); + let mut x125: u32 = 0; + let mut x126: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x125, &mut x126, x124, x97, (0x0 as u32)); + let mut x127: u32 = 0; + let mut x128: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x127, &mut x128, x126, x99, x87); + let mut x129: u32 = 0; + let mut x130: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x129, &mut x130, x128, x101, x103); + let mut x131: u32 = 0; + let mut x132: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x131, &mut x132, x130, (((x102 as u32) + (x62 as u32)) + ((x86 as u32) + x64)), x104); + let mut x133: u32 = 0; + let mut x134: u32 = 0; + fiat_p256_mulx_u32(&mut x133, &mut x134, x2, 0x4); + let mut x135: u32 = 0; + let mut x136: u32 = 0; + fiat_p256_mulx_u32(&mut x135, &mut x136, x2, 0xfffffffd); + let mut x137: u32 = 0; + let mut x138: u32 = 0; + fiat_p256_mulx_u32(&mut x137, &mut x138, x2, 0xffffffff); + let mut x139: u32 = 0; + let mut x140: u32 = 0; + fiat_p256_mulx_u32(&mut x139, &mut x140, x2, 0xfffffffe); + let mut x141: u32 = 0; + let mut x142: u32 = 0; + fiat_p256_mulx_u32(&mut x141, &mut x142, x2, 0xfffffffb); + let mut x143: u32 = 0; + let mut x144: u32 = 0; + fiat_p256_mulx_u32(&mut x143, &mut x144, x2, 0xffffffff); + let mut x145: u32 = 0; + let mut x146: u32 = 0; + fiat_p256_mulx_u32(&mut x145, &mut x146, x2, 0x3); + let mut x147: u32 = 0; + let mut x148: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x147, &mut x148, 0x0, x144, x141); + let mut x149: u32 = 0; + let mut x150: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x149, &mut x150, x148, x142, x139); + let mut x151: u32 = 0; + let mut x152: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x151, &mut x152, x150, x140, x137); + let mut x153: u32 = 0; + let mut x154: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x153, &mut x154, x152, x138, x135); + let mut x155: u32 = 0; + let mut x156: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x155, &mut x156, x154, x136, x133); + let mut x157: u32 = 0; + let mut x158: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x157, &mut x158, 0x0, x117, x145); + let mut x159: u32 = 0; + let mut x160: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x159, &mut x160, x158, x119, x146); + let mut x161: u32 = 0; + let mut x162: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x161, &mut x162, x160, x121, x143); + let mut x163: u32 = 0; + let mut x164: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x163, &mut x164, x162, x123, x147); + let mut x165: u32 = 0; + let mut x166: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x165, &mut x166, x164, x125, x149); + let mut x167: u32 = 0; + let mut x168: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x167, &mut x168, x166, x127, x151); + let mut x169: u32 = 0; + let mut x170: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x169, &mut x170, x168, x129, x153); + let mut x171: u32 = 0; + let mut x172: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x171, &mut x172, x170, x131, x155); + let mut x173: u32 = 0; + let mut x174: u32 = 0; + fiat_p256_mulx_u32(&mut x173, &mut x174, x157, 0xffffffff); + let mut x175: u32 = 0; + let mut x176: u32 = 0; + fiat_p256_mulx_u32(&mut x175, &mut x176, x157, 0xffffffff); + let mut x177: u32 = 0; + let mut x178: u32 = 0; + fiat_p256_mulx_u32(&mut x177, &mut x178, x157, 0xffffffff); + let mut x179: u32 = 0; + let mut x180: u32 = 0; + fiat_p256_mulx_u32(&mut x179, &mut x180, x157, 0xffffffff); + let mut x181: u32 = 0; + let mut x182: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x181, &mut x182, 0x0, x180, x177); + let mut x183: u32 = 0; + let mut x184: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x183, &mut x184, x182, x178, x175); + let mut x185: u32 = 0; + let mut x186: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x185, &mut x186, 0x0, x157, x179); + let mut x187: u32 = 0; + let mut x188: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x187, &mut x188, x186, x159, x181); + let mut x189: u32 = 0; + let mut x190: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x189, &mut x190, x188, x161, x183); + let mut x191: u32 = 0; + let mut x192: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x191, &mut x192, x190, x163, ((x184 as u32) + x176)); + let mut x193: u32 = 0; + let mut x194: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x193, &mut x194, x192, x165, (0x0 as u32)); + let mut x195: u32 = 0; + let mut x196: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x195, &mut x196, x194, x167, (0x0 as u32)); + let mut x197: u32 = 0; + let mut x198: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x197, &mut x198, x196, x169, x157); + let mut x199: u32 = 0; + let mut x200: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x199, &mut x200, x198, x171, x173); + let mut x201: u32 = 0; + let mut x202: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x201, &mut x202, x200, (((x172 as u32) + (x132 as u32)) + ((x156 as u32) + x134)), x174); + let mut x203: u32 = 0; + let mut x204: u32 = 0; + fiat_p256_mulx_u32(&mut x203, &mut x204, x3, 0x4); + let mut x205: u32 = 0; + let mut x206: u32 = 0; + fiat_p256_mulx_u32(&mut x205, &mut x206, x3, 0xfffffffd); + let mut x207: u32 = 0; + let mut x208: u32 = 0; + fiat_p256_mulx_u32(&mut x207, &mut x208, x3, 0xffffffff); + let mut x209: u32 = 0; + let mut x210: u32 = 0; + fiat_p256_mulx_u32(&mut x209, &mut x210, x3, 0xfffffffe); + let mut x211: u32 = 0; + let mut x212: u32 = 0; + fiat_p256_mulx_u32(&mut x211, &mut x212, x3, 0xfffffffb); + let mut x213: u32 = 0; + let mut x214: u32 = 0; + fiat_p256_mulx_u32(&mut x213, &mut x214, x3, 0xffffffff); + let mut x215: u32 = 0; + let mut x216: u32 = 0; + fiat_p256_mulx_u32(&mut x215, &mut x216, x3, 0x3); + let mut x217: u32 = 0; + let mut x218: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x217, &mut x218, 0x0, x214, x211); + let mut x219: u32 = 0; + let mut x220: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x219, &mut x220, x218, x212, x209); + let mut x221: u32 = 0; + let mut x222: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x221, &mut x222, x220, x210, x207); + let mut x223: u32 = 0; + let mut x224: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x223, &mut x224, x222, x208, x205); + let mut x225: u32 = 0; + let mut x226: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x225, &mut x226, x224, x206, x203); + let mut x227: u32 = 0; + let mut x228: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x227, &mut x228, 0x0, x187, x215); + let mut x229: u32 = 0; + let mut x230: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x229, &mut x230, x228, x189, x216); + let mut x231: u32 = 0; + let mut x232: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x231, &mut x232, x230, x191, x213); + let mut x233: u32 = 0; + let mut x234: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x233, &mut x234, x232, x193, x217); + let mut x235: u32 = 0; + let mut x236: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x235, &mut x236, x234, x195, x219); + let mut x237: u32 = 0; + let mut x238: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x237, &mut x238, x236, x197, x221); + let mut x239: u32 = 0; + let mut x240: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x239, &mut x240, x238, x199, x223); + let mut x241: u32 = 0; + let mut x242: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x241, &mut x242, x240, x201, x225); + let mut x243: u32 = 0; + let mut x244: u32 = 0; + fiat_p256_mulx_u32(&mut x243, &mut x244, x227, 0xffffffff); + let mut x245: u32 = 0; + let mut x246: u32 = 0; + fiat_p256_mulx_u32(&mut x245, &mut x246, x227, 0xffffffff); + let mut x247: u32 = 0; + let mut x248: u32 = 0; + fiat_p256_mulx_u32(&mut x247, &mut x248, x227, 0xffffffff); + let mut x249: u32 = 0; + let mut x250: u32 = 0; + fiat_p256_mulx_u32(&mut x249, &mut x250, x227, 0xffffffff); + let mut x251: u32 = 0; + let mut x252: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x251, &mut x252, 0x0, x250, x247); + let mut x253: u32 = 0; + let mut x254: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x253, &mut x254, x252, x248, x245); + let mut x255: u32 = 0; + let mut x256: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x255, &mut x256, 0x0, x227, x249); + let mut x257: u32 = 0; + let mut x258: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x257, &mut x258, x256, x229, x251); + let mut x259: u32 = 0; + let mut x260: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x259, &mut x260, x258, x231, x253); + let mut x261: u32 = 0; + let mut x262: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x261, &mut x262, x260, x233, ((x254 as u32) + x246)); + let mut x263: u32 = 0; + let mut x264: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x263, &mut x264, x262, x235, (0x0 as u32)); + let mut x265: u32 = 0; + let mut x266: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x265, &mut x266, x264, x237, (0x0 as u32)); + let mut x267: u32 = 0; + let mut x268: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x267, &mut x268, x266, x239, x227); + let mut x269: u32 = 0; + let mut x270: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x269, &mut x270, x268, x241, x243); + let mut x271: u32 = 0; + let mut x272: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x271, &mut x272, x270, (((x242 as u32) + (x202 as u32)) + ((x226 as u32) + x204)), x244); + let mut x273: u32 = 0; + let mut x274: u32 = 0; + fiat_p256_mulx_u32(&mut x273, &mut x274, x4, 0x4); + let mut x275: u32 = 0; + let mut x276: u32 = 0; + fiat_p256_mulx_u32(&mut x275, &mut x276, x4, 0xfffffffd); + let mut x277: u32 = 0; + let mut x278: u32 = 0; + fiat_p256_mulx_u32(&mut x277, &mut x278, x4, 0xffffffff); + let mut x279: u32 = 0; + let mut x280: u32 = 0; + fiat_p256_mulx_u32(&mut x279, &mut x280, x4, 0xfffffffe); + let mut x281: u32 = 0; + let mut x282: u32 = 0; + fiat_p256_mulx_u32(&mut x281, &mut x282, x4, 0xfffffffb); + let mut x283: u32 = 0; + let mut x284: u32 = 0; + fiat_p256_mulx_u32(&mut x283, &mut x284, x4, 0xffffffff); + let mut x285: u32 = 0; + let mut x286: u32 = 0; + fiat_p256_mulx_u32(&mut x285, &mut x286, x4, 0x3); + let mut x287: u32 = 0; + let mut x288: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x287, &mut x288, 0x0, x284, x281); + let mut x289: u32 = 0; + let mut x290: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x289, &mut x290, x288, x282, x279); + let mut x291: u32 = 0; + let mut x292: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x291, &mut x292, x290, x280, x277); + let mut x293: u32 = 0; + let mut x294: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x293, &mut x294, x292, x278, x275); + let mut x295: u32 = 0; + let mut x296: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x295, &mut x296, x294, x276, x273); + let mut x297: u32 = 0; + let mut x298: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x297, &mut x298, 0x0, x257, x285); + let mut x299: u32 = 0; + let mut x300: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x299, &mut x300, x298, x259, x286); + let mut x301: u32 = 0; + let mut x302: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x301, &mut x302, x300, x261, x283); + let mut x303: u32 = 0; + let mut x304: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x303, &mut x304, x302, x263, x287); + let mut x305: u32 = 0; + let mut x306: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x305, &mut x306, x304, x265, x289); + let mut x307: u32 = 0; + let mut x308: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x307, &mut x308, x306, x267, x291); + let mut x309: u32 = 0; + let mut x310: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x309, &mut x310, x308, x269, x293); + let mut x311: u32 = 0; + let mut x312: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x311, &mut x312, x310, x271, x295); + let mut x313: u32 = 0; + let mut x314: u32 = 0; + fiat_p256_mulx_u32(&mut x313, &mut x314, x297, 0xffffffff); + let mut x315: u32 = 0; + let mut x316: u32 = 0; + fiat_p256_mulx_u32(&mut x315, &mut x316, x297, 0xffffffff); + let mut x317: u32 = 0; + let mut x318: u32 = 0; + fiat_p256_mulx_u32(&mut x317, &mut x318, x297, 0xffffffff); + let mut x319: u32 = 0; + let mut x320: u32 = 0; + fiat_p256_mulx_u32(&mut x319, &mut x320, x297, 0xffffffff); + let mut x321: u32 = 0; + let mut x322: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x321, &mut x322, 0x0, x320, x317); + let mut x323: u32 = 0; + let mut x324: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x323, &mut x324, x322, x318, x315); + let mut x325: u32 = 0; + let mut x326: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x325, &mut x326, 0x0, x297, x319); + let mut x327: u32 = 0; + let mut x328: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x327, &mut x328, x326, x299, x321); + let mut x329: u32 = 0; + let mut x330: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x329, &mut x330, x328, x301, x323); + let mut x331: u32 = 0; + let mut x332: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x331, &mut x332, x330, x303, ((x324 as u32) + x316)); + let mut x333: u32 = 0; + let mut x334: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x333, &mut x334, x332, x305, (0x0 as u32)); + let mut x335: u32 = 0; + let mut x336: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x335, &mut x336, x334, x307, (0x0 as u32)); + let mut x337: u32 = 0; + let mut x338: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x337, &mut x338, x336, x309, x297); + let mut x339: u32 = 0; + let mut x340: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x339, &mut x340, x338, x311, x313); + let mut x341: u32 = 0; + let mut x342: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x341, &mut x342, x340, (((x312 as u32) + (x272 as u32)) + ((x296 as u32) + x274)), x314); + let mut x343: u32 = 0; + let mut x344: u32 = 0; + fiat_p256_mulx_u32(&mut x343, &mut x344, x5, 0x4); + let mut x345: u32 = 0; + let mut x346: u32 = 0; + fiat_p256_mulx_u32(&mut x345, &mut x346, x5, 0xfffffffd); + let mut x347: u32 = 0; + let mut x348: u32 = 0; + fiat_p256_mulx_u32(&mut x347, &mut x348, x5, 0xffffffff); + let mut x349: u32 = 0; + let mut x350: u32 = 0; + fiat_p256_mulx_u32(&mut x349, &mut x350, x5, 0xfffffffe); + let mut x351: u32 = 0; + let mut x352: u32 = 0; + fiat_p256_mulx_u32(&mut x351, &mut x352, x5, 0xfffffffb); + let mut x353: u32 = 0; + let mut x354: u32 = 0; + fiat_p256_mulx_u32(&mut x353, &mut x354, x5, 0xffffffff); + let mut x355: u32 = 0; + let mut x356: u32 = 0; + fiat_p256_mulx_u32(&mut x355, &mut x356, x5, 0x3); + let mut x357: u32 = 0; + let mut x358: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x357, &mut x358, 0x0, x354, x351); + let mut x359: u32 = 0; + let mut x360: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x359, &mut x360, x358, x352, x349); + let mut x361: u32 = 0; + let mut x362: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x361, &mut x362, x360, x350, x347); + let mut x363: u32 = 0; + let mut x364: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x363, &mut x364, x362, x348, x345); + let mut x365: u32 = 0; + let mut x366: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x365, &mut x366, x364, x346, x343); + let mut x367: u32 = 0; + let mut x368: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x367, &mut x368, 0x0, x327, x355); + let mut x369: u32 = 0; + let mut x370: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x369, &mut x370, x368, x329, x356); + let mut x371: u32 = 0; + let mut x372: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x371, &mut x372, x370, x331, x353); + let mut x373: u32 = 0; + let mut x374: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x373, &mut x374, x372, x333, x357); + let mut x375: u32 = 0; + let mut x376: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x375, &mut x376, x374, x335, x359); + let mut x377: u32 = 0; + let mut x378: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x377, &mut x378, x376, x337, x361); + let mut x379: u32 = 0; + let mut x380: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x379, &mut x380, x378, x339, x363); + let mut x381: u32 = 0; + let mut x382: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x381, &mut x382, x380, x341, x365); + let mut x383: u32 = 0; + let mut x384: u32 = 0; + fiat_p256_mulx_u32(&mut x383, &mut x384, x367, 0xffffffff); + let mut x385: u32 = 0; + let mut x386: u32 = 0; + fiat_p256_mulx_u32(&mut x385, &mut x386, x367, 0xffffffff); + let mut x387: u32 = 0; + let mut x388: u32 = 0; + fiat_p256_mulx_u32(&mut x387, &mut x388, x367, 0xffffffff); + let mut x389: u32 = 0; + let mut x390: u32 = 0; + fiat_p256_mulx_u32(&mut x389, &mut x390, x367, 0xffffffff); + let mut x391: u32 = 0; + let mut x392: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x391, &mut x392, 0x0, x390, x387); + let mut x393: u32 = 0; + let mut x394: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x393, &mut x394, x392, x388, x385); + let mut x395: u32 = 0; + let mut x396: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x395, &mut x396, 0x0, x367, x389); + let mut x397: u32 = 0; + let mut x398: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x397, &mut x398, x396, x369, x391); + let mut x399: u32 = 0; + let mut x400: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x399, &mut x400, x398, x371, x393); + let mut x401: u32 = 0; + let mut x402: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x401, &mut x402, x400, x373, ((x394 as u32) + x386)); + let mut x403: u32 = 0; + let mut x404: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x403, &mut x404, x402, x375, (0x0 as u32)); + let mut x405: u32 = 0; + let mut x406: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x405, &mut x406, x404, x377, (0x0 as u32)); + let mut x407: u32 = 0; + let mut x408: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x407, &mut x408, x406, x379, x367); + let mut x409: u32 = 0; + let mut x410: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x409, &mut x410, x408, x381, x383); + let mut x411: u32 = 0; + let mut x412: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x411, &mut x412, x410, (((x382 as u32) + (x342 as u32)) + ((x366 as u32) + x344)), x384); + let mut x413: u32 = 0; + let mut x414: u32 = 0; + fiat_p256_mulx_u32(&mut x413, &mut x414, x6, 0x4); + let mut x415: u32 = 0; + let mut x416: u32 = 0; + fiat_p256_mulx_u32(&mut x415, &mut x416, x6, 0xfffffffd); + let mut x417: u32 = 0; + let mut x418: u32 = 0; + fiat_p256_mulx_u32(&mut x417, &mut x418, x6, 0xffffffff); + let mut x419: u32 = 0; + let mut x420: u32 = 0; + fiat_p256_mulx_u32(&mut x419, &mut x420, x6, 0xfffffffe); + let mut x421: u32 = 0; + let mut x422: u32 = 0; + fiat_p256_mulx_u32(&mut x421, &mut x422, x6, 0xfffffffb); + let mut x423: u32 = 0; + let mut x424: u32 = 0; + fiat_p256_mulx_u32(&mut x423, &mut x424, x6, 0xffffffff); + let mut x425: u32 = 0; + let mut x426: u32 = 0; + fiat_p256_mulx_u32(&mut x425, &mut x426, x6, 0x3); + let mut x427: u32 = 0; + let mut x428: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x427, &mut x428, 0x0, x424, x421); + let mut x429: u32 = 0; + let mut x430: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x429, &mut x430, x428, x422, x419); + let mut x431: u32 = 0; + let mut x432: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x431, &mut x432, x430, x420, x417); + let mut x433: u32 = 0; + let mut x434: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x433, &mut x434, x432, x418, x415); + let mut x435: u32 = 0; + let mut x436: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x435, &mut x436, x434, x416, x413); + let mut x437: u32 = 0; + let mut x438: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x437, &mut x438, 0x0, x397, x425); + let mut x439: u32 = 0; + let mut x440: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x439, &mut x440, x438, x399, x426); + let mut x441: u32 = 0; + let mut x442: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x441, &mut x442, x440, x401, x423); + let mut x443: u32 = 0; + let mut x444: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x443, &mut x444, x442, x403, x427); + let mut x445: u32 = 0; + let mut x446: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x445, &mut x446, x444, x405, x429); + let mut x447: u32 = 0; + let mut x448: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x447, &mut x448, x446, x407, x431); + let mut x449: u32 = 0; + let mut x450: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x449, &mut x450, x448, x409, x433); + let mut x451: u32 = 0; + let mut x452: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x451, &mut x452, x450, x411, x435); + let mut x453: u32 = 0; + let mut x454: u32 = 0; + fiat_p256_mulx_u32(&mut x453, &mut x454, x437, 0xffffffff); + let mut x455: u32 = 0; + let mut x456: u32 = 0; + fiat_p256_mulx_u32(&mut x455, &mut x456, x437, 0xffffffff); + let mut x457: u32 = 0; + let mut x458: u32 = 0; + fiat_p256_mulx_u32(&mut x457, &mut x458, x437, 0xffffffff); + let mut x459: u32 = 0; + let mut x460: u32 = 0; + fiat_p256_mulx_u32(&mut x459, &mut x460, x437, 0xffffffff); + let mut x461: u32 = 0; + let mut x462: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x461, &mut x462, 0x0, x460, x457); + let mut x463: u32 = 0; + let mut x464: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x463, &mut x464, x462, x458, x455); + let mut x465: u32 = 0; + let mut x466: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x465, &mut x466, 0x0, x437, x459); + let mut x467: u32 = 0; + let mut x468: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x467, &mut x468, x466, x439, x461); + let mut x469: u32 = 0; + let mut x470: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x469, &mut x470, x468, x441, x463); + let mut x471: u32 = 0; + let mut x472: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x471, &mut x472, x470, x443, ((x464 as u32) + x456)); + let mut x473: u32 = 0; + let mut x474: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x473, &mut x474, x472, x445, (0x0 as u32)); + let mut x475: u32 = 0; + let mut x476: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x475, &mut x476, x474, x447, (0x0 as u32)); + let mut x477: u32 = 0; + let mut x478: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x477, &mut x478, x476, x449, x437); + let mut x479: u32 = 0; + let mut x480: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x479, &mut x480, x478, x451, x453); + let mut x481: u32 = 0; + let mut x482: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x481, &mut x482, x480, (((x452 as u32) + (x412 as u32)) + ((x436 as u32) + x414)), x454); + let mut x483: u32 = 0; + let mut x484: u32 = 0; + fiat_p256_mulx_u32(&mut x483, &mut x484, x7, 0x4); + let mut x485: u32 = 0; + let mut x486: u32 = 0; + fiat_p256_mulx_u32(&mut x485, &mut x486, x7, 0xfffffffd); + let mut x487: u32 = 0; + let mut x488: u32 = 0; + fiat_p256_mulx_u32(&mut x487, &mut x488, x7, 0xffffffff); + let mut x489: u32 = 0; + let mut x490: u32 = 0; + fiat_p256_mulx_u32(&mut x489, &mut x490, x7, 0xfffffffe); + let mut x491: u32 = 0; + let mut x492: u32 = 0; + fiat_p256_mulx_u32(&mut x491, &mut x492, x7, 0xfffffffb); + let mut x493: u32 = 0; + let mut x494: u32 = 0; + fiat_p256_mulx_u32(&mut x493, &mut x494, x7, 0xffffffff); + let mut x495: u32 = 0; + let mut x496: u32 = 0; + fiat_p256_mulx_u32(&mut x495, &mut x496, x7, 0x3); + let mut x497: u32 = 0; + let mut x498: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x497, &mut x498, 0x0, x494, x491); + let mut x499: u32 = 0; + let mut x500: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x499, &mut x500, x498, x492, x489); + let mut x501: u32 = 0; + let mut x502: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x501, &mut x502, x500, x490, x487); + let mut x503: u32 = 0; + let mut x504: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x503, &mut x504, x502, x488, x485); + let mut x505: u32 = 0; + let mut x506: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x505, &mut x506, x504, x486, x483); + let mut x507: u32 = 0; + let mut x508: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x507, &mut x508, 0x0, x467, x495); + let mut x509: u32 = 0; + let mut x510: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x509, &mut x510, x508, x469, x496); + let mut x511: u32 = 0; + let mut x512: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x511, &mut x512, x510, x471, x493); + let mut x513: u32 = 0; + let mut x514: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x513, &mut x514, x512, x473, x497); + let mut x515: u32 = 0; + let mut x516: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x515, &mut x516, x514, x475, x499); + let mut x517: u32 = 0; + let mut x518: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x517, &mut x518, x516, x477, x501); + let mut x519: u32 = 0; + let mut x520: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x519, &mut x520, x518, x479, x503); + let mut x521: u32 = 0; + let mut x522: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x521, &mut x522, x520, x481, x505); + let mut x523: u32 = 0; + let mut x524: u32 = 0; + fiat_p256_mulx_u32(&mut x523, &mut x524, x507, 0xffffffff); + let mut x525: u32 = 0; + let mut x526: u32 = 0; + fiat_p256_mulx_u32(&mut x525, &mut x526, x507, 0xffffffff); + let mut x527: u32 = 0; + let mut x528: u32 = 0; + fiat_p256_mulx_u32(&mut x527, &mut x528, x507, 0xffffffff); + let mut x529: u32 = 0; + let mut x530: u32 = 0; + fiat_p256_mulx_u32(&mut x529, &mut x530, x507, 0xffffffff); + let mut x531: u32 = 0; + let mut x532: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x531, &mut x532, 0x0, x530, x527); + let mut x533: u32 = 0; + let mut x534: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x533, &mut x534, x532, x528, x525); + let mut x535: u32 = 0; + let mut x536: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x535, &mut x536, 0x0, x507, x529); + let mut x537: u32 = 0; + let mut x538: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x537, &mut x538, x536, x509, x531); + let mut x539: u32 = 0; + let mut x540: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x539, &mut x540, x538, x511, x533); + let mut x541: u32 = 0; + let mut x542: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x541, &mut x542, x540, x513, ((x534 as u32) + x526)); + let mut x543: u32 = 0; + let mut x544: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x543, &mut x544, x542, x515, (0x0 as u32)); + let mut x545: u32 = 0; + let mut x546: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x545, &mut x546, x544, x517, (0x0 as u32)); + let mut x547: u32 = 0; + let mut x548: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x547, &mut x548, x546, x519, x507); + let mut x549: u32 = 0; + let mut x550: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x549, &mut x550, x548, x521, x523); + let mut x551: u32 = 0; + let mut x552: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x551, &mut x552, x550, (((x522 as u32) + (x482 as u32)) + ((x506 as u32) + x484)), x524); + let mut x553: u32 = 0; + let mut x554: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x553, &mut x554, 0x0, x537, 0xffffffff); + let mut x555: u32 = 0; + let mut x556: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x555, &mut x556, x554, x539, 0xffffffff); + let mut x557: u32 = 0; + let mut x558: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x557, &mut x558, x556, x541, 0xffffffff); + let mut x559: u32 = 0; + let mut x560: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x559, &mut x560, x558, x543, (0x0 as u32)); + let mut x561: u32 = 0; + let mut x562: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x561, &mut x562, x560, x545, (0x0 as u32)); + let mut x563: u32 = 0; + let mut x564: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x563, &mut x564, x562, x547, (0x0 as u32)); + let mut x565: u32 = 0; + let mut x566: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x565, &mut x566, x564, x549, (0x1 as u32)); + let mut x567: u32 = 0; + let mut x568: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x567, &mut x568, x566, x551, 0xffffffff); + let mut x569: u32 = 0; + let mut x570: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x569, &mut x570, x568, (x552 as u32), (0x0 as u32)); + let mut x571: u32 = 0; + fiat_p256_cmovznz_u32(&mut x571, x570, x553, x537); + let mut x572: u32 = 0; + fiat_p256_cmovznz_u32(&mut x572, x570, x555, x539); + let mut x573: u32 = 0; + fiat_p256_cmovznz_u32(&mut x573, x570, x557, x541); + let mut x574: u32 = 0; + fiat_p256_cmovznz_u32(&mut x574, x570, x559, x543); + let mut x575: u32 = 0; + fiat_p256_cmovznz_u32(&mut x575, x570, x561, x545); + let mut x576: u32 = 0; + fiat_p256_cmovznz_u32(&mut x576, x570, x563, x547); + let mut x577: u32 = 0; + fiat_p256_cmovznz_u32(&mut x577, x570, x565, x549); + let mut x578: u32 = 0; + fiat_p256_cmovznz_u32(&mut x578, x570, x567, x551); + out1[0] = x571; + out1[1] = x572; + out1[2] = x573; + out1[3] = x574; + out1[4] = x575; + out1[5] = x576; + out1[6] = x577; + out1[7] = x578; +} + +/// The function fiat_p256_nonzero outputs a single non-zero word if the input is non-zero and zero otherwise. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// out1 = 0 ↔ eval (from_montgomery arg1) mod m = 0 +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +#[inline] +pub fn fiat_p256_nonzero(out1: &mut u32, arg1: &[u32; 8]) -> () { + let x1: u32 = ((arg1[0]) | ((arg1[1]) | ((arg1[2]) | ((arg1[3]) | ((arg1[4]) | ((arg1[5]) | ((arg1[6]) | (arg1[7])))))))); + *out1 = x1; +} + +/// The function fiat_p256_selectznz is a multi-limb conditional select. +/// +/// Postconditions: +/// out1 = (if arg1 = 0 then arg2 else arg3) +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// arg3: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +#[inline] +pub fn fiat_p256_selectznz(out1: &mut [u32; 8], arg1: fiat_p256_u1, arg2: &[u32; 8], arg3: &[u32; 8]) -> () { + let mut x1: u32 = 0; + fiat_p256_cmovznz_u32(&mut x1, arg1, (arg2[0]), (arg3[0])); + let mut x2: u32 = 0; + fiat_p256_cmovznz_u32(&mut x2, arg1, (arg2[1]), (arg3[1])); + let mut x3: u32 = 0; + fiat_p256_cmovznz_u32(&mut x3, arg1, (arg2[2]), (arg3[2])); + let mut x4: u32 = 0; + fiat_p256_cmovznz_u32(&mut x4, arg1, (arg2[3]), (arg3[3])); + let mut x5: u32 = 0; + fiat_p256_cmovznz_u32(&mut x5, arg1, (arg2[4]), (arg3[4])); + let mut x6: u32 = 0; + fiat_p256_cmovznz_u32(&mut x6, arg1, (arg2[5]), (arg3[5])); + let mut x7: u32 = 0; + fiat_p256_cmovznz_u32(&mut x7, arg1, (arg2[6]), (arg3[6])); + let mut x8: u32 = 0; + fiat_p256_cmovznz_u32(&mut x8, arg1, (arg2[7]), (arg3[7])); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; + out1[3] = x4; + out1[4] = x5; + out1[5] = x6; + out1[6] = x7; + out1[7] = x8; +} + +/// The function fiat_p256_to_bytes serializes a field element NOT in the Montgomery domain to bytes in little-endian order. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..31] +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] +#[inline] +pub fn fiat_p256_to_bytes(out1: &mut [u8; 32], arg1: &[u32; 8]) -> () { + let x1: u32 = (arg1[7]); + let x2: u32 = (arg1[6]); + let x3: u32 = (arg1[5]); + let x4: u32 = (arg1[4]); + let x5: u32 = (arg1[3]); + let x6: u32 = (arg1[2]); + let x7: u32 = (arg1[1]); + let x8: u32 = (arg1[0]); + let x9: u8 = ((x8 & (0xff as u32)) as u8); + let x10: u32 = (x8 >> 8); + let x11: u8 = ((x10 & (0xff as u32)) as u8); + let x12: u32 = (x10 >> 8); + let x13: u8 = ((x12 & (0xff as u32)) as u8); + let x14: u8 = ((x12 >> 8) as u8); + let x15: u8 = ((x7 & (0xff as u32)) as u8); + let x16: u32 = (x7 >> 8); + let x17: u8 = ((x16 & (0xff as u32)) as u8); + let x18: u32 = (x16 >> 8); + let x19: u8 = ((x18 & (0xff as u32)) as u8); + let x20: u8 = ((x18 >> 8) as u8); + let x21: u8 = ((x6 & (0xff as u32)) as u8); + let x22: u32 = (x6 >> 8); + let x23: u8 = ((x22 & (0xff as u32)) as u8); + let x24: u32 = (x22 >> 8); + let x25: u8 = ((x24 & (0xff as u32)) as u8); + let x26: u8 = ((x24 >> 8) as u8); + let x27: u8 = ((x5 & (0xff as u32)) as u8); + let x28: u32 = (x5 >> 8); + let x29: u8 = ((x28 & (0xff as u32)) as u8); + let x30: u32 = (x28 >> 8); + let x31: u8 = ((x30 & (0xff as u32)) as u8); + let x32: u8 = ((x30 >> 8) as u8); + let x33: u8 = ((x4 & (0xff as u32)) as u8); + let x34: u32 = (x4 >> 8); + let x35: u8 = ((x34 & (0xff as u32)) as u8); + let x36: u32 = (x34 >> 8); + let x37: u8 = ((x36 & (0xff as u32)) as u8); + let x38: u8 = ((x36 >> 8) as u8); + let x39: u8 = ((x3 & (0xff as u32)) as u8); + let x40: u32 = (x3 >> 8); + let x41: u8 = ((x40 & (0xff as u32)) as u8); + let x42: u32 = (x40 >> 8); + let x43: u8 = ((x42 & (0xff as u32)) as u8); + let x44: u8 = ((x42 >> 8) as u8); + let x45: u8 = ((x2 & (0xff as u32)) as u8); + let x46: u32 = (x2 >> 8); + let x47: u8 = ((x46 & (0xff as u32)) as u8); + let x48: u32 = (x46 >> 8); + let x49: u8 = ((x48 & (0xff as u32)) as u8); + let x50: u8 = ((x48 >> 8) as u8); + let x51: u8 = ((x1 & (0xff as u32)) as u8); + let x52: u32 = (x1 >> 8); + let x53: u8 = ((x52 & (0xff as u32)) as u8); + let x54: u32 = (x52 >> 8); + let x55: u8 = ((x54 & (0xff as u32)) as u8); + let x56: u8 = ((x54 >> 8) as u8); + out1[0] = x9; + out1[1] = x11; + out1[2] = x13; + out1[3] = x14; + out1[4] = x15; + out1[5] = x17; + out1[6] = x19; + out1[7] = x20; + out1[8] = x21; + out1[9] = x23; + out1[10] = x25; + out1[11] = x26; + out1[12] = x27; + out1[13] = x29; + out1[14] = x31; + out1[15] = x32; + out1[16] = x33; + out1[17] = x35; + out1[18] = x37; + out1[19] = x38; + out1[20] = x39; + out1[21] = x41; + out1[22] = x43; + out1[23] = x44; + out1[24] = x45; + out1[25] = x47; + out1[26] = x49; + out1[27] = x50; + out1[28] = x51; + out1[29] = x53; + out1[30] = x55; + out1[31] = x56; +} + +/// The function fiat_p256_from_bytes deserializes a field element NOT in the Montgomery domain from bytes in little-endian order. +/// +/// Preconditions: +/// 0 ≤ bytes_eval arg1 < m +/// Postconditions: +/// eval out1 mod m = bytes_eval arg1 mod m +/// 0 ≤ eval out1 < m +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +#[inline] +pub fn fiat_p256_from_bytes(out1: &mut [u32; 8], arg1: &[u8; 32]) -> () { + let x1: u32 = (((arg1[31]) as u32) << 24); + let x2: u32 = (((arg1[30]) as u32) << 16); + let x3: u32 = (((arg1[29]) as u32) << 8); + let x4: u8 = (arg1[28]); + let x5: u32 = (((arg1[27]) as u32) << 24); + let x6: u32 = (((arg1[26]) as u32) << 16); + let x7: u32 = (((arg1[25]) as u32) << 8); + let x8: u8 = (arg1[24]); + let x9: u32 = (((arg1[23]) as u32) << 24); + let x10: u32 = (((arg1[22]) as u32) << 16); + let x11: u32 = (((arg1[21]) as u32) << 8); + let x12: u8 = (arg1[20]); + let x13: u32 = (((arg1[19]) as u32) << 24); + let x14: u32 = (((arg1[18]) as u32) << 16); + let x15: u32 = (((arg1[17]) as u32) << 8); + let x16: u8 = (arg1[16]); + let x17: u32 = (((arg1[15]) as u32) << 24); + let x18: u32 = (((arg1[14]) as u32) << 16); + let x19: u32 = (((arg1[13]) as u32) << 8); + let x20: u8 = (arg1[12]); + let x21: u32 = (((arg1[11]) as u32) << 24); + let x22: u32 = (((arg1[10]) as u32) << 16); + let x23: u32 = (((arg1[9]) as u32) << 8); + let x24: u8 = (arg1[8]); + let x25: u32 = (((arg1[7]) as u32) << 24); + let x26: u32 = (((arg1[6]) as u32) << 16); + let x27: u32 = (((arg1[5]) as u32) << 8); + let x28: u8 = (arg1[4]); + let x29: u32 = (((arg1[3]) as u32) << 24); + let x30: u32 = (((arg1[2]) as u32) << 16); + let x31: u32 = (((arg1[1]) as u32) << 8); + let x32: u8 = (arg1[0]); + let x33: u32 = (x31 + (x32 as u32)); + let x34: u32 = (x30 + x33); + let x35: u32 = (x29 + x34); + let x36: u32 = (x27 + (x28 as u32)); + let x37: u32 = (x26 + x36); + let x38: u32 = (x25 + x37); + let x39: u32 = (x23 + (x24 as u32)); + let x40: u32 = (x22 + x39); + let x41: u32 = (x21 + x40); + let x42: u32 = (x19 + (x20 as u32)); + let x43: u32 = (x18 + x42); + let x44: u32 = (x17 + x43); + let x45: u32 = (x15 + (x16 as u32)); + let x46: u32 = (x14 + x45); + let x47: u32 = (x13 + x46); + let x48: u32 = (x11 + (x12 as u32)); + let x49: u32 = (x10 + x48); + let x50: u32 = (x9 + x49); + let x51: u32 = (x7 + (x8 as u32)); + let x52: u32 = (x6 + x51); + let x53: u32 = (x5 + x52); + let x54: u32 = (x3 + (x4 as u32)); + let x55: u32 = (x2 + x54); + let x56: u32 = (x1 + x55); + out1[0] = x35; + out1[1] = x38; + out1[2] = x41; + out1[3] = x44; + out1[4] = x47; + out1[5] = x50; + out1[6] = x53; + out1[7] = x56; +} + +/// The function fiat_p256_set_one returns the field element one in the Montgomery domain. +/// +/// Postconditions: +/// eval (from_montgomery out1) mod m = 1 mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p256_set_one(out1: &mut fiat_p256_montgomery_domain_field_element) -> () { + out1[0] = (0x1 as u32); + out1[1] = (0x0 as u32); + out1[2] = (0x0 as u32); + out1[3] = 0xffffffff; + out1[4] = 0xffffffff; + out1[5] = 0xffffffff; + out1[6] = 0xfffffffe; + out1[7] = (0x0 as u32); +} + +/// The function fiat_p256_msat returns the saturated representation of the prime modulus. +/// +/// Postconditions: +/// twos_complement_eval out1 = m +/// 0 ≤ eval out1 < m +/// +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +#[inline] +pub fn fiat_p256_msat(out1: &mut [u32; 9]) -> () { + out1[0] = 0xffffffff; + out1[1] = 0xffffffff; + out1[2] = 0xffffffff; + out1[3] = (0x0 as u32); + out1[4] = (0x0 as u32); + out1[5] = (0x0 as u32); + out1[6] = (0x1 as u32); + out1[7] = 0xffffffff; + out1[8] = (0x0 as u32); +} + +/// The function fiat_p256_divstep computes a divstep. +/// +/// Preconditions: +/// 0 ≤ eval arg4 < m +/// 0 ≤ eval arg5 < m +/// Postconditions: +/// out1 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then 1 - arg1 else 1 + arg1) +/// twos_complement_eval out2 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then twos_complement_eval arg3 else twos_complement_eval arg2) +/// twos_complement_eval out3 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then ⌊(twos_complement_eval arg3 - twos_complement_eval arg2) / 2⌋ else ⌊(twos_complement_eval arg3 + (twos_complement_eval arg3 mod 2) * twos_complement_eval arg2) / 2⌋) +/// eval (from_montgomery out4) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (2 * eval (from_montgomery arg5)) mod m else (2 * eval (from_montgomery arg4)) mod m) +/// eval (from_montgomery out5) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (eval (from_montgomery arg4) - eval (from_montgomery arg4)) mod m else (eval (from_montgomery arg5) + (twos_complement_eval arg3 mod 2) * eval (from_montgomery arg4)) mod m) +/// 0 ≤ eval out5 < m +/// 0 ≤ eval out5 < m +/// 0 ≤ eval out2 < m +/// 0 ≤ eval out3 < m +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0xffffffff] +/// arg2: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// arg3: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// arg4: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// arg5: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +/// out2: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// out3: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// out4: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// out5: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +#[inline] +pub fn fiat_p256_divstep(out1: &mut u32, out2: &mut [u32; 9], out3: &mut [u32; 9], out4: &mut [u32; 8], out5: &mut [u32; 8], arg1: u32, arg2: &[u32; 9], arg3: &[u32; 9], arg4: &[u32; 8], arg5: &[u32; 8]) -> () { + let mut x1: u32 = 0; + let mut x2: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x1, &mut x2, 0x0, (!arg1), (0x1 as u32)); + let x3: fiat_p256_u1 = (((x1 >> 31) as fiat_p256_u1) & (((arg3[0]) & (0x1 as u32)) as fiat_p256_u1)); + let mut x4: u32 = 0; + let mut x5: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x4, &mut x5, 0x0, (!arg1), (0x1 as u32)); + let mut x6: u32 = 0; + fiat_p256_cmovznz_u32(&mut x6, x3, arg1, x4); + let mut x7: u32 = 0; + fiat_p256_cmovznz_u32(&mut x7, x3, (arg2[0]), (arg3[0])); + let mut x8: u32 = 0; + fiat_p256_cmovznz_u32(&mut x8, x3, (arg2[1]), (arg3[1])); + let mut x9: u32 = 0; + fiat_p256_cmovznz_u32(&mut x9, x3, (arg2[2]), (arg3[2])); + let mut x10: u32 = 0; + fiat_p256_cmovznz_u32(&mut x10, x3, (arg2[3]), (arg3[3])); + let mut x11: u32 = 0; + fiat_p256_cmovznz_u32(&mut x11, x3, (arg2[4]), (arg3[4])); + let mut x12: u32 = 0; + fiat_p256_cmovznz_u32(&mut x12, x3, (arg2[5]), (arg3[5])); + let mut x13: u32 = 0; + fiat_p256_cmovznz_u32(&mut x13, x3, (arg2[6]), (arg3[6])); + let mut x14: u32 = 0; + fiat_p256_cmovznz_u32(&mut x14, x3, (arg2[7]), (arg3[7])); + let mut x15: u32 = 0; + fiat_p256_cmovznz_u32(&mut x15, x3, (arg2[8]), (arg3[8])); + let mut x16: u32 = 0; + let mut x17: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x16, &mut x17, 0x0, (0x1 as u32), (!(arg2[0]))); + let mut x18: u32 = 0; + let mut x19: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x18, &mut x19, x17, (0x0 as u32), (!(arg2[1]))); + let mut x20: u32 = 0; + let mut x21: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x20, &mut x21, x19, (0x0 as u32), (!(arg2[2]))); + let mut x22: u32 = 0; + let mut x23: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x22, &mut x23, x21, (0x0 as u32), (!(arg2[3]))); + let mut x24: u32 = 0; + let mut x25: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x24, &mut x25, x23, (0x0 as u32), (!(arg2[4]))); + let mut x26: u32 = 0; + let mut x27: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x26, &mut x27, x25, (0x0 as u32), (!(arg2[5]))); + let mut x28: u32 = 0; + let mut x29: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x28, &mut x29, x27, (0x0 as u32), (!(arg2[6]))); + let mut x30: u32 = 0; + let mut x31: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x30, &mut x31, x29, (0x0 as u32), (!(arg2[7]))); + let mut x32: u32 = 0; + let mut x33: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x32, &mut x33, x31, (0x0 as u32), (!(arg2[8]))); + let mut x34: u32 = 0; + fiat_p256_cmovznz_u32(&mut x34, x3, (arg3[0]), x16); + let mut x35: u32 = 0; + fiat_p256_cmovznz_u32(&mut x35, x3, (arg3[1]), x18); + let mut x36: u32 = 0; + fiat_p256_cmovznz_u32(&mut x36, x3, (arg3[2]), x20); + let mut x37: u32 = 0; + fiat_p256_cmovznz_u32(&mut x37, x3, (arg3[3]), x22); + let mut x38: u32 = 0; + fiat_p256_cmovznz_u32(&mut x38, x3, (arg3[4]), x24); + let mut x39: u32 = 0; + fiat_p256_cmovznz_u32(&mut x39, x3, (arg3[5]), x26); + let mut x40: u32 = 0; + fiat_p256_cmovznz_u32(&mut x40, x3, (arg3[6]), x28); + let mut x41: u32 = 0; + fiat_p256_cmovznz_u32(&mut x41, x3, (arg3[7]), x30); + let mut x42: u32 = 0; + fiat_p256_cmovznz_u32(&mut x42, x3, (arg3[8]), x32); + let mut x43: u32 = 0; + fiat_p256_cmovznz_u32(&mut x43, x3, (arg4[0]), (arg5[0])); + let mut x44: u32 = 0; + fiat_p256_cmovznz_u32(&mut x44, x3, (arg4[1]), (arg5[1])); + let mut x45: u32 = 0; + fiat_p256_cmovznz_u32(&mut x45, x3, (arg4[2]), (arg5[2])); + let mut x46: u32 = 0; + fiat_p256_cmovznz_u32(&mut x46, x3, (arg4[3]), (arg5[3])); + let mut x47: u32 = 0; + fiat_p256_cmovznz_u32(&mut x47, x3, (arg4[4]), (arg5[4])); + let mut x48: u32 = 0; + fiat_p256_cmovznz_u32(&mut x48, x3, (arg4[5]), (arg5[5])); + let mut x49: u32 = 0; + fiat_p256_cmovznz_u32(&mut x49, x3, (arg4[6]), (arg5[6])); + let mut x50: u32 = 0; + fiat_p256_cmovznz_u32(&mut x50, x3, (arg4[7]), (arg5[7])); + let mut x51: u32 = 0; + let mut x52: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x51, &mut x52, 0x0, x43, x43); + let mut x53: u32 = 0; + let mut x54: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x53, &mut x54, x52, x44, x44); + let mut x55: u32 = 0; + let mut x56: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x55, &mut x56, x54, x45, x45); + let mut x57: u32 = 0; + let mut x58: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x57, &mut x58, x56, x46, x46); + let mut x59: u32 = 0; + let mut x60: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x59, &mut x60, x58, x47, x47); + let mut x61: u32 = 0; + let mut x62: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x61, &mut x62, x60, x48, x48); + let mut x63: u32 = 0; + let mut x64: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x63, &mut x64, x62, x49, x49); + let mut x65: u32 = 0; + let mut x66: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x65, &mut x66, x64, x50, x50); + let mut x67: u32 = 0; + let mut x68: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x67, &mut x68, 0x0, x51, 0xffffffff); + let mut x69: u32 = 0; + let mut x70: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x69, &mut x70, x68, x53, 0xffffffff); + let mut x71: u32 = 0; + let mut x72: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x71, &mut x72, x70, x55, 0xffffffff); + let mut x73: u32 = 0; + let mut x74: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x73, &mut x74, x72, x57, (0x0 as u32)); + let mut x75: u32 = 0; + let mut x76: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x75, &mut x76, x74, x59, (0x0 as u32)); + let mut x77: u32 = 0; + let mut x78: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x77, &mut x78, x76, x61, (0x0 as u32)); + let mut x79: u32 = 0; + let mut x80: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x79, &mut x80, x78, x63, (0x1 as u32)); + let mut x81: u32 = 0; + let mut x82: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x81, &mut x82, x80, x65, 0xffffffff); + let mut x83: u32 = 0; + let mut x84: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x83, &mut x84, x82, (x66 as u32), (0x0 as u32)); + let x85: u32 = (arg4[7]); + let x86: u32 = (arg4[6]); + let x87: u32 = (arg4[5]); + let x88: u32 = (arg4[4]); + let x89: u32 = (arg4[3]); + let x90: u32 = (arg4[2]); + let x91: u32 = (arg4[1]); + let x92: u32 = (arg4[0]); + let mut x93: u32 = 0; + let mut x94: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x93, &mut x94, 0x0, (0x0 as u32), x92); + let mut x95: u32 = 0; + let mut x96: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x95, &mut x96, x94, (0x0 as u32), x91); + let mut x97: u32 = 0; + let mut x98: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x97, &mut x98, x96, (0x0 as u32), x90); + let mut x99: u32 = 0; + let mut x100: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x99, &mut x100, x98, (0x0 as u32), x89); + let mut x101: u32 = 0; + let mut x102: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x101, &mut x102, x100, (0x0 as u32), x88); + let mut x103: u32 = 0; + let mut x104: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x103, &mut x104, x102, (0x0 as u32), x87); + let mut x105: u32 = 0; + let mut x106: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x105, &mut x106, x104, (0x0 as u32), x86); + let mut x107: u32 = 0; + let mut x108: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x107, &mut x108, x106, (0x0 as u32), x85); + let mut x109: u32 = 0; + fiat_p256_cmovznz_u32(&mut x109, x108, (0x0 as u32), 0xffffffff); + let mut x110: u32 = 0; + let mut x111: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x110, &mut x111, 0x0, x93, x109); + let mut x112: u32 = 0; + let mut x113: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x112, &mut x113, x111, x95, x109); + let mut x114: u32 = 0; + let mut x115: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x114, &mut x115, x113, x97, x109); + let mut x116: u32 = 0; + let mut x117: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x116, &mut x117, x115, x99, (0x0 as u32)); + let mut x118: u32 = 0; + let mut x119: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x118, &mut x119, x117, x101, (0x0 as u32)); + let mut x120: u32 = 0; + let mut x121: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x120, &mut x121, x119, x103, (0x0 as u32)); + let mut x122: u32 = 0; + let mut x123: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x122, &mut x123, x121, x105, (((x109 & (0x1 as u32)) as fiat_p256_u1) as u32)); + let mut x124: u32 = 0; + let mut x125: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x124, &mut x125, x123, x107, x109); + let mut x126: u32 = 0; + fiat_p256_cmovznz_u32(&mut x126, x3, (arg5[0]), x110); + let mut x127: u32 = 0; + fiat_p256_cmovznz_u32(&mut x127, x3, (arg5[1]), x112); + let mut x128: u32 = 0; + fiat_p256_cmovznz_u32(&mut x128, x3, (arg5[2]), x114); + let mut x129: u32 = 0; + fiat_p256_cmovznz_u32(&mut x129, x3, (arg5[3]), x116); + let mut x130: u32 = 0; + fiat_p256_cmovznz_u32(&mut x130, x3, (arg5[4]), x118); + let mut x131: u32 = 0; + fiat_p256_cmovznz_u32(&mut x131, x3, (arg5[5]), x120); + let mut x132: u32 = 0; + fiat_p256_cmovznz_u32(&mut x132, x3, (arg5[6]), x122); + let mut x133: u32 = 0; + fiat_p256_cmovznz_u32(&mut x133, x3, (arg5[7]), x124); + let x134: fiat_p256_u1 = ((x34 & (0x1 as u32)) as fiat_p256_u1); + let mut x135: u32 = 0; + fiat_p256_cmovznz_u32(&mut x135, x134, (0x0 as u32), x7); + let mut x136: u32 = 0; + fiat_p256_cmovznz_u32(&mut x136, x134, (0x0 as u32), x8); + let mut x137: u32 = 0; + fiat_p256_cmovznz_u32(&mut x137, x134, (0x0 as u32), x9); + let mut x138: u32 = 0; + fiat_p256_cmovznz_u32(&mut x138, x134, (0x0 as u32), x10); + let mut x139: u32 = 0; + fiat_p256_cmovznz_u32(&mut x139, x134, (0x0 as u32), x11); + let mut x140: u32 = 0; + fiat_p256_cmovznz_u32(&mut x140, x134, (0x0 as u32), x12); + let mut x141: u32 = 0; + fiat_p256_cmovznz_u32(&mut x141, x134, (0x0 as u32), x13); + let mut x142: u32 = 0; + fiat_p256_cmovznz_u32(&mut x142, x134, (0x0 as u32), x14); + let mut x143: u32 = 0; + fiat_p256_cmovznz_u32(&mut x143, x134, (0x0 as u32), x15); + let mut x144: u32 = 0; + let mut x145: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x144, &mut x145, 0x0, x34, x135); + let mut x146: u32 = 0; + let mut x147: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x146, &mut x147, x145, x35, x136); + let mut x148: u32 = 0; + let mut x149: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x148, &mut x149, x147, x36, x137); + let mut x150: u32 = 0; + let mut x151: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x150, &mut x151, x149, x37, x138); + let mut x152: u32 = 0; + let mut x153: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x152, &mut x153, x151, x38, x139); + let mut x154: u32 = 0; + let mut x155: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x154, &mut x155, x153, x39, x140); + let mut x156: u32 = 0; + let mut x157: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x156, &mut x157, x155, x40, x141); + let mut x158: u32 = 0; + let mut x159: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x158, &mut x159, x157, x41, x142); + let mut x160: u32 = 0; + let mut x161: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x160, &mut x161, x159, x42, x143); + let mut x162: u32 = 0; + fiat_p256_cmovznz_u32(&mut x162, x134, (0x0 as u32), x43); + let mut x163: u32 = 0; + fiat_p256_cmovznz_u32(&mut x163, x134, (0x0 as u32), x44); + let mut x164: u32 = 0; + fiat_p256_cmovznz_u32(&mut x164, x134, (0x0 as u32), x45); + let mut x165: u32 = 0; + fiat_p256_cmovznz_u32(&mut x165, x134, (0x0 as u32), x46); + let mut x166: u32 = 0; + fiat_p256_cmovznz_u32(&mut x166, x134, (0x0 as u32), x47); + let mut x167: u32 = 0; + fiat_p256_cmovznz_u32(&mut x167, x134, (0x0 as u32), x48); + let mut x168: u32 = 0; + fiat_p256_cmovznz_u32(&mut x168, x134, (0x0 as u32), x49); + let mut x169: u32 = 0; + fiat_p256_cmovznz_u32(&mut x169, x134, (0x0 as u32), x50); + let mut x170: u32 = 0; + let mut x171: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x170, &mut x171, 0x0, x126, x162); + let mut x172: u32 = 0; + let mut x173: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x172, &mut x173, x171, x127, x163); + let mut x174: u32 = 0; + let mut x175: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x174, &mut x175, x173, x128, x164); + let mut x176: u32 = 0; + let mut x177: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x176, &mut x177, x175, x129, x165); + let mut x178: u32 = 0; + let mut x179: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x178, &mut x179, x177, x130, x166); + let mut x180: u32 = 0; + let mut x181: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x180, &mut x181, x179, x131, x167); + let mut x182: u32 = 0; + let mut x183: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x182, &mut x183, x181, x132, x168); + let mut x184: u32 = 0; + let mut x185: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x184, &mut x185, x183, x133, x169); + let mut x186: u32 = 0; + let mut x187: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x186, &mut x187, 0x0, x170, 0xffffffff); + let mut x188: u32 = 0; + let mut x189: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x188, &mut x189, x187, x172, 0xffffffff); + let mut x190: u32 = 0; + let mut x191: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x190, &mut x191, x189, x174, 0xffffffff); + let mut x192: u32 = 0; + let mut x193: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x192, &mut x193, x191, x176, (0x0 as u32)); + let mut x194: u32 = 0; + let mut x195: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x194, &mut x195, x193, x178, (0x0 as u32)); + let mut x196: u32 = 0; + let mut x197: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x196, &mut x197, x195, x180, (0x0 as u32)); + let mut x198: u32 = 0; + let mut x199: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x198, &mut x199, x197, x182, (0x1 as u32)); + let mut x200: u32 = 0; + let mut x201: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x200, &mut x201, x199, x184, 0xffffffff); + let mut x202: u32 = 0; + let mut x203: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u32(&mut x202, &mut x203, x201, (x185 as u32), (0x0 as u32)); + let mut x204: u32 = 0; + let mut x205: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u32(&mut x204, &mut x205, 0x0, x6, (0x1 as u32)); + let x206: u32 = ((x144 >> 1) | ((x146 << 31) & 0xffffffff)); + let x207: u32 = ((x146 >> 1) | ((x148 << 31) & 0xffffffff)); + let x208: u32 = ((x148 >> 1) | ((x150 << 31) & 0xffffffff)); + let x209: u32 = ((x150 >> 1) | ((x152 << 31) & 0xffffffff)); + let x210: u32 = ((x152 >> 1) | ((x154 << 31) & 0xffffffff)); + let x211: u32 = ((x154 >> 1) | ((x156 << 31) & 0xffffffff)); + let x212: u32 = ((x156 >> 1) | ((x158 << 31) & 0xffffffff)); + let x213: u32 = ((x158 >> 1) | ((x160 << 31) & 0xffffffff)); + let x214: u32 = ((x160 & 0x80000000) | (x160 >> 1)); + let mut x215: u32 = 0; + fiat_p256_cmovznz_u32(&mut x215, x84, x67, x51); + let mut x216: u32 = 0; + fiat_p256_cmovznz_u32(&mut x216, x84, x69, x53); + let mut x217: u32 = 0; + fiat_p256_cmovznz_u32(&mut x217, x84, x71, x55); + let mut x218: u32 = 0; + fiat_p256_cmovznz_u32(&mut x218, x84, x73, x57); + let mut x219: u32 = 0; + fiat_p256_cmovznz_u32(&mut x219, x84, x75, x59); + let mut x220: u32 = 0; + fiat_p256_cmovznz_u32(&mut x220, x84, x77, x61); + let mut x221: u32 = 0; + fiat_p256_cmovznz_u32(&mut x221, x84, x79, x63); + let mut x222: u32 = 0; + fiat_p256_cmovznz_u32(&mut x222, x84, x81, x65); + let mut x223: u32 = 0; + fiat_p256_cmovznz_u32(&mut x223, x203, x186, x170); + let mut x224: u32 = 0; + fiat_p256_cmovznz_u32(&mut x224, x203, x188, x172); + let mut x225: u32 = 0; + fiat_p256_cmovznz_u32(&mut x225, x203, x190, x174); + let mut x226: u32 = 0; + fiat_p256_cmovznz_u32(&mut x226, x203, x192, x176); + let mut x227: u32 = 0; + fiat_p256_cmovznz_u32(&mut x227, x203, x194, x178); + let mut x228: u32 = 0; + fiat_p256_cmovznz_u32(&mut x228, x203, x196, x180); + let mut x229: u32 = 0; + fiat_p256_cmovznz_u32(&mut x229, x203, x198, x182); + let mut x230: u32 = 0; + fiat_p256_cmovznz_u32(&mut x230, x203, x200, x184); + *out1 = x204; + out2[0] = x7; + out2[1] = x8; + out2[2] = x9; + out2[3] = x10; + out2[4] = x11; + out2[5] = x12; + out2[6] = x13; + out2[7] = x14; + out2[8] = x15; + out3[0] = x206; + out3[1] = x207; + out3[2] = x208; + out3[3] = x209; + out3[4] = x210; + out3[5] = x211; + out3[6] = x212; + out3[7] = x213; + out3[8] = x214; + out4[0] = x215; + out4[1] = x216; + out4[2] = x217; + out4[3] = x218; + out4[4] = x219; + out4[5] = x220; + out4[6] = x221; + out4[7] = x222; + out5[0] = x223; + out5[1] = x224; + out5[2] = x225; + out5[3] = x226; + out5[4] = x227; + out5[5] = x228; + out5[6] = x229; + out5[7] = x230; +} + +/// The function fiat_p256_divstep_precomp returns the precomputed value for Bernstein-Yang-inversion (in montgomery form). +/// +/// Postconditions: +/// eval (from_montgomery out1) = ⌊(m - 1) / 2⌋^(if ⌊log2 m⌋ + 1 < 46 then ⌊(49 * (⌊log2 m⌋ + 1) + 80) / 17⌋ else ⌊(49 * (⌊log2 m⌋ + 1) + 57) / 17⌋) +/// 0 ≤ eval out1 < m +/// +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +#[inline] +pub fn fiat_p256_divstep_precomp(out1: &mut [u32; 8]) -> () { + out1[0] = 0xb8000000; + out1[1] = 0x67ffffff; + out1[2] = 0x38000000; + out1[3] = 0xc0000000; + out1[4] = 0x7fffffff; + out1[5] = 0xd8000000; + out1[6] = 0xffffffff; + out1[7] = 0x2fffffff; +} diff --git a/vendor/fiat-crypto/src/p256_64.rs b/vendor/fiat-crypto/src/p256_64.rs new file mode 100644 index 000000000..0a3c6fb84 --- /dev/null +++ b/vendor/fiat-crypto/src/p256_64.rs @@ -0,0 +1,1793 @@ +//! Autogenerated: 'src/ExtractionOCaml/word_by_word_montgomery' --lang Rust --inline p256 64 '2^256 - 2^224 + 2^192 + 2^96 - 1' mul square add sub opp from_montgomery to_montgomery nonzero selectznz to_bytes from_bytes one msat divstep divstep_precomp +//! curve description: p256 +//! machine_wordsize = 64 (from "64") +//! requested operations: mul, square, add, sub, opp, from_montgomery, to_montgomery, nonzero, selectznz, to_bytes, from_bytes, one, msat, divstep, divstep_precomp +//! m = 0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff (from "2^256 - 2^224 + 2^192 + 2^96 - 1") +//! +//! NOTE: In addition to the bounds specified above each function, all +//! functions synthesized for this Montgomery arithmetic require the +//! input to be strictly less than the prime modulus (m), and also +//! require the input to be in the unique saturated representation. +//! All functions also ensure that these two properties are true of +//! return values. +//! +//! Computed values: +//! eval z = z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) +//! bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248) +//! twos_complement_eval z = let x1 := z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) in +//! if x1 & (2^256-1) < 2^255 then x1 & (2^256-1) else (x1 & (2^256-1)) - 2^256 + +#![allow(unused_parens)] +#![allow(non_camel_case_types)] + +pub type fiat_p256_u1 = u8; +pub type fiat_p256_i1 = i8; +pub type fiat_p256_u2 = u8; +pub type fiat_p256_i2 = i8; + +/* The type fiat_p256_montgomery_domain_field_element is a field element in the Montgomery domain. */ +/* Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] */ +pub type fiat_p256_montgomery_domain_field_element = [u64; 4]; + +/* The type fiat_p256_non_montgomery_domain_field_element is a field element NOT in the Montgomery domain. */ +/* Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] */ +pub type fiat_p256_non_montgomery_domain_field_element = [u64; 4]; + + +/// The function fiat_p256_addcarryx_u64 is an addition with carry. +/// +/// Postconditions: +/// out1 = (arg1 + arg2 + arg3) mod 2^64 +/// out2 = ⌊(arg1 + arg2 + arg3) / 2^64⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffffffffffff] +/// arg3: [0x0 ~> 0xffffffffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_p256_addcarryx_u64(out1: &mut u64, out2: &mut fiat_p256_u1, arg1: fiat_p256_u1, arg2: u64, arg3: u64) -> () { + let x1: u128 = (((arg1 as u128) + (arg2 as u128)) + (arg3 as u128)); + let x2: u64 = ((x1 & (0xffffffffffffffff as u128)) as u64); + let x3: fiat_p256_u1 = ((x1 >> 64) as fiat_p256_u1); + *out1 = x2; + *out2 = x3; +} + +/// The function fiat_p256_subborrowx_u64 is a subtraction with borrow. +/// +/// Postconditions: +/// out1 = (-arg1 + arg2 + -arg3) mod 2^64 +/// out2 = -⌊(-arg1 + arg2 + -arg3) / 2^64⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffffffffffff] +/// arg3: [0x0 ~> 0xffffffffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_p256_subborrowx_u64(out1: &mut u64, out2: &mut fiat_p256_u1, arg1: fiat_p256_u1, arg2: u64, arg3: u64) -> () { + let x1: i128 = (((arg2 as i128) - (arg1 as i128)) - (arg3 as i128)); + let x2: fiat_p256_i1 = ((x1 >> 64) as fiat_p256_i1); + let x3: u64 = ((x1 & (0xffffffffffffffff as i128)) as u64); + *out1 = x3; + *out2 = (((0x0 as fiat_p256_i2) - (x2 as fiat_p256_i2)) as fiat_p256_u1); +} + +/// The function fiat_p256_mulx_u64 is a multiplication, returning the full double-width result. +/// +/// Postconditions: +/// out1 = (arg1 * arg2) mod 2^64 +/// out2 = ⌊arg1 * arg2 / 2^64⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0xffffffffffffffff] +/// arg2: [0x0 ~> 0xffffffffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +/// out2: [0x0 ~> 0xffffffffffffffff] +#[inline] +pub fn fiat_p256_mulx_u64(out1: &mut u64, out2: &mut u64, arg1: u64, arg2: u64) -> () { + let x1: u128 = ((arg1 as u128) * (arg2 as u128)); + let x2: u64 = ((x1 & (0xffffffffffffffff as u128)) as u64); + let x3: u64 = ((x1 >> 64) as u64); + *out1 = x2; + *out2 = x3; +} + +/// The function fiat_p256_cmovznz_u64 is a single-word conditional move. +/// +/// Postconditions: +/// out1 = (if arg1 = 0 then arg2 else arg3) +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffffffffffff] +/// arg3: [0x0 ~> 0xffffffffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +#[inline] +pub fn fiat_p256_cmovznz_u64(out1: &mut u64, arg1: fiat_p256_u1, arg2: u64, arg3: u64) -> () { + let x1: fiat_p256_u1 = (!(!arg1)); + let x2: u64 = ((((((0x0 as fiat_p256_i2) - (x1 as fiat_p256_i2)) as fiat_p256_i1) as i128) & (0xffffffffffffffff as i128)) as u64); + let x3: u64 = ((x2 & arg3) | ((!x2) & arg2)); + *out1 = x3; +} + +/// The function fiat_p256_mul multiplies two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p256_mul(out1: &mut fiat_p256_montgomery_domain_field_element, arg1: &fiat_p256_montgomery_domain_field_element, arg2: &fiat_p256_montgomery_domain_field_element) -> () { + let x1: u64 = (arg1[1]); + let x2: u64 = (arg1[2]); + let x3: u64 = (arg1[3]); + let x4: u64 = (arg1[0]); + let mut x5: u64 = 0; + let mut x6: u64 = 0; + fiat_p256_mulx_u64(&mut x5, &mut x6, x4, (arg2[3])); + let mut x7: u64 = 0; + let mut x8: u64 = 0; + fiat_p256_mulx_u64(&mut x7, &mut x8, x4, (arg2[2])); + let mut x9: u64 = 0; + let mut x10: u64 = 0; + fiat_p256_mulx_u64(&mut x9, &mut x10, x4, (arg2[1])); + let mut x11: u64 = 0; + let mut x12: u64 = 0; + fiat_p256_mulx_u64(&mut x11, &mut x12, x4, (arg2[0])); + let mut x13: u64 = 0; + let mut x14: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x13, &mut x14, 0x0, x12, x9); + let mut x15: u64 = 0; + let mut x16: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x15, &mut x16, x14, x10, x7); + let mut x17: u64 = 0; + let mut x18: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x17, &mut x18, x16, x8, x5); + let x19: u64 = ((x18 as u64) + x6); + let mut x20: u64 = 0; + let mut x21: u64 = 0; + fiat_p256_mulx_u64(&mut x20, &mut x21, x11, 0xffffffff00000001); + let mut x22: u64 = 0; + let mut x23: u64 = 0; + fiat_p256_mulx_u64(&mut x22, &mut x23, x11, 0xffffffff); + let mut x24: u64 = 0; + let mut x25: u64 = 0; + fiat_p256_mulx_u64(&mut x24, &mut x25, x11, 0xffffffffffffffff); + let mut x26: u64 = 0; + let mut x27: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x26, &mut x27, 0x0, x25, x22); + let x28: u64 = ((x27 as u64) + x23); + let mut x29: u64 = 0; + let mut x30: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x29, &mut x30, 0x0, x11, x24); + let mut x31: u64 = 0; + let mut x32: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x31, &mut x32, x30, x13, x26); + let mut x33: u64 = 0; + let mut x34: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x33, &mut x34, x32, x15, x28); + let mut x35: u64 = 0; + let mut x36: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x35, &mut x36, x34, x17, x20); + let mut x37: u64 = 0; + let mut x38: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x37, &mut x38, x36, x19, x21); + let mut x39: u64 = 0; + let mut x40: u64 = 0; + fiat_p256_mulx_u64(&mut x39, &mut x40, x1, (arg2[3])); + let mut x41: u64 = 0; + let mut x42: u64 = 0; + fiat_p256_mulx_u64(&mut x41, &mut x42, x1, (arg2[2])); + let mut x43: u64 = 0; + let mut x44: u64 = 0; + fiat_p256_mulx_u64(&mut x43, &mut x44, x1, (arg2[1])); + let mut x45: u64 = 0; + let mut x46: u64 = 0; + fiat_p256_mulx_u64(&mut x45, &mut x46, x1, (arg2[0])); + let mut x47: u64 = 0; + let mut x48: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x47, &mut x48, 0x0, x46, x43); + let mut x49: u64 = 0; + let mut x50: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x49, &mut x50, x48, x44, x41); + let mut x51: u64 = 0; + let mut x52: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x51, &mut x52, x50, x42, x39); + let x53: u64 = ((x52 as u64) + x40); + let mut x54: u64 = 0; + let mut x55: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x54, &mut x55, 0x0, x31, x45); + let mut x56: u64 = 0; + let mut x57: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x56, &mut x57, x55, x33, x47); + let mut x58: u64 = 0; + let mut x59: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x58, &mut x59, x57, x35, x49); + let mut x60: u64 = 0; + let mut x61: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x60, &mut x61, x59, x37, x51); + let mut x62: u64 = 0; + let mut x63: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x62, &mut x63, x61, (x38 as u64), x53); + let mut x64: u64 = 0; + let mut x65: u64 = 0; + fiat_p256_mulx_u64(&mut x64, &mut x65, x54, 0xffffffff00000001); + let mut x66: u64 = 0; + let mut x67: u64 = 0; + fiat_p256_mulx_u64(&mut x66, &mut x67, x54, 0xffffffff); + let mut x68: u64 = 0; + let mut x69: u64 = 0; + fiat_p256_mulx_u64(&mut x68, &mut x69, x54, 0xffffffffffffffff); + let mut x70: u64 = 0; + let mut x71: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x70, &mut x71, 0x0, x69, x66); + let x72: u64 = ((x71 as u64) + x67); + let mut x73: u64 = 0; + let mut x74: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x73, &mut x74, 0x0, x54, x68); + let mut x75: u64 = 0; + let mut x76: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x75, &mut x76, x74, x56, x70); + let mut x77: u64 = 0; + let mut x78: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x77, &mut x78, x76, x58, x72); + let mut x79: u64 = 0; + let mut x80: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x79, &mut x80, x78, x60, x64); + let mut x81: u64 = 0; + let mut x82: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x81, &mut x82, x80, x62, x65); + let x83: u64 = ((x82 as u64) + (x63 as u64)); + let mut x84: u64 = 0; + let mut x85: u64 = 0; + fiat_p256_mulx_u64(&mut x84, &mut x85, x2, (arg2[3])); + let mut x86: u64 = 0; + let mut x87: u64 = 0; + fiat_p256_mulx_u64(&mut x86, &mut x87, x2, (arg2[2])); + let mut x88: u64 = 0; + let mut x89: u64 = 0; + fiat_p256_mulx_u64(&mut x88, &mut x89, x2, (arg2[1])); + let mut x90: u64 = 0; + let mut x91: u64 = 0; + fiat_p256_mulx_u64(&mut x90, &mut x91, x2, (arg2[0])); + let mut x92: u64 = 0; + let mut x93: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x92, &mut x93, 0x0, x91, x88); + let mut x94: u64 = 0; + let mut x95: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x94, &mut x95, x93, x89, x86); + let mut x96: u64 = 0; + let mut x97: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x96, &mut x97, x95, x87, x84); + let x98: u64 = ((x97 as u64) + x85); + let mut x99: u64 = 0; + let mut x100: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x99, &mut x100, 0x0, x75, x90); + let mut x101: u64 = 0; + let mut x102: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x101, &mut x102, x100, x77, x92); + let mut x103: u64 = 0; + let mut x104: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x103, &mut x104, x102, x79, x94); + let mut x105: u64 = 0; + let mut x106: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x105, &mut x106, x104, x81, x96); + let mut x107: u64 = 0; + let mut x108: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x107, &mut x108, x106, x83, x98); + let mut x109: u64 = 0; + let mut x110: u64 = 0; + fiat_p256_mulx_u64(&mut x109, &mut x110, x99, 0xffffffff00000001); + let mut x111: u64 = 0; + let mut x112: u64 = 0; + fiat_p256_mulx_u64(&mut x111, &mut x112, x99, 0xffffffff); + let mut x113: u64 = 0; + let mut x114: u64 = 0; + fiat_p256_mulx_u64(&mut x113, &mut x114, x99, 0xffffffffffffffff); + let mut x115: u64 = 0; + let mut x116: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x115, &mut x116, 0x0, x114, x111); + let x117: u64 = ((x116 as u64) + x112); + let mut x118: u64 = 0; + let mut x119: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x118, &mut x119, 0x0, x99, x113); + let mut x120: u64 = 0; + let mut x121: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x120, &mut x121, x119, x101, x115); + let mut x122: u64 = 0; + let mut x123: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x122, &mut x123, x121, x103, x117); + let mut x124: u64 = 0; + let mut x125: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x124, &mut x125, x123, x105, x109); + let mut x126: u64 = 0; + let mut x127: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x126, &mut x127, x125, x107, x110); + let x128: u64 = ((x127 as u64) + (x108 as u64)); + let mut x129: u64 = 0; + let mut x130: u64 = 0; + fiat_p256_mulx_u64(&mut x129, &mut x130, x3, (arg2[3])); + let mut x131: u64 = 0; + let mut x132: u64 = 0; + fiat_p256_mulx_u64(&mut x131, &mut x132, x3, (arg2[2])); + let mut x133: u64 = 0; + let mut x134: u64 = 0; + fiat_p256_mulx_u64(&mut x133, &mut x134, x3, (arg2[1])); + let mut x135: u64 = 0; + let mut x136: u64 = 0; + fiat_p256_mulx_u64(&mut x135, &mut x136, x3, (arg2[0])); + let mut x137: u64 = 0; + let mut x138: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x137, &mut x138, 0x0, x136, x133); + let mut x139: u64 = 0; + let mut x140: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x139, &mut x140, x138, x134, x131); + let mut x141: u64 = 0; + let mut x142: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x141, &mut x142, x140, x132, x129); + let x143: u64 = ((x142 as u64) + x130); + let mut x144: u64 = 0; + let mut x145: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x144, &mut x145, 0x0, x120, x135); + let mut x146: u64 = 0; + let mut x147: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x146, &mut x147, x145, x122, x137); + let mut x148: u64 = 0; + let mut x149: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x148, &mut x149, x147, x124, x139); + let mut x150: u64 = 0; + let mut x151: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x150, &mut x151, x149, x126, x141); + let mut x152: u64 = 0; + let mut x153: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x152, &mut x153, x151, x128, x143); + let mut x154: u64 = 0; + let mut x155: u64 = 0; + fiat_p256_mulx_u64(&mut x154, &mut x155, x144, 0xffffffff00000001); + let mut x156: u64 = 0; + let mut x157: u64 = 0; + fiat_p256_mulx_u64(&mut x156, &mut x157, x144, 0xffffffff); + let mut x158: u64 = 0; + let mut x159: u64 = 0; + fiat_p256_mulx_u64(&mut x158, &mut x159, x144, 0xffffffffffffffff); + let mut x160: u64 = 0; + let mut x161: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x160, &mut x161, 0x0, x159, x156); + let x162: u64 = ((x161 as u64) + x157); + let mut x163: u64 = 0; + let mut x164: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x163, &mut x164, 0x0, x144, x158); + let mut x165: u64 = 0; + let mut x166: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x165, &mut x166, x164, x146, x160); + let mut x167: u64 = 0; + let mut x168: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x167, &mut x168, x166, x148, x162); + let mut x169: u64 = 0; + let mut x170: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x169, &mut x170, x168, x150, x154); + let mut x171: u64 = 0; + let mut x172: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x171, &mut x172, x170, x152, x155); + let x173: u64 = ((x172 as u64) + (x153 as u64)); + let mut x174: u64 = 0; + let mut x175: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u64(&mut x174, &mut x175, 0x0, x165, 0xffffffffffffffff); + let mut x176: u64 = 0; + let mut x177: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u64(&mut x176, &mut x177, x175, x167, 0xffffffff); + let mut x178: u64 = 0; + let mut x179: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u64(&mut x178, &mut x179, x177, x169, (0x0 as u64)); + let mut x180: u64 = 0; + let mut x181: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u64(&mut x180, &mut x181, x179, x171, 0xffffffff00000001); + let mut x182: u64 = 0; + let mut x183: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u64(&mut x182, &mut x183, x181, x173, (0x0 as u64)); + let mut x184: u64 = 0; + fiat_p256_cmovznz_u64(&mut x184, x183, x174, x165); + let mut x185: u64 = 0; + fiat_p256_cmovznz_u64(&mut x185, x183, x176, x167); + let mut x186: u64 = 0; + fiat_p256_cmovznz_u64(&mut x186, x183, x178, x169); + let mut x187: u64 = 0; + fiat_p256_cmovznz_u64(&mut x187, x183, x180, x171); + out1[0] = x184; + out1[1] = x185; + out1[2] = x186; + out1[3] = x187; +} + +/// The function fiat_p256_square squares a field element in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg1)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p256_square(out1: &mut fiat_p256_montgomery_domain_field_element, arg1: &fiat_p256_montgomery_domain_field_element) -> () { + let x1: u64 = (arg1[1]); + let x2: u64 = (arg1[2]); + let x3: u64 = (arg1[3]); + let x4: u64 = (arg1[0]); + let mut x5: u64 = 0; + let mut x6: u64 = 0; + fiat_p256_mulx_u64(&mut x5, &mut x6, x4, (arg1[3])); + let mut x7: u64 = 0; + let mut x8: u64 = 0; + fiat_p256_mulx_u64(&mut x7, &mut x8, x4, (arg1[2])); + let mut x9: u64 = 0; + let mut x10: u64 = 0; + fiat_p256_mulx_u64(&mut x9, &mut x10, x4, (arg1[1])); + let mut x11: u64 = 0; + let mut x12: u64 = 0; + fiat_p256_mulx_u64(&mut x11, &mut x12, x4, (arg1[0])); + let mut x13: u64 = 0; + let mut x14: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x13, &mut x14, 0x0, x12, x9); + let mut x15: u64 = 0; + let mut x16: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x15, &mut x16, x14, x10, x7); + let mut x17: u64 = 0; + let mut x18: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x17, &mut x18, x16, x8, x5); + let x19: u64 = ((x18 as u64) + x6); + let mut x20: u64 = 0; + let mut x21: u64 = 0; + fiat_p256_mulx_u64(&mut x20, &mut x21, x11, 0xffffffff00000001); + let mut x22: u64 = 0; + let mut x23: u64 = 0; + fiat_p256_mulx_u64(&mut x22, &mut x23, x11, 0xffffffff); + let mut x24: u64 = 0; + let mut x25: u64 = 0; + fiat_p256_mulx_u64(&mut x24, &mut x25, x11, 0xffffffffffffffff); + let mut x26: u64 = 0; + let mut x27: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x26, &mut x27, 0x0, x25, x22); + let x28: u64 = ((x27 as u64) + x23); + let mut x29: u64 = 0; + let mut x30: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x29, &mut x30, 0x0, x11, x24); + let mut x31: u64 = 0; + let mut x32: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x31, &mut x32, x30, x13, x26); + let mut x33: u64 = 0; + let mut x34: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x33, &mut x34, x32, x15, x28); + let mut x35: u64 = 0; + let mut x36: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x35, &mut x36, x34, x17, x20); + let mut x37: u64 = 0; + let mut x38: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x37, &mut x38, x36, x19, x21); + let mut x39: u64 = 0; + let mut x40: u64 = 0; + fiat_p256_mulx_u64(&mut x39, &mut x40, x1, (arg1[3])); + let mut x41: u64 = 0; + let mut x42: u64 = 0; + fiat_p256_mulx_u64(&mut x41, &mut x42, x1, (arg1[2])); + let mut x43: u64 = 0; + let mut x44: u64 = 0; + fiat_p256_mulx_u64(&mut x43, &mut x44, x1, (arg1[1])); + let mut x45: u64 = 0; + let mut x46: u64 = 0; + fiat_p256_mulx_u64(&mut x45, &mut x46, x1, (arg1[0])); + let mut x47: u64 = 0; + let mut x48: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x47, &mut x48, 0x0, x46, x43); + let mut x49: u64 = 0; + let mut x50: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x49, &mut x50, x48, x44, x41); + let mut x51: u64 = 0; + let mut x52: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x51, &mut x52, x50, x42, x39); + let x53: u64 = ((x52 as u64) + x40); + let mut x54: u64 = 0; + let mut x55: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x54, &mut x55, 0x0, x31, x45); + let mut x56: u64 = 0; + let mut x57: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x56, &mut x57, x55, x33, x47); + let mut x58: u64 = 0; + let mut x59: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x58, &mut x59, x57, x35, x49); + let mut x60: u64 = 0; + let mut x61: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x60, &mut x61, x59, x37, x51); + let mut x62: u64 = 0; + let mut x63: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x62, &mut x63, x61, (x38 as u64), x53); + let mut x64: u64 = 0; + let mut x65: u64 = 0; + fiat_p256_mulx_u64(&mut x64, &mut x65, x54, 0xffffffff00000001); + let mut x66: u64 = 0; + let mut x67: u64 = 0; + fiat_p256_mulx_u64(&mut x66, &mut x67, x54, 0xffffffff); + let mut x68: u64 = 0; + let mut x69: u64 = 0; + fiat_p256_mulx_u64(&mut x68, &mut x69, x54, 0xffffffffffffffff); + let mut x70: u64 = 0; + let mut x71: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x70, &mut x71, 0x0, x69, x66); + let x72: u64 = ((x71 as u64) + x67); + let mut x73: u64 = 0; + let mut x74: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x73, &mut x74, 0x0, x54, x68); + let mut x75: u64 = 0; + let mut x76: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x75, &mut x76, x74, x56, x70); + let mut x77: u64 = 0; + let mut x78: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x77, &mut x78, x76, x58, x72); + let mut x79: u64 = 0; + let mut x80: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x79, &mut x80, x78, x60, x64); + let mut x81: u64 = 0; + let mut x82: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x81, &mut x82, x80, x62, x65); + let x83: u64 = ((x82 as u64) + (x63 as u64)); + let mut x84: u64 = 0; + let mut x85: u64 = 0; + fiat_p256_mulx_u64(&mut x84, &mut x85, x2, (arg1[3])); + let mut x86: u64 = 0; + let mut x87: u64 = 0; + fiat_p256_mulx_u64(&mut x86, &mut x87, x2, (arg1[2])); + let mut x88: u64 = 0; + let mut x89: u64 = 0; + fiat_p256_mulx_u64(&mut x88, &mut x89, x2, (arg1[1])); + let mut x90: u64 = 0; + let mut x91: u64 = 0; + fiat_p256_mulx_u64(&mut x90, &mut x91, x2, (arg1[0])); + let mut x92: u64 = 0; + let mut x93: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x92, &mut x93, 0x0, x91, x88); + let mut x94: u64 = 0; + let mut x95: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x94, &mut x95, x93, x89, x86); + let mut x96: u64 = 0; + let mut x97: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x96, &mut x97, x95, x87, x84); + let x98: u64 = ((x97 as u64) + x85); + let mut x99: u64 = 0; + let mut x100: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x99, &mut x100, 0x0, x75, x90); + let mut x101: u64 = 0; + let mut x102: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x101, &mut x102, x100, x77, x92); + let mut x103: u64 = 0; + let mut x104: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x103, &mut x104, x102, x79, x94); + let mut x105: u64 = 0; + let mut x106: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x105, &mut x106, x104, x81, x96); + let mut x107: u64 = 0; + let mut x108: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x107, &mut x108, x106, x83, x98); + let mut x109: u64 = 0; + let mut x110: u64 = 0; + fiat_p256_mulx_u64(&mut x109, &mut x110, x99, 0xffffffff00000001); + let mut x111: u64 = 0; + let mut x112: u64 = 0; + fiat_p256_mulx_u64(&mut x111, &mut x112, x99, 0xffffffff); + let mut x113: u64 = 0; + let mut x114: u64 = 0; + fiat_p256_mulx_u64(&mut x113, &mut x114, x99, 0xffffffffffffffff); + let mut x115: u64 = 0; + let mut x116: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x115, &mut x116, 0x0, x114, x111); + let x117: u64 = ((x116 as u64) + x112); + let mut x118: u64 = 0; + let mut x119: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x118, &mut x119, 0x0, x99, x113); + let mut x120: u64 = 0; + let mut x121: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x120, &mut x121, x119, x101, x115); + let mut x122: u64 = 0; + let mut x123: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x122, &mut x123, x121, x103, x117); + let mut x124: u64 = 0; + let mut x125: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x124, &mut x125, x123, x105, x109); + let mut x126: u64 = 0; + let mut x127: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x126, &mut x127, x125, x107, x110); + let x128: u64 = ((x127 as u64) + (x108 as u64)); + let mut x129: u64 = 0; + let mut x130: u64 = 0; + fiat_p256_mulx_u64(&mut x129, &mut x130, x3, (arg1[3])); + let mut x131: u64 = 0; + let mut x132: u64 = 0; + fiat_p256_mulx_u64(&mut x131, &mut x132, x3, (arg1[2])); + let mut x133: u64 = 0; + let mut x134: u64 = 0; + fiat_p256_mulx_u64(&mut x133, &mut x134, x3, (arg1[1])); + let mut x135: u64 = 0; + let mut x136: u64 = 0; + fiat_p256_mulx_u64(&mut x135, &mut x136, x3, (arg1[0])); + let mut x137: u64 = 0; + let mut x138: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x137, &mut x138, 0x0, x136, x133); + let mut x139: u64 = 0; + let mut x140: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x139, &mut x140, x138, x134, x131); + let mut x141: u64 = 0; + let mut x142: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x141, &mut x142, x140, x132, x129); + let x143: u64 = ((x142 as u64) + x130); + let mut x144: u64 = 0; + let mut x145: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x144, &mut x145, 0x0, x120, x135); + let mut x146: u64 = 0; + let mut x147: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x146, &mut x147, x145, x122, x137); + let mut x148: u64 = 0; + let mut x149: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x148, &mut x149, x147, x124, x139); + let mut x150: u64 = 0; + let mut x151: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x150, &mut x151, x149, x126, x141); + let mut x152: u64 = 0; + let mut x153: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x152, &mut x153, x151, x128, x143); + let mut x154: u64 = 0; + let mut x155: u64 = 0; + fiat_p256_mulx_u64(&mut x154, &mut x155, x144, 0xffffffff00000001); + let mut x156: u64 = 0; + let mut x157: u64 = 0; + fiat_p256_mulx_u64(&mut x156, &mut x157, x144, 0xffffffff); + let mut x158: u64 = 0; + let mut x159: u64 = 0; + fiat_p256_mulx_u64(&mut x158, &mut x159, x144, 0xffffffffffffffff); + let mut x160: u64 = 0; + let mut x161: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x160, &mut x161, 0x0, x159, x156); + let x162: u64 = ((x161 as u64) + x157); + let mut x163: u64 = 0; + let mut x164: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x163, &mut x164, 0x0, x144, x158); + let mut x165: u64 = 0; + let mut x166: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x165, &mut x166, x164, x146, x160); + let mut x167: u64 = 0; + let mut x168: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x167, &mut x168, x166, x148, x162); + let mut x169: u64 = 0; + let mut x170: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x169, &mut x170, x168, x150, x154); + let mut x171: u64 = 0; + let mut x172: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x171, &mut x172, x170, x152, x155); + let x173: u64 = ((x172 as u64) + (x153 as u64)); + let mut x174: u64 = 0; + let mut x175: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u64(&mut x174, &mut x175, 0x0, x165, 0xffffffffffffffff); + let mut x176: u64 = 0; + let mut x177: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u64(&mut x176, &mut x177, x175, x167, 0xffffffff); + let mut x178: u64 = 0; + let mut x179: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u64(&mut x178, &mut x179, x177, x169, (0x0 as u64)); + let mut x180: u64 = 0; + let mut x181: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u64(&mut x180, &mut x181, x179, x171, 0xffffffff00000001); + let mut x182: u64 = 0; + let mut x183: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u64(&mut x182, &mut x183, x181, x173, (0x0 as u64)); + let mut x184: u64 = 0; + fiat_p256_cmovznz_u64(&mut x184, x183, x174, x165); + let mut x185: u64 = 0; + fiat_p256_cmovznz_u64(&mut x185, x183, x176, x167); + let mut x186: u64 = 0; + fiat_p256_cmovznz_u64(&mut x186, x183, x178, x169); + let mut x187: u64 = 0; + fiat_p256_cmovznz_u64(&mut x187, x183, x180, x171); + out1[0] = x184; + out1[1] = x185; + out1[2] = x186; + out1[3] = x187; +} + +/// The function fiat_p256_add adds two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) + eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p256_add(out1: &mut fiat_p256_montgomery_domain_field_element, arg1: &fiat_p256_montgomery_domain_field_element, arg2: &fiat_p256_montgomery_domain_field_element) -> () { + let mut x1: u64 = 0; + let mut x2: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x1, &mut x2, 0x0, (arg1[0]), (arg2[0])); + let mut x3: u64 = 0; + let mut x4: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x3, &mut x4, x2, (arg1[1]), (arg2[1])); + let mut x5: u64 = 0; + let mut x6: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x5, &mut x6, x4, (arg1[2]), (arg2[2])); + let mut x7: u64 = 0; + let mut x8: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x7, &mut x8, x6, (arg1[3]), (arg2[3])); + let mut x9: u64 = 0; + let mut x10: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u64(&mut x9, &mut x10, 0x0, x1, 0xffffffffffffffff); + let mut x11: u64 = 0; + let mut x12: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u64(&mut x11, &mut x12, x10, x3, 0xffffffff); + let mut x13: u64 = 0; + let mut x14: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u64(&mut x13, &mut x14, x12, x5, (0x0 as u64)); + let mut x15: u64 = 0; + let mut x16: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u64(&mut x15, &mut x16, x14, x7, 0xffffffff00000001); + let mut x17: u64 = 0; + let mut x18: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u64(&mut x17, &mut x18, x16, (x8 as u64), (0x0 as u64)); + let mut x19: u64 = 0; + fiat_p256_cmovznz_u64(&mut x19, x18, x9, x1); + let mut x20: u64 = 0; + fiat_p256_cmovznz_u64(&mut x20, x18, x11, x3); + let mut x21: u64 = 0; + fiat_p256_cmovznz_u64(&mut x21, x18, x13, x5); + let mut x22: u64 = 0; + fiat_p256_cmovznz_u64(&mut x22, x18, x15, x7); + out1[0] = x19; + out1[1] = x20; + out1[2] = x21; + out1[3] = x22; +} + +/// The function fiat_p256_sub subtracts two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) - eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p256_sub(out1: &mut fiat_p256_montgomery_domain_field_element, arg1: &fiat_p256_montgomery_domain_field_element, arg2: &fiat_p256_montgomery_domain_field_element) -> () { + let mut x1: u64 = 0; + let mut x2: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u64(&mut x1, &mut x2, 0x0, (arg1[0]), (arg2[0])); + let mut x3: u64 = 0; + let mut x4: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u64(&mut x3, &mut x4, x2, (arg1[1]), (arg2[1])); + let mut x5: u64 = 0; + let mut x6: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u64(&mut x5, &mut x6, x4, (arg1[2]), (arg2[2])); + let mut x7: u64 = 0; + let mut x8: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u64(&mut x7, &mut x8, x6, (arg1[3]), (arg2[3])); + let mut x9: u64 = 0; + fiat_p256_cmovznz_u64(&mut x9, x8, (0x0 as u64), 0xffffffffffffffff); + let mut x10: u64 = 0; + let mut x11: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x10, &mut x11, 0x0, x1, x9); + let mut x12: u64 = 0; + let mut x13: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x12, &mut x13, x11, x3, (x9 & 0xffffffff)); + let mut x14: u64 = 0; + let mut x15: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x14, &mut x15, x13, x5, (0x0 as u64)); + let mut x16: u64 = 0; + let mut x17: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x16, &mut x17, x15, x7, (x9 & 0xffffffff00000001)); + out1[0] = x10; + out1[1] = x12; + out1[2] = x14; + out1[3] = x16; +} + +/// The function fiat_p256_opp negates a field element in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = -eval (from_montgomery arg1) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p256_opp(out1: &mut fiat_p256_montgomery_domain_field_element, arg1: &fiat_p256_montgomery_domain_field_element) -> () { + let mut x1: u64 = 0; + let mut x2: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u64(&mut x1, &mut x2, 0x0, (0x0 as u64), (arg1[0])); + let mut x3: u64 = 0; + let mut x4: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u64(&mut x3, &mut x4, x2, (0x0 as u64), (arg1[1])); + let mut x5: u64 = 0; + let mut x6: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u64(&mut x5, &mut x6, x4, (0x0 as u64), (arg1[2])); + let mut x7: u64 = 0; + let mut x8: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u64(&mut x7, &mut x8, x6, (0x0 as u64), (arg1[3])); + let mut x9: u64 = 0; + fiat_p256_cmovznz_u64(&mut x9, x8, (0x0 as u64), 0xffffffffffffffff); + let mut x10: u64 = 0; + let mut x11: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x10, &mut x11, 0x0, x1, x9); + let mut x12: u64 = 0; + let mut x13: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x12, &mut x13, x11, x3, (x9 & 0xffffffff)); + let mut x14: u64 = 0; + let mut x15: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x14, &mut x15, x13, x5, (0x0 as u64)); + let mut x16: u64 = 0; + let mut x17: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x16, &mut x17, x15, x7, (x9 & 0xffffffff00000001)); + out1[0] = x10; + out1[1] = x12; + out1[2] = x14; + out1[3] = x16; +} + +/// The function fiat_p256_from_montgomery translates a field element out of the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval out1 mod m = (eval arg1 * ((2^64)⁻¹ mod m)^4) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p256_from_montgomery(out1: &mut fiat_p256_non_montgomery_domain_field_element, arg1: &fiat_p256_montgomery_domain_field_element) -> () { + let x1: u64 = (arg1[0]); + let mut x2: u64 = 0; + let mut x3: u64 = 0; + fiat_p256_mulx_u64(&mut x2, &mut x3, x1, 0xffffffff00000001); + let mut x4: u64 = 0; + let mut x5: u64 = 0; + fiat_p256_mulx_u64(&mut x4, &mut x5, x1, 0xffffffff); + let mut x6: u64 = 0; + let mut x7: u64 = 0; + fiat_p256_mulx_u64(&mut x6, &mut x7, x1, 0xffffffffffffffff); + let mut x8: u64 = 0; + let mut x9: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x8, &mut x9, 0x0, x7, x4); + let mut x10: u64 = 0; + let mut x11: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x10, &mut x11, 0x0, x1, x6); + let mut x12: u64 = 0; + let mut x13: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x12, &mut x13, x11, (0x0 as u64), x8); + let mut x14: u64 = 0; + let mut x15: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x14, &mut x15, 0x0, x12, (arg1[1])); + let mut x16: u64 = 0; + let mut x17: u64 = 0; + fiat_p256_mulx_u64(&mut x16, &mut x17, x14, 0xffffffff00000001); + let mut x18: u64 = 0; + let mut x19: u64 = 0; + fiat_p256_mulx_u64(&mut x18, &mut x19, x14, 0xffffffff); + let mut x20: u64 = 0; + let mut x21: u64 = 0; + fiat_p256_mulx_u64(&mut x20, &mut x21, x14, 0xffffffffffffffff); + let mut x22: u64 = 0; + let mut x23: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x22, &mut x23, 0x0, x21, x18); + let mut x24: u64 = 0; + let mut x25: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x24, &mut x25, 0x0, x14, x20); + let mut x26: u64 = 0; + let mut x27: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x26, &mut x27, x25, ((x15 as u64) + ((x13 as u64) + ((x9 as u64) + x5))), x22); + let mut x28: u64 = 0; + let mut x29: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x28, &mut x29, x27, x2, ((x23 as u64) + x19)); + let mut x30: u64 = 0; + let mut x31: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x30, &mut x31, x29, x3, x16); + let mut x32: u64 = 0; + let mut x33: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x32, &mut x33, 0x0, x26, (arg1[2])); + let mut x34: u64 = 0; + let mut x35: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x34, &mut x35, x33, x28, (0x0 as u64)); + let mut x36: u64 = 0; + let mut x37: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x36, &mut x37, x35, x30, (0x0 as u64)); + let mut x38: u64 = 0; + let mut x39: u64 = 0; + fiat_p256_mulx_u64(&mut x38, &mut x39, x32, 0xffffffff00000001); + let mut x40: u64 = 0; + let mut x41: u64 = 0; + fiat_p256_mulx_u64(&mut x40, &mut x41, x32, 0xffffffff); + let mut x42: u64 = 0; + let mut x43: u64 = 0; + fiat_p256_mulx_u64(&mut x42, &mut x43, x32, 0xffffffffffffffff); + let mut x44: u64 = 0; + let mut x45: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x44, &mut x45, 0x0, x43, x40); + let mut x46: u64 = 0; + let mut x47: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x46, &mut x47, 0x0, x32, x42); + let mut x48: u64 = 0; + let mut x49: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x48, &mut x49, x47, x34, x44); + let mut x50: u64 = 0; + let mut x51: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x50, &mut x51, x49, x36, ((x45 as u64) + x41)); + let mut x52: u64 = 0; + let mut x53: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x52, &mut x53, x51, ((x37 as u64) + ((x31 as u64) + x17)), x38); + let mut x54: u64 = 0; + let mut x55: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x54, &mut x55, 0x0, x48, (arg1[3])); + let mut x56: u64 = 0; + let mut x57: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x56, &mut x57, x55, x50, (0x0 as u64)); + let mut x58: u64 = 0; + let mut x59: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x58, &mut x59, x57, x52, (0x0 as u64)); + let mut x60: u64 = 0; + let mut x61: u64 = 0; + fiat_p256_mulx_u64(&mut x60, &mut x61, x54, 0xffffffff00000001); + let mut x62: u64 = 0; + let mut x63: u64 = 0; + fiat_p256_mulx_u64(&mut x62, &mut x63, x54, 0xffffffff); + let mut x64: u64 = 0; + let mut x65: u64 = 0; + fiat_p256_mulx_u64(&mut x64, &mut x65, x54, 0xffffffffffffffff); + let mut x66: u64 = 0; + let mut x67: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x66, &mut x67, 0x0, x65, x62); + let mut x68: u64 = 0; + let mut x69: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x68, &mut x69, 0x0, x54, x64); + let mut x70: u64 = 0; + let mut x71: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x70, &mut x71, x69, x56, x66); + let mut x72: u64 = 0; + let mut x73: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x72, &mut x73, x71, x58, ((x67 as u64) + x63)); + let mut x74: u64 = 0; + let mut x75: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x74, &mut x75, x73, ((x59 as u64) + ((x53 as u64) + x39)), x60); + let x76: u64 = ((x75 as u64) + x61); + let mut x77: u64 = 0; + let mut x78: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u64(&mut x77, &mut x78, 0x0, x70, 0xffffffffffffffff); + let mut x79: u64 = 0; + let mut x80: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u64(&mut x79, &mut x80, x78, x72, 0xffffffff); + let mut x81: u64 = 0; + let mut x82: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u64(&mut x81, &mut x82, x80, x74, (0x0 as u64)); + let mut x83: u64 = 0; + let mut x84: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u64(&mut x83, &mut x84, x82, x76, 0xffffffff00000001); + let mut x85: u64 = 0; + let mut x86: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u64(&mut x85, &mut x86, x84, (0x0 as u64), (0x0 as u64)); + let mut x87: u64 = 0; + fiat_p256_cmovznz_u64(&mut x87, x86, x77, x70); + let mut x88: u64 = 0; + fiat_p256_cmovznz_u64(&mut x88, x86, x79, x72); + let mut x89: u64 = 0; + fiat_p256_cmovznz_u64(&mut x89, x86, x81, x74); + let mut x90: u64 = 0; + fiat_p256_cmovznz_u64(&mut x90, x86, x83, x76); + out1[0] = x87; + out1[1] = x88; + out1[2] = x89; + out1[3] = x90; +} + +/// The function fiat_p256_to_montgomery translates a field element into the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = eval arg1 mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p256_to_montgomery(out1: &mut fiat_p256_montgomery_domain_field_element, arg1: &fiat_p256_non_montgomery_domain_field_element) -> () { + let x1: u64 = (arg1[1]); + let x2: u64 = (arg1[2]); + let x3: u64 = (arg1[3]); + let x4: u64 = (arg1[0]); + let mut x5: u64 = 0; + let mut x6: u64 = 0; + fiat_p256_mulx_u64(&mut x5, &mut x6, x4, 0x4fffffffd); + let mut x7: u64 = 0; + let mut x8: u64 = 0; + fiat_p256_mulx_u64(&mut x7, &mut x8, x4, 0xfffffffffffffffe); + let mut x9: u64 = 0; + let mut x10: u64 = 0; + fiat_p256_mulx_u64(&mut x9, &mut x10, x4, 0xfffffffbffffffff); + let mut x11: u64 = 0; + let mut x12: u64 = 0; + fiat_p256_mulx_u64(&mut x11, &mut x12, x4, 0x3); + let mut x13: u64 = 0; + let mut x14: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x13, &mut x14, 0x0, x12, x9); + let mut x15: u64 = 0; + let mut x16: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x15, &mut x16, x14, x10, x7); + let mut x17: u64 = 0; + let mut x18: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x17, &mut x18, x16, x8, x5); + let mut x19: u64 = 0; + let mut x20: u64 = 0; + fiat_p256_mulx_u64(&mut x19, &mut x20, x11, 0xffffffff00000001); + let mut x21: u64 = 0; + let mut x22: u64 = 0; + fiat_p256_mulx_u64(&mut x21, &mut x22, x11, 0xffffffff); + let mut x23: u64 = 0; + let mut x24: u64 = 0; + fiat_p256_mulx_u64(&mut x23, &mut x24, x11, 0xffffffffffffffff); + let mut x25: u64 = 0; + let mut x26: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x25, &mut x26, 0x0, x24, x21); + let mut x27: u64 = 0; + let mut x28: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x27, &mut x28, 0x0, x11, x23); + let mut x29: u64 = 0; + let mut x30: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x29, &mut x30, x28, x13, x25); + let mut x31: u64 = 0; + let mut x32: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x31, &mut x32, x30, x15, ((x26 as u64) + x22)); + let mut x33: u64 = 0; + let mut x34: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x33, &mut x34, x32, x17, x19); + let mut x35: u64 = 0; + let mut x36: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x35, &mut x36, x34, ((x18 as u64) + x6), x20); + let mut x37: u64 = 0; + let mut x38: u64 = 0; + fiat_p256_mulx_u64(&mut x37, &mut x38, x1, 0x4fffffffd); + let mut x39: u64 = 0; + let mut x40: u64 = 0; + fiat_p256_mulx_u64(&mut x39, &mut x40, x1, 0xfffffffffffffffe); + let mut x41: u64 = 0; + let mut x42: u64 = 0; + fiat_p256_mulx_u64(&mut x41, &mut x42, x1, 0xfffffffbffffffff); + let mut x43: u64 = 0; + let mut x44: u64 = 0; + fiat_p256_mulx_u64(&mut x43, &mut x44, x1, 0x3); + let mut x45: u64 = 0; + let mut x46: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x45, &mut x46, 0x0, x44, x41); + let mut x47: u64 = 0; + let mut x48: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x47, &mut x48, x46, x42, x39); + let mut x49: u64 = 0; + let mut x50: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x49, &mut x50, x48, x40, x37); + let mut x51: u64 = 0; + let mut x52: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x51, &mut x52, 0x0, x29, x43); + let mut x53: u64 = 0; + let mut x54: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x53, &mut x54, x52, x31, x45); + let mut x55: u64 = 0; + let mut x56: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x55, &mut x56, x54, x33, x47); + let mut x57: u64 = 0; + let mut x58: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x57, &mut x58, x56, x35, x49); + let mut x59: u64 = 0; + let mut x60: u64 = 0; + fiat_p256_mulx_u64(&mut x59, &mut x60, x51, 0xffffffff00000001); + let mut x61: u64 = 0; + let mut x62: u64 = 0; + fiat_p256_mulx_u64(&mut x61, &mut x62, x51, 0xffffffff); + let mut x63: u64 = 0; + let mut x64: u64 = 0; + fiat_p256_mulx_u64(&mut x63, &mut x64, x51, 0xffffffffffffffff); + let mut x65: u64 = 0; + let mut x66: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x65, &mut x66, 0x0, x64, x61); + let mut x67: u64 = 0; + let mut x68: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x67, &mut x68, 0x0, x51, x63); + let mut x69: u64 = 0; + let mut x70: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x69, &mut x70, x68, x53, x65); + let mut x71: u64 = 0; + let mut x72: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x71, &mut x72, x70, x55, ((x66 as u64) + x62)); + let mut x73: u64 = 0; + let mut x74: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x73, &mut x74, x72, x57, x59); + let mut x75: u64 = 0; + let mut x76: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x75, &mut x76, x74, (((x58 as u64) + (x36 as u64)) + ((x50 as u64) + x38)), x60); + let mut x77: u64 = 0; + let mut x78: u64 = 0; + fiat_p256_mulx_u64(&mut x77, &mut x78, x2, 0x4fffffffd); + let mut x79: u64 = 0; + let mut x80: u64 = 0; + fiat_p256_mulx_u64(&mut x79, &mut x80, x2, 0xfffffffffffffffe); + let mut x81: u64 = 0; + let mut x82: u64 = 0; + fiat_p256_mulx_u64(&mut x81, &mut x82, x2, 0xfffffffbffffffff); + let mut x83: u64 = 0; + let mut x84: u64 = 0; + fiat_p256_mulx_u64(&mut x83, &mut x84, x2, 0x3); + let mut x85: u64 = 0; + let mut x86: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x85, &mut x86, 0x0, x84, x81); + let mut x87: u64 = 0; + let mut x88: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x87, &mut x88, x86, x82, x79); + let mut x89: u64 = 0; + let mut x90: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x89, &mut x90, x88, x80, x77); + let mut x91: u64 = 0; + let mut x92: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x91, &mut x92, 0x0, x69, x83); + let mut x93: u64 = 0; + let mut x94: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x93, &mut x94, x92, x71, x85); + let mut x95: u64 = 0; + let mut x96: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x95, &mut x96, x94, x73, x87); + let mut x97: u64 = 0; + let mut x98: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x97, &mut x98, x96, x75, x89); + let mut x99: u64 = 0; + let mut x100: u64 = 0; + fiat_p256_mulx_u64(&mut x99, &mut x100, x91, 0xffffffff00000001); + let mut x101: u64 = 0; + let mut x102: u64 = 0; + fiat_p256_mulx_u64(&mut x101, &mut x102, x91, 0xffffffff); + let mut x103: u64 = 0; + let mut x104: u64 = 0; + fiat_p256_mulx_u64(&mut x103, &mut x104, x91, 0xffffffffffffffff); + let mut x105: u64 = 0; + let mut x106: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x105, &mut x106, 0x0, x104, x101); + let mut x107: u64 = 0; + let mut x108: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x107, &mut x108, 0x0, x91, x103); + let mut x109: u64 = 0; + let mut x110: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x109, &mut x110, x108, x93, x105); + let mut x111: u64 = 0; + let mut x112: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x111, &mut x112, x110, x95, ((x106 as u64) + x102)); + let mut x113: u64 = 0; + let mut x114: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x113, &mut x114, x112, x97, x99); + let mut x115: u64 = 0; + let mut x116: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x115, &mut x116, x114, (((x98 as u64) + (x76 as u64)) + ((x90 as u64) + x78)), x100); + let mut x117: u64 = 0; + let mut x118: u64 = 0; + fiat_p256_mulx_u64(&mut x117, &mut x118, x3, 0x4fffffffd); + let mut x119: u64 = 0; + let mut x120: u64 = 0; + fiat_p256_mulx_u64(&mut x119, &mut x120, x3, 0xfffffffffffffffe); + let mut x121: u64 = 0; + let mut x122: u64 = 0; + fiat_p256_mulx_u64(&mut x121, &mut x122, x3, 0xfffffffbffffffff); + let mut x123: u64 = 0; + let mut x124: u64 = 0; + fiat_p256_mulx_u64(&mut x123, &mut x124, x3, 0x3); + let mut x125: u64 = 0; + let mut x126: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x125, &mut x126, 0x0, x124, x121); + let mut x127: u64 = 0; + let mut x128: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x127, &mut x128, x126, x122, x119); + let mut x129: u64 = 0; + let mut x130: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x129, &mut x130, x128, x120, x117); + let mut x131: u64 = 0; + let mut x132: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x131, &mut x132, 0x0, x109, x123); + let mut x133: u64 = 0; + let mut x134: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x133, &mut x134, x132, x111, x125); + let mut x135: u64 = 0; + let mut x136: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x135, &mut x136, x134, x113, x127); + let mut x137: u64 = 0; + let mut x138: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x137, &mut x138, x136, x115, x129); + let mut x139: u64 = 0; + let mut x140: u64 = 0; + fiat_p256_mulx_u64(&mut x139, &mut x140, x131, 0xffffffff00000001); + let mut x141: u64 = 0; + let mut x142: u64 = 0; + fiat_p256_mulx_u64(&mut x141, &mut x142, x131, 0xffffffff); + let mut x143: u64 = 0; + let mut x144: u64 = 0; + fiat_p256_mulx_u64(&mut x143, &mut x144, x131, 0xffffffffffffffff); + let mut x145: u64 = 0; + let mut x146: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x145, &mut x146, 0x0, x144, x141); + let mut x147: u64 = 0; + let mut x148: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x147, &mut x148, 0x0, x131, x143); + let mut x149: u64 = 0; + let mut x150: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x149, &mut x150, x148, x133, x145); + let mut x151: u64 = 0; + let mut x152: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x151, &mut x152, x150, x135, ((x146 as u64) + x142)); + let mut x153: u64 = 0; + let mut x154: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x153, &mut x154, x152, x137, x139); + let mut x155: u64 = 0; + let mut x156: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x155, &mut x156, x154, (((x138 as u64) + (x116 as u64)) + ((x130 as u64) + x118)), x140); + let mut x157: u64 = 0; + let mut x158: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u64(&mut x157, &mut x158, 0x0, x149, 0xffffffffffffffff); + let mut x159: u64 = 0; + let mut x160: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u64(&mut x159, &mut x160, x158, x151, 0xffffffff); + let mut x161: u64 = 0; + let mut x162: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u64(&mut x161, &mut x162, x160, x153, (0x0 as u64)); + let mut x163: u64 = 0; + let mut x164: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u64(&mut x163, &mut x164, x162, x155, 0xffffffff00000001); + let mut x165: u64 = 0; + let mut x166: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u64(&mut x165, &mut x166, x164, (x156 as u64), (0x0 as u64)); + let mut x167: u64 = 0; + fiat_p256_cmovznz_u64(&mut x167, x166, x157, x149); + let mut x168: u64 = 0; + fiat_p256_cmovznz_u64(&mut x168, x166, x159, x151); + let mut x169: u64 = 0; + fiat_p256_cmovznz_u64(&mut x169, x166, x161, x153); + let mut x170: u64 = 0; + fiat_p256_cmovznz_u64(&mut x170, x166, x163, x155); + out1[0] = x167; + out1[1] = x168; + out1[2] = x169; + out1[3] = x170; +} + +/// The function fiat_p256_nonzero outputs a single non-zero word if the input is non-zero and zero otherwise. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// out1 = 0 ↔ eval (from_montgomery arg1) mod m = 0 +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +#[inline] +pub fn fiat_p256_nonzero(out1: &mut u64, arg1: &[u64; 4]) -> () { + let x1: u64 = ((arg1[0]) | ((arg1[1]) | ((arg1[2]) | (arg1[3])))); + *out1 = x1; +} + +/// The function fiat_p256_selectznz is a multi-limb conditional select. +/// +/// Postconditions: +/// out1 = (if arg1 = 0 then arg2 else arg3) +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +#[inline] +pub fn fiat_p256_selectznz(out1: &mut [u64; 4], arg1: fiat_p256_u1, arg2: &[u64; 4], arg3: &[u64; 4]) -> () { + let mut x1: u64 = 0; + fiat_p256_cmovznz_u64(&mut x1, arg1, (arg2[0]), (arg3[0])); + let mut x2: u64 = 0; + fiat_p256_cmovznz_u64(&mut x2, arg1, (arg2[1]), (arg3[1])); + let mut x3: u64 = 0; + fiat_p256_cmovznz_u64(&mut x3, arg1, (arg2[2]), (arg3[2])); + let mut x4: u64 = 0; + fiat_p256_cmovznz_u64(&mut x4, arg1, (arg2[3]), (arg3[3])); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; + out1[3] = x4; +} + +/// The function fiat_p256_to_bytes serializes a field element NOT in the Montgomery domain to bytes in little-endian order. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..31] +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] +#[inline] +pub fn fiat_p256_to_bytes(out1: &mut [u8; 32], arg1: &[u64; 4]) -> () { + let x1: u64 = (arg1[3]); + let x2: u64 = (arg1[2]); + let x3: u64 = (arg1[1]); + let x4: u64 = (arg1[0]); + let x5: u8 = ((x4 & (0xff as u64)) as u8); + let x6: u64 = (x4 >> 8); + let x7: u8 = ((x6 & (0xff as u64)) as u8); + let x8: u64 = (x6 >> 8); + let x9: u8 = ((x8 & (0xff as u64)) as u8); + let x10: u64 = (x8 >> 8); + let x11: u8 = ((x10 & (0xff as u64)) as u8); + let x12: u64 = (x10 >> 8); + let x13: u8 = ((x12 & (0xff as u64)) as u8); + let x14: u64 = (x12 >> 8); + let x15: u8 = ((x14 & (0xff as u64)) as u8); + let x16: u64 = (x14 >> 8); + let x17: u8 = ((x16 & (0xff as u64)) as u8); + let x18: u8 = ((x16 >> 8) as u8); + let x19: u8 = ((x3 & (0xff as u64)) as u8); + let x20: u64 = (x3 >> 8); + let x21: u8 = ((x20 & (0xff as u64)) as u8); + let x22: u64 = (x20 >> 8); + let x23: u8 = ((x22 & (0xff as u64)) as u8); + let x24: u64 = (x22 >> 8); + let x25: u8 = ((x24 & (0xff as u64)) as u8); + let x26: u64 = (x24 >> 8); + let x27: u8 = ((x26 & (0xff as u64)) as u8); + let x28: u64 = (x26 >> 8); + let x29: u8 = ((x28 & (0xff as u64)) as u8); + let x30: u64 = (x28 >> 8); + let x31: u8 = ((x30 & (0xff as u64)) as u8); + let x32: u8 = ((x30 >> 8) as u8); + let x33: u8 = ((x2 & (0xff as u64)) as u8); + let x34: u64 = (x2 >> 8); + let x35: u8 = ((x34 & (0xff as u64)) as u8); + let x36: u64 = (x34 >> 8); + let x37: u8 = ((x36 & (0xff as u64)) as u8); + let x38: u64 = (x36 >> 8); + let x39: u8 = ((x38 & (0xff as u64)) as u8); + let x40: u64 = (x38 >> 8); + let x41: u8 = ((x40 & (0xff as u64)) as u8); + let x42: u64 = (x40 >> 8); + let x43: u8 = ((x42 & (0xff as u64)) as u8); + let x44: u64 = (x42 >> 8); + let x45: u8 = ((x44 & (0xff as u64)) as u8); + let x46: u8 = ((x44 >> 8) as u8); + let x47: u8 = ((x1 & (0xff as u64)) as u8); + let x48: u64 = (x1 >> 8); + let x49: u8 = ((x48 & (0xff as u64)) as u8); + let x50: u64 = (x48 >> 8); + let x51: u8 = ((x50 & (0xff as u64)) as u8); + let x52: u64 = (x50 >> 8); + let x53: u8 = ((x52 & (0xff as u64)) as u8); + let x54: u64 = (x52 >> 8); + let x55: u8 = ((x54 & (0xff as u64)) as u8); + let x56: u64 = (x54 >> 8); + let x57: u8 = ((x56 & (0xff as u64)) as u8); + let x58: u64 = (x56 >> 8); + let x59: u8 = ((x58 & (0xff as u64)) as u8); + let x60: u8 = ((x58 >> 8) as u8); + out1[0] = x5; + out1[1] = x7; + out1[2] = x9; + out1[3] = x11; + out1[4] = x13; + out1[5] = x15; + out1[6] = x17; + out1[7] = x18; + out1[8] = x19; + out1[9] = x21; + out1[10] = x23; + out1[11] = x25; + out1[12] = x27; + out1[13] = x29; + out1[14] = x31; + out1[15] = x32; + out1[16] = x33; + out1[17] = x35; + out1[18] = x37; + out1[19] = x39; + out1[20] = x41; + out1[21] = x43; + out1[22] = x45; + out1[23] = x46; + out1[24] = x47; + out1[25] = x49; + out1[26] = x51; + out1[27] = x53; + out1[28] = x55; + out1[29] = x57; + out1[30] = x59; + out1[31] = x60; +} + +/// The function fiat_p256_from_bytes deserializes a field element NOT in the Montgomery domain from bytes in little-endian order. +/// +/// Preconditions: +/// 0 ≤ bytes_eval arg1 < m +/// Postconditions: +/// eval out1 mod m = bytes_eval arg1 mod m +/// 0 ≤ eval out1 < m +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +#[inline] +pub fn fiat_p256_from_bytes(out1: &mut [u64; 4], arg1: &[u8; 32]) -> () { + let x1: u64 = (((arg1[31]) as u64) << 56); + let x2: u64 = (((arg1[30]) as u64) << 48); + let x3: u64 = (((arg1[29]) as u64) << 40); + let x4: u64 = (((arg1[28]) as u64) << 32); + let x5: u64 = (((arg1[27]) as u64) << 24); + let x6: u64 = (((arg1[26]) as u64) << 16); + let x7: u64 = (((arg1[25]) as u64) << 8); + let x8: u8 = (arg1[24]); + let x9: u64 = (((arg1[23]) as u64) << 56); + let x10: u64 = (((arg1[22]) as u64) << 48); + let x11: u64 = (((arg1[21]) as u64) << 40); + let x12: u64 = (((arg1[20]) as u64) << 32); + let x13: u64 = (((arg1[19]) as u64) << 24); + let x14: u64 = (((arg1[18]) as u64) << 16); + let x15: u64 = (((arg1[17]) as u64) << 8); + let x16: u8 = (arg1[16]); + let x17: u64 = (((arg1[15]) as u64) << 56); + let x18: u64 = (((arg1[14]) as u64) << 48); + let x19: u64 = (((arg1[13]) as u64) << 40); + let x20: u64 = (((arg1[12]) as u64) << 32); + let x21: u64 = (((arg1[11]) as u64) << 24); + let x22: u64 = (((arg1[10]) as u64) << 16); + let x23: u64 = (((arg1[9]) as u64) << 8); + let x24: u8 = (arg1[8]); + let x25: u64 = (((arg1[7]) as u64) << 56); + let x26: u64 = (((arg1[6]) as u64) << 48); + let x27: u64 = (((arg1[5]) as u64) << 40); + let x28: u64 = (((arg1[4]) as u64) << 32); + let x29: u64 = (((arg1[3]) as u64) << 24); + let x30: u64 = (((arg1[2]) as u64) << 16); + let x31: u64 = (((arg1[1]) as u64) << 8); + let x32: u8 = (arg1[0]); + let x33: u64 = (x31 + (x32 as u64)); + let x34: u64 = (x30 + x33); + let x35: u64 = (x29 + x34); + let x36: u64 = (x28 + x35); + let x37: u64 = (x27 + x36); + let x38: u64 = (x26 + x37); + let x39: u64 = (x25 + x38); + let x40: u64 = (x23 + (x24 as u64)); + let x41: u64 = (x22 + x40); + let x42: u64 = (x21 + x41); + let x43: u64 = (x20 + x42); + let x44: u64 = (x19 + x43); + let x45: u64 = (x18 + x44); + let x46: u64 = (x17 + x45); + let x47: u64 = (x15 + (x16 as u64)); + let x48: u64 = (x14 + x47); + let x49: u64 = (x13 + x48); + let x50: u64 = (x12 + x49); + let x51: u64 = (x11 + x50); + let x52: u64 = (x10 + x51); + let x53: u64 = (x9 + x52); + let x54: u64 = (x7 + (x8 as u64)); + let x55: u64 = (x6 + x54); + let x56: u64 = (x5 + x55); + let x57: u64 = (x4 + x56); + let x58: u64 = (x3 + x57); + let x59: u64 = (x2 + x58); + let x60: u64 = (x1 + x59); + out1[0] = x39; + out1[1] = x46; + out1[2] = x53; + out1[3] = x60; +} + +/// The function fiat_p256_set_one returns the field element one in the Montgomery domain. +/// +/// Postconditions: +/// eval (from_montgomery out1) mod m = 1 mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p256_set_one(out1: &mut fiat_p256_montgomery_domain_field_element) -> () { + out1[0] = (0x1 as u64); + out1[1] = 0xffffffff00000000; + out1[2] = 0xffffffffffffffff; + out1[3] = 0xfffffffe; +} + +/// The function fiat_p256_msat returns the saturated representation of the prime modulus. +/// +/// Postconditions: +/// twos_complement_eval out1 = m +/// 0 ≤ eval out1 < m +/// +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +#[inline] +pub fn fiat_p256_msat(out1: &mut [u64; 5]) -> () { + out1[0] = 0xffffffffffffffff; + out1[1] = 0xffffffff; + out1[2] = (0x0 as u64); + out1[3] = 0xffffffff00000001; + out1[4] = (0x0 as u64); +} + +/// The function fiat_p256_divstep computes a divstep. +/// +/// Preconditions: +/// 0 ≤ eval arg4 < m +/// 0 ≤ eval arg5 < m +/// Postconditions: +/// out1 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then 1 - arg1 else 1 + arg1) +/// twos_complement_eval out2 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then twos_complement_eval arg3 else twos_complement_eval arg2) +/// twos_complement_eval out3 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then ⌊(twos_complement_eval arg3 - twos_complement_eval arg2) / 2⌋ else ⌊(twos_complement_eval arg3 + (twos_complement_eval arg3 mod 2) * twos_complement_eval arg2) / 2⌋) +/// eval (from_montgomery out4) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (2 * eval (from_montgomery arg5)) mod m else (2 * eval (from_montgomery arg4)) mod m) +/// eval (from_montgomery out5) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (eval (from_montgomery arg4) - eval (from_montgomery arg4)) mod m else (eval (from_montgomery arg5) + (twos_complement_eval arg3 mod 2) * eval (from_montgomery arg4)) mod m) +/// 0 ≤ eval out5 < m +/// 0 ≤ eval out5 < m +/// 0 ≤ eval out2 < m +/// 0 ≤ eval out3 < m +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0xffffffffffffffff] +/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// arg4: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// arg5: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +/// out2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// out3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// out4: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// out5: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +#[inline] +pub fn fiat_p256_divstep(out1: &mut u64, out2: &mut [u64; 5], out3: &mut [u64; 5], out4: &mut [u64; 4], out5: &mut [u64; 4], arg1: u64, arg2: &[u64; 5], arg3: &[u64; 5], arg4: &[u64; 4], arg5: &[u64; 4]) -> () { + let mut x1: u64 = 0; + let mut x2: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x1, &mut x2, 0x0, (!arg1), (0x1 as u64)); + let x3: fiat_p256_u1 = (((x1 >> 63) as fiat_p256_u1) & (((arg3[0]) & (0x1 as u64)) as fiat_p256_u1)); + let mut x4: u64 = 0; + let mut x5: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x4, &mut x5, 0x0, (!arg1), (0x1 as u64)); + let mut x6: u64 = 0; + fiat_p256_cmovznz_u64(&mut x6, x3, arg1, x4); + let mut x7: u64 = 0; + fiat_p256_cmovznz_u64(&mut x7, x3, (arg2[0]), (arg3[0])); + let mut x8: u64 = 0; + fiat_p256_cmovznz_u64(&mut x8, x3, (arg2[1]), (arg3[1])); + let mut x9: u64 = 0; + fiat_p256_cmovznz_u64(&mut x9, x3, (arg2[2]), (arg3[2])); + let mut x10: u64 = 0; + fiat_p256_cmovznz_u64(&mut x10, x3, (arg2[3]), (arg3[3])); + let mut x11: u64 = 0; + fiat_p256_cmovznz_u64(&mut x11, x3, (arg2[4]), (arg3[4])); + let mut x12: u64 = 0; + let mut x13: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x12, &mut x13, 0x0, (0x1 as u64), (!(arg2[0]))); + let mut x14: u64 = 0; + let mut x15: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x14, &mut x15, x13, (0x0 as u64), (!(arg2[1]))); + let mut x16: u64 = 0; + let mut x17: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x16, &mut x17, x15, (0x0 as u64), (!(arg2[2]))); + let mut x18: u64 = 0; + let mut x19: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x18, &mut x19, x17, (0x0 as u64), (!(arg2[3]))); + let mut x20: u64 = 0; + let mut x21: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x20, &mut x21, x19, (0x0 as u64), (!(arg2[4]))); + let mut x22: u64 = 0; + fiat_p256_cmovznz_u64(&mut x22, x3, (arg3[0]), x12); + let mut x23: u64 = 0; + fiat_p256_cmovznz_u64(&mut x23, x3, (arg3[1]), x14); + let mut x24: u64 = 0; + fiat_p256_cmovznz_u64(&mut x24, x3, (arg3[2]), x16); + let mut x25: u64 = 0; + fiat_p256_cmovznz_u64(&mut x25, x3, (arg3[3]), x18); + let mut x26: u64 = 0; + fiat_p256_cmovznz_u64(&mut x26, x3, (arg3[4]), x20); + let mut x27: u64 = 0; + fiat_p256_cmovznz_u64(&mut x27, x3, (arg4[0]), (arg5[0])); + let mut x28: u64 = 0; + fiat_p256_cmovznz_u64(&mut x28, x3, (arg4[1]), (arg5[1])); + let mut x29: u64 = 0; + fiat_p256_cmovznz_u64(&mut x29, x3, (arg4[2]), (arg5[2])); + let mut x30: u64 = 0; + fiat_p256_cmovznz_u64(&mut x30, x3, (arg4[3]), (arg5[3])); + let mut x31: u64 = 0; + let mut x32: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x31, &mut x32, 0x0, x27, x27); + let mut x33: u64 = 0; + let mut x34: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x33, &mut x34, x32, x28, x28); + let mut x35: u64 = 0; + let mut x36: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x35, &mut x36, x34, x29, x29); + let mut x37: u64 = 0; + let mut x38: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x37, &mut x38, x36, x30, x30); + let mut x39: u64 = 0; + let mut x40: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u64(&mut x39, &mut x40, 0x0, x31, 0xffffffffffffffff); + let mut x41: u64 = 0; + let mut x42: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u64(&mut x41, &mut x42, x40, x33, 0xffffffff); + let mut x43: u64 = 0; + let mut x44: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u64(&mut x43, &mut x44, x42, x35, (0x0 as u64)); + let mut x45: u64 = 0; + let mut x46: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u64(&mut x45, &mut x46, x44, x37, 0xffffffff00000001); + let mut x47: u64 = 0; + let mut x48: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u64(&mut x47, &mut x48, x46, (x38 as u64), (0x0 as u64)); + let x49: u64 = (arg4[3]); + let x50: u64 = (arg4[2]); + let x51: u64 = (arg4[1]); + let x52: u64 = (arg4[0]); + let mut x53: u64 = 0; + let mut x54: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u64(&mut x53, &mut x54, 0x0, (0x0 as u64), x52); + let mut x55: u64 = 0; + let mut x56: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u64(&mut x55, &mut x56, x54, (0x0 as u64), x51); + let mut x57: u64 = 0; + let mut x58: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u64(&mut x57, &mut x58, x56, (0x0 as u64), x50); + let mut x59: u64 = 0; + let mut x60: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u64(&mut x59, &mut x60, x58, (0x0 as u64), x49); + let mut x61: u64 = 0; + fiat_p256_cmovznz_u64(&mut x61, x60, (0x0 as u64), 0xffffffffffffffff); + let mut x62: u64 = 0; + let mut x63: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x62, &mut x63, 0x0, x53, x61); + let mut x64: u64 = 0; + let mut x65: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x64, &mut x65, x63, x55, (x61 & 0xffffffff)); + let mut x66: u64 = 0; + let mut x67: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x66, &mut x67, x65, x57, (0x0 as u64)); + let mut x68: u64 = 0; + let mut x69: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x68, &mut x69, x67, x59, (x61 & 0xffffffff00000001)); + let mut x70: u64 = 0; + fiat_p256_cmovznz_u64(&mut x70, x3, (arg5[0]), x62); + let mut x71: u64 = 0; + fiat_p256_cmovznz_u64(&mut x71, x3, (arg5[1]), x64); + let mut x72: u64 = 0; + fiat_p256_cmovznz_u64(&mut x72, x3, (arg5[2]), x66); + let mut x73: u64 = 0; + fiat_p256_cmovznz_u64(&mut x73, x3, (arg5[3]), x68); + let x74: fiat_p256_u1 = ((x22 & (0x1 as u64)) as fiat_p256_u1); + let mut x75: u64 = 0; + fiat_p256_cmovznz_u64(&mut x75, x74, (0x0 as u64), x7); + let mut x76: u64 = 0; + fiat_p256_cmovznz_u64(&mut x76, x74, (0x0 as u64), x8); + let mut x77: u64 = 0; + fiat_p256_cmovznz_u64(&mut x77, x74, (0x0 as u64), x9); + let mut x78: u64 = 0; + fiat_p256_cmovznz_u64(&mut x78, x74, (0x0 as u64), x10); + let mut x79: u64 = 0; + fiat_p256_cmovznz_u64(&mut x79, x74, (0x0 as u64), x11); + let mut x80: u64 = 0; + let mut x81: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x80, &mut x81, 0x0, x22, x75); + let mut x82: u64 = 0; + let mut x83: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x82, &mut x83, x81, x23, x76); + let mut x84: u64 = 0; + let mut x85: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x84, &mut x85, x83, x24, x77); + let mut x86: u64 = 0; + let mut x87: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x86, &mut x87, x85, x25, x78); + let mut x88: u64 = 0; + let mut x89: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x88, &mut x89, x87, x26, x79); + let mut x90: u64 = 0; + fiat_p256_cmovznz_u64(&mut x90, x74, (0x0 as u64), x27); + let mut x91: u64 = 0; + fiat_p256_cmovznz_u64(&mut x91, x74, (0x0 as u64), x28); + let mut x92: u64 = 0; + fiat_p256_cmovznz_u64(&mut x92, x74, (0x0 as u64), x29); + let mut x93: u64 = 0; + fiat_p256_cmovznz_u64(&mut x93, x74, (0x0 as u64), x30); + let mut x94: u64 = 0; + let mut x95: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x94, &mut x95, 0x0, x70, x90); + let mut x96: u64 = 0; + let mut x97: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x96, &mut x97, x95, x71, x91); + let mut x98: u64 = 0; + let mut x99: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x98, &mut x99, x97, x72, x92); + let mut x100: u64 = 0; + let mut x101: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x100, &mut x101, x99, x73, x93); + let mut x102: u64 = 0; + let mut x103: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u64(&mut x102, &mut x103, 0x0, x94, 0xffffffffffffffff); + let mut x104: u64 = 0; + let mut x105: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u64(&mut x104, &mut x105, x103, x96, 0xffffffff); + let mut x106: u64 = 0; + let mut x107: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u64(&mut x106, &mut x107, x105, x98, (0x0 as u64)); + let mut x108: u64 = 0; + let mut x109: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u64(&mut x108, &mut x109, x107, x100, 0xffffffff00000001); + let mut x110: u64 = 0; + let mut x111: fiat_p256_u1 = 0; + fiat_p256_subborrowx_u64(&mut x110, &mut x111, x109, (x101 as u64), (0x0 as u64)); + let mut x112: u64 = 0; + let mut x113: fiat_p256_u1 = 0; + fiat_p256_addcarryx_u64(&mut x112, &mut x113, 0x0, x6, (0x1 as u64)); + let x114: u64 = ((x80 >> 1) | ((x82 << 63) & 0xffffffffffffffff)); + let x115: u64 = ((x82 >> 1) | ((x84 << 63) & 0xffffffffffffffff)); + let x116: u64 = ((x84 >> 1) | ((x86 << 63) & 0xffffffffffffffff)); + let x117: u64 = ((x86 >> 1) | ((x88 << 63) & 0xffffffffffffffff)); + let x118: u64 = ((x88 & 0x8000000000000000) | (x88 >> 1)); + let mut x119: u64 = 0; + fiat_p256_cmovznz_u64(&mut x119, x48, x39, x31); + let mut x120: u64 = 0; + fiat_p256_cmovznz_u64(&mut x120, x48, x41, x33); + let mut x121: u64 = 0; + fiat_p256_cmovznz_u64(&mut x121, x48, x43, x35); + let mut x122: u64 = 0; + fiat_p256_cmovznz_u64(&mut x122, x48, x45, x37); + let mut x123: u64 = 0; + fiat_p256_cmovznz_u64(&mut x123, x111, x102, x94); + let mut x124: u64 = 0; + fiat_p256_cmovznz_u64(&mut x124, x111, x104, x96); + let mut x125: u64 = 0; + fiat_p256_cmovznz_u64(&mut x125, x111, x106, x98); + let mut x126: u64 = 0; + fiat_p256_cmovznz_u64(&mut x126, x111, x108, x100); + *out1 = x112; + out2[0] = x7; + out2[1] = x8; + out2[2] = x9; + out2[3] = x10; + out2[4] = x11; + out3[0] = x114; + out3[1] = x115; + out3[2] = x116; + out3[3] = x117; + out3[4] = x118; + out4[0] = x119; + out4[1] = x120; + out4[2] = x121; + out4[3] = x122; + out5[0] = x123; + out5[1] = x124; + out5[2] = x125; + out5[3] = x126; +} + +/// The function fiat_p256_divstep_precomp returns the precomputed value for Bernstein-Yang-inversion (in montgomery form). +/// +/// Postconditions: +/// eval (from_montgomery out1) = ⌊(m - 1) / 2⌋^(if ⌊log2 m⌋ + 1 < 46 then ⌊(49 * (⌊log2 m⌋ + 1) + 80) / 17⌋ else ⌊(49 * (⌊log2 m⌋ + 1) + 57) / 17⌋) +/// 0 ≤ eval out1 < m +/// +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +#[inline] +pub fn fiat_p256_divstep_precomp(out1: &mut [u64; 4]) -> () { + out1[0] = 0x67ffffffb8000000; + out1[1] = 0xc000000038000000; + out1[2] = 0xd80000007fffffff; + out1[3] = 0x2fffffffffffffff; +} diff --git a/vendor/fiat-crypto/src/p256_scalar_32.rs b/vendor/fiat-crypto/src/p256_scalar_32.rs new file mode 100644 index 000000000..4028e42ed --- /dev/null +++ b/vendor/fiat-crypto/src/p256_scalar_32.rs @@ -0,0 +1,5310 @@ +//! Autogenerated: 'src/ExtractionOCaml/word_by_word_montgomery' --lang Rust --inline p256_scalar 32 '2^256 - 2^224 + 2^192 - 89188191075325690597107910205041859247' mul square add sub opp from_montgomery to_montgomery nonzero selectznz to_bytes from_bytes one msat divstep divstep_precomp +//! curve description: p256_scalar +//! machine_wordsize = 32 (from "32") +//! requested operations: mul, square, add, sub, opp, from_montgomery, to_montgomery, nonzero, selectznz, to_bytes, from_bytes, one, msat, divstep, divstep_precomp +//! m = 0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551 (from "2^256 - 2^224 + 2^192 - 89188191075325690597107910205041859247") +//! +//! NOTE: In addition to the bounds specified above each function, all +//! functions synthesized for this Montgomery arithmetic require the +//! input to be strictly less than the prime modulus (m), and also +//! require the input to be in the unique saturated representation. +//! All functions also ensure that these two properties are true of +//! return values. +//! +//! Computed values: +//! eval z = z[0] + (z[1] << 32) + (z[2] << 64) + (z[3] << 96) + (z[4] << 128) + (z[5] << 160) + (z[6] << 192) + (z[7] << 224) +//! bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248) +//! twos_complement_eval z = let x1 := z[0] + (z[1] << 32) + (z[2] << 64) + (z[3] << 96) + (z[4] << 128) + (z[5] << 160) + (z[6] << 192) + (z[7] << 224) in +//! if x1 & (2^256-1) < 2^255 then x1 & (2^256-1) else (x1 & (2^256-1)) - 2^256 + +#![allow(unused_parens)] +#![allow(non_camel_case_types)] + +pub type fiat_p256_scalar_u1 = u8; +pub type fiat_p256_scalar_i1 = i8; +pub type fiat_p256_scalar_u2 = u8; +pub type fiat_p256_scalar_i2 = i8; + +/* The type fiat_p256_scalar_montgomery_domain_field_element is a field element in the Montgomery domain. */ +/* Bounds: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] */ +pub type fiat_p256_scalar_montgomery_domain_field_element = [u32; 8]; + +/* The type fiat_p256_scalar_non_montgomery_domain_field_element is a field element NOT in the Montgomery domain. */ +/* Bounds: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] */ +pub type fiat_p256_scalar_non_montgomery_domain_field_element = [u32; 8]; + + +/// The function fiat_p256_scalar_addcarryx_u32 is an addition with carry. +/// +/// Postconditions: +/// out1 = (arg1 + arg2 + arg3) mod 2^32 +/// out2 = ⌊(arg1 + arg2 + arg3) / 2^32⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffff] +/// arg3: [0x0 ~> 0xffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_p256_scalar_addcarryx_u32(out1: &mut u32, out2: &mut fiat_p256_scalar_u1, arg1: fiat_p256_scalar_u1, arg2: u32, arg3: u32) -> () { + let x1: u64 = (((arg1 as u64) + (arg2 as u64)) + (arg3 as u64)); + let x2: u32 = ((x1 & (0xffffffff as u64)) as u32); + let x3: fiat_p256_scalar_u1 = ((x1 >> 32) as fiat_p256_scalar_u1); + *out1 = x2; + *out2 = x3; +} + +/// The function fiat_p256_scalar_subborrowx_u32 is a subtraction with borrow. +/// +/// Postconditions: +/// out1 = (-arg1 + arg2 + -arg3) mod 2^32 +/// out2 = -⌊(-arg1 + arg2 + -arg3) / 2^32⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffff] +/// arg3: [0x0 ~> 0xffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_p256_scalar_subborrowx_u32(out1: &mut u32, out2: &mut fiat_p256_scalar_u1, arg1: fiat_p256_scalar_u1, arg2: u32, arg3: u32) -> () { + let x1: i64 = (((arg2 as i64) - (arg1 as i64)) - (arg3 as i64)); + let x2: fiat_p256_scalar_i1 = ((x1 >> 32) as fiat_p256_scalar_i1); + let x3: u32 = ((x1 & (0xffffffff as i64)) as u32); + *out1 = x3; + *out2 = (((0x0 as fiat_p256_scalar_i2) - (x2 as fiat_p256_scalar_i2)) as fiat_p256_scalar_u1); +} + +/// The function fiat_p256_scalar_mulx_u32 is a multiplication, returning the full double-width result. +/// +/// Postconditions: +/// out1 = (arg1 * arg2) mod 2^32 +/// out2 = ⌊arg1 * arg2 / 2^32⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0xffffffff] +/// arg2: [0x0 ~> 0xffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +/// out2: [0x0 ~> 0xffffffff] +#[inline] +pub fn fiat_p256_scalar_mulx_u32(out1: &mut u32, out2: &mut u32, arg1: u32, arg2: u32) -> () { + let x1: u64 = ((arg1 as u64) * (arg2 as u64)); + let x2: u32 = ((x1 & (0xffffffff as u64)) as u32); + let x3: u32 = ((x1 >> 32) as u32); + *out1 = x2; + *out2 = x3; +} + +/// The function fiat_p256_scalar_cmovznz_u32 is a single-word conditional move. +/// +/// Postconditions: +/// out1 = (if arg1 = 0 then arg2 else arg3) +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffff] +/// arg3: [0x0 ~> 0xffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +#[inline] +pub fn fiat_p256_scalar_cmovznz_u32(out1: &mut u32, arg1: fiat_p256_scalar_u1, arg2: u32, arg3: u32) -> () { + let x1: fiat_p256_scalar_u1 = (!(!arg1)); + let x2: u32 = ((((((0x0 as fiat_p256_scalar_i2) - (x1 as fiat_p256_scalar_i2)) as fiat_p256_scalar_i1) as i64) & (0xffffffff as i64)) as u32); + let x3: u32 = ((x2 & arg3) | ((!x2) & arg2)); + *out1 = x3; +} + +/// The function fiat_p256_scalar_mul multiplies two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p256_scalar_mul(out1: &mut fiat_p256_scalar_montgomery_domain_field_element, arg1: &fiat_p256_scalar_montgomery_domain_field_element, arg2: &fiat_p256_scalar_montgomery_domain_field_element) -> () { + let x1: u32 = (arg1[1]); + let x2: u32 = (arg1[2]); + let x3: u32 = (arg1[3]); + let x4: u32 = (arg1[4]); + let x5: u32 = (arg1[5]); + let x6: u32 = (arg1[6]); + let x7: u32 = (arg1[7]); + let x8: u32 = (arg1[0]); + let mut x9: u32 = 0; + let mut x10: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x9, &mut x10, x8, (arg2[7])); + let mut x11: u32 = 0; + let mut x12: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x11, &mut x12, x8, (arg2[6])); + let mut x13: u32 = 0; + let mut x14: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x13, &mut x14, x8, (arg2[5])); + let mut x15: u32 = 0; + let mut x16: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x15, &mut x16, x8, (arg2[4])); + let mut x17: u32 = 0; + let mut x18: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x17, &mut x18, x8, (arg2[3])); + let mut x19: u32 = 0; + let mut x20: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x19, &mut x20, x8, (arg2[2])); + let mut x21: u32 = 0; + let mut x22: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x21, &mut x22, x8, (arg2[1])); + let mut x23: u32 = 0; + let mut x24: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x23, &mut x24, x8, (arg2[0])); + let mut x25: u32 = 0; + let mut x26: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x25, &mut x26, 0x0, x24, x21); + let mut x27: u32 = 0; + let mut x28: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x27, &mut x28, x26, x22, x19); + let mut x29: u32 = 0; + let mut x30: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x29, &mut x30, x28, x20, x17); + let mut x31: u32 = 0; + let mut x32: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x31, &mut x32, x30, x18, x15); + let mut x33: u32 = 0; + let mut x34: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x33, &mut x34, x32, x16, x13); + let mut x35: u32 = 0; + let mut x36: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x35, &mut x36, x34, x14, x11); + let mut x37: u32 = 0; + let mut x38: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x37, &mut x38, x36, x12, x9); + let x39: u32 = ((x38 as u32) + x10); + let mut x40: u32 = 0; + let mut x41: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x40, &mut x41, x23, 0xee00bc4f); + let mut x42: u32 = 0; + let mut x43: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x42, &mut x43, x40, 0xffffffff); + let mut x44: u32 = 0; + let mut x45: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x44, &mut x45, x40, 0xffffffff); + let mut x46: u32 = 0; + let mut x47: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x46, &mut x47, x40, 0xffffffff); + let mut x48: u32 = 0; + let mut x49: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x48, &mut x49, x40, 0xbce6faad); + let mut x50: u32 = 0; + let mut x51: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x50, &mut x51, x40, 0xa7179e84); + let mut x52: u32 = 0; + let mut x53: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x52, &mut x53, x40, 0xf3b9cac2); + let mut x54: u32 = 0; + let mut x55: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x54, &mut x55, x40, 0xfc632551); + let mut x56: u32 = 0; + let mut x57: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x56, &mut x57, 0x0, x55, x52); + let mut x58: u32 = 0; + let mut x59: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x58, &mut x59, x57, x53, x50); + let mut x60: u32 = 0; + let mut x61: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x60, &mut x61, x59, x51, x48); + let mut x62: u32 = 0; + let mut x63: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x62, &mut x63, x61, x49, x46); + let mut x64: u32 = 0; + let mut x65: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x64, &mut x65, x63, x47, x44); + let x66: u32 = ((x65 as u32) + x45); + let mut x67: u32 = 0; + let mut x68: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x67, &mut x68, 0x0, x23, x54); + let mut x69: u32 = 0; + let mut x70: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x69, &mut x70, x68, x25, x56); + let mut x71: u32 = 0; + let mut x72: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x71, &mut x72, x70, x27, x58); + let mut x73: u32 = 0; + let mut x74: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x73, &mut x74, x72, x29, x60); + let mut x75: u32 = 0; + let mut x76: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x75, &mut x76, x74, x31, x62); + let mut x77: u32 = 0; + let mut x78: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x77, &mut x78, x76, x33, x64); + let mut x79: u32 = 0; + let mut x80: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x79, &mut x80, x78, x35, x66); + let mut x81: u32 = 0; + let mut x82: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x81, &mut x82, x80, x37, x42); + let mut x83: u32 = 0; + let mut x84: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x83, &mut x84, x82, x39, x43); + let mut x85: u32 = 0; + let mut x86: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x85, &mut x86, x1, (arg2[7])); + let mut x87: u32 = 0; + let mut x88: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x87, &mut x88, x1, (arg2[6])); + let mut x89: u32 = 0; + let mut x90: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x89, &mut x90, x1, (arg2[5])); + let mut x91: u32 = 0; + let mut x92: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x91, &mut x92, x1, (arg2[4])); + let mut x93: u32 = 0; + let mut x94: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x93, &mut x94, x1, (arg2[3])); + let mut x95: u32 = 0; + let mut x96: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x95, &mut x96, x1, (arg2[2])); + let mut x97: u32 = 0; + let mut x98: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x97, &mut x98, x1, (arg2[1])); + let mut x99: u32 = 0; + let mut x100: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x99, &mut x100, x1, (arg2[0])); + let mut x101: u32 = 0; + let mut x102: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x101, &mut x102, 0x0, x100, x97); + let mut x103: u32 = 0; + let mut x104: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x103, &mut x104, x102, x98, x95); + let mut x105: u32 = 0; + let mut x106: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x105, &mut x106, x104, x96, x93); + let mut x107: u32 = 0; + let mut x108: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x107, &mut x108, x106, x94, x91); + let mut x109: u32 = 0; + let mut x110: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x109, &mut x110, x108, x92, x89); + let mut x111: u32 = 0; + let mut x112: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x111, &mut x112, x110, x90, x87); + let mut x113: u32 = 0; + let mut x114: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x113, &mut x114, x112, x88, x85); + let x115: u32 = ((x114 as u32) + x86); + let mut x116: u32 = 0; + let mut x117: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x116, &mut x117, 0x0, x69, x99); + let mut x118: u32 = 0; + let mut x119: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x118, &mut x119, x117, x71, x101); + let mut x120: u32 = 0; + let mut x121: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x120, &mut x121, x119, x73, x103); + let mut x122: u32 = 0; + let mut x123: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x122, &mut x123, x121, x75, x105); + let mut x124: u32 = 0; + let mut x125: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x124, &mut x125, x123, x77, x107); + let mut x126: u32 = 0; + let mut x127: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x126, &mut x127, x125, x79, x109); + let mut x128: u32 = 0; + let mut x129: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x128, &mut x129, x127, x81, x111); + let mut x130: u32 = 0; + let mut x131: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x130, &mut x131, x129, x83, x113); + let mut x132: u32 = 0; + let mut x133: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x132, &mut x133, x131, (x84 as u32), x115); + let mut x134: u32 = 0; + let mut x135: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x134, &mut x135, x116, 0xee00bc4f); + let mut x136: u32 = 0; + let mut x137: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x136, &mut x137, x134, 0xffffffff); + let mut x138: u32 = 0; + let mut x139: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x138, &mut x139, x134, 0xffffffff); + let mut x140: u32 = 0; + let mut x141: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x140, &mut x141, x134, 0xffffffff); + let mut x142: u32 = 0; + let mut x143: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x142, &mut x143, x134, 0xbce6faad); + let mut x144: u32 = 0; + let mut x145: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x144, &mut x145, x134, 0xa7179e84); + let mut x146: u32 = 0; + let mut x147: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x146, &mut x147, x134, 0xf3b9cac2); + let mut x148: u32 = 0; + let mut x149: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x148, &mut x149, x134, 0xfc632551); + let mut x150: u32 = 0; + let mut x151: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x150, &mut x151, 0x0, x149, x146); + let mut x152: u32 = 0; + let mut x153: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x152, &mut x153, x151, x147, x144); + let mut x154: u32 = 0; + let mut x155: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x154, &mut x155, x153, x145, x142); + let mut x156: u32 = 0; + let mut x157: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x156, &mut x157, x155, x143, x140); + let mut x158: u32 = 0; + let mut x159: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x158, &mut x159, x157, x141, x138); + let x160: u32 = ((x159 as u32) + x139); + let mut x161: u32 = 0; + let mut x162: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x161, &mut x162, 0x0, x116, x148); + let mut x163: u32 = 0; + let mut x164: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x163, &mut x164, x162, x118, x150); + let mut x165: u32 = 0; + let mut x166: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x165, &mut x166, x164, x120, x152); + let mut x167: u32 = 0; + let mut x168: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x167, &mut x168, x166, x122, x154); + let mut x169: u32 = 0; + let mut x170: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x169, &mut x170, x168, x124, x156); + let mut x171: u32 = 0; + let mut x172: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x171, &mut x172, x170, x126, x158); + let mut x173: u32 = 0; + let mut x174: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x173, &mut x174, x172, x128, x160); + let mut x175: u32 = 0; + let mut x176: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x175, &mut x176, x174, x130, x136); + let mut x177: u32 = 0; + let mut x178: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x177, &mut x178, x176, x132, x137); + let x179: u32 = ((x178 as u32) + (x133 as u32)); + let mut x180: u32 = 0; + let mut x181: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x180, &mut x181, x2, (arg2[7])); + let mut x182: u32 = 0; + let mut x183: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x182, &mut x183, x2, (arg2[6])); + let mut x184: u32 = 0; + let mut x185: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x184, &mut x185, x2, (arg2[5])); + let mut x186: u32 = 0; + let mut x187: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x186, &mut x187, x2, (arg2[4])); + let mut x188: u32 = 0; + let mut x189: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x188, &mut x189, x2, (arg2[3])); + let mut x190: u32 = 0; + let mut x191: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x190, &mut x191, x2, (arg2[2])); + let mut x192: u32 = 0; + let mut x193: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x192, &mut x193, x2, (arg2[1])); + let mut x194: u32 = 0; + let mut x195: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x194, &mut x195, x2, (arg2[0])); + let mut x196: u32 = 0; + let mut x197: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x196, &mut x197, 0x0, x195, x192); + let mut x198: u32 = 0; + let mut x199: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x198, &mut x199, x197, x193, x190); + let mut x200: u32 = 0; + let mut x201: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x200, &mut x201, x199, x191, x188); + let mut x202: u32 = 0; + let mut x203: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x202, &mut x203, x201, x189, x186); + let mut x204: u32 = 0; + let mut x205: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x204, &mut x205, x203, x187, x184); + let mut x206: u32 = 0; + let mut x207: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x206, &mut x207, x205, x185, x182); + let mut x208: u32 = 0; + let mut x209: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x208, &mut x209, x207, x183, x180); + let x210: u32 = ((x209 as u32) + x181); + let mut x211: u32 = 0; + let mut x212: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x211, &mut x212, 0x0, x163, x194); + let mut x213: u32 = 0; + let mut x214: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x213, &mut x214, x212, x165, x196); + let mut x215: u32 = 0; + let mut x216: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x215, &mut x216, x214, x167, x198); + let mut x217: u32 = 0; + let mut x218: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x217, &mut x218, x216, x169, x200); + let mut x219: u32 = 0; + let mut x220: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x219, &mut x220, x218, x171, x202); + let mut x221: u32 = 0; + let mut x222: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x221, &mut x222, x220, x173, x204); + let mut x223: u32 = 0; + let mut x224: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x223, &mut x224, x222, x175, x206); + let mut x225: u32 = 0; + let mut x226: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x225, &mut x226, x224, x177, x208); + let mut x227: u32 = 0; + let mut x228: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x227, &mut x228, x226, x179, x210); + let mut x229: u32 = 0; + let mut x230: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x229, &mut x230, x211, 0xee00bc4f); + let mut x231: u32 = 0; + let mut x232: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x231, &mut x232, x229, 0xffffffff); + let mut x233: u32 = 0; + let mut x234: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x233, &mut x234, x229, 0xffffffff); + let mut x235: u32 = 0; + let mut x236: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x235, &mut x236, x229, 0xffffffff); + let mut x237: u32 = 0; + let mut x238: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x237, &mut x238, x229, 0xbce6faad); + let mut x239: u32 = 0; + let mut x240: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x239, &mut x240, x229, 0xa7179e84); + let mut x241: u32 = 0; + let mut x242: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x241, &mut x242, x229, 0xf3b9cac2); + let mut x243: u32 = 0; + let mut x244: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x243, &mut x244, x229, 0xfc632551); + let mut x245: u32 = 0; + let mut x246: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x245, &mut x246, 0x0, x244, x241); + let mut x247: u32 = 0; + let mut x248: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x247, &mut x248, x246, x242, x239); + let mut x249: u32 = 0; + let mut x250: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x249, &mut x250, x248, x240, x237); + let mut x251: u32 = 0; + let mut x252: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x251, &mut x252, x250, x238, x235); + let mut x253: u32 = 0; + let mut x254: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x253, &mut x254, x252, x236, x233); + let x255: u32 = ((x254 as u32) + x234); + let mut x256: u32 = 0; + let mut x257: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x256, &mut x257, 0x0, x211, x243); + let mut x258: u32 = 0; + let mut x259: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x258, &mut x259, x257, x213, x245); + let mut x260: u32 = 0; + let mut x261: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x260, &mut x261, x259, x215, x247); + let mut x262: u32 = 0; + let mut x263: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x262, &mut x263, x261, x217, x249); + let mut x264: u32 = 0; + let mut x265: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x264, &mut x265, x263, x219, x251); + let mut x266: u32 = 0; + let mut x267: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x266, &mut x267, x265, x221, x253); + let mut x268: u32 = 0; + let mut x269: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x268, &mut x269, x267, x223, x255); + let mut x270: u32 = 0; + let mut x271: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x270, &mut x271, x269, x225, x231); + let mut x272: u32 = 0; + let mut x273: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x272, &mut x273, x271, x227, x232); + let x274: u32 = ((x273 as u32) + (x228 as u32)); + let mut x275: u32 = 0; + let mut x276: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x275, &mut x276, x3, (arg2[7])); + let mut x277: u32 = 0; + let mut x278: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x277, &mut x278, x3, (arg2[6])); + let mut x279: u32 = 0; + let mut x280: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x279, &mut x280, x3, (arg2[5])); + let mut x281: u32 = 0; + let mut x282: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x281, &mut x282, x3, (arg2[4])); + let mut x283: u32 = 0; + let mut x284: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x283, &mut x284, x3, (arg2[3])); + let mut x285: u32 = 0; + let mut x286: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x285, &mut x286, x3, (arg2[2])); + let mut x287: u32 = 0; + let mut x288: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x287, &mut x288, x3, (arg2[1])); + let mut x289: u32 = 0; + let mut x290: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x289, &mut x290, x3, (arg2[0])); + let mut x291: u32 = 0; + let mut x292: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x291, &mut x292, 0x0, x290, x287); + let mut x293: u32 = 0; + let mut x294: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x293, &mut x294, x292, x288, x285); + let mut x295: u32 = 0; + let mut x296: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x295, &mut x296, x294, x286, x283); + let mut x297: u32 = 0; + let mut x298: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x297, &mut x298, x296, x284, x281); + let mut x299: u32 = 0; + let mut x300: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x299, &mut x300, x298, x282, x279); + let mut x301: u32 = 0; + let mut x302: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x301, &mut x302, x300, x280, x277); + let mut x303: u32 = 0; + let mut x304: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x303, &mut x304, x302, x278, x275); + let x305: u32 = ((x304 as u32) + x276); + let mut x306: u32 = 0; + let mut x307: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x306, &mut x307, 0x0, x258, x289); + let mut x308: u32 = 0; + let mut x309: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x308, &mut x309, x307, x260, x291); + let mut x310: u32 = 0; + let mut x311: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x310, &mut x311, x309, x262, x293); + let mut x312: u32 = 0; + let mut x313: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x312, &mut x313, x311, x264, x295); + let mut x314: u32 = 0; + let mut x315: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x314, &mut x315, x313, x266, x297); + let mut x316: u32 = 0; + let mut x317: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x316, &mut x317, x315, x268, x299); + let mut x318: u32 = 0; + let mut x319: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x318, &mut x319, x317, x270, x301); + let mut x320: u32 = 0; + let mut x321: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x320, &mut x321, x319, x272, x303); + let mut x322: u32 = 0; + let mut x323: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x322, &mut x323, x321, x274, x305); + let mut x324: u32 = 0; + let mut x325: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x324, &mut x325, x306, 0xee00bc4f); + let mut x326: u32 = 0; + let mut x327: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x326, &mut x327, x324, 0xffffffff); + let mut x328: u32 = 0; + let mut x329: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x328, &mut x329, x324, 0xffffffff); + let mut x330: u32 = 0; + let mut x331: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x330, &mut x331, x324, 0xffffffff); + let mut x332: u32 = 0; + let mut x333: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x332, &mut x333, x324, 0xbce6faad); + let mut x334: u32 = 0; + let mut x335: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x334, &mut x335, x324, 0xa7179e84); + let mut x336: u32 = 0; + let mut x337: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x336, &mut x337, x324, 0xf3b9cac2); + let mut x338: u32 = 0; + let mut x339: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x338, &mut x339, x324, 0xfc632551); + let mut x340: u32 = 0; + let mut x341: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x340, &mut x341, 0x0, x339, x336); + let mut x342: u32 = 0; + let mut x343: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x342, &mut x343, x341, x337, x334); + let mut x344: u32 = 0; + let mut x345: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x344, &mut x345, x343, x335, x332); + let mut x346: u32 = 0; + let mut x347: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x346, &mut x347, x345, x333, x330); + let mut x348: u32 = 0; + let mut x349: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x348, &mut x349, x347, x331, x328); + let x350: u32 = ((x349 as u32) + x329); + let mut x351: u32 = 0; + let mut x352: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x351, &mut x352, 0x0, x306, x338); + let mut x353: u32 = 0; + let mut x354: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x353, &mut x354, x352, x308, x340); + let mut x355: u32 = 0; + let mut x356: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x355, &mut x356, x354, x310, x342); + let mut x357: u32 = 0; + let mut x358: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x357, &mut x358, x356, x312, x344); + let mut x359: u32 = 0; + let mut x360: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x359, &mut x360, x358, x314, x346); + let mut x361: u32 = 0; + let mut x362: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x361, &mut x362, x360, x316, x348); + let mut x363: u32 = 0; + let mut x364: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x363, &mut x364, x362, x318, x350); + let mut x365: u32 = 0; + let mut x366: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x365, &mut x366, x364, x320, x326); + let mut x367: u32 = 0; + let mut x368: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x367, &mut x368, x366, x322, x327); + let x369: u32 = ((x368 as u32) + (x323 as u32)); + let mut x370: u32 = 0; + let mut x371: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x370, &mut x371, x4, (arg2[7])); + let mut x372: u32 = 0; + let mut x373: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x372, &mut x373, x4, (arg2[6])); + let mut x374: u32 = 0; + let mut x375: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x374, &mut x375, x4, (arg2[5])); + let mut x376: u32 = 0; + let mut x377: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x376, &mut x377, x4, (arg2[4])); + let mut x378: u32 = 0; + let mut x379: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x378, &mut x379, x4, (arg2[3])); + let mut x380: u32 = 0; + let mut x381: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x380, &mut x381, x4, (arg2[2])); + let mut x382: u32 = 0; + let mut x383: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x382, &mut x383, x4, (arg2[1])); + let mut x384: u32 = 0; + let mut x385: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x384, &mut x385, x4, (arg2[0])); + let mut x386: u32 = 0; + let mut x387: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x386, &mut x387, 0x0, x385, x382); + let mut x388: u32 = 0; + let mut x389: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x388, &mut x389, x387, x383, x380); + let mut x390: u32 = 0; + let mut x391: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x390, &mut x391, x389, x381, x378); + let mut x392: u32 = 0; + let mut x393: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x392, &mut x393, x391, x379, x376); + let mut x394: u32 = 0; + let mut x395: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x394, &mut x395, x393, x377, x374); + let mut x396: u32 = 0; + let mut x397: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x396, &mut x397, x395, x375, x372); + let mut x398: u32 = 0; + let mut x399: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x398, &mut x399, x397, x373, x370); + let x400: u32 = ((x399 as u32) + x371); + let mut x401: u32 = 0; + let mut x402: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x401, &mut x402, 0x0, x353, x384); + let mut x403: u32 = 0; + let mut x404: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x403, &mut x404, x402, x355, x386); + let mut x405: u32 = 0; + let mut x406: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x405, &mut x406, x404, x357, x388); + let mut x407: u32 = 0; + let mut x408: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x407, &mut x408, x406, x359, x390); + let mut x409: u32 = 0; + let mut x410: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x409, &mut x410, x408, x361, x392); + let mut x411: u32 = 0; + let mut x412: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x411, &mut x412, x410, x363, x394); + let mut x413: u32 = 0; + let mut x414: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x413, &mut x414, x412, x365, x396); + let mut x415: u32 = 0; + let mut x416: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x415, &mut x416, x414, x367, x398); + let mut x417: u32 = 0; + let mut x418: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x417, &mut x418, x416, x369, x400); + let mut x419: u32 = 0; + let mut x420: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x419, &mut x420, x401, 0xee00bc4f); + let mut x421: u32 = 0; + let mut x422: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x421, &mut x422, x419, 0xffffffff); + let mut x423: u32 = 0; + let mut x424: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x423, &mut x424, x419, 0xffffffff); + let mut x425: u32 = 0; + let mut x426: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x425, &mut x426, x419, 0xffffffff); + let mut x427: u32 = 0; + let mut x428: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x427, &mut x428, x419, 0xbce6faad); + let mut x429: u32 = 0; + let mut x430: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x429, &mut x430, x419, 0xa7179e84); + let mut x431: u32 = 0; + let mut x432: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x431, &mut x432, x419, 0xf3b9cac2); + let mut x433: u32 = 0; + let mut x434: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x433, &mut x434, x419, 0xfc632551); + let mut x435: u32 = 0; + let mut x436: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x435, &mut x436, 0x0, x434, x431); + let mut x437: u32 = 0; + let mut x438: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x437, &mut x438, x436, x432, x429); + let mut x439: u32 = 0; + let mut x440: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x439, &mut x440, x438, x430, x427); + let mut x441: u32 = 0; + let mut x442: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x441, &mut x442, x440, x428, x425); + let mut x443: u32 = 0; + let mut x444: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x443, &mut x444, x442, x426, x423); + let x445: u32 = ((x444 as u32) + x424); + let mut x446: u32 = 0; + let mut x447: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x446, &mut x447, 0x0, x401, x433); + let mut x448: u32 = 0; + let mut x449: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x448, &mut x449, x447, x403, x435); + let mut x450: u32 = 0; + let mut x451: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x450, &mut x451, x449, x405, x437); + let mut x452: u32 = 0; + let mut x453: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x452, &mut x453, x451, x407, x439); + let mut x454: u32 = 0; + let mut x455: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x454, &mut x455, x453, x409, x441); + let mut x456: u32 = 0; + let mut x457: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x456, &mut x457, x455, x411, x443); + let mut x458: u32 = 0; + let mut x459: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x458, &mut x459, x457, x413, x445); + let mut x460: u32 = 0; + let mut x461: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x460, &mut x461, x459, x415, x421); + let mut x462: u32 = 0; + let mut x463: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x462, &mut x463, x461, x417, x422); + let x464: u32 = ((x463 as u32) + (x418 as u32)); + let mut x465: u32 = 0; + let mut x466: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x465, &mut x466, x5, (arg2[7])); + let mut x467: u32 = 0; + let mut x468: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x467, &mut x468, x5, (arg2[6])); + let mut x469: u32 = 0; + let mut x470: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x469, &mut x470, x5, (arg2[5])); + let mut x471: u32 = 0; + let mut x472: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x471, &mut x472, x5, (arg2[4])); + let mut x473: u32 = 0; + let mut x474: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x473, &mut x474, x5, (arg2[3])); + let mut x475: u32 = 0; + let mut x476: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x475, &mut x476, x5, (arg2[2])); + let mut x477: u32 = 0; + let mut x478: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x477, &mut x478, x5, (arg2[1])); + let mut x479: u32 = 0; + let mut x480: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x479, &mut x480, x5, (arg2[0])); + let mut x481: u32 = 0; + let mut x482: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x481, &mut x482, 0x0, x480, x477); + let mut x483: u32 = 0; + let mut x484: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x483, &mut x484, x482, x478, x475); + let mut x485: u32 = 0; + let mut x486: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x485, &mut x486, x484, x476, x473); + let mut x487: u32 = 0; + let mut x488: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x487, &mut x488, x486, x474, x471); + let mut x489: u32 = 0; + let mut x490: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x489, &mut x490, x488, x472, x469); + let mut x491: u32 = 0; + let mut x492: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x491, &mut x492, x490, x470, x467); + let mut x493: u32 = 0; + let mut x494: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x493, &mut x494, x492, x468, x465); + let x495: u32 = ((x494 as u32) + x466); + let mut x496: u32 = 0; + let mut x497: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x496, &mut x497, 0x0, x448, x479); + let mut x498: u32 = 0; + let mut x499: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x498, &mut x499, x497, x450, x481); + let mut x500: u32 = 0; + let mut x501: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x500, &mut x501, x499, x452, x483); + let mut x502: u32 = 0; + let mut x503: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x502, &mut x503, x501, x454, x485); + let mut x504: u32 = 0; + let mut x505: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x504, &mut x505, x503, x456, x487); + let mut x506: u32 = 0; + let mut x507: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x506, &mut x507, x505, x458, x489); + let mut x508: u32 = 0; + let mut x509: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x508, &mut x509, x507, x460, x491); + let mut x510: u32 = 0; + let mut x511: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x510, &mut x511, x509, x462, x493); + let mut x512: u32 = 0; + let mut x513: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x512, &mut x513, x511, x464, x495); + let mut x514: u32 = 0; + let mut x515: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x514, &mut x515, x496, 0xee00bc4f); + let mut x516: u32 = 0; + let mut x517: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x516, &mut x517, x514, 0xffffffff); + let mut x518: u32 = 0; + let mut x519: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x518, &mut x519, x514, 0xffffffff); + let mut x520: u32 = 0; + let mut x521: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x520, &mut x521, x514, 0xffffffff); + let mut x522: u32 = 0; + let mut x523: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x522, &mut x523, x514, 0xbce6faad); + let mut x524: u32 = 0; + let mut x525: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x524, &mut x525, x514, 0xa7179e84); + let mut x526: u32 = 0; + let mut x527: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x526, &mut x527, x514, 0xf3b9cac2); + let mut x528: u32 = 0; + let mut x529: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x528, &mut x529, x514, 0xfc632551); + let mut x530: u32 = 0; + let mut x531: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x530, &mut x531, 0x0, x529, x526); + let mut x532: u32 = 0; + let mut x533: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x532, &mut x533, x531, x527, x524); + let mut x534: u32 = 0; + let mut x535: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x534, &mut x535, x533, x525, x522); + let mut x536: u32 = 0; + let mut x537: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x536, &mut x537, x535, x523, x520); + let mut x538: u32 = 0; + let mut x539: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x538, &mut x539, x537, x521, x518); + let x540: u32 = ((x539 as u32) + x519); + let mut x541: u32 = 0; + let mut x542: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x541, &mut x542, 0x0, x496, x528); + let mut x543: u32 = 0; + let mut x544: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x543, &mut x544, x542, x498, x530); + let mut x545: u32 = 0; + let mut x546: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x545, &mut x546, x544, x500, x532); + let mut x547: u32 = 0; + let mut x548: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x547, &mut x548, x546, x502, x534); + let mut x549: u32 = 0; + let mut x550: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x549, &mut x550, x548, x504, x536); + let mut x551: u32 = 0; + let mut x552: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x551, &mut x552, x550, x506, x538); + let mut x553: u32 = 0; + let mut x554: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x553, &mut x554, x552, x508, x540); + let mut x555: u32 = 0; + let mut x556: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x555, &mut x556, x554, x510, x516); + let mut x557: u32 = 0; + let mut x558: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x557, &mut x558, x556, x512, x517); + let x559: u32 = ((x558 as u32) + (x513 as u32)); + let mut x560: u32 = 0; + let mut x561: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x560, &mut x561, x6, (arg2[7])); + let mut x562: u32 = 0; + let mut x563: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x562, &mut x563, x6, (arg2[6])); + let mut x564: u32 = 0; + let mut x565: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x564, &mut x565, x6, (arg2[5])); + let mut x566: u32 = 0; + let mut x567: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x566, &mut x567, x6, (arg2[4])); + let mut x568: u32 = 0; + let mut x569: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x568, &mut x569, x6, (arg2[3])); + let mut x570: u32 = 0; + let mut x571: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x570, &mut x571, x6, (arg2[2])); + let mut x572: u32 = 0; + let mut x573: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x572, &mut x573, x6, (arg2[1])); + let mut x574: u32 = 0; + let mut x575: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x574, &mut x575, x6, (arg2[0])); + let mut x576: u32 = 0; + let mut x577: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x576, &mut x577, 0x0, x575, x572); + let mut x578: u32 = 0; + let mut x579: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x578, &mut x579, x577, x573, x570); + let mut x580: u32 = 0; + let mut x581: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x580, &mut x581, x579, x571, x568); + let mut x582: u32 = 0; + let mut x583: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x582, &mut x583, x581, x569, x566); + let mut x584: u32 = 0; + let mut x585: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x584, &mut x585, x583, x567, x564); + let mut x586: u32 = 0; + let mut x587: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x586, &mut x587, x585, x565, x562); + let mut x588: u32 = 0; + let mut x589: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x588, &mut x589, x587, x563, x560); + let x590: u32 = ((x589 as u32) + x561); + let mut x591: u32 = 0; + let mut x592: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x591, &mut x592, 0x0, x543, x574); + let mut x593: u32 = 0; + let mut x594: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x593, &mut x594, x592, x545, x576); + let mut x595: u32 = 0; + let mut x596: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x595, &mut x596, x594, x547, x578); + let mut x597: u32 = 0; + let mut x598: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x597, &mut x598, x596, x549, x580); + let mut x599: u32 = 0; + let mut x600: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x599, &mut x600, x598, x551, x582); + let mut x601: u32 = 0; + let mut x602: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x601, &mut x602, x600, x553, x584); + let mut x603: u32 = 0; + let mut x604: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x603, &mut x604, x602, x555, x586); + let mut x605: u32 = 0; + let mut x606: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x605, &mut x606, x604, x557, x588); + let mut x607: u32 = 0; + let mut x608: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x607, &mut x608, x606, x559, x590); + let mut x609: u32 = 0; + let mut x610: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x609, &mut x610, x591, 0xee00bc4f); + let mut x611: u32 = 0; + let mut x612: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x611, &mut x612, x609, 0xffffffff); + let mut x613: u32 = 0; + let mut x614: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x613, &mut x614, x609, 0xffffffff); + let mut x615: u32 = 0; + let mut x616: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x615, &mut x616, x609, 0xffffffff); + let mut x617: u32 = 0; + let mut x618: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x617, &mut x618, x609, 0xbce6faad); + let mut x619: u32 = 0; + let mut x620: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x619, &mut x620, x609, 0xa7179e84); + let mut x621: u32 = 0; + let mut x622: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x621, &mut x622, x609, 0xf3b9cac2); + let mut x623: u32 = 0; + let mut x624: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x623, &mut x624, x609, 0xfc632551); + let mut x625: u32 = 0; + let mut x626: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x625, &mut x626, 0x0, x624, x621); + let mut x627: u32 = 0; + let mut x628: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x627, &mut x628, x626, x622, x619); + let mut x629: u32 = 0; + let mut x630: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x629, &mut x630, x628, x620, x617); + let mut x631: u32 = 0; + let mut x632: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x631, &mut x632, x630, x618, x615); + let mut x633: u32 = 0; + let mut x634: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x633, &mut x634, x632, x616, x613); + let x635: u32 = ((x634 as u32) + x614); + let mut x636: u32 = 0; + let mut x637: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x636, &mut x637, 0x0, x591, x623); + let mut x638: u32 = 0; + let mut x639: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x638, &mut x639, x637, x593, x625); + let mut x640: u32 = 0; + let mut x641: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x640, &mut x641, x639, x595, x627); + let mut x642: u32 = 0; + let mut x643: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x642, &mut x643, x641, x597, x629); + let mut x644: u32 = 0; + let mut x645: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x644, &mut x645, x643, x599, x631); + let mut x646: u32 = 0; + let mut x647: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x646, &mut x647, x645, x601, x633); + let mut x648: u32 = 0; + let mut x649: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x648, &mut x649, x647, x603, x635); + let mut x650: u32 = 0; + let mut x651: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x650, &mut x651, x649, x605, x611); + let mut x652: u32 = 0; + let mut x653: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x652, &mut x653, x651, x607, x612); + let x654: u32 = ((x653 as u32) + (x608 as u32)); + let mut x655: u32 = 0; + let mut x656: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x655, &mut x656, x7, (arg2[7])); + let mut x657: u32 = 0; + let mut x658: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x657, &mut x658, x7, (arg2[6])); + let mut x659: u32 = 0; + let mut x660: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x659, &mut x660, x7, (arg2[5])); + let mut x661: u32 = 0; + let mut x662: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x661, &mut x662, x7, (arg2[4])); + let mut x663: u32 = 0; + let mut x664: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x663, &mut x664, x7, (arg2[3])); + let mut x665: u32 = 0; + let mut x666: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x665, &mut x666, x7, (arg2[2])); + let mut x667: u32 = 0; + let mut x668: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x667, &mut x668, x7, (arg2[1])); + let mut x669: u32 = 0; + let mut x670: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x669, &mut x670, x7, (arg2[0])); + let mut x671: u32 = 0; + let mut x672: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x671, &mut x672, 0x0, x670, x667); + let mut x673: u32 = 0; + let mut x674: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x673, &mut x674, x672, x668, x665); + let mut x675: u32 = 0; + let mut x676: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x675, &mut x676, x674, x666, x663); + let mut x677: u32 = 0; + let mut x678: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x677, &mut x678, x676, x664, x661); + let mut x679: u32 = 0; + let mut x680: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x679, &mut x680, x678, x662, x659); + let mut x681: u32 = 0; + let mut x682: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x681, &mut x682, x680, x660, x657); + let mut x683: u32 = 0; + let mut x684: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x683, &mut x684, x682, x658, x655); + let x685: u32 = ((x684 as u32) + x656); + let mut x686: u32 = 0; + let mut x687: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x686, &mut x687, 0x0, x638, x669); + let mut x688: u32 = 0; + let mut x689: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x688, &mut x689, x687, x640, x671); + let mut x690: u32 = 0; + let mut x691: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x690, &mut x691, x689, x642, x673); + let mut x692: u32 = 0; + let mut x693: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x692, &mut x693, x691, x644, x675); + let mut x694: u32 = 0; + let mut x695: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x694, &mut x695, x693, x646, x677); + let mut x696: u32 = 0; + let mut x697: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x696, &mut x697, x695, x648, x679); + let mut x698: u32 = 0; + let mut x699: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x698, &mut x699, x697, x650, x681); + let mut x700: u32 = 0; + let mut x701: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x700, &mut x701, x699, x652, x683); + let mut x702: u32 = 0; + let mut x703: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x702, &mut x703, x701, x654, x685); + let mut x704: u32 = 0; + let mut x705: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x704, &mut x705, x686, 0xee00bc4f); + let mut x706: u32 = 0; + let mut x707: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x706, &mut x707, x704, 0xffffffff); + let mut x708: u32 = 0; + let mut x709: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x708, &mut x709, x704, 0xffffffff); + let mut x710: u32 = 0; + let mut x711: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x710, &mut x711, x704, 0xffffffff); + let mut x712: u32 = 0; + let mut x713: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x712, &mut x713, x704, 0xbce6faad); + let mut x714: u32 = 0; + let mut x715: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x714, &mut x715, x704, 0xa7179e84); + let mut x716: u32 = 0; + let mut x717: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x716, &mut x717, x704, 0xf3b9cac2); + let mut x718: u32 = 0; + let mut x719: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x718, &mut x719, x704, 0xfc632551); + let mut x720: u32 = 0; + let mut x721: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x720, &mut x721, 0x0, x719, x716); + let mut x722: u32 = 0; + let mut x723: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x722, &mut x723, x721, x717, x714); + let mut x724: u32 = 0; + let mut x725: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x724, &mut x725, x723, x715, x712); + let mut x726: u32 = 0; + let mut x727: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x726, &mut x727, x725, x713, x710); + let mut x728: u32 = 0; + let mut x729: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x728, &mut x729, x727, x711, x708); + let x730: u32 = ((x729 as u32) + x709); + let mut x731: u32 = 0; + let mut x732: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x731, &mut x732, 0x0, x686, x718); + let mut x733: u32 = 0; + let mut x734: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x733, &mut x734, x732, x688, x720); + let mut x735: u32 = 0; + let mut x736: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x735, &mut x736, x734, x690, x722); + let mut x737: u32 = 0; + let mut x738: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x737, &mut x738, x736, x692, x724); + let mut x739: u32 = 0; + let mut x740: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x739, &mut x740, x738, x694, x726); + let mut x741: u32 = 0; + let mut x742: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x741, &mut x742, x740, x696, x728); + let mut x743: u32 = 0; + let mut x744: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x743, &mut x744, x742, x698, x730); + let mut x745: u32 = 0; + let mut x746: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x745, &mut x746, x744, x700, x706); + let mut x747: u32 = 0; + let mut x748: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x747, &mut x748, x746, x702, x707); + let x749: u32 = ((x748 as u32) + (x703 as u32)); + let mut x750: u32 = 0; + let mut x751: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x750, &mut x751, 0x0, x733, 0xfc632551); + let mut x752: u32 = 0; + let mut x753: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x752, &mut x753, x751, x735, 0xf3b9cac2); + let mut x754: u32 = 0; + let mut x755: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x754, &mut x755, x753, x737, 0xa7179e84); + let mut x756: u32 = 0; + let mut x757: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x756, &mut x757, x755, x739, 0xbce6faad); + let mut x758: u32 = 0; + let mut x759: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x758, &mut x759, x757, x741, 0xffffffff); + let mut x760: u32 = 0; + let mut x761: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x760, &mut x761, x759, x743, 0xffffffff); + let mut x762: u32 = 0; + let mut x763: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x762, &mut x763, x761, x745, (0x0 as u32)); + let mut x764: u32 = 0; + let mut x765: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x764, &mut x765, x763, x747, 0xffffffff); + let mut x766: u32 = 0; + let mut x767: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x766, &mut x767, x765, x749, (0x0 as u32)); + let mut x768: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x768, x767, x750, x733); + let mut x769: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x769, x767, x752, x735); + let mut x770: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x770, x767, x754, x737); + let mut x771: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x771, x767, x756, x739); + let mut x772: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x772, x767, x758, x741); + let mut x773: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x773, x767, x760, x743); + let mut x774: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x774, x767, x762, x745); + let mut x775: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x775, x767, x764, x747); + out1[0] = x768; + out1[1] = x769; + out1[2] = x770; + out1[3] = x771; + out1[4] = x772; + out1[5] = x773; + out1[6] = x774; + out1[7] = x775; +} + +/// The function fiat_p256_scalar_square squares a field element in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg1)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p256_scalar_square(out1: &mut fiat_p256_scalar_montgomery_domain_field_element, arg1: &fiat_p256_scalar_montgomery_domain_field_element) -> () { + let x1: u32 = (arg1[1]); + let x2: u32 = (arg1[2]); + let x3: u32 = (arg1[3]); + let x4: u32 = (arg1[4]); + let x5: u32 = (arg1[5]); + let x6: u32 = (arg1[6]); + let x7: u32 = (arg1[7]); + let x8: u32 = (arg1[0]); + let mut x9: u32 = 0; + let mut x10: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x9, &mut x10, x8, (arg1[7])); + let mut x11: u32 = 0; + let mut x12: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x11, &mut x12, x8, (arg1[6])); + let mut x13: u32 = 0; + let mut x14: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x13, &mut x14, x8, (arg1[5])); + let mut x15: u32 = 0; + let mut x16: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x15, &mut x16, x8, (arg1[4])); + let mut x17: u32 = 0; + let mut x18: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x17, &mut x18, x8, (arg1[3])); + let mut x19: u32 = 0; + let mut x20: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x19, &mut x20, x8, (arg1[2])); + let mut x21: u32 = 0; + let mut x22: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x21, &mut x22, x8, (arg1[1])); + let mut x23: u32 = 0; + let mut x24: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x23, &mut x24, x8, (arg1[0])); + let mut x25: u32 = 0; + let mut x26: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x25, &mut x26, 0x0, x24, x21); + let mut x27: u32 = 0; + let mut x28: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x27, &mut x28, x26, x22, x19); + let mut x29: u32 = 0; + let mut x30: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x29, &mut x30, x28, x20, x17); + let mut x31: u32 = 0; + let mut x32: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x31, &mut x32, x30, x18, x15); + let mut x33: u32 = 0; + let mut x34: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x33, &mut x34, x32, x16, x13); + let mut x35: u32 = 0; + let mut x36: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x35, &mut x36, x34, x14, x11); + let mut x37: u32 = 0; + let mut x38: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x37, &mut x38, x36, x12, x9); + let x39: u32 = ((x38 as u32) + x10); + let mut x40: u32 = 0; + let mut x41: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x40, &mut x41, x23, 0xee00bc4f); + let mut x42: u32 = 0; + let mut x43: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x42, &mut x43, x40, 0xffffffff); + let mut x44: u32 = 0; + let mut x45: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x44, &mut x45, x40, 0xffffffff); + let mut x46: u32 = 0; + let mut x47: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x46, &mut x47, x40, 0xffffffff); + let mut x48: u32 = 0; + let mut x49: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x48, &mut x49, x40, 0xbce6faad); + let mut x50: u32 = 0; + let mut x51: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x50, &mut x51, x40, 0xa7179e84); + let mut x52: u32 = 0; + let mut x53: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x52, &mut x53, x40, 0xf3b9cac2); + let mut x54: u32 = 0; + let mut x55: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x54, &mut x55, x40, 0xfc632551); + let mut x56: u32 = 0; + let mut x57: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x56, &mut x57, 0x0, x55, x52); + let mut x58: u32 = 0; + let mut x59: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x58, &mut x59, x57, x53, x50); + let mut x60: u32 = 0; + let mut x61: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x60, &mut x61, x59, x51, x48); + let mut x62: u32 = 0; + let mut x63: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x62, &mut x63, x61, x49, x46); + let mut x64: u32 = 0; + let mut x65: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x64, &mut x65, x63, x47, x44); + let x66: u32 = ((x65 as u32) + x45); + let mut x67: u32 = 0; + let mut x68: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x67, &mut x68, 0x0, x23, x54); + let mut x69: u32 = 0; + let mut x70: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x69, &mut x70, x68, x25, x56); + let mut x71: u32 = 0; + let mut x72: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x71, &mut x72, x70, x27, x58); + let mut x73: u32 = 0; + let mut x74: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x73, &mut x74, x72, x29, x60); + let mut x75: u32 = 0; + let mut x76: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x75, &mut x76, x74, x31, x62); + let mut x77: u32 = 0; + let mut x78: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x77, &mut x78, x76, x33, x64); + let mut x79: u32 = 0; + let mut x80: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x79, &mut x80, x78, x35, x66); + let mut x81: u32 = 0; + let mut x82: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x81, &mut x82, x80, x37, x42); + let mut x83: u32 = 0; + let mut x84: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x83, &mut x84, x82, x39, x43); + let mut x85: u32 = 0; + let mut x86: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x85, &mut x86, x1, (arg1[7])); + let mut x87: u32 = 0; + let mut x88: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x87, &mut x88, x1, (arg1[6])); + let mut x89: u32 = 0; + let mut x90: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x89, &mut x90, x1, (arg1[5])); + let mut x91: u32 = 0; + let mut x92: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x91, &mut x92, x1, (arg1[4])); + let mut x93: u32 = 0; + let mut x94: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x93, &mut x94, x1, (arg1[3])); + let mut x95: u32 = 0; + let mut x96: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x95, &mut x96, x1, (arg1[2])); + let mut x97: u32 = 0; + let mut x98: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x97, &mut x98, x1, (arg1[1])); + let mut x99: u32 = 0; + let mut x100: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x99, &mut x100, x1, (arg1[0])); + let mut x101: u32 = 0; + let mut x102: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x101, &mut x102, 0x0, x100, x97); + let mut x103: u32 = 0; + let mut x104: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x103, &mut x104, x102, x98, x95); + let mut x105: u32 = 0; + let mut x106: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x105, &mut x106, x104, x96, x93); + let mut x107: u32 = 0; + let mut x108: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x107, &mut x108, x106, x94, x91); + let mut x109: u32 = 0; + let mut x110: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x109, &mut x110, x108, x92, x89); + let mut x111: u32 = 0; + let mut x112: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x111, &mut x112, x110, x90, x87); + let mut x113: u32 = 0; + let mut x114: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x113, &mut x114, x112, x88, x85); + let x115: u32 = ((x114 as u32) + x86); + let mut x116: u32 = 0; + let mut x117: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x116, &mut x117, 0x0, x69, x99); + let mut x118: u32 = 0; + let mut x119: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x118, &mut x119, x117, x71, x101); + let mut x120: u32 = 0; + let mut x121: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x120, &mut x121, x119, x73, x103); + let mut x122: u32 = 0; + let mut x123: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x122, &mut x123, x121, x75, x105); + let mut x124: u32 = 0; + let mut x125: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x124, &mut x125, x123, x77, x107); + let mut x126: u32 = 0; + let mut x127: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x126, &mut x127, x125, x79, x109); + let mut x128: u32 = 0; + let mut x129: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x128, &mut x129, x127, x81, x111); + let mut x130: u32 = 0; + let mut x131: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x130, &mut x131, x129, x83, x113); + let mut x132: u32 = 0; + let mut x133: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x132, &mut x133, x131, (x84 as u32), x115); + let mut x134: u32 = 0; + let mut x135: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x134, &mut x135, x116, 0xee00bc4f); + let mut x136: u32 = 0; + let mut x137: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x136, &mut x137, x134, 0xffffffff); + let mut x138: u32 = 0; + let mut x139: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x138, &mut x139, x134, 0xffffffff); + let mut x140: u32 = 0; + let mut x141: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x140, &mut x141, x134, 0xffffffff); + let mut x142: u32 = 0; + let mut x143: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x142, &mut x143, x134, 0xbce6faad); + let mut x144: u32 = 0; + let mut x145: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x144, &mut x145, x134, 0xa7179e84); + let mut x146: u32 = 0; + let mut x147: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x146, &mut x147, x134, 0xf3b9cac2); + let mut x148: u32 = 0; + let mut x149: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x148, &mut x149, x134, 0xfc632551); + let mut x150: u32 = 0; + let mut x151: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x150, &mut x151, 0x0, x149, x146); + let mut x152: u32 = 0; + let mut x153: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x152, &mut x153, x151, x147, x144); + let mut x154: u32 = 0; + let mut x155: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x154, &mut x155, x153, x145, x142); + let mut x156: u32 = 0; + let mut x157: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x156, &mut x157, x155, x143, x140); + let mut x158: u32 = 0; + let mut x159: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x158, &mut x159, x157, x141, x138); + let x160: u32 = ((x159 as u32) + x139); + let mut x161: u32 = 0; + let mut x162: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x161, &mut x162, 0x0, x116, x148); + let mut x163: u32 = 0; + let mut x164: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x163, &mut x164, x162, x118, x150); + let mut x165: u32 = 0; + let mut x166: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x165, &mut x166, x164, x120, x152); + let mut x167: u32 = 0; + let mut x168: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x167, &mut x168, x166, x122, x154); + let mut x169: u32 = 0; + let mut x170: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x169, &mut x170, x168, x124, x156); + let mut x171: u32 = 0; + let mut x172: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x171, &mut x172, x170, x126, x158); + let mut x173: u32 = 0; + let mut x174: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x173, &mut x174, x172, x128, x160); + let mut x175: u32 = 0; + let mut x176: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x175, &mut x176, x174, x130, x136); + let mut x177: u32 = 0; + let mut x178: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x177, &mut x178, x176, x132, x137); + let x179: u32 = ((x178 as u32) + (x133 as u32)); + let mut x180: u32 = 0; + let mut x181: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x180, &mut x181, x2, (arg1[7])); + let mut x182: u32 = 0; + let mut x183: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x182, &mut x183, x2, (arg1[6])); + let mut x184: u32 = 0; + let mut x185: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x184, &mut x185, x2, (arg1[5])); + let mut x186: u32 = 0; + let mut x187: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x186, &mut x187, x2, (arg1[4])); + let mut x188: u32 = 0; + let mut x189: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x188, &mut x189, x2, (arg1[3])); + let mut x190: u32 = 0; + let mut x191: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x190, &mut x191, x2, (arg1[2])); + let mut x192: u32 = 0; + let mut x193: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x192, &mut x193, x2, (arg1[1])); + let mut x194: u32 = 0; + let mut x195: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x194, &mut x195, x2, (arg1[0])); + let mut x196: u32 = 0; + let mut x197: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x196, &mut x197, 0x0, x195, x192); + let mut x198: u32 = 0; + let mut x199: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x198, &mut x199, x197, x193, x190); + let mut x200: u32 = 0; + let mut x201: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x200, &mut x201, x199, x191, x188); + let mut x202: u32 = 0; + let mut x203: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x202, &mut x203, x201, x189, x186); + let mut x204: u32 = 0; + let mut x205: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x204, &mut x205, x203, x187, x184); + let mut x206: u32 = 0; + let mut x207: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x206, &mut x207, x205, x185, x182); + let mut x208: u32 = 0; + let mut x209: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x208, &mut x209, x207, x183, x180); + let x210: u32 = ((x209 as u32) + x181); + let mut x211: u32 = 0; + let mut x212: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x211, &mut x212, 0x0, x163, x194); + let mut x213: u32 = 0; + let mut x214: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x213, &mut x214, x212, x165, x196); + let mut x215: u32 = 0; + let mut x216: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x215, &mut x216, x214, x167, x198); + let mut x217: u32 = 0; + let mut x218: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x217, &mut x218, x216, x169, x200); + let mut x219: u32 = 0; + let mut x220: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x219, &mut x220, x218, x171, x202); + let mut x221: u32 = 0; + let mut x222: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x221, &mut x222, x220, x173, x204); + let mut x223: u32 = 0; + let mut x224: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x223, &mut x224, x222, x175, x206); + let mut x225: u32 = 0; + let mut x226: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x225, &mut x226, x224, x177, x208); + let mut x227: u32 = 0; + let mut x228: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x227, &mut x228, x226, x179, x210); + let mut x229: u32 = 0; + let mut x230: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x229, &mut x230, x211, 0xee00bc4f); + let mut x231: u32 = 0; + let mut x232: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x231, &mut x232, x229, 0xffffffff); + let mut x233: u32 = 0; + let mut x234: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x233, &mut x234, x229, 0xffffffff); + let mut x235: u32 = 0; + let mut x236: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x235, &mut x236, x229, 0xffffffff); + let mut x237: u32 = 0; + let mut x238: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x237, &mut x238, x229, 0xbce6faad); + let mut x239: u32 = 0; + let mut x240: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x239, &mut x240, x229, 0xa7179e84); + let mut x241: u32 = 0; + let mut x242: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x241, &mut x242, x229, 0xf3b9cac2); + let mut x243: u32 = 0; + let mut x244: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x243, &mut x244, x229, 0xfc632551); + let mut x245: u32 = 0; + let mut x246: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x245, &mut x246, 0x0, x244, x241); + let mut x247: u32 = 0; + let mut x248: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x247, &mut x248, x246, x242, x239); + let mut x249: u32 = 0; + let mut x250: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x249, &mut x250, x248, x240, x237); + let mut x251: u32 = 0; + let mut x252: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x251, &mut x252, x250, x238, x235); + let mut x253: u32 = 0; + let mut x254: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x253, &mut x254, x252, x236, x233); + let x255: u32 = ((x254 as u32) + x234); + let mut x256: u32 = 0; + let mut x257: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x256, &mut x257, 0x0, x211, x243); + let mut x258: u32 = 0; + let mut x259: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x258, &mut x259, x257, x213, x245); + let mut x260: u32 = 0; + let mut x261: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x260, &mut x261, x259, x215, x247); + let mut x262: u32 = 0; + let mut x263: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x262, &mut x263, x261, x217, x249); + let mut x264: u32 = 0; + let mut x265: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x264, &mut x265, x263, x219, x251); + let mut x266: u32 = 0; + let mut x267: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x266, &mut x267, x265, x221, x253); + let mut x268: u32 = 0; + let mut x269: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x268, &mut x269, x267, x223, x255); + let mut x270: u32 = 0; + let mut x271: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x270, &mut x271, x269, x225, x231); + let mut x272: u32 = 0; + let mut x273: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x272, &mut x273, x271, x227, x232); + let x274: u32 = ((x273 as u32) + (x228 as u32)); + let mut x275: u32 = 0; + let mut x276: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x275, &mut x276, x3, (arg1[7])); + let mut x277: u32 = 0; + let mut x278: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x277, &mut x278, x3, (arg1[6])); + let mut x279: u32 = 0; + let mut x280: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x279, &mut x280, x3, (arg1[5])); + let mut x281: u32 = 0; + let mut x282: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x281, &mut x282, x3, (arg1[4])); + let mut x283: u32 = 0; + let mut x284: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x283, &mut x284, x3, (arg1[3])); + let mut x285: u32 = 0; + let mut x286: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x285, &mut x286, x3, (arg1[2])); + let mut x287: u32 = 0; + let mut x288: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x287, &mut x288, x3, (arg1[1])); + let mut x289: u32 = 0; + let mut x290: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x289, &mut x290, x3, (arg1[0])); + let mut x291: u32 = 0; + let mut x292: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x291, &mut x292, 0x0, x290, x287); + let mut x293: u32 = 0; + let mut x294: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x293, &mut x294, x292, x288, x285); + let mut x295: u32 = 0; + let mut x296: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x295, &mut x296, x294, x286, x283); + let mut x297: u32 = 0; + let mut x298: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x297, &mut x298, x296, x284, x281); + let mut x299: u32 = 0; + let mut x300: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x299, &mut x300, x298, x282, x279); + let mut x301: u32 = 0; + let mut x302: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x301, &mut x302, x300, x280, x277); + let mut x303: u32 = 0; + let mut x304: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x303, &mut x304, x302, x278, x275); + let x305: u32 = ((x304 as u32) + x276); + let mut x306: u32 = 0; + let mut x307: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x306, &mut x307, 0x0, x258, x289); + let mut x308: u32 = 0; + let mut x309: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x308, &mut x309, x307, x260, x291); + let mut x310: u32 = 0; + let mut x311: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x310, &mut x311, x309, x262, x293); + let mut x312: u32 = 0; + let mut x313: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x312, &mut x313, x311, x264, x295); + let mut x314: u32 = 0; + let mut x315: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x314, &mut x315, x313, x266, x297); + let mut x316: u32 = 0; + let mut x317: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x316, &mut x317, x315, x268, x299); + let mut x318: u32 = 0; + let mut x319: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x318, &mut x319, x317, x270, x301); + let mut x320: u32 = 0; + let mut x321: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x320, &mut x321, x319, x272, x303); + let mut x322: u32 = 0; + let mut x323: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x322, &mut x323, x321, x274, x305); + let mut x324: u32 = 0; + let mut x325: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x324, &mut x325, x306, 0xee00bc4f); + let mut x326: u32 = 0; + let mut x327: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x326, &mut x327, x324, 0xffffffff); + let mut x328: u32 = 0; + let mut x329: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x328, &mut x329, x324, 0xffffffff); + let mut x330: u32 = 0; + let mut x331: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x330, &mut x331, x324, 0xffffffff); + let mut x332: u32 = 0; + let mut x333: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x332, &mut x333, x324, 0xbce6faad); + let mut x334: u32 = 0; + let mut x335: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x334, &mut x335, x324, 0xa7179e84); + let mut x336: u32 = 0; + let mut x337: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x336, &mut x337, x324, 0xf3b9cac2); + let mut x338: u32 = 0; + let mut x339: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x338, &mut x339, x324, 0xfc632551); + let mut x340: u32 = 0; + let mut x341: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x340, &mut x341, 0x0, x339, x336); + let mut x342: u32 = 0; + let mut x343: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x342, &mut x343, x341, x337, x334); + let mut x344: u32 = 0; + let mut x345: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x344, &mut x345, x343, x335, x332); + let mut x346: u32 = 0; + let mut x347: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x346, &mut x347, x345, x333, x330); + let mut x348: u32 = 0; + let mut x349: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x348, &mut x349, x347, x331, x328); + let x350: u32 = ((x349 as u32) + x329); + let mut x351: u32 = 0; + let mut x352: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x351, &mut x352, 0x0, x306, x338); + let mut x353: u32 = 0; + let mut x354: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x353, &mut x354, x352, x308, x340); + let mut x355: u32 = 0; + let mut x356: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x355, &mut x356, x354, x310, x342); + let mut x357: u32 = 0; + let mut x358: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x357, &mut x358, x356, x312, x344); + let mut x359: u32 = 0; + let mut x360: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x359, &mut x360, x358, x314, x346); + let mut x361: u32 = 0; + let mut x362: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x361, &mut x362, x360, x316, x348); + let mut x363: u32 = 0; + let mut x364: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x363, &mut x364, x362, x318, x350); + let mut x365: u32 = 0; + let mut x366: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x365, &mut x366, x364, x320, x326); + let mut x367: u32 = 0; + let mut x368: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x367, &mut x368, x366, x322, x327); + let x369: u32 = ((x368 as u32) + (x323 as u32)); + let mut x370: u32 = 0; + let mut x371: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x370, &mut x371, x4, (arg1[7])); + let mut x372: u32 = 0; + let mut x373: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x372, &mut x373, x4, (arg1[6])); + let mut x374: u32 = 0; + let mut x375: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x374, &mut x375, x4, (arg1[5])); + let mut x376: u32 = 0; + let mut x377: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x376, &mut x377, x4, (arg1[4])); + let mut x378: u32 = 0; + let mut x379: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x378, &mut x379, x4, (arg1[3])); + let mut x380: u32 = 0; + let mut x381: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x380, &mut x381, x4, (arg1[2])); + let mut x382: u32 = 0; + let mut x383: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x382, &mut x383, x4, (arg1[1])); + let mut x384: u32 = 0; + let mut x385: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x384, &mut x385, x4, (arg1[0])); + let mut x386: u32 = 0; + let mut x387: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x386, &mut x387, 0x0, x385, x382); + let mut x388: u32 = 0; + let mut x389: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x388, &mut x389, x387, x383, x380); + let mut x390: u32 = 0; + let mut x391: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x390, &mut x391, x389, x381, x378); + let mut x392: u32 = 0; + let mut x393: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x392, &mut x393, x391, x379, x376); + let mut x394: u32 = 0; + let mut x395: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x394, &mut x395, x393, x377, x374); + let mut x396: u32 = 0; + let mut x397: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x396, &mut x397, x395, x375, x372); + let mut x398: u32 = 0; + let mut x399: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x398, &mut x399, x397, x373, x370); + let x400: u32 = ((x399 as u32) + x371); + let mut x401: u32 = 0; + let mut x402: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x401, &mut x402, 0x0, x353, x384); + let mut x403: u32 = 0; + let mut x404: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x403, &mut x404, x402, x355, x386); + let mut x405: u32 = 0; + let mut x406: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x405, &mut x406, x404, x357, x388); + let mut x407: u32 = 0; + let mut x408: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x407, &mut x408, x406, x359, x390); + let mut x409: u32 = 0; + let mut x410: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x409, &mut x410, x408, x361, x392); + let mut x411: u32 = 0; + let mut x412: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x411, &mut x412, x410, x363, x394); + let mut x413: u32 = 0; + let mut x414: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x413, &mut x414, x412, x365, x396); + let mut x415: u32 = 0; + let mut x416: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x415, &mut x416, x414, x367, x398); + let mut x417: u32 = 0; + let mut x418: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x417, &mut x418, x416, x369, x400); + let mut x419: u32 = 0; + let mut x420: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x419, &mut x420, x401, 0xee00bc4f); + let mut x421: u32 = 0; + let mut x422: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x421, &mut x422, x419, 0xffffffff); + let mut x423: u32 = 0; + let mut x424: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x423, &mut x424, x419, 0xffffffff); + let mut x425: u32 = 0; + let mut x426: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x425, &mut x426, x419, 0xffffffff); + let mut x427: u32 = 0; + let mut x428: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x427, &mut x428, x419, 0xbce6faad); + let mut x429: u32 = 0; + let mut x430: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x429, &mut x430, x419, 0xa7179e84); + let mut x431: u32 = 0; + let mut x432: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x431, &mut x432, x419, 0xf3b9cac2); + let mut x433: u32 = 0; + let mut x434: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x433, &mut x434, x419, 0xfc632551); + let mut x435: u32 = 0; + let mut x436: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x435, &mut x436, 0x0, x434, x431); + let mut x437: u32 = 0; + let mut x438: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x437, &mut x438, x436, x432, x429); + let mut x439: u32 = 0; + let mut x440: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x439, &mut x440, x438, x430, x427); + let mut x441: u32 = 0; + let mut x442: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x441, &mut x442, x440, x428, x425); + let mut x443: u32 = 0; + let mut x444: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x443, &mut x444, x442, x426, x423); + let x445: u32 = ((x444 as u32) + x424); + let mut x446: u32 = 0; + let mut x447: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x446, &mut x447, 0x0, x401, x433); + let mut x448: u32 = 0; + let mut x449: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x448, &mut x449, x447, x403, x435); + let mut x450: u32 = 0; + let mut x451: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x450, &mut x451, x449, x405, x437); + let mut x452: u32 = 0; + let mut x453: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x452, &mut x453, x451, x407, x439); + let mut x454: u32 = 0; + let mut x455: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x454, &mut x455, x453, x409, x441); + let mut x456: u32 = 0; + let mut x457: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x456, &mut x457, x455, x411, x443); + let mut x458: u32 = 0; + let mut x459: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x458, &mut x459, x457, x413, x445); + let mut x460: u32 = 0; + let mut x461: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x460, &mut x461, x459, x415, x421); + let mut x462: u32 = 0; + let mut x463: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x462, &mut x463, x461, x417, x422); + let x464: u32 = ((x463 as u32) + (x418 as u32)); + let mut x465: u32 = 0; + let mut x466: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x465, &mut x466, x5, (arg1[7])); + let mut x467: u32 = 0; + let mut x468: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x467, &mut x468, x5, (arg1[6])); + let mut x469: u32 = 0; + let mut x470: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x469, &mut x470, x5, (arg1[5])); + let mut x471: u32 = 0; + let mut x472: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x471, &mut x472, x5, (arg1[4])); + let mut x473: u32 = 0; + let mut x474: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x473, &mut x474, x5, (arg1[3])); + let mut x475: u32 = 0; + let mut x476: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x475, &mut x476, x5, (arg1[2])); + let mut x477: u32 = 0; + let mut x478: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x477, &mut x478, x5, (arg1[1])); + let mut x479: u32 = 0; + let mut x480: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x479, &mut x480, x5, (arg1[0])); + let mut x481: u32 = 0; + let mut x482: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x481, &mut x482, 0x0, x480, x477); + let mut x483: u32 = 0; + let mut x484: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x483, &mut x484, x482, x478, x475); + let mut x485: u32 = 0; + let mut x486: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x485, &mut x486, x484, x476, x473); + let mut x487: u32 = 0; + let mut x488: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x487, &mut x488, x486, x474, x471); + let mut x489: u32 = 0; + let mut x490: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x489, &mut x490, x488, x472, x469); + let mut x491: u32 = 0; + let mut x492: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x491, &mut x492, x490, x470, x467); + let mut x493: u32 = 0; + let mut x494: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x493, &mut x494, x492, x468, x465); + let x495: u32 = ((x494 as u32) + x466); + let mut x496: u32 = 0; + let mut x497: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x496, &mut x497, 0x0, x448, x479); + let mut x498: u32 = 0; + let mut x499: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x498, &mut x499, x497, x450, x481); + let mut x500: u32 = 0; + let mut x501: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x500, &mut x501, x499, x452, x483); + let mut x502: u32 = 0; + let mut x503: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x502, &mut x503, x501, x454, x485); + let mut x504: u32 = 0; + let mut x505: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x504, &mut x505, x503, x456, x487); + let mut x506: u32 = 0; + let mut x507: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x506, &mut x507, x505, x458, x489); + let mut x508: u32 = 0; + let mut x509: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x508, &mut x509, x507, x460, x491); + let mut x510: u32 = 0; + let mut x511: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x510, &mut x511, x509, x462, x493); + let mut x512: u32 = 0; + let mut x513: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x512, &mut x513, x511, x464, x495); + let mut x514: u32 = 0; + let mut x515: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x514, &mut x515, x496, 0xee00bc4f); + let mut x516: u32 = 0; + let mut x517: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x516, &mut x517, x514, 0xffffffff); + let mut x518: u32 = 0; + let mut x519: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x518, &mut x519, x514, 0xffffffff); + let mut x520: u32 = 0; + let mut x521: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x520, &mut x521, x514, 0xffffffff); + let mut x522: u32 = 0; + let mut x523: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x522, &mut x523, x514, 0xbce6faad); + let mut x524: u32 = 0; + let mut x525: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x524, &mut x525, x514, 0xa7179e84); + let mut x526: u32 = 0; + let mut x527: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x526, &mut x527, x514, 0xf3b9cac2); + let mut x528: u32 = 0; + let mut x529: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x528, &mut x529, x514, 0xfc632551); + let mut x530: u32 = 0; + let mut x531: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x530, &mut x531, 0x0, x529, x526); + let mut x532: u32 = 0; + let mut x533: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x532, &mut x533, x531, x527, x524); + let mut x534: u32 = 0; + let mut x535: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x534, &mut x535, x533, x525, x522); + let mut x536: u32 = 0; + let mut x537: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x536, &mut x537, x535, x523, x520); + let mut x538: u32 = 0; + let mut x539: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x538, &mut x539, x537, x521, x518); + let x540: u32 = ((x539 as u32) + x519); + let mut x541: u32 = 0; + let mut x542: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x541, &mut x542, 0x0, x496, x528); + let mut x543: u32 = 0; + let mut x544: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x543, &mut x544, x542, x498, x530); + let mut x545: u32 = 0; + let mut x546: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x545, &mut x546, x544, x500, x532); + let mut x547: u32 = 0; + let mut x548: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x547, &mut x548, x546, x502, x534); + let mut x549: u32 = 0; + let mut x550: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x549, &mut x550, x548, x504, x536); + let mut x551: u32 = 0; + let mut x552: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x551, &mut x552, x550, x506, x538); + let mut x553: u32 = 0; + let mut x554: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x553, &mut x554, x552, x508, x540); + let mut x555: u32 = 0; + let mut x556: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x555, &mut x556, x554, x510, x516); + let mut x557: u32 = 0; + let mut x558: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x557, &mut x558, x556, x512, x517); + let x559: u32 = ((x558 as u32) + (x513 as u32)); + let mut x560: u32 = 0; + let mut x561: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x560, &mut x561, x6, (arg1[7])); + let mut x562: u32 = 0; + let mut x563: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x562, &mut x563, x6, (arg1[6])); + let mut x564: u32 = 0; + let mut x565: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x564, &mut x565, x6, (arg1[5])); + let mut x566: u32 = 0; + let mut x567: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x566, &mut x567, x6, (arg1[4])); + let mut x568: u32 = 0; + let mut x569: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x568, &mut x569, x6, (arg1[3])); + let mut x570: u32 = 0; + let mut x571: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x570, &mut x571, x6, (arg1[2])); + let mut x572: u32 = 0; + let mut x573: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x572, &mut x573, x6, (arg1[1])); + let mut x574: u32 = 0; + let mut x575: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x574, &mut x575, x6, (arg1[0])); + let mut x576: u32 = 0; + let mut x577: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x576, &mut x577, 0x0, x575, x572); + let mut x578: u32 = 0; + let mut x579: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x578, &mut x579, x577, x573, x570); + let mut x580: u32 = 0; + let mut x581: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x580, &mut x581, x579, x571, x568); + let mut x582: u32 = 0; + let mut x583: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x582, &mut x583, x581, x569, x566); + let mut x584: u32 = 0; + let mut x585: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x584, &mut x585, x583, x567, x564); + let mut x586: u32 = 0; + let mut x587: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x586, &mut x587, x585, x565, x562); + let mut x588: u32 = 0; + let mut x589: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x588, &mut x589, x587, x563, x560); + let x590: u32 = ((x589 as u32) + x561); + let mut x591: u32 = 0; + let mut x592: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x591, &mut x592, 0x0, x543, x574); + let mut x593: u32 = 0; + let mut x594: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x593, &mut x594, x592, x545, x576); + let mut x595: u32 = 0; + let mut x596: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x595, &mut x596, x594, x547, x578); + let mut x597: u32 = 0; + let mut x598: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x597, &mut x598, x596, x549, x580); + let mut x599: u32 = 0; + let mut x600: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x599, &mut x600, x598, x551, x582); + let mut x601: u32 = 0; + let mut x602: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x601, &mut x602, x600, x553, x584); + let mut x603: u32 = 0; + let mut x604: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x603, &mut x604, x602, x555, x586); + let mut x605: u32 = 0; + let mut x606: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x605, &mut x606, x604, x557, x588); + let mut x607: u32 = 0; + let mut x608: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x607, &mut x608, x606, x559, x590); + let mut x609: u32 = 0; + let mut x610: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x609, &mut x610, x591, 0xee00bc4f); + let mut x611: u32 = 0; + let mut x612: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x611, &mut x612, x609, 0xffffffff); + let mut x613: u32 = 0; + let mut x614: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x613, &mut x614, x609, 0xffffffff); + let mut x615: u32 = 0; + let mut x616: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x615, &mut x616, x609, 0xffffffff); + let mut x617: u32 = 0; + let mut x618: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x617, &mut x618, x609, 0xbce6faad); + let mut x619: u32 = 0; + let mut x620: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x619, &mut x620, x609, 0xa7179e84); + let mut x621: u32 = 0; + let mut x622: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x621, &mut x622, x609, 0xf3b9cac2); + let mut x623: u32 = 0; + let mut x624: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x623, &mut x624, x609, 0xfc632551); + let mut x625: u32 = 0; + let mut x626: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x625, &mut x626, 0x0, x624, x621); + let mut x627: u32 = 0; + let mut x628: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x627, &mut x628, x626, x622, x619); + let mut x629: u32 = 0; + let mut x630: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x629, &mut x630, x628, x620, x617); + let mut x631: u32 = 0; + let mut x632: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x631, &mut x632, x630, x618, x615); + let mut x633: u32 = 0; + let mut x634: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x633, &mut x634, x632, x616, x613); + let x635: u32 = ((x634 as u32) + x614); + let mut x636: u32 = 0; + let mut x637: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x636, &mut x637, 0x0, x591, x623); + let mut x638: u32 = 0; + let mut x639: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x638, &mut x639, x637, x593, x625); + let mut x640: u32 = 0; + let mut x641: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x640, &mut x641, x639, x595, x627); + let mut x642: u32 = 0; + let mut x643: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x642, &mut x643, x641, x597, x629); + let mut x644: u32 = 0; + let mut x645: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x644, &mut x645, x643, x599, x631); + let mut x646: u32 = 0; + let mut x647: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x646, &mut x647, x645, x601, x633); + let mut x648: u32 = 0; + let mut x649: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x648, &mut x649, x647, x603, x635); + let mut x650: u32 = 0; + let mut x651: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x650, &mut x651, x649, x605, x611); + let mut x652: u32 = 0; + let mut x653: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x652, &mut x653, x651, x607, x612); + let x654: u32 = ((x653 as u32) + (x608 as u32)); + let mut x655: u32 = 0; + let mut x656: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x655, &mut x656, x7, (arg1[7])); + let mut x657: u32 = 0; + let mut x658: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x657, &mut x658, x7, (arg1[6])); + let mut x659: u32 = 0; + let mut x660: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x659, &mut x660, x7, (arg1[5])); + let mut x661: u32 = 0; + let mut x662: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x661, &mut x662, x7, (arg1[4])); + let mut x663: u32 = 0; + let mut x664: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x663, &mut x664, x7, (arg1[3])); + let mut x665: u32 = 0; + let mut x666: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x665, &mut x666, x7, (arg1[2])); + let mut x667: u32 = 0; + let mut x668: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x667, &mut x668, x7, (arg1[1])); + let mut x669: u32 = 0; + let mut x670: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x669, &mut x670, x7, (arg1[0])); + let mut x671: u32 = 0; + let mut x672: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x671, &mut x672, 0x0, x670, x667); + let mut x673: u32 = 0; + let mut x674: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x673, &mut x674, x672, x668, x665); + let mut x675: u32 = 0; + let mut x676: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x675, &mut x676, x674, x666, x663); + let mut x677: u32 = 0; + let mut x678: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x677, &mut x678, x676, x664, x661); + let mut x679: u32 = 0; + let mut x680: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x679, &mut x680, x678, x662, x659); + let mut x681: u32 = 0; + let mut x682: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x681, &mut x682, x680, x660, x657); + let mut x683: u32 = 0; + let mut x684: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x683, &mut x684, x682, x658, x655); + let x685: u32 = ((x684 as u32) + x656); + let mut x686: u32 = 0; + let mut x687: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x686, &mut x687, 0x0, x638, x669); + let mut x688: u32 = 0; + let mut x689: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x688, &mut x689, x687, x640, x671); + let mut x690: u32 = 0; + let mut x691: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x690, &mut x691, x689, x642, x673); + let mut x692: u32 = 0; + let mut x693: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x692, &mut x693, x691, x644, x675); + let mut x694: u32 = 0; + let mut x695: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x694, &mut x695, x693, x646, x677); + let mut x696: u32 = 0; + let mut x697: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x696, &mut x697, x695, x648, x679); + let mut x698: u32 = 0; + let mut x699: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x698, &mut x699, x697, x650, x681); + let mut x700: u32 = 0; + let mut x701: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x700, &mut x701, x699, x652, x683); + let mut x702: u32 = 0; + let mut x703: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x702, &mut x703, x701, x654, x685); + let mut x704: u32 = 0; + let mut x705: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x704, &mut x705, x686, 0xee00bc4f); + let mut x706: u32 = 0; + let mut x707: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x706, &mut x707, x704, 0xffffffff); + let mut x708: u32 = 0; + let mut x709: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x708, &mut x709, x704, 0xffffffff); + let mut x710: u32 = 0; + let mut x711: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x710, &mut x711, x704, 0xffffffff); + let mut x712: u32 = 0; + let mut x713: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x712, &mut x713, x704, 0xbce6faad); + let mut x714: u32 = 0; + let mut x715: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x714, &mut x715, x704, 0xa7179e84); + let mut x716: u32 = 0; + let mut x717: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x716, &mut x717, x704, 0xf3b9cac2); + let mut x718: u32 = 0; + let mut x719: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x718, &mut x719, x704, 0xfc632551); + let mut x720: u32 = 0; + let mut x721: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x720, &mut x721, 0x0, x719, x716); + let mut x722: u32 = 0; + let mut x723: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x722, &mut x723, x721, x717, x714); + let mut x724: u32 = 0; + let mut x725: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x724, &mut x725, x723, x715, x712); + let mut x726: u32 = 0; + let mut x727: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x726, &mut x727, x725, x713, x710); + let mut x728: u32 = 0; + let mut x729: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x728, &mut x729, x727, x711, x708); + let x730: u32 = ((x729 as u32) + x709); + let mut x731: u32 = 0; + let mut x732: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x731, &mut x732, 0x0, x686, x718); + let mut x733: u32 = 0; + let mut x734: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x733, &mut x734, x732, x688, x720); + let mut x735: u32 = 0; + let mut x736: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x735, &mut x736, x734, x690, x722); + let mut x737: u32 = 0; + let mut x738: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x737, &mut x738, x736, x692, x724); + let mut x739: u32 = 0; + let mut x740: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x739, &mut x740, x738, x694, x726); + let mut x741: u32 = 0; + let mut x742: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x741, &mut x742, x740, x696, x728); + let mut x743: u32 = 0; + let mut x744: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x743, &mut x744, x742, x698, x730); + let mut x745: u32 = 0; + let mut x746: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x745, &mut x746, x744, x700, x706); + let mut x747: u32 = 0; + let mut x748: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x747, &mut x748, x746, x702, x707); + let x749: u32 = ((x748 as u32) + (x703 as u32)); + let mut x750: u32 = 0; + let mut x751: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x750, &mut x751, 0x0, x733, 0xfc632551); + let mut x752: u32 = 0; + let mut x753: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x752, &mut x753, x751, x735, 0xf3b9cac2); + let mut x754: u32 = 0; + let mut x755: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x754, &mut x755, x753, x737, 0xa7179e84); + let mut x756: u32 = 0; + let mut x757: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x756, &mut x757, x755, x739, 0xbce6faad); + let mut x758: u32 = 0; + let mut x759: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x758, &mut x759, x757, x741, 0xffffffff); + let mut x760: u32 = 0; + let mut x761: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x760, &mut x761, x759, x743, 0xffffffff); + let mut x762: u32 = 0; + let mut x763: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x762, &mut x763, x761, x745, (0x0 as u32)); + let mut x764: u32 = 0; + let mut x765: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x764, &mut x765, x763, x747, 0xffffffff); + let mut x766: u32 = 0; + let mut x767: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x766, &mut x767, x765, x749, (0x0 as u32)); + let mut x768: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x768, x767, x750, x733); + let mut x769: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x769, x767, x752, x735); + let mut x770: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x770, x767, x754, x737); + let mut x771: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x771, x767, x756, x739); + let mut x772: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x772, x767, x758, x741); + let mut x773: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x773, x767, x760, x743); + let mut x774: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x774, x767, x762, x745); + let mut x775: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x775, x767, x764, x747); + out1[0] = x768; + out1[1] = x769; + out1[2] = x770; + out1[3] = x771; + out1[4] = x772; + out1[5] = x773; + out1[6] = x774; + out1[7] = x775; +} + +/// The function fiat_p256_scalar_add adds two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) + eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p256_scalar_add(out1: &mut fiat_p256_scalar_montgomery_domain_field_element, arg1: &fiat_p256_scalar_montgomery_domain_field_element, arg2: &fiat_p256_scalar_montgomery_domain_field_element) -> () { + let mut x1: u32 = 0; + let mut x2: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x1, &mut x2, 0x0, (arg1[0]), (arg2[0])); + let mut x3: u32 = 0; + let mut x4: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x3, &mut x4, x2, (arg1[1]), (arg2[1])); + let mut x5: u32 = 0; + let mut x6: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x5, &mut x6, x4, (arg1[2]), (arg2[2])); + let mut x7: u32 = 0; + let mut x8: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x7, &mut x8, x6, (arg1[3]), (arg2[3])); + let mut x9: u32 = 0; + let mut x10: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x9, &mut x10, x8, (arg1[4]), (arg2[4])); + let mut x11: u32 = 0; + let mut x12: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x11, &mut x12, x10, (arg1[5]), (arg2[5])); + let mut x13: u32 = 0; + let mut x14: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x13, &mut x14, x12, (arg1[6]), (arg2[6])); + let mut x15: u32 = 0; + let mut x16: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x15, &mut x16, x14, (arg1[7]), (arg2[7])); + let mut x17: u32 = 0; + let mut x18: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x17, &mut x18, 0x0, x1, 0xfc632551); + let mut x19: u32 = 0; + let mut x20: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x19, &mut x20, x18, x3, 0xf3b9cac2); + let mut x21: u32 = 0; + let mut x22: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x21, &mut x22, x20, x5, 0xa7179e84); + let mut x23: u32 = 0; + let mut x24: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x23, &mut x24, x22, x7, 0xbce6faad); + let mut x25: u32 = 0; + let mut x26: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x25, &mut x26, x24, x9, 0xffffffff); + let mut x27: u32 = 0; + let mut x28: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x27, &mut x28, x26, x11, 0xffffffff); + let mut x29: u32 = 0; + let mut x30: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x29, &mut x30, x28, x13, (0x0 as u32)); + let mut x31: u32 = 0; + let mut x32: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x31, &mut x32, x30, x15, 0xffffffff); + let mut x33: u32 = 0; + let mut x34: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x33, &mut x34, x32, (x16 as u32), (0x0 as u32)); + let mut x35: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x35, x34, x17, x1); + let mut x36: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x36, x34, x19, x3); + let mut x37: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x37, x34, x21, x5); + let mut x38: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x38, x34, x23, x7); + let mut x39: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x39, x34, x25, x9); + let mut x40: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x40, x34, x27, x11); + let mut x41: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x41, x34, x29, x13); + let mut x42: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x42, x34, x31, x15); + out1[0] = x35; + out1[1] = x36; + out1[2] = x37; + out1[3] = x38; + out1[4] = x39; + out1[5] = x40; + out1[6] = x41; + out1[7] = x42; +} + +/// The function fiat_p256_scalar_sub subtracts two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) - eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p256_scalar_sub(out1: &mut fiat_p256_scalar_montgomery_domain_field_element, arg1: &fiat_p256_scalar_montgomery_domain_field_element, arg2: &fiat_p256_scalar_montgomery_domain_field_element) -> () { + let mut x1: u32 = 0; + let mut x2: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x1, &mut x2, 0x0, (arg1[0]), (arg2[0])); + let mut x3: u32 = 0; + let mut x4: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x3, &mut x4, x2, (arg1[1]), (arg2[1])); + let mut x5: u32 = 0; + let mut x6: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x5, &mut x6, x4, (arg1[2]), (arg2[2])); + let mut x7: u32 = 0; + let mut x8: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x7, &mut x8, x6, (arg1[3]), (arg2[3])); + let mut x9: u32 = 0; + let mut x10: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x9, &mut x10, x8, (arg1[4]), (arg2[4])); + let mut x11: u32 = 0; + let mut x12: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x11, &mut x12, x10, (arg1[5]), (arg2[5])); + let mut x13: u32 = 0; + let mut x14: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x13, &mut x14, x12, (arg1[6]), (arg2[6])); + let mut x15: u32 = 0; + let mut x16: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x15, &mut x16, x14, (arg1[7]), (arg2[7])); + let mut x17: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x17, x16, (0x0 as u32), 0xffffffff); + let mut x18: u32 = 0; + let mut x19: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x18, &mut x19, 0x0, x1, (x17 & 0xfc632551)); + let mut x20: u32 = 0; + let mut x21: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x20, &mut x21, x19, x3, (x17 & 0xf3b9cac2)); + let mut x22: u32 = 0; + let mut x23: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x22, &mut x23, x21, x5, (x17 & 0xa7179e84)); + let mut x24: u32 = 0; + let mut x25: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x24, &mut x25, x23, x7, (x17 & 0xbce6faad)); + let mut x26: u32 = 0; + let mut x27: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x26, &mut x27, x25, x9, x17); + let mut x28: u32 = 0; + let mut x29: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x28, &mut x29, x27, x11, x17); + let mut x30: u32 = 0; + let mut x31: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x30, &mut x31, x29, x13, (0x0 as u32)); + let mut x32: u32 = 0; + let mut x33: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x32, &mut x33, x31, x15, x17); + out1[0] = x18; + out1[1] = x20; + out1[2] = x22; + out1[3] = x24; + out1[4] = x26; + out1[5] = x28; + out1[6] = x30; + out1[7] = x32; +} + +/// The function fiat_p256_scalar_opp negates a field element in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = -eval (from_montgomery arg1) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p256_scalar_opp(out1: &mut fiat_p256_scalar_montgomery_domain_field_element, arg1: &fiat_p256_scalar_montgomery_domain_field_element) -> () { + let mut x1: u32 = 0; + let mut x2: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x1, &mut x2, 0x0, (0x0 as u32), (arg1[0])); + let mut x3: u32 = 0; + let mut x4: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x3, &mut x4, x2, (0x0 as u32), (arg1[1])); + let mut x5: u32 = 0; + let mut x6: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x5, &mut x6, x4, (0x0 as u32), (arg1[2])); + let mut x7: u32 = 0; + let mut x8: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x7, &mut x8, x6, (0x0 as u32), (arg1[3])); + let mut x9: u32 = 0; + let mut x10: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x9, &mut x10, x8, (0x0 as u32), (arg1[4])); + let mut x11: u32 = 0; + let mut x12: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x11, &mut x12, x10, (0x0 as u32), (arg1[5])); + let mut x13: u32 = 0; + let mut x14: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x13, &mut x14, x12, (0x0 as u32), (arg1[6])); + let mut x15: u32 = 0; + let mut x16: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x15, &mut x16, x14, (0x0 as u32), (arg1[7])); + let mut x17: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x17, x16, (0x0 as u32), 0xffffffff); + let mut x18: u32 = 0; + let mut x19: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x18, &mut x19, 0x0, x1, (x17 & 0xfc632551)); + let mut x20: u32 = 0; + let mut x21: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x20, &mut x21, x19, x3, (x17 & 0xf3b9cac2)); + let mut x22: u32 = 0; + let mut x23: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x22, &mut x23, x21, x5, (x17 & 0xa7179e84)); + let mut x24: u32 = 0; + let mut x25: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x24, &mut x25, x23, x7, (x17 & 0xbce6faad)); + let mut x26: u32 = 0; + let mut x27: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x26, &mut x27, x25, x9, x17); + let mut x28: u32 = 0; + let mut x29: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x28, &mut x29, x27, x11, x17); + let mut x30: u32 = 0; + let mut x31: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x30, &mut x31, x29, x13, (0x0 as u32)); + let mut x32: u32 = 0; + let mut x33: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x32, &mut x33, x31, x15, x17); + out1[0] = x18; + out1[1] = x20; + out1[2] = x22; + out1[3] = x24; + out1[4] = x26; + out1[5] = x28; + out1[6] = x30; + out1[7] = x32; +} + +/// The function fiat_p256_scalar_from_montgomery translates a field element out of the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval out1 mod m = (eval arg1 * ((2^32)⁻¹ mod m)^8) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p256_scalar_from_montgomery(out1: &mut fiat_p256_scalar_non_montgomery_domain_field_element, arg1: &fiat_p256_scalar_montgomery_domain_field_element) -> () { + let x1: u32 = (arg1[0]); + let mut x2: u32 = 0; + let mut x3: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x2, &mut x3, x1, 0xee00bc4f); + let mut x4: u32 = 0; + let mut x5: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x4, &mut x5, x2, 0xffffffff); + let mut x6: u32 = 0; + let mut x7: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x6, &mut x7, x2, 0xffffffff); + let mut x8: u32 = 0; + let mut x9: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x8, &mut x9, x2, 0xffffffff); + let mut x10: u32 = 0; + let mut x11: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x10, &mut x11, x2, 0xbce6faad); + let mut x12: u32 = 0; + let mut x13: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x12, &mut x13, x2, 0xa7179e84); + let mut x14: u32 = 0; + let mut x15: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x14, &mut x15, x2, 0xf3b9cac2); + let mut x16: u32 = 0; + let mut x17: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x16, &mut x17, x2, 0xfc632551); + let mut x18: u32 = 0; + let mut x19: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x18, &mut x19, 0x0, x17, x14); + let mut x20: u32 = 0; + let mut x21: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x20, &mut x21, x19, x15, x12); + let mut x22: u32 = 0; + let mut x23: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x22, &mut x23, x21, x13, x10); + let mut x24: u32 = 0; + let mut x25: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x24, &mut x25, x23, x11, x8); + let mut x26: u32 = 0; + let mut x27: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x26, &mut x27, x25, x9, x6); + let mut x28: u32 = 0; + let mut x29: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x28, &mut x29, 0x0, x1, x16); + let mut x30: u32 = 0; + let mut x31: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x30, &mut x31, x29, (0x0 as u32), x18); + let mut x32: u32 = 0; + let mut x33: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x32, &mut x33, x31, (0x0 as u32), x20); + let mut x34: u32 = 0; + let mut x35: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x34, &mut x35, x33, (0x0 as u32), x22); + let mut x36: u32 = 0; + let mut x37: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x36, &mut x37, x35, (0x0 as u32), x24); + let mut x38: u32 = 0; + let mut x39: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x38, &mut x39, x37, (0x0 as u32), x26); + let mut x40: u32 = 0; + let mut x41: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x40, &mut x41, x39, (0x0 as u32), ((x27 as u32) + x7)); + let mut x42: u32 = 0; + let mut x43: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x42, &mut x43, x41, (0x0 as u32), x4); + let mut x44: u32 = 0; + let mut x45: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x44, &mut x45, 0x0, x30, (arg1[1])); + let mut x46: u32 = 0; + let mut x47: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x46, &mut x47, x45, x32, (0x0 as u32)); + let mut x48: u32 = 0; + let mut x49: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x48, &mut x49, x47, x34, (0x0 as u32)); + let mut x50: u32 = 0; + let mut x51: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x50, &mut x51, x49, x36, (0x0 as u32)); + let mut x52: u32 = 0; + let mut x53: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x52, &mut x53, x51, x38, (0x0 as u32)); + let mut x54: u32 = 0; + let mut x55: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x54, &mut x55, x53, x40, (0x0 as u32)); + let mut x56: u32 = 0; + let mut x57: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x56, &mut x57, x55, x42, (0x0 as u32)); + let mut x58: u32 = 0; + let mut x59: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x58, &mut x59, x57, ((x43 as u32) + x5), (0x0 as u32)); + let mut x60: u32 = 0; + let mut x61: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x60, &mut x61, x44, 0xee00bc4f); + let mut x62: u32 = 0; + let mut x63: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x62, &mut x63, x60, 0xffffffff); + let mut x64: u32 = 0; + let mut x65: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x64, &mut x65, x60, 0xffffffff); + let mut x66: u32 = 0; + let mut x67: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x66, &mut x67, x60, 0xffffffff); + let mut x68: u32 = 0; + let mut x69: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x68, &mut x69, x60, 0xbce6faad); + let mut x70: u32 = 0; + let mut x71: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x70, &mut x71, x60, 0xa7179e84); + let mut x72: u32 = 0; + let mut x73: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x72, &mut x73, x60, 0xf3b9cac2); + let mut x74: u32 = 0; + let mut x75: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x74, &mut x75, x60, 0xfc632551); + let mut x76: u32 = 0; + let mut x77: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x76, &mut x77, 0x0, x75, x72); + let mut x78: u32 = 0; + let mut x79: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x78, &mut x79, x77, x73, x70); + let mut x80: u32 = 0; + let mut x81: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x80, &mut x81, x79, x71, x68); + let mut x82: u32 = 0; + let mut x83: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x82, &mut x83, x81, x69, x66); + let mut x84: u32 = 0; + let mut x85: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x84, &mut x85, x83, x67, x64); + let mut x86: u32 = 0; + let mut x87: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x86, &mut x87, 0x0, x44, x74); + let mut x88: u32 = 0; + let mut x89: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x88, &mut x89, x87, x46, x76); + let mut x90: u32 = 0; + let mut x91: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x90, &mut x91, x89, x48, x78); + let mut x92: u32 = 0; + let mut x93: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x92, &mut x93, x91, x50, x80); + let mut x94: u32 = 0; + let mut x95: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x94, &mut x95, x93, x52, x82); + let mut x96: u32 = 0; + let mut x97: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x96, &mut x97, x95, x54, x84); + let mut x98: u32 = 0; + let mut x99: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x98, &mut x99, x97, x56, ((x85 as u32) + x65)); + let mut x100: u32 = 0; + let mut x101: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x100, &mut x101, x99, x58, x62); + let mut x102: u32 = 0; + let mut x103: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x102, &mut x103, x101, (x59 as u32), x63); + let mut x104: u32 = 0; + let mut x105: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x104, &mut x105, 0x0, x88, (arg1[2])); + let mut x106: u32 = 0; + let mut x107: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x106, &mut x107, x105, x90, (0x0 as u32)); + let mut x108: u32 = 0; + let mut x109: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x108, &mut x109, x107, x92, (0x0 as u32)); + let mut x110: u32 = 0; + let mut x111: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x110, &mut x111, x109, x94, (0x0 as u32)); + let mut x112: u32 = 0; + let mut x113: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x112, &mut x113, x111, x96, (0x0 as u32)); + let mut x114: u32 = 0; + let mut x115: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x114, &mut x115, x113, x98, (0x0 as u32)); + let mut x116: u32 = 0; + let mut x117: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x116, &mut x117, x115, x100, (0x0 as u32)); + let mut x118: u32 = 0; + let mut x119: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x118, &mut x119, x117, x102, (0x0 as u32)); + let mut x120: u32 = 0; + let mut x121: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x120, &mut x121, x104, 0xee00bc4f); + let mut x122: u32 = 0; + let mut x123: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x122, &mut x123, x120, 0xffffffff); + let mut x124: u32 = 0; + let mut x125: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x124, &mut x125, x120, 0xffffffff); + let mut x126: u32 = 0; + let mut x127: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x126, &mut x127, x120, 0xffffffff); + let mut x128: u32 = 0; + let mut x129: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x128, &mut x129, x120, 0xbce6faad); + let mut x130: u32 = 0; + let mut x131: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x130, &mut x131, x120, 0xa7179e84); + let mut x132: u32 = 0; + let mut x133: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x132, &mut x133, x120, 0xf3b9cac2); + let mut x134: u32 = 0; + let mut x135: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x134, &mut x135, x120, 0xfc632551); + let mut x136: u32 = 0; + let mut x137: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x136, &mut x137, 0x0, x135, x132); + let mut x138: u32 = 0; + let mut x139: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x138, &mut x139, x137, x133, x130); + let mut x140: u32 = 0; + let mut x141: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x140, &mut x141, x139, x131, x128); + let mut x142: u32 = 0; + let mut x143: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x142, &mut x143, x141, x129, x126); + let mut x144: u32 = 0; + let mut x145: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x144, &mut x145, x143, x127, x124); + let mut x146: u32 = 0; + let mut x147: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x146, &mut x147, 0x0, x104, x134); + let mut x148: u32 = 0; + let mut x149: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x148, &mut x149, x147, x106, x136); + let mut x150: u32 = 0; + let mut x151: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x150, &mut x151, x149, x108, x138); + let mut x152: u32 = 0; + let mut x153: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x152, &mut x153, x151, x110, x140); + let mut x154: u32 = 0; + let mut x155: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x154, &mut x155, x153, x112, x142); + let mut x156: u32 = 0; + let mut x157: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x156, &mut x157, x155, x114, x144); + let mut x158: u32 = 0; + let mut x159: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x158, &mut x159, x157, x116, ((x145 as u32) + x125)); + let mut x160: u32 = 0; + let mut x161: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x160, &mut x161, x159, x118, x122); + let mut x162: u32 = 0; + let mut x163: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x162, &mut x163, x161, ((x119 as u32) + (x103 as u32)), x123); + let mut x164: u32 = 0; + let mut x165: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x164, &mut x165, 0x0, x148, (arg1[3])); + let mut x166: u32 = 0; + let mut x167: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x166, &mut x167, x165, x150, (0x0 as u32)); + let mut x168: u32 = 0; + let mut x169: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x168, &mut x169, x167, x152, (0x0 as u32)); + let mut x170: u32 = 0; + let mut x171: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x170, &mut x171, x169, x154, (0x0 as u32)); + let mut x172: u32 = 0; + let mut x173: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x172, &mut x173, x171, x156, (0x0 as u32)); + let mut x174: u32 = 0; + let mut x175: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x174, &mut x175, x173, x158, (0x0 as u32)); + let mut x176: u32 = 0; + let mut x177: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x176, &mut x177, x175, x160, (0x0 as u32)); + let mut x178: u32 = 0; + let mut x179: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x178, &mut x179, x177, x162, (0x0 as u32)); + let mut x180: u32 = 0; + let mut x181: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x180, &mut x181, x164, 0xee00bc4f); + let mut x182: u32 = 0; + let mut x183: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x182, &mut x183, x180, 0xffffffff); + let mut x184: u32 = 0; + let mut x185: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x184, &mut x185, x180, 0xffffffff); + let mut x186: u32 = 0; + let mut x187: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x186, &mut x187, x180, 0xffffffff); + let mut x188: u32 = 0; + let mut x189: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x188, &mut x189, x180, 0xbce6faad); + let mut x190: u32 = 0; + let mut x191: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x190, &mut x191, x180, 0xa7179e84); + let mut x192: u32 = 0; + let mut x193: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x192, &mut x193, x180, 0xf3b9cac2); + let mut x194: u32 = 0; + let mut x195: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x194, &mut x195, x180, 0xfc632551); + let mut x196: u32 = 0; + let mut x197: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x196, &mut x197, 0x0, x195, x192); + let mut x198: u32 = 0; + let mut x199: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x198, &mut x199, x197, x193, x190); + let mut x200: u32 = 0; + let mut x201: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x200, &mut x201, x199, x191, x188); + let mut x202: u32 = 0; + let mut x203: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x202, &mut x203, x201, x189, x186); + let mut x204: u32 = 0; + let mut x205: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x204, &mut x205, x203, x187, x184); + let mut x206: u32 = 0; + let mut x207: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x206, &mut x207, 0x0, x164, x194); + let mut x208: u32 = 0; + let mut x209: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x208, &mut x209, x207, x166, x196); + let mut x210: u32 = 0; + let mut x211: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x210, &mut x211, x209, x168, x198); + let mut x212: u32 = 0; + let mut x213: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x212, &mut x213, x211, x170, x200); + let mut x214: u32 = 0; + let mut x215: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x214, &mut x215, x213, x172, x202); + let mut x216: u32 = 0; + let mut x217: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x216, &mut x217, x215, x174, x204); + let mut x218: u32 = 0; + let mut x219: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x218, &mut x219, x217, x176, ((x205 as u32) + x185)); + let mut x220: u32 = 0; + let mut x221: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x220, &mut x221, x219, x178, x182); + let mut x222: u32 = 0; + let mut x223: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x222, &mut x223, x221, ((x179 as u32) + (x163 as u32)), x183); + let mut x224: u32 = 0; + let mut x225: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x224, &mut x225, 0x0, x208, (arg1[4])); + let mut x226: u32 = 0; + let mut x227: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x226, &mut x227, x225, x210, (0x0 as u32)); + let mut x228: u32 = 0; + let mut x229: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x228, &mut x229, x227, x212, (0x0 as u32)); + let mut x230: u32 = 0; + let mut x231: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x230, &mut x231, x229, x214, (0x0 as u32)); + let mut x232: u32 = 0; + let mut x233: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x232, &mut x233, x231, x216, (0x0 as u32)); + let mut x234: u32 = 0; + let mut x235: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x234, &mut x235, x233, x218, (0x0 as u32)); + let mut x236: u32 = 0; + let mut x237: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x236, &mut x237, x235, x220, (0x0 as u32)); + let mut x238: u32 = 0; + let mut x239: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x238, &mut x239, x237, x222, (0x0 as u32)); + let mut x240: u32 = 0; + let mut x241: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x240, &mut x241, x224, 0xee00bc4f); + let mut x242: u32 = 0; + let mut x243: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x242, &mut x243, x240, 0xffffffff); + let mut x244: u32 = 0; + let mut x245: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x244, &mut x245, x240, 0xffffffff); + let mut x246: u32 = 0; + let mut x247: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x246, &mut x247, x240, 0xffffffff); + let mut x248: u32 = 0; + let mut x249: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x248, &mut x249, x240, 0xbce6faad); + let mut x250: u32 = 0; + let mut x251: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x250, &mut x251, x240, 0xa7179e84); + let mut x252: u32 = 0; + let mut x253: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x252, &mut x253, x240, 0xf3b9cac2); + let mut x254: u32 = 0; + let mut x255: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x254, &mut x255, x240, 0xfc632551); + let mut x256: u32 = 0; + let mut x257: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x256, &mut x257, 0x0, x255, x252); + let mut x258: u32 = 0; + let mut x259: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x258, &mut x259, x257, x253, x250); + let mut x260: u32 = 0; + let mut x261: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x260, &mut x261, x259, x251, x248); + let mut x262: u32 = 0; + let mut x263: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x262, &mut x263, x261, x249, x246); + let mut x264: u32 = 0; + let mut x265: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x264, &mut x265, x263, x247, x244); + let mut x266: u32 = 0; + let mut x267: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x266, &mut x267, 0x0, x224, x254); + let mut x268: u32 = 0; + let mut x269: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x268, &mut x269, x267, x226, x256); + let mut x270: u32 = 0; + let mut x271: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x270, &mut x271, x269, x228, x258); + let mut x272: u32 = 0; + let mut x273: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x272, &mut x273, x271, x230, x260); + let mut x274: u32 = 0; + let mut x275: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x274, &mut x275, x273, x232, x262); + let mut x276: u32 = 0; + let mut x277: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x276, &mut x277, x275, x234, x264); + let mut x278: u32 = 0; + let mut x279: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x278, &mut x279, x277, x236, ((x265 as u32) + x245)); + let mut x280: u32 = 0; + let mut x281: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x280, &mut x281, x279, x238, x242); + let mut x282: u32 = 0; + let mut x283: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x282, &mut x283, x281, ((x239 as u32) + (x223 as u32)), x243); + let mut x284: u32 = 0; + let mut x285: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x284, &mut x285, 0x0, x268, (arg1[5])); + let mut x286: u32 = 0; + let mut x287: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x286, &mut x287, x285, x270, (0x0 as u32)); + let mut x288: u32 = 0; + let mut x289: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x288, &mut x289, x287, x272, (0x0 as u32)); + let mut x290: u32 = 0; + let mut x291: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x290, &mut x291, x289, x274, (0x0 as u32)); + let mut x292: u32 = 0; + let mut x293: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x292, &mut x293, x291, x276, (0x0 as u32)); + let mut x294: u32 = 0; + let mut x295: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x294, &mut x295, x293, x278, (0x0 as u32)); + let mut x296: u32 = 0; + let mut x297: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x296, &mut x297, x295, x280, (0x0 as u32)); + let mut x298: u32 = 0; + let mut x299: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x298, &mut x299, x297, x282, (0x0 as u32)); + let mut x300: u32 = 0; + let mut x301: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x300, &mut x301, x284, 0xee00bc4f); + let mut x302: u32 = 0; + let mut x303: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x302, &mut x303, x300, 0xffffffff); + let mut x304: u32 = 0; + let mut x305: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x304, &mut x305, x300, 0xffffffff); + let mut x306: u32 = 0; + let mut x307: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x306, &mut x307, x300, 0xffffffff); + let mut x308: u32 = 0; + let mut x309: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x308, &mut x309, x300, 0xbce6faad); + let mut x310: u32 = 0; + let mut x311: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x310, &mut x311, x300, 0xa7179e84); + let mut x312: u32 = 0; + let mut x313: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x312, &mut x313, x300, 0xf3b9cac2); + let mut x314: u32 = 0; + let mut x315: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x314, &mut x315, x300, 0xfc632551); + let mut x316: u32 = 0; + let mut x317: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x316, &mut x317, 0x0, x315, x312); + let mut x318: u32 = 0; + let mut x319: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x318, &mut x319, x317, x313, x310); + let mut x320: u32 = 0; + let mut x321: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x320, &mut x321, x319, x311, x308); + let mut x322: u32 = 0; + let mut x323: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x322, &mut x323, x321, x309, x306); + let mut x324: u32 = 0; + let mut x325: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x324, &mut x325, x323, x307, x304); + let mut x326: u32 = 0; + let mut x327: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x326, &mut x327, 0x0, x284, x314); + let mut x328: u32 = 0; + let mut x329: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x328, &mut x329, x327, x286, x316); + let mut x330: u32 = 0; + let mut x331: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x330, &mut x331, x329, x288, x318); + let mut x332: u32 = 0; + let mut x333: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x332, &mut x333, x331, x290, x320); + let mut x334: u32 = 0; + let mut x335: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x334, &mut x335, x333, x292, x322); + let mut x336: u32 = 0; + let mut x337: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x336, &mut x337, x335, x294, x324); + let mut x338: u32 = 0; + let mut x339: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x338, &mut x339, x337, x296, ((x325 as u32) + x305)); + let mut x340: u32 = 0; + let mut x341: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x340, &mut x341, x339, x298, x302); + let mut x342: u32 = 0; + let mut x343: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x342, &mut x343, x341, ((x299 as u32) + (x283 as u32)), x303); + let mut x344: u32 = 0; + let mut x345: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x344, &mut x345, 0x0, x328, (arg1[6])); + let mut x346: u32 = 0; + let mut x347: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x346, &mut x347, x345, x330, (0x0 as u32)); + let mut x348: u32 = 0; + let mut x349: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x348, &mut x349, x347, x332, (0x0 as u32)); + let mut x350: u32 = 0; + let mut x351: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x350, &mut x351, x349, x334, (0x0 as u32)); + let mut x352: u32 = 0; + let mut x353: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x352, &mut x353, x351, x336, (0x0 as u32)); + let mut x354: u32 = 0; + let mut x355: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x354, &mut x355, x353, x338, (0x0 as u32)); + let mut x356: u32 = 0; + let mut x357: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x356, &mut x357, x355, x340, (0x0 as u32)); + let mut x358: u32 = 0; + let mut x359: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x358, &mut x359, x357, x342, (0x0 as u32)); + let mut x360: u32 = 0; + let mut x361: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x360, &mut x361, x344, 0xee00bc4f); + let mut x362: u32 = 0; + let mut x363: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x362, &mut x363, x360, 0xffffffff); + let mut x364: u32 = 0; + let mut x365: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x364, &mut x365, x360, 0xffffffff); + let mut x366: u32 = 0; + let mut x367: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x366, &mut x367, x360, 0xffffffff); + let mut x368: u32 = 0; + let mut x369: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x368, &mut x369, x360, 0xbce6faad); + let mut x370: u32 = 0; + let mut x371: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x370, &mut x371, x360, 0xa7179e84); + let mut x372: u32 = 0; + let mut x373: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x372, &mut x373, x360, 0xf3b9cac2); + let mut x374: u32 = 0; + let mut x375: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x374, &mut x375, x360, 0xfc632551); + let mut x376: u32 = 0; + let mut x377: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x376, &mut x377, 0x0, x375, x372); + let mut x378: u32 = 0; + let mut x379: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x378, &mut x379, x377, x373, x370); + let mut x380: u32 = 0; + let mut x381: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x380, &mut x381, x379, x371, x368); + let mut x382: u32 = 0; + let mut x383: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x382, &mut x383, x381, x369, x366); + let mut x384: u32 = 0; + let mut x385: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x384, &mut x385, x383, x367, x364); + let mut x386: u32 = 0; + let mut x387: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x386, &mut x387, 0x0, x344, x374); + let mut x388: u32 = 0; + let mut x389: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x388, &mut x389, x387, x346, x376); + let mut x390: u32 = 0; + let mut x391: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x390, &mut x391, x389, x348, x378); + let mut x392: u32 = 0; + let mut x393: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x392, &mut x393, x391, x350, x380); + let mut x394: u32 = 0; + let mut x395: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x394, &mut x395, x393, x352, x382); + let mut x396: u32 = 0; + let mut x397: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x396, &mut x397, x395, x354, x384); + let mut x398: u32 = 0; + let mut x399: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x398, &mut x399, x397, x356, ((x385 as u32) + x365)); + let mut x400: u32 = 0; + let mut x401: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x400, &mut x401, x399, x358, x362); + let mut x402: u32 = 0; + let mut x403: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x402, &mut x403, x401, ((x359 as u32) + (x343 as u32)), x363); + let mut x404: u32 = 0; + let mut x405: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x404, &mut x405, 0x0, x388, (arg1[7])); + let mut x406: u32 = 0; + let mut x407: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x406, &mut x407, x405, x390, (0x0 as u32)); + let mut x408: u32 = 0; + let mut x409: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x408, &mut x409, x407, x392, (0x0 as u32)); + let mut x410: u32 = 0; + let mut x411: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x410, &mut x411, x409, x394, (0x0 as u32)); + let mut x412: u32 = 0; + let mut x413: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x412, &mut x413, x411, x396, (0x0 as u32)); + let mut x414: u32 = 0; + let mut x415: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x414, &mut x415, x413, x398, (0x0 as u32)); + let mut x416: u32 = 0; + let mut x417: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x416, &mut x417, x415, x400, (0x0 as u32)); + let mut x418: u32 = 0; + let mut x419: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x418, &mut x419, x417, x402, (0x0 as u32)); + let mut x420: u32 = 0; + let mut x421: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x420, &mut x421, x404, 0xee00bc4f); + let mut x422: u32 = 0; + let mut x423: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x422, &mut x423, x420, 0xffffffff); + let mut x424: u32 = 0; + let mut x425: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x424, &mut x425, x420, 0xffffffff); + let mut x426: u32 = 0; + let mut x427: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x426, &mut x427, x420, 0xffffffff); + let mut x428: u32 = 0; + let mut x429: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x428, &mut x429, x420, 0xbce6faad); + let mut x430: u32 = 0; + let mut x431: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x430, &mut x431, x420, 0xa7179e84); + let mut x432: u32 = 0; + let mut x433: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x432, &mut x433, x420, 0xf3b9cac2); + let mut x434: u32 = 0; + let mut x435: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x434, &mut x435, x420, 0xfc632551); + let mut x436: u32 = 0; + let mut x437: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x436, &mut x437, 0x0, x435, x432); + let mut x438: u32 = 0; + let mut x439: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x438, &mut x439, x437, x433, x430); + let mut x440: u32 = 0; + let mut x441: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x440, &mut x441, x439, x431, x428); + let mut x442: u32 = 0; + let mut x443: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x442, &mut x443, x441, x429, x426); + let mut x444: u32 = 0; + let mut x445: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x444, &mut x445, x443, x427, x424); + let mut x446: u32 = 0; + let mut x447: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x446, &mut x447, 0x0, x404, x434); + let mut x448: u32 = 0; + let mut x449: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x448, &mut x449, x447, x406, x436); + let mut x450: u32 = 0; + let mut x451: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x450, &mut x451, x449, x408, x438); + let mut x452: u32 = 0; + let mut x453: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x452, &mut x453, x451, x410, x440); + let mut x454: u32 = 0; + let mut x455: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x454, &mut x455, x453, x412, x442); + let mut x456: u32 = 0; + let mut x457: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x456, &mut x457, x455, x414, x444); + let mut x458: u32 = 0; + let mut x459: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x458, &mut x459, x457, x416, ((x445 as u32) + x425)); + let mut x460: u32 = 0; + let mut x461: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x460, &mut x461, x459, x418, x422); + let mut x462: u32 = 0; + let mut x463: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x462, &mut x463, x461, ((x419 as u32) + (x403 as u32)), x423); + let mut x464: u32 = 0; + let mut x465: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x464, &mut x465, 0x0, x448, 0xfc632551); + let mut x466: u32 = 0; + let mut x467: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x466, &mut x467, x465, x450, 0xf3b9cac2); + let mut x468: u32 = 0; + let mut x469: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x468, &mut x469, x467, x452, 0xa7179e84); + let mut x470: u32 = 0; + let mut x471: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x470, &mut x471, x469, x454, 0xbce6faad); + let mut x472: u32 = 0; + let mut x473: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x472, &mut x473, x471, x456, 0xffffffff); + let mut x474: u32 = 0; + let mut x475: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x474, &mut x475, x473, x458, 0xffffffff); + let mut x476: u32 = 0; + let mut x477: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x476, &mut x477, x475, x460, (0x0 as u32)); + let mut x478: u32 = 0; + let mut x479: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x478, &mut x479, x477, x462, 0xffffffff); + let mut x480: u32 = 0; + let mut x481: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x480, &mut x481, x479, (x463 as u32), (0x0 as u32)); + let mut x482: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x482, x481, x464, x448); + let mut x483: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x483, x481, x466, x450); + let mut x484: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x484, x481, x468, x452); + let mut x485: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x485, x481, x470, x454); + let mut x486: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x486, x481, x472, x456); + let mut x487: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x487, x481, x474, x458); + let mut x488: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x488, x481, x476, x460); + let mut x489: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x489, x481, x478, x462); + out1[0] = x482; + out1[1] = x483; + out1[2] = x484; + out1[3] = x485; + out1[4] = x486; + out1[5] = x487; + out1[6] = x488; + out1[7] = x489; +} + +/// The function fiat_p256_scalar_to_montgomery translates a field element into the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = eval arg1 mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p256_scalar_to_montgomery(out1: &mut fiat_p256_scalar_montgomery_domain_field_element, arg1: &fiat_p256_scalar_non_montgomery_domain_field_element) -> () { + let x1: u32 = (arg1[1]); + let x2: u32 = (arg1[2]); + let x3: u32 = (arg1[3]); + let x4: u32 = (arg1[4]); + let x5: u32 = (arg1[5]); + let x6: u32 = (arg1[6]); + let x7: u32 = (arg1[7]); + let x8: u32 = (arg1[0]); + let mut x9: u32 = 0; + let mut x10: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x9, &mut x10, x8, 0x66e12d94); + let mut x11: u32 = 0; + let mut x12: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x11, &mut x12, x8, 0xf3d95620); + let mut x13: u32 = 0; + let mut x14: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x13, &mut x14, x8, 0x2845b239); + let mut x15: u32 = 0; + let mut x16: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x15, &mut x16, x8, 0x2b6bec59); + let mut x17: u32 = 0; + let mut x18: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x17, &mut x18, x8, 0x4699799c); + let mut x19: u32 = 0; + let mut x20: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x19, &mut x20, x8, 0x49bd6fa6); + let mut x21: u32 = 0; + let mut x22: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x21, &mut x22, x8, 0x83244c95); + let mut x23: u32 = 0; + let mut x24: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x23, &mut x24, x8, 0xbe79eea2); + let mut x25: u32 = 0; + let mut x26: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x25, &mut x26, 0x0, x24, x21); + let mut x27: u32 = 0; + let mut x28: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x27, &mut x28, x26, x22, x19); + let mut x29: u32 = 0; + let mut x30: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x29, &mut x30, x28, x20, x17); + let mut x31: u32 = 0; + let mut x32: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x31, &mut x32, x30, x18, x15); + let mut x33: u32 = 0; + let mut x34: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x33, &mut x34, x32, x16, x13); + let mut x35: u32 = 0; + let mut x36: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x35, &mut x36, x34, x14, x11); + let mut x37: u32 = 0; + let mut x38: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x37, &mut x38, x36, x12, x9); + let mut x39: u32 = 0; + let mut x40: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x39, &mut x40, x23, 0xee00bc4f); + let mut x41: u32 = 0; + let mut x42: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x41, &mut x42, x39, 0xffffffff); + let mut x43: u32 = 0; + let mut x44: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x43, &mut x44, x39, 0xffffffff); + let mut x45: u32 = 0; + let mut x46: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x45, &mut x46, x39, 0xffffffff); + let mut x47: u32 = 0; + let mut x48: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x47, &mut x48, x39, 0xbce6faad); + let mut x49: u32 = 0; + let mut x50: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x49, &mut x50, x39, 0xa7179e84); + let mut x51: u32 = 0; + let mut x52: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x51, &mut x52, x39, 0xf3b9cac2); + let mut x53: u32 = 0; + let mut x54: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x53, &mut x54, x39, 0xfc632551); + let mut x55: u32 = 0; + let mut x56: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x55, &mut x56, 0x0, x54, x51); + let mut x57: u32 = 0; + let mut x58: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x57, &mut x58, x56, x52, x49); + let mut x59: u32 = 0; + let mut x60: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x59, &mut x60, x58, x50, x47); + let mut x61: u32 = 0; + let mut x62: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x61, &mut x62, x60, x48, x45); + let mut x63: u32 = 0; + let mut x64: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x63, &mut x64, x62, x46, x43); + let mut x65: u32 = 0; + let mut x66: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x65, &mut x66, 0x0, x23, x53); + let mut x67: u32 = 0; + let mut x68: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x67, &mut x68, x66, x25, x55); + let mut x69: u32 = 0; + let mut x70: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x69, &mut x70, x68, x27, x57); + let mut x71: u32 = 0; + let mut x72: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x71, &mut x72, x70, x29, x59); + let mut x73: u32 = 0; + let mut x74: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x73, &mut x74, x72, x31, x61); + let mut x75: u32 = 0; + let mut x76: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x75, &mut x76, x74, x33, x63); + let mut x77: u32 = 0; + let mut x78: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x77, &mut x78, x76, x35, ((x64 as u32) + x44)); + let mut x79: u32 = 0; + let mut x80: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x79, &mut x80, x78, x37, x41); + let mut x81: u32 = 0; + let mut x82: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x81, &mut x82, x80, ((x38 as u32) + x10), x42); + let mut x83: u32 = 0; + let mut x84: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x83, &mut x84, x1, 0x66e12d94); + let mut x85: u32 = 0; + let mut x86: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x85, &mut x86, x1, 0xf3d95620); + let mut x87: u32 = 0; + let mut x88: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x87, &mut x88, x1, 0x2845b239); + let mut x89: u32 = 0; + let mut x90: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x89, &mut x90, x1, 0x2b6bec59); + let mut x91: u32 = 0; + let mut x92: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x91, &mut x92, x1, 0x4699799c); + let mut x93: u32 = 0; + let mut x94: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x93, &mut x94, x1, 0x49bd6fa6); + let mut x95: u32 = 0; + let mut x96: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x95, &mut x96, x1, 0x83244c95); + let mut x97: u32 = 0; + let mut x98: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x97, &mut x98, x1, 0xbe79eea2); + let mut x99: u32 = 0; + let mut x100: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x99, &mut x100, 0x0, x98, x95); + let mut x101: u32 = 0; + let mut x102: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x101, &mut x102, x100, x96, x93); + let mut x103: u32 = 0; + let mut x104: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x103, &mut x104, x102, x94, x91); + let mut x105: u32 = 0; + let mut x106: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x105, &mut x106, x104, x92, x89); + let mut x107: u32 = 0; + let mut x108: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x107, &mut x108, x106, x90, x87); + let mut x109: u32 = 0; + let mut x110: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x109, &mut x110, x108, x88, x85); + let mut x111: u32 = 0; + let mut x112: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x111, &mut x112, x110, x86, x83); + let mut x113: u32 = 0; + let mut x114: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x113, &mut x114, 0x0, x67, x97); + let mut x115: u32 = 0; + let mut x116: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x115, &mut x116, x114, x69, x99); + let mut x117: u32 = 0; + let mut x118: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x117, &mut x118, x116, x71, x101); + let mut x119: u32 = 0; + let mut x120: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x119, &mut x120, x118, x73, x103); + let mut x121: u32 = 0; + let mut x122: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x121, &mut x122, x120, x75, x105); + let mut x123: u32 = 0; + let mut x124: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x123, &mut x124, x122, x77, x107); + let mut x125: u32 = 0; + let mut x126: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x125, &mut x126, x124, x79, x109); + let mut x127: u32 = 0; + let mut x128: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x127, &mut x128, x126, x81, x111); + let mut x129: u32 = 0; + let mut x130: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x129, &mut x130, x113, 0xee00bc4f); + let mut x131: u32 = 0; + let mut x132: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x131, &mut x132, x129, 0xffffffff); + let mut x133: u32 = 0; + let mut x134: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x133, &mut x134, x129, 0xffffffff); + let mut x135: u32 = 0; + let mut x136: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x135, &mut x136, x129, 0xffffffff); + let mut x137: u32 = 0; + let mut x138: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x137, &mut x138, x129, 0xbce6faad); + let mut x139: u32 = 0; + let mut x140: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x139, &mut x140, x129, 0xa7179e84); + let mut x141: u32 = 0; + let mut x142: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x141, &mut x142, x129, 0xf3b9cac2); + let mut x143: u32 = 0; + let mut x144: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x143, &mut x144, x129, 0xfc632551); + let mut x145: u32 = 0; + let mut x146: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x145, &mut x146, 0x0, x144, x141); + let mut x147: u32 = 0; + let mut x148: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x147, &mut x148, x146, x142, x139); + let mut x149: u32 = 0; + let mut x150: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x149, &mut x150, x148, x140, x137); + let mut x151: u32 = 0; + let mut x152: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x151, &mut x152, x150, x138, x135); + let mut x153: u32 = 0; + let mut x154: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x153, &mut x154, x152, x136, x133); + let mut x155: u32 = 0; + let mut x156: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x155, &mut x156, 0x0, x113, x143); + let mut x157: u32 = 0; + let mut x158: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x157, &mut x158, x156, x115, x145); + let mut x159: u32 = 0; + let mut x160: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x159, &mut x160, x158, x117, x147); + let mut x161: u32 = 0; + let mut x162: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x161, &mut x162, x160, x119, x149); + let mut x163: u32 = 0; + let mut x164: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x163, &mut x164, x162, x121, x151); + let mut x165: u32 = 0; + let mut x166: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x165, &mut x166, x164, x123, x153); + let mut x167: u32 = 0; + let mut x168: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x167, &mut x168, x166, x125, ((x154 as u32) + x134)); + let mut x169: u32 = 0; + let mut x170: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x169, &mut x170, x168, x127, x131); + let mut x171: u32 = 0; + let mut x172: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x171, &mut x172, x170, (((x128 as u32) + (x82 as u32)) + ((x112 as u32) + x84)), x132); + let mut x173: u32 = 0; + let mut x174: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x173, &mut x174, x2, 0x66e12d94); + let mut x175: u32 = 0; + let mut x176: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x175, &mut x176, x2, 0xf3d95620); + let mut x177: u32 = 0; + let mut x178: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x177, &mut x178, x2, 0x2845b239); + let mut x179: u32 = 0; + let mut x180: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x179, &mut x180, x2, 0x2b6bec59); + let mut x181: u32 = 0; + let mut x182: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x181, &mut x182, x2, 0x4699799c); + let mut x183: u32 = 0; + let mut x184: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x183, &mut x184, x2, 0x49bd6fa6); + let mut x185: u32 = 0; + let mut x186: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x185, &mut x186, x2, 0x83244c95); + let mut x187: u32 = 0; + let mut x188: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x187, &mut x188, x2, 0xbe79eea2); + let mut x189: u32 = 0; + let mut x190: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x189, &mut x190, 0x0, x188, x185); + let mut x191: u32 = 0; + let mut x192: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x191, &mut x192, x190, x186, x183); + let mut x193: u32 = 0; + let mut x194: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x193, &mut x194, x192, x184, x181); + let mut x195: u32 = 0; + let mut x196: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x195, &mut x196, x194, x182, x179); + let mut x197: u32 = 0; + let mut x198: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x197, &mut x198, x196, x180, x177); + let mut x199: u32 = 0; + let mut x200: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x199, &mut x200, x198, x178, x175); + let mut x201: u32 = 0; + let mut x202: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x201, &mut x202, x200, x176, x173); + let mut x203: u32 = 0; + let mut x204: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x203, &mut x204, 0x0, x157, x187); + let mut x205: u32 = 0; + let mut x206: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x205, &mut x206, x204, x159, x189); + let mut x207: u32 = 0; + let mut x208: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x207, &mut x208, x206, x161, x191); + let mut x209: u32 = 0; + let mut x210: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x209, &mut x210, x208, x163, x193); + let mut x211: u32 = 0; + let mut x212: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x211, &mut x212, x210, x165, x195); + let mut x213: u32 = 0; + let mut x214: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x213, &mut x214, x212, x167, x197); + let mut x215: u32 = 0; + let mut x216: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x215, &mut x216, x214, x169, x199); + let mut x217: u32 = 0; + let mut x218: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x217, &mut x218, x216, x171, x201); + let mut x219: u32 = 0; + let mut x220: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x219, &mut x220, x203, 0xee00bc4f); + let mut x221: u32 = 0; + let mut x222: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x221, &mut x222, x219, 0xffffffff); + let mut x223: u32 = 0; + let mut x224: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x223, &mut x224, x219, 0xffffffff); + let mut x225: u32 = 0; + let mut x226: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x225, &mut x226, x219, 0xffffffff); + let mut x227: u32 = 0; + let mut x228: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x227, &mut x228, x219, 0xbce6faad); + let mut x229: u32 = 0; + let mut x230: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x229, &mut x230, x219, 0xa7179e84); + let mut x231: u32 = 0; + let mut x232: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x231, &mut x232, x219, 0xf3b9cac2); + let mut x233: u32 = 0; + let mut x234: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x233, &mut x234, x219, 0xfc632551); + let mut x235: u32 = 0; + let mut x236: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x235, &mut x236, 0x0, x234, x231); + let mut x237: u32 = 0; + let mut x238: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x237, &mut x238, x236, x232, x229); + let mut x239: u32 = 0; + let mut x240: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x239, &mut x240, x238, x230, x227); + let mut x241: u32 = 0; + let mut x242: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x241, &mut x242, x240, x228, x225); + let mut x243: u32 = 0; + let mut x244: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x243, &mut x244, x242, x226, x223); + let mut x245: u32 = 0; + let mut x246: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x245, &mut x246, 0x0, x203, x233); + let mut x247: u32 = 0; + let mut x248: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x247, &mut x248, x246, x205, x235); + let mut x249: u32 = 0; + let mut x250: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x249, &mut x250, x248, x207, x237); + let mut x251: u32 = 0; + let mut x252: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x251, &mut x252, x250, x209, x239); + let mut x253: u32 = 0; + let mut x254: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x253, &mut x254, x252, x211, x241); + let mut x255: u32 = 0; + let mut x256: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x255, &mut x256, x254, x213, x243); + let mut x257: u32 = 0; + let mut x258: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x257, &mut x258, x256, x215, ((x244 as u32) + x224)); + let mut x259: u32 = 0; + let mut x260: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x259, &mut x260, x258, x217, x221); + let mut x261: u32 = 0; + let mut x262: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x261, &mut x262, x260, (((x218 as u32) + (x172 as u32)) + ((x202 as u32) + x174)), x222); + let mut x263: u32 = 0; + let mut x264: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x263, &mut x264, x3, 0x66e12d94); + let mut x265: u32 = 0; + let mut x266: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x265, &mut x266, x3, 0xf3d95620); + let mut x267: u32 = 0; + let mut x268: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x267, &mut x268, x3, 0x2845b239); + let mut x269: u32 = 0; + let mut x270: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x269, &mut x270, x3, 0x2b6bec59); + let mut x271: u32 = 0; + let mut x272: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x271, &mut x272, x3, 0x4699799c); + let mut x273: u32 = 0; + let mut x274: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x273, &mut x274, x3, 0x49bd6fa6); + let mut x275: u32 = 0; + let mut x276: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x275, &mut x276, x3, 0x83244c95); + let mut x277: u32 = 0; + let mut x278: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x277, &mut x278, x3, 0xbe79eea2); + let mut x279: u32 = 0; + let mut x280: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x279, &mut x280, 0x0, x278, x275); + let mut x281: u32 = 0; + let mut x282: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x281, &mut x282, x280, x276, x273); + let mut x283: u32 = 0; + let mut x284: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x283, &mut x284, x282, x274, x271); + let mut x285: u32 = 0; + let mut x286: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x285, &mut x286, x284, x272, x269); + let mut x287: u32 = 0; + let mut x288: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x287, &mut x288, x286, x270, x267); + let mut x289: u32 = 0; + let mut x290: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x289, &mut x290, x288, x268, x265); + let mut x291: u32 = 0; + let mut x292: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x291, &mut x292, x290, x266, x263); + let mut x293: u32 = 0; + let mut x294: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x293, &mut x294, 0x0, x247, x277); + let mut x295: u32 = 0; + let mut x296: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x295, &mut x296, x294, x249, x279); + let mut x297: u32 = 0; + let mut x298: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x297, &mut x298, x296, x251, x281); + let mut x299: u32 = 0; + let mut x300: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x299, &mut x300, x298, x253, x283); + let mut x301: u32 = 0; + let mut x302: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x301, &mut x302, x300, x255, x285); + let mut x303: u32 = 0; + let mut x304: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x303, &mut x304, x302, x257, x287); + let mut x305: u32 = 0; + let mut x306: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x305, &mut x306, x304, x259, x289); + let mut x307: u32 = 0; + let mut x308: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x307, &mut x308, x306, x261, x291); + let mut x309: u32 = 0; + let mut x310: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x309, &mut x310, x293, 0xee00bc4f); + let mut x311: u32 = 0; + let mut x312: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x311, &mut x312, x309, 0xffffffff); + let mut x313: u32 = 0; + let mut x314: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x313, &mut x314, x309, 0xffffffff); + let mut x315: u32 = 0; + let mut x316: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x315, &mut x316, x309, 0xffffffff); + let mut x317: u32 = 0; + let mut x318: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x317, &mut x318, x309, 0xbce6faad); + let mut x319: u32 = 0; + let mut x320: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x319, &mut x320, x309, 0xa7179e84); + let mut x321: u32 = 0; + let mut x322: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x321, &mut x322, x309, 0xf3b9cac2); + let mut x323: u32 = 0; + let mut x324: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x323, &mut x324, x309, 0xfc632551); + let mut x325: u32 = 0; + let mut x326: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x325, &mut x326, 0x0, x324, x321); + let mut x327: u32 = 0; + let mut x328: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x327, &mut x328, x326, x322, x319); + let mut x329: u32 = 0; + let mut x330: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x329, &mut x330, x328, x320, x317); + let mut x331: u32 = 0; + let mut x332: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x331, &mut x332, x330, x318, x315); + let mut x333: u32 = 0; + let mut x334: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x333, &mut x334, x332, x316, x313); + let mut x335: u32 = 0; + let mut x336: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x335, &mut x336, 0x0, x293, x323); + let mut x337: u32 = 0; + let mut x338: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x337, &mut x338, x336, x295, x325); + let mut x339: u32 = 0; + let mut x340: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x339, &mut x340, x338, x297, x327); + let mut x341: u32 = 0; + let mut x342: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x341, &mut x342, x340, x299, x329); + let mut x343: u32 = 0; + let mut x344: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x343, &mut x344, x342, x301, x331); + let mut x345: u32 = 0; + let mut x346: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x345, &mut x346, x344, x303, x333); + let mut x347: u32 = 0; + let mut x348: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x347, &mut x348, x346, x305, ((x334 as u32) + x314)); + let mut x349: u32 = 0; + let mut x350: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x349, &mut x350, x348, x307, x311); + let mut x351: u32 = 0; + let mut x352: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x351, &mut x352, x350, (((x308 as u32) + (x262 as u32)) + ((x292 as u32) + x264)), x312); + let mut x353: u32 = 0; + let mut x354: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x353, &mut x354, x4, 0x66e12d94); + let mut x355: u32 = 0; + let mut x356: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x355, &mut x356, x4, 0xf3d95620); + let mut x357: u32 = 0; + let mut x358: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x357, &mut x358, x4, 0x2845b239); + let mut x359: u32 = 0; + let mut x360: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x359, &mut x360, x4, 0x2b6bec59); + let mut x361: u32 = 0; + let mut x362: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x361, &mut x362, x4, 0x4699799c); + let mut x363: u32 = 0; + let mut x364: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x363, &mut x364, x4, 0x49bd6fa6); + let mut x365: u32 = 0; + let mut x366: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x365, &mut x366, x4, 0x83244c95); + let mut x367: u32 = 0; + let mut x368: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x367, &mut x368, x4, 0xbe79eea2); + let mut x369: u32 = 0; + let mut x370: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x369, &mut x370, 0x0, x368, x365); + let mut x371: u32 = 0; + let mut x372: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x371, &mut x372, x370, x366, x363); + let mut x373: u32 = 0; + let mut x374: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x373, &mut x374, x372, x364, x361); + let mut x375: u32 = 0; + let mut x376: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x375, &mut x376, x374, x362, x359); + let mut x377: u32 = 0; + let mut x378: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x377, &mut x378, x376, x360, x357); + let mut x379: u32 = 0; + let mut x380: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x379, &mut x380, x378, x358, x355); + let mut x381: u32 = 0; + let mut x382: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x381, &mut x382, x380, x356, x353); + let mut x383: u32 = 0; + let mut x384: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x383, &mut x384, 0x0, x337, x367); + let mut x385: u32 = 0; + let mut x386: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x385, &mut x386, x384, x339, x369); + let mut x387: u32 = 0; + let mut x388: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x387, &mut x388, x386, x341, x371); + let mut x389: u32 = 0; + let mut x390: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x389, &mut x390, x388, x343, x373); + let mut x391: u32 = 0; + let mut x392: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x391, &mut x392, x390, x345, x375); + let mut x393: u32 = 0; + let mut x394: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x393, &mut x394, x392, x347, x377); + let mut x395: u32 = 0; + let mut x396: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x395, &mut x396, x394, x349, x379); + let mut x397: u32 = 0; + let mut x398: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x397, &mut x398, x396, x351, x381); + let mut x399: u32 = 0; + let mut x400: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x399, &mut x400, x383, 0xee00bc4f); + let mut x401: u32 = 0; + let mut x402: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x401, &mut x402, x399, 0xffffffff); + let mut x403: u32 = 0; + let mut x404: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x403, &mut x404, x399, 0xffffffff); + let mut x405: u32 = 0; + let mut x406: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x405, &mut x406, x399, 0xffffffff); + let mut x407: u32 = 0; + let mut x408: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x407, &mut x408, x399, 0xbce6faad); + let mut x409: u32 = 0; + let mut x410: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x409, &mut x410, x399, 0xa7179e84); + let mut x411: u32 = 0; + let mut x412: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x411, &mut x412, x399, 0xf3b9cac2); + let mut x413: u32 = 0; + let mut x414: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x413, &mut x414, x399, 0xfc632551); + let mut x415: u32 = 0; + let mut x416: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x415, &mut x416, 0x0, x414, x411); + let mut x417: u32 = 0; + let mut x418: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x417, &mut x418, x416, x412, x409); + let mut x419: u32 = 0; + let mut x420: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x419, &mut x420, x418, x410, x407); + let mut x421: u32 = 0; + let mut x422: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x421, &mut x422, x420, x408, x405); + let mut x423: u32 = 0; + let mut x424: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x423, &mut x424, x422, x406, x403); + let mut x425: u32 = 0; + let mut x426: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x425, &mut x426, 0x0, x383, x413); + let mut x427: u32 = 0; + let mut x428: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x427, &mut x428, x426, x385, x415); + let mut x429: u32 = 0; + let mut x430: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x429, &mut x430, x428, x387, x417); + let mut x431: u32 = 0; + let mut x432: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x431, &mut x432, x430, x389, x419); + let mut x433: u32 = 0; + let mut x434: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x433, &mut x434, x432, x391, x421); + let mut x435: u32 = 0; + let mut x436: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x435, &mut x436, x434, x393, x423); + let mut x437: u32 = 0; + let mut x438: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x437, &mut x438, x436, x395, ((x424 as u32) + x404)); + let mut x439: u32 = 0; + let mut x440: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x439, &mut x440, x438, x397, x401); + let mut x441: u32 = 0; + let mut x442: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x441, &mut x442, x440, (((x398 as u32) + (x352 as u32)) + ((x382 as u32) + x354)), x402); + let mut x443: u32 = 0; + let mut x444: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x443, &mut x444, x5, 0x66e12d94); + let mut x445: u32 = 0; + let mut x446: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x445, &mut x446, x5, 0xf3d95620); + let mut x447: u32 = 0; + let mut x448: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x447, &mut x448, x5, 0x2845b239); + let mut x449: u32 = 0; + let mut x450: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x449, &mut x450, x5, 0x2b6bec59); + let mut x451: u32 = 0; + let mut x452: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x451, &mut x452, x5, 0x4699799c); + let mut x453: u32 = 0; + let mut x454: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x453, &mut x454, x5, 0x49bd6fa6); + let mut x455: u32 = 0; + let mut x456: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x455, &mut x456, x5, 0x83244c95); + let mut x457: u32 = 0; + let mut x458: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x457, &mut x458, x5, 0xbe79eea2); + let mut x459: u32 = 0; + let mut x460: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x459, &mut x460, 0x0, x458, x455); + let mut x461: u32 = 0; + let mut x462: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x461, &mut x462, x460, x456, x453); + let mut x463: u32 = 0; + let mut x464: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x463, &mut x464, x462, x454, x451); + let mut x465: u32 = 0; + let mut x466: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x465, &mut x466, x464, x452, x449); + let mut x467: u32 = 0; + let mut x468: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x467, &mut x468, x466, x450, x447); + let mut x469: u32 = 0; + let mut x470: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x469, &mut x470, x468, x448, x445); + let mut x471: u32 = 0; + let mut x472: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x471, &mut x472, x470, x446, x443); + let mut x473: u32 = 0; + let mut x474: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x473, &mut x474, 0x0, x427, x457); + let mut x475: u32 = 0; + let mut x476: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x475, &mut x476, x474, x429, x459); + let mut x477: u32 = 0; + let mut x478: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x477, &mut x478, x476, x431, x461); + let mut x479: u32 = 0; + let mut x480: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x479, &mut x480, x478, x433, x463); + let mut x481: u32 = 0; + let mut x482: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x481, &mut x482, x480, x435, x465); + let mut x483: u32 = 0; + let mut x484: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x483, &mut x484, x482, x437, x467); + let mut x485: u32 = 0; + let mut x486: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x485, &mut x486, x484, x439, x469); + let mut x487: u32 = 0; + let mut x488: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x487, &mut x488, x486, x441, x471); + let mut x489: u32 = 0; + let mut x490: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x489, &mut x490, x473, 0xee00bc4f); + let mut x491: u32 = 0; + let mut x492: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x491, &mut x492, x489, 0xffffffff); + let mut x493: u32 = 0; + let mut x494: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x493, &mut x494, x489, 0xffffffff); + let mut x495: u32 = 0; + let mut x496: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x495, &mut x496, x489, 0xffffffff); + let mut x497: u32 = 0; + let mut x498: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x497, &mut x498, x489, 0xbce6faad); + let mut x499: u32 = 0; + let mut x500: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x499, &mut x500, x489, 0xa7179e84); + let mut x501: u32 = 0; + let mut x502: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x501, &mut x502, x489, 0xf3b9cac2); + let mut x503: u32 = 0; + let mut x504: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x503, &mut x504, x489, 0xfc632551); + let mut x505: u32 = 0; + let mut x506: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x505, &mut x506, 0x0, x504, x501); + let mut x507: u32 = 0; + let mut x508: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x507, &mut x508, x506, x502, x499); + let mut x509: u32 = 0; + let mut x510: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x509, &mut x510, x508, x500, x497); + let mut x511: u32 = 0; + let mut x512: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x511, &mut x512, x510, x498, x495); + let mut x513: u32 = 0; + let mut x514: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x513, &mut x514, x512, x496, x493); + let mut x515: u32 = 0; + let mut x516: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x515, &mut x516, 0x0, x473, x503); + let mut x517: u32 = 0; + let mut x518: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x517, &mut x518, x516, x475, x505); + let mut x519: u32 = 0; + let mut x520: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x519, &mut x520, x518, x477, x507); + let mut x521: u32 = 0; + let mut x522: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x521, &mut x522, x520, x479, x509); + let mut x523: u32 = 0; + let mut x524: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x523, &mut x524, x522, x481, x511); + let mut x525: u32 = 0; + let mut x526: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x525, &mut x526, x524, x483, x513); + let mut x527: u32 = 0; + let mut x528: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x527, &mut x528, x526, x485, ((x514 as u32) + x494)); + let mut x529: u32 = 0; + let mut x530: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x529, &mut x530, x528, x487, x491); + let mut x531: u32 = 0; + let mut x532: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x531, &mut x532, x530, (((x488 as u32) + (x442 as u32)) + ((x472 as u32) + x444)), x492); + let mut x533: u32 = 0; + let mut x534: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x533, &mut x534, x6, 0x66e12d94); + let mut x535: u32 = 0; + let mut x536: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x535, &mut x536, x6, 0xf3d95620); + let mut x537: u32 = 0; + let mut x538: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x537, &mut x538, x6, 0x2845b239); + let mut x539: u32 = 0; + let mut x540: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x539, &mut x540, x6, 0x2b6bec59); + let mut x541: u32 = 0; + let mut x542: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x541, &mut x542, x6, 0x4699799c); + let mut x543: u32 = 0; + let mut x544: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x543, &mut x544, x6, 0x49bd6fa6); + let mut x545: u32 = 0; + let mut x546: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x545, &mut x546, x6, 0x83244c95); + let mut x547: u32 = 0; + let mut x548: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x547, &mut x548, x6, 0xbe79eea2); + let mut x549: u32 = 0; + let mut x550: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x549, &mut x550, 0x0, x548, x545); + let mut x551: u32 = 0; + let mut x552: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x551, &mut x552, x550, x546, x543); + let mut x553: u32 = 0; + let mut x554: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x553, &mut x554, x552, x544, x541); + let mut x555: u32 = 0; + let mut x556: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x555, &mut x556, x554, x542, x539); + let mut x557: u32 = 0; + let mut x558: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x557, &mut x558, x556, x540, x537); + let mut x559: u32 = 0; + let mut x560: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x559, &mut x560, x558, x538, x535); + let mut x561: u32 = 0; + let mut x562: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x561, &mut x562, x560, x536, x533); + let mut x563: u32 = 0; + let mut x564: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x563, &mut x564, 0x0, x517, x547); + let mut x565: u32 = 0; + let mut x566: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x565, &mut x566, x564, x519, x549); + let mut x567: u32 = 0; + let mut x568: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x567, &mut x568, x566, x521, x551); + let mut x569: u32 = 0; + let mut x570: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x569, &mut x570, x568, x523, x553); + let mut x571: u32 = 0; + let mut x572: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x571, &mut x572, x570, x525, x555); + let mut x573: u32 = 0; + let mut x574: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x573, &mut x574, x572, x527, x557); + let mut x575: u32 = 0; + let mut x576: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x575, &mut x576, x574, x529, x559); + let mut x577: u32 = 0; + let mut x578: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x577, &mut x578, x576, x531, x561); + let mut x579: u32 = 0; + let mut x580: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x579, &mut x580, x563, 0xee00bc4f); + let mut x581: u32 = 0; + let mut x582: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x581, &mut x582, x579, 0xffffffff); + let mut x583: u32 = 0; + let mut x584: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x583, &mut x584, x579, 0xffffffff); + let mut x585: u32 = 0; + let mut x586: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x585, &mut x586, x579, 0xffffffff); + let mut x587: u32 = 0; + let mut x588: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x587, &mut x588, x579, 0xbce6faad); + let mut x589: u32 = 0; + let mut x590: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x589, &mut x590, x579, 0xa7179e84); + let mut x591: u32 = 0; + let mut x592: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x591, &mut x592, x579, 0xf3b9cac2); + let mut x593: u32 = 0; + let mut x594: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x593, &mut x594, x579, 0xfc632551); + let mut x595: u32 = 0; + let mut x596: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x595, &mut x596, 0x0, x594, x591); + let mut x597: u32 = 0; + let mut x598: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x597, &mut x598, x596, x592, x589); + let mut x599: u32 = 0; + let mut x600: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x599, &mut x600, x598, x590, x587); + let mut x601: u32 = 0; + let mut x602: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x601, &mut x602, x600, x588, x585); + let mut x603: u32 = 0; + let mut x604: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x603, &mut x604, x602, x586, x583); + let mut x605: u32 = 0; + let mut x606: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x605, &mut x606, 0x0, x563, x593); + let mut x607: u32 = 0; + let mut x608: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x607, &mut x608, x606, x565, x595); + let mut x609: u32 = 0; + let mut x610: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x609, &mut x610, x608, x567, x597); + let mut x611: u32 = 0; + let mut x612: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x611, &mut x612, x610, x569, x599); + let mut x613: u32 = 0; + let mut x614: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x613, &mut x614, x612, x571, x601); + let mut x615: u32 = 0; + let mut x616: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x615, &mut x616, x614, x573, x603); + let mut x617: u32 = 0; + let mut x618: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x617, &mut x618, x616, x575, ((x604 as u32) + x584)); + let mut x619: u32 = 0; + let mut x620: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x619, &mut x620, x618, x577, x581); + let mut x621: u32 = 0; + let mut x622: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x621, &mut x622, x620, (((x578 as u32) + (x532 as u32)) + ((x562 as u32) + x534)), x582); + let mut x623: u32 = 0; + let mut x624: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x623, &mut x624, x7, 0x66e12d94); + let mut x625: u32 = 0; + let mut x626: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x625, &mut x626, x7, 0xf3d95620); + let mut x627: u32 = 0; + let mut x628: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x627, &mut x628, x7, 0x2845b239); + let mut x629: u32 = 0; + let mut x630: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x629, &mut x630, x7, 0x2b6bec59); + let mut x631: u32 = 0; + let mut x632: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x631, &mut x632, x7, 0x4699799c); + let mut x633: u32 = 0; + let mut x634: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x633, &mut x634, x7, 0x49bd6fa6); + let mut x635: u32 = 0; + let mut x636: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x635, &mut x636, x7, 0x83244c95); + let mut x637: u32 = 0; + let mut x638: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x637, &mut x638, x7, 0xbe79eea2); + let mut x639: u32 = 0; + let mut x640: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x639, &mut x640, 0x0, x638, x635); + let mut x641: u32 = 0; + let mut x642: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x641, &mut x642, x640, x636, x633); + let mut x643: u32 = 0; + let mut x644: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x643, &mut x644, x642, x634, x631); + let mut x645: u32 = 0; + let mut x646: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x645, &mut x646, x644, x632, x629); + let mut x647: u32 = 0; + let mut x648: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x647, &mut x648, x646, x630, x627); + let mut x649: u32 = 0; + let mut x650: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x649, &mut x650, x648, x628, x625); + let mut x651: u32 = 0; + let mut x652: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x651, &mut x652, x650, x626, x623); + let mut x653: u32 = 0; + let mut x654: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x653, &mut x654, 0x0, x607, x637); + let mut x655: u32 = 0; + let mut x656: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x655, &mut x656, x654, x609, x639); + let mut x657: u32 = 0; + let mut x658: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x657, &mut x658, x656, x611, x641); + let mut x659: u32 = 0; + let mut x660: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x659, &mut x660, x658, x613, x643); + let mut x661: u32 = 0; + let mut x662: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x661, &mut x662, x660, x615, x645); + let mut x663: u32 = 0; + let mut x664: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x663, &mut x664, x662, x617, x647); + let mut x665: u32 = 0; + let mut x666: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x665, &mut x666, x664, x619, x649); + let mut x667: u32 = 0; + let mut x668: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x667, &mut x668, x666, x621, x651); + let mut x669: u32 = 0; + let mut x670: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x669, &mut x670, x653, 0xee00bc4f); + let mut x671: u32 = 0; + let mut x672: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x671, &mut x672, x669, 0xffffffff); + let mut x673: u32 = 0; + let mut x674: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x673, &mut x674, x669, 0xffffffff); + let mut x675: u32 = 0; + let mut x676: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x675, &mut x676, x669, 0xffffffff); + let mut x677: u32 = 0; + let mut x678: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x677, &mut x678, x669, 0xbce6faad); + let mut x679: u32 = 0; + let mut x680: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x679, &mut x680, x669, 0xa7179e84); + let mut x681: u32 = 0; + let mut x682: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x681, &mut x682, x669, 0xf3b9cac2); + let mut x683: u32 = 0; + let mut x684: u32 = 0; + fiat_p256_scalar_mulx_u32(&mut x683, &mut x684, x669, 0xfc632551); + let mut x685: u32 = 0; + let mut x686: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x685, &mut x686, 0x0, x684, x681); + let mut x687: u32 = 0; + let mut x688: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x687, &mut x688, x686, x682, x679); + let mut x689: u32 = 0; + let mut x690: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x689, &mut x690, x688, x680, x677); + let mut x691: u32 = 0; + let mut x692: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x691, &mut x692, x690, x678, x675); + let mut x693: u32 = 0; + let mut x694: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x693, &mut x694, x692, x676, x673); + let mut x695: u32 = 0; + let mut x696: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x695, &mut x696, 0x0, x653, x683); + let mut x697: u32 = 0; + let mut x698: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x697, &mut x698, x696, x655, x685); + let mut x699: u32 = 0; + let mut x700: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x699, &mut x700, x698, x657, x687); + let mut x701: u32 = 0; + let mut x702: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x701, &mut x702, x700, x659, x689); + let mut x703: u32 = 0; + let mut x704: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x703, &mut x704, x702, x661, x691); + let mut x705: u32 = 0; + let mut x706: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x705, &mut x706, x704, x663, x693); + let mut x707: u32 = 0; + let mut x708: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x707, &mut x708, x706, x665, ((x694 as u32) + x674)); + let mut x709: u32 = 0; + let mut x710: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x709, &mut x710, x708, x667, x671); + let mut x711: u32 = 0; + let mut x712: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x711, &mut x712, x710, (((x668 as u32) + (x622 as u32)) + ((x652 as u32) + x624)), x672); + let mut x713: u32 = 0; + let mut x714: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x713, &mut x714, 0x0, x697, 0xfc632551); + let mut x715: u32 = 0; + let mut x716: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x715, &mut x716, x714, x699, 0xf3b9cac2); + let mut x717: u32 = 0; + let mut x718: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x717, &mut x718, x716, x701, 0xa7179e84); + let mut x719: u32 = 0; + let mut x720: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x719, &mut x720, x718, x703, 0xbce6faad); + let mut x721: u32 = 0; + let mut x722: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x721, &mut x722, x720, x705, 0xffffffff); + let mut x723: u32 = 0; + let mut x724: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x723, &mut x724, x722, x707, 0xffffffff); + let mut x725: u32 = 0; + let mut x726: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x725, &mut x726, x724, x709, (0x0 as u32)); + let mut x727: u32 = 0; + let mut x728: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x727, &mut x728, x726, x711, 0xffffffff); + let mut x729: u32 = 0; + let mut x730: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x729, &mut x730, x728, (x712 as u32), (0x0 as u32)); + let mut x731: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x731, x730, x713, x697); + let mut x732: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x732, x730, x715, x699); + let mut x733: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x733, x730, x717, x701); + let mut x734: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x734, x730, x719, x703); + let mut x735: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x735, x730, x721, x705); + let mut x736: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x736, x730, x723, x707); + let mut x737: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x737, x730, x725, x709); + let mut x738: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x738, x730, x727, x711); + out1[0] = x731; + out1[1] = x732; + out1[2] = x733; + out1[3] = x734; + out1[4] = x735; + out1[5] = x736; + out1[6] = x737; + out1[7] = x738; +} + +/// The function fiat_p256_scalar_nonzero outputs a single non-zero word if the input is non-zero and zero otherwise. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// out1 = 0 ↔ eval (from_montgomery arg1) mod m = 0 +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +#[inline] +pub fn fiat_p256_scalar_nonzero(out1: &mut u32, arg1: &[u32; 8]) -> () { + let x1: u32 = ((arg1[0]) | ((arg1[1]) | ((arg1[2]) | ((arg1[3]) | ((arg1[4]) | ((arg1[5]) | ((arg1[6]) | (arg1[7])))))))); + *out1 = x1; +} + +/// The function fiat_p256_scalar_selectznz is a multi-limb conditional select. +/// +/// Postconditions: +/// out1 = (if arg1 = 0 then arg2 else arg3) +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// arg3: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +#[inline] +pub fn fiat_p256_scalar_selectznz(out1: &mut [u32; 8], arg1: fiat_p256_scalar_u1, arg2: &[u32; 8], arg3: &[u32; 8]) -> () { + let mut x1: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x1, arg1, (arg2[0]), (arg3[0])); + let mut x2: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x2, arg1, (arg2[1]), (arg3[1])); + let mut x3: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x3, arg1, (arg2[2]), (arg3[2])); + let mut x4: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x4, arg1, (arg2[3]), (arg3[3])); + let mut x5: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x5, arg1, (arg2[4]), (arg3[4])); + let mut x6: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x6, arg1, (arg2[5]), (arg3[5])); + let mut x7: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x7, arg1, (arg2[6]), (arg3[6])); + let mut x8: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x8, arg1, (arg2[7]), (arg3[7])); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; + out1[3] = x4; + out1[4] = x5; + out1[5] = x6; + out1[6] = x7; + out1[7] = x8; +} + +/// The function fiat_p256_scalar_to_bytes serializes a field element NOT in the Montgomery domain to bytes in little-endian order. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..31] +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] +#[inline] +pub fn fiat_p256_scalar_to_bytes(out1: &mut [u8; 32], arg1: &[u32; 8]) -> () { + let x1: u32 = (arg1[7]); + let x2: u32 = (arg1[6]); + let x3: u32 = (arg1[5]); + let x4: u32 = (arg1[4]); + let x5: u32 = (arg1[3]); + let x6: u32 = (arg1[2]); + let x7: u32 = (arg1[1]); + let x8: u32 = (arg1[0]); + let x9: u8 = ((x8 & (0xff as u32)) as u8); + let x10: u32 = (x8 >> 8); + let x11: u8 = ((x10 & (0xff as u32)) as u8); + let x12: u32 = (x10 >> 8); + let x13: u8 = ((x12 & (0xff as u32)) as u8); + let x14: u8 = ((x12 >> 8) as u8); + let x15: u8 = ((x7 & (0xff as u32)) as u8); + let x16: u32 = (x7 >> 8); + let x17: u8 = ((x16 & (0xff as u32)) as u8); + let x18: u32 = (x16 >> 8); + let x19: u8 = ((x18 & (0xff as u32)) as u8); + let x20: u8 = ((x18 >> 8) as u8); + let x21: u8 = ((x6 & (0xff as u32)) as u8); + let x22: u32 = (x6 >> 8); + let x23: u8 = ((x22 & (0xff as u32)) as u8); + let x24: u32 = (x22 >> 8); + let x25: u8 = ((x24 & (0xff as u32)) as u8); + let x26: u8 = ((x24 >> 8) as u8); + let x27: u8 = ((x5 & (0xff as u32)) as u8); + let x28: u32 = (x5 >> 8); + let x29: u8 = ((x28 & (0xff as u32)) as u8); + let x30: u32 = (x28 >> 8); + let x31: u8 = ((x30 & (0xff as u32)) as u8); + let x32: u8 = ((x30 >> 8) as u8); + let x33: u8 = ((x4 & (0xff as u32)) as u8); + let x34: u32 = (x4 >> 8); + let x35: u8 = ((x34 & (0xff as u32)) as u8); + let x36: u32 = (x34 >> 8); + let x37: u8 = ((x36 & (0xff as u32)) as u8); + let x38: u8 = ((x36 >> 8) as u8); + let x39: u8 = ((x3 & (0xff as u32)) as u8); + let x40: u32 = (x3 >> 8); + let x41: u8 = ((x40 & (0xff as u32)) as u8); + let x42: u32 = (x40 >> 8); + let x43: u8 = ((x42 & (0xff as u32)) as u8); + let x44: u8 = ((x42 >> 8) as u8); + let x45: u8 = ((x2 & (0xff as u32)) as u8); + let x46: u32 = (x2 >> 8); + let x47: u8 = ((x46 & (0xff as u32)) as u8); + let x48: u32 = (x46 >> 8); + let x49: u8 = ((x48 & (0xff as u32)) as u8); + let x50: u8 = ((x48 >> 8) as u8); + let x51: u8 = ((x1 & (0xff as u32)) as u8); + let x52: u32 = (x1 >> 8); + let x53: u8 = ((x52 & (0xff as u32)) as u8); + let x54: u32 = (x52 >> 8); + let x55: u8 = ((x54 & (0xff as u32)) as u8); + let x56: u8 = ((x54 >> 8) as u8); + out1[0] = x9; + out1[1] = x11; + out1[2] = x13; + out1[3] = x14; + out1[4] = x15; + out1[5] = x17; + out1[6] = x19; + out1[7] = x20; + out1[8] = x21; + out1[9] = x23; + out1[10] = x25; + out1[11] = x26; + out1[12] = x27; + out1[13] = x29; + out1[14] = x31; + out1[15] = x32; + out1[16] = x33; + out1[17] = x35; + out1[18] = x37; + out1[19] = x38; + out1[20] = x39; + out1[21] = x41; + out1[22] = x43; + out1[23] = x44; + out1[24] = x45; + out1[25] = x47; + out1[26] = x49; + out1[27] = x50; + out1[28] = x51; + out1[29] = x53; + out1[30] = x55; + out1[31] = x56; +} + +/// The function fiat_p256_scalar_from_bytes deserializes a field element NOT in the Montgomery domain from bytes in little-endian order. +/// +/// Preconditions: +/// 0 ≤ bytes_eval arg1 < m +/// Postconditions: +/// eval out1 mod m = bytes_eval arg1 mod m +/// 0 ≤ eval out1 < m +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +#[inline] +pub fn fiat_p256_scalar_from_bytes(out1: &mut [u32; 8], arg1: &[u8; 32]) -> () { + let x1: u32 = (((arg1[31]) as u32) << 24); + let x2: u32 = (((arg1[30]) as u32) << 16); + let x3: u32 = (((arg1[29]) as u32) << 8); + let x4: u8 = (arg1[28]); + let x5: u32 = (((arg1[27]) as u32) << 24); + let x6: u32 = (((arg1[26]) as u32) << 16); + let x7: u32 = (((arg1[25]) as u32) << 8); + let x8: u8 = (arg1[24]); + let x9: u32 = (((arg1[23]) as u32) << 24); + let x10: u32 = (((arg1[22]) as u32) << 16); + let x11: u32 = (((arg1[21]) as u32) << 8); + let x12: u8 = (arg1[20]); + let x13: u32 = (((arg1[19]) as u32) << 24); + let x14: u32 = (((arg1[18]) as u32) << 16); + let x15: u32 = (((arg1[17]) as u32) << 8); + let x16: u8 = (arg1[16]); + let x17: u32 = (((arg1[15]) as u32) << 24); + let x18: u32 = (((arg1[14]) as u32) << 16); + let x19: u32 = (((arg1[13]) as u32) << 8); + let x20: u8 = (arg1[12]); + let x21: u32 = (((arg1[11]) as u32) << 24); + let x22: u32 = (((arg1[10]) as u32) << 16); + let x23: u32 = (((arg1[9]) as u32) << 8); + let x24: u8 = (arg1[8]); + let x25: u32 = (((arg1[7]) as u32) << 24); + let x26: u32 = (((arg1[6]) as u32) << 16); + let x27: u32 = (((arg1[5]) as u32) << 8); + let x28: u8 = (arg1[4]); + let x29: u32 = (((arg1[3]) as u32) << 24); + let x30: u32 = (((arg1[2]) as u32) << 16); + let x31: u32 = (((arg1[1]) as u32) << 8); + let x32: u8 = (arg1[0]); + let x33: u32 = (x31 + (x32 as u32)); + let x34: u32 = (x30 + x33); + let x35: u32 = (x29 + x34); + let x36: u32 = (x27 + (x28 as u32)); + let x37: u32 = (x26 + x36); + let x38: u32 = (x25 + x37); + let x39: u32 = (x23 + (x24 as u32)); + let x40: u32 = (x22 + x39); + let x41: u32 = (x21 + x40); + let x42: u32 = (x19 + (x20 as u32)); + let x43: u32 = (x18 + x42); + let x44: u32 = (x17 + x43); + let x45: u32 = (x15 + (x16 as u32)); + let x46: u32 = (x14 + x45); + let x47: u32 = (x13 + x46); + let x48: u32 = (x11 + (x12 as u32)); + let x49: u32 = (x10 + x48); + let x50: u32 = (x9 + x49); + let x51: u32 = (x7 + (x8 as u32)); + let x52: u32 = (x6 + x51); + let x53: u32 = (x5 + x52); + let x54: u32 = (x3 + (x4 as u32)); + let x55: u32 = (x2 + x54); + let x56: u32 = (x1 + x55); + out1[0] = x35; + out1[1] = x38; + out1[2] = x41; + out1[3] = x44; + out1[4] = x47; + out1[5] = x50; + out1[6] = x53; + out1[7] = x56; +} + +/// The function fiat_p256_scalar_set_one returns the field element one in the Montgomery domain. +/// +/// Postconditions: +/// eval (from_montgomery out1) mod m = 1 mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p256_scalar_set_one(out1: &mut fiat_p256_scalar_montgomery_domain_field_element) -> () { + out1[0] = 0x39cdaaf; + out1[1] = 0xc46353d; + out1[2] = 0x58e8617b; + out1[3] = 0x43190552; + out1[4] = (0x0 as u32); + out1[5] = (0x0 as u32); + out1[6] = 0xffffffff; + out1[7] = (0x0 as u32); +} + +/// The function fiat_p256_scalar_msat returns the saturated representation of the prime modulus. +/// +/// Postconditions: +/// twos_complement_eval out1 = m +/// 0 ≤ eval out1 < m +/// +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +#[inline] +pub fn fiat_p256_scalar_msat(out1: &mut [u32; 9]) -> () { + out1[0] = 0xfc632551; + out1[1] = 0xf3b9cac2; + out1[2] = 0xa7179e84; + out1[3] = 0xbce6faad; + out1[4] = 0xffffffff; + out1[5] = 0xffffffff; + out1[6] = (0x0 as u32); + out1[7] = 0xffffffff; + out1[8] = (0x0 as u32); +} + +/// The function fiat_p256_scalar_divstep computes a divstep. +/// +/// Preconditions: +/// 0 ≤ eval arg4 < m +/// 0 ≤ eval arg5 < m +/// Postconditions: +/// out1 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then 1 - arg1 else 1 + arg1) +/// twos_complement_eval out2 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then twos_complement_eval arg3 else twos_complement_eval arg2) +/// twos_complement_eval out3 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then ⌊(twos_complement_eval arg3 - twos_complement_eval arg2) / 2⌋ else ⌊(twos_complement_eval arg3 + (twos_complement_eval arg3 mod 2) * twos_complement_eval arg2) / 2⌋) +/// eval (from_montgomery out4) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (2 * eval (from_montgomery arg5)) mod m else (2 * eval (from_montgomery arg4)) mod m) +/// eval (from_montgomery out5) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (eval (from_montgomery arg4) - eval (from_montgomery arg4)) mod m else (eval (from_montgomery arg5) + (twos_complement_eval arg3 mod 2) * eval (from_montgomery arg4)) mod m) +/// 0 ≤ eval out5 < m +/// 0 ≤ eval out5 < m +/// 0 ≤ eval out2 < m +/// 0 ≤ eval out3 < m +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0xffffffff] +/// arg2: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// arg3: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// arg4: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// arg5: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +/// out2: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// out3: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// out4: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// out5: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +#[inline] +pub fn fiat_p256_scalar_divstep(out1: &mut u32, out2: &mut [u32; 9], out3: &mut [u32; 9], out4: &mut [u32; 8], out5: &mut [u32; 8], arg1: u32, arg2: &[u32; 9], arg3: &[u32; 9], arg4: &[u32; 8], arg5: &[u32; 8]) -> () { + let mut x1: u32 = 0; + let mut x2: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x1, &mut x2, 0x0, (!arg1), (0x1 as u32)); + let x3: fiat_p256_scalar_u1 = (((x1 >> 31) as fiat_p256_scalar_u1) & (((arg3[0]) & (0x1 as u32)) as fiat_p256_scalar_u1)); + let mut x4: u32 = 0; + let mut x5: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x4, &mut x5, 0x0, (!arg1), (0x1 as u32)); + let mut x6: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x6, x3, arg1, x4); + let mut x7: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x7, x3, (arg2[0]), (arg3[0])); + let mut x8: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x8, x3, (arg2[1]), (arg3[1])); + let mut x9: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x9, x3, (arg2[2]), (arg3[2])); + let mut x10: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x10, x3, (arg2[3]), (arg3[3])); + let mut x11: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x11, x3, (arg2[4]), (arg3[4])); + let mut x12: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x12, x3, (arg2[5]), (arg3[5])); + let mut x13: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x13, x3, (arg2[6]), (arg3[6])); + let mut x14: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x14, x3, (arg2[7]), (arg3[7])); + let mut x15: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x15, x3, (arg2[8]), (arg3[8])); + let mut x16: u32 = 0; + let mut x17: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x16, &mut x17, 0x0, (0x1 as u32), (!(arg2[0]))); + let mut x18: u32 = 0; + let mut x19: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x18, &mut x19, x17, (0x0 as u32), (!(arg2[1]))); + let mut x20: u32 = 0; + let mut x21: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x20, &mut x21, x19, (0x0 as u32), (!(arg2[2]))); + let mut x22: u32 = 0; + let mut x23: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x22, &mut x23, x21, (0x0 as u32), (!(arg2[3]))); + let mut x24: u32 = 0; + let mut x25: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x24, &mut x25, x23, (0x0 as u32), (!(arg2[4]))); + let mut x26: u32 = 0; + let mut x27: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x26, &mut x27, x25, (0x0 as u32), (!(arg2[5]))); + let mut x28: u32 = 0; + let mut x29: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x28, &mut x29, x27, (0x0 as u32), (!(arg2[6]))); + let mut x30: u32 = 0; + let mut x31: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x30, &mut x31, x29, (0x0 as u32), (!(arg2[7]))); + let mut x32: u32 = 0; + let mut x33: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x32, &mut x33, x31, (0x0 as u32), (!(arg2[8]))); + let mut x34: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x34, x3, (arg3[0]), x16); + let mut x35: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x35, x3, (arg3[1]), x18); + let mut x36: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x36, x3, (arg3[2]), x20); + let mut x37: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x37, x3, (arg3[3]), x22); + let mut x38: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x38, x3, (arg3[4]), x24); + let mut x39: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x39, x3, (arg3[5]), x26); + let mut x40: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x40, x3, (arg3[6]), x28); + let mut x41: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x41, x3, (arg3[7]), x30); + let mut x42: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x42, x3, (arg3[8]), x32); + let mut x43: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x43, x3, (arg4[0]), (arg5[0])); + let mut x44: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x44, x3, (arg4[1]), (arg5[1])); + let mut x45: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x45, x3, (arg4[2]), (arg5[2])); + let mut x46: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x46, x3, (arg4[3]), (arg5[3])); + let mut x47: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x47, x3, (arg4[4]), (arg5[4])); + let mut x48: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x48, x3, (arg4[5]), (arg5[5])); + let mut x49: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x49, x3, (arg4[6]), (arg5[6])); + let mut x50: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x50, x3, (arg4[7]), (arg5[7])); + let mut x51: u32 = 0; + let mut x52: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x51, &mut x52, 0x0, x43, x43); + let mut x53: u32 = 0; + let mut x54: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x53, &mut x54, x52, x44, x44); + let mut x55: u32 = 0; + let mut x56: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x55, &mut x56, x54, x45, x45); + let mut x57: u32 = 0; + let mut x58: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x57, &mut x58, x56, x46, x46); + let mut x59: u32 = 0; + let mut x60: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x59, &mut x60, x58, x47, x47); + let mut x61: u32 = 0; + let mut x62: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x61, &mut x62, x60, x48, x48); + let mut x63: u32 = 0; + let mut x64: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x63, &mut x64, x62, x49, x49); + let mut x65: u32 = 0; + let mut x66: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x65, &mut x66, x64, x50, x50); + let mut x67: u32 = 0; + let mut x68: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x67, &mut x68, 0x0, x51, 0xfc632551); + let mut x69: u32 = 0; + let mut x70: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x69, &mut x70, x68, x53, 0xf3b9cac2); + let mut x71: u32 = 0; + let mut x72: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x71, &mut x72, x70, x55, 0xa7179e84); + let mut x73: u32 = 0; + let mut x74: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x73, &mut x74, x72, x57, 0xbce6faad); + let mut x75: u32 = 0; + let mut x76: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x75, &mut x76, x74, x59, 0xffffffff); + let mut x77: u32 = 0; + let mut x78: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x77, &mut x78, x76, x61, 0xffffffff); + let mut x79: u32 = 0; + let mut x80: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x79, &mut x80, x78, x63, (0x0 as u32)); + let mut x81: u32 = 0; + let mut x82: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x81, &mut x82, x80, x65, 0xffffffff); + let mut x83: u32 = 0; + let mut x84: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x83, &mut x84, x82, (x66 as u32), (0x0 as u32)); + let x85: u32 = (arg4[7]); + let x86: u32 = (arg4[6]); + let x87: u32 = (arg4[5]); + let x88: u32 = (arg4[4]); + let x89: u32 = (arg4[3]); + let x90: u32 = (arg4[2]); + let x91: u32 = (arg4[1]); + let x92: u32 = (arg4[0]); + let mut x93: u32 = 0; + let mut x94: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x93, &mut x94, 0x0, (0x0 as u32), x92); + let mut x95: u32 = 0; + let mut x96: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x95, &mut x96, x94, (0x0 as u32), x91); + let mut x97: u32 = 0; + let mut x98: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x97, &mut x98, x96, (0x0 as u32), x90); + let mut x99: u32 = 0; + let mut x100: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x99, &mut x100, x98, (0x0 as u32), x89); + let mut x101: u32 = 0; + let mut x102: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x101, &mut x102, x100, (0x0 as u32), x88); + let mut x103: u32 = 0; + let mut x104: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x103, &mut x104, x102, (0x0 as u32), x87); + let mut x105: u32 = 0; + let mut x106: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x105, &mut x106, x104, (0x0 as u32), x86); + let mut x107: u32 = 0; + let mut x108: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x107, &mut x108, x106, (0x0 as u32), x85); + let mut x109: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x109, x108, (0x0 as u32), 0xffffffff); + let mut x110: u32 = 0; + let mut x111: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x110, &mut x111, 0x0, x93, (x109 & 0xfc632551)); + let mut x112: u32 = 0; + let mut x113: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x112, &mut x113, x111, x95, (x109 & 0xf3b9cac2)); + let mut x114: u32 = 0; + let mut x115: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x114, &mut x115, x113, x97, (x109 & 0xa7179e84)); + let mut x116: u32 = 0; + let mut x117: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x116, &mut x117, x115, x99, (x109 & 0xbce6faad)); + let mut x118: u32 = 0; + let mut x119: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x118, &mut x119, x117, x101, x109); + let mut x120: u32 = 0; + let mut x121: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x120, &mut x121, x119, x103, x109); + let mut x122: u32 = 0; + let mut x123: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x122, &mut x123, x121, x105, (0x0 as u32)); + let mut x124: u32 = 0; + let mut x125: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x124, &mut x125, x123, x107, x109); + let mut x126: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x126, x3, (arg5[0]), x110); + let mut x127: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x127, x3, (arg5[1]), x112); + let mut x128: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x128, x3, (arg5[2]), x114); + let mut x129: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x129, x3, (arg5[3]), x116); + let mut x130: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x130, x3, (arg5[4]), x118); + let mut x131: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x131, x3, (arg5[5]), x120); + let mut x132: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x132, x3, (arg5[6]), x122); + let mut x133: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x133, x3, (arg5[7]), x124); + let x134: fiat_p256_scalar_u1 = ((x34 & (0x1 as u32)) as fiat_p256_scalar_u1); + let mut x135: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x135, x134, (0x0 as u32), x7); + let mut x136: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x136, x134, (0x0 as u32), x8); + let mut x137: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x137, x134, (0x0 as u32), x9); + let mut x138: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x138, x134, (0x0 as u32), x10); + let mut x139: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x139, x134, (0x0 as u32), x11); + let mut x140: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x140, x134, (0x0 as u32), x12); + let mut x141: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x141, x134, (0x0 as u32), x13); + let mut x142: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x142, x134, (0x0 as u32), x14); + let mut x143: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x143, x134, (0x0 as u32), x15); + let mut x144: u32 = 0; + let mut x145: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x144, &mut x145, 0x0, x34, x135); + let mut x146: u32 = 0; + let mut x147: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x146, &mut x147, x145, x35, x136); + let mut x148: u32 = 0; + let mut x149: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x148, &mut x149, x147, x36, x137); + let mut x150: u32 = 0; + let mut x151: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x150, &mut x151, x149, x37, x138); + let mut x152: u32 = 0; + let mut x153: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x152, &mut x153, x151, x38, x139); + let mut x154: u32 = 0; + let mut x155: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x154, &mut x155, x153, x39, x140); + let mut x156: u32 = 0; + let mut x157: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x156, &mut x157, x155, x40, x141); + let mut x158: u32 = 0; + let mut x159: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x158, &mut x159, x157, x41, x142); + let mut x160: u32 = 0; + let mut x161: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x160, &mut x161, x159, x42, x143); + let mut x162: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x162, x134, (0x0 as u32), x43); + let mut x163: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x163, x134, (0x0 as u32), x44); + let mut x164: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x164, x134, (0x0 as u32), x45); + let mut x165: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x165, x134, (0x0 as u32), x46); + let mut x166: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x166, x134, (0x0 as u32), x47); + let mut x167: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x167, x134, (0x0 as u32), x48); + let mut x168: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x168, x134, (0x0 as u32), x49); + let mut x169: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x169, x134, (0x0 as u32), x50); + let mut x170: u32 = 0; + let mut x171: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x170, &mut x171, 0x0, x126, x162); + let mut x172: u32 = 0; + let mut x173: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x172, &mut x173, x171, x127, x163); + let mut x174: u32 = 0; + let mut x175: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x174, &mut x175, x173, x128, x164); + let mut x176: u32 = 0; + let mut x177: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x176, &mut x177, x175, x129, x165); + let mut x178: u32 = 0; + let mut x179: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x178, &mut x179, x177, x130, x166); + let mut x180: u32 = 0; + let mut x181: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x180, &mut x181, x179, x131, x167); + let mut x182: u32 = 0; + let mut x183: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x182, &mut x183, x181, x132, x168); + let mut x184: u32 = 0; + let mut x185: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x184, &mut x185, x183, x133, x169); + let mut x186: u32 = 0; + let mut x187: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x186, &mut x187, 0x0, x170, 0xfc632551); + let mut x188: u32 = 0; + let mut x189: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x188, &mut x189, x187, x172, 0xf3b9cac2); + let mut x190: u32 = 0; + let mut x191: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x190, &mut x191, x189, x174, 0xa7179e84); + let mut x192: u32 = 0; + let mut x193: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x192, &mut x193, x191, x176, 0xbce6faad); + let mut x194: u32 = 0; + let mut x195: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x194, &mut x195, x193, x178, 0xffffffff); + let mut x196: u32 = 0; + let mut x197: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x196, &mut x197, x195, x180, 0xffffffff); + let mut x198: u32 = 0; + let mut x199: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x198, &mut x199, x197, x182, (0x0 as u32)); + let mut x200: u32 = 0; + let mut x201: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x200, &mut x201, x199, x184, 0xffffffff); + let mut x202: u32 = 0; + let mut x203: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u32(&mut x202, &mut x203, x201, (x185 as u32), (0x0 as u32)); + let mut x204: u32 = 0; + let mut x205: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u32(&mut x204, &mut x205, 0x0, x6, (0x1 as u32)); + let x206: u32 = ((x144 >> 1) | ((x146 << 31) & 0xffffffff)); + let x207: u32 = ((x146 >> 1) | ((x148 << 31) & 0xffffffff)); + let x208: u32 = ((x148 >> 1) | ((x150 << 31) & 0xffffffff)); + let x209: u32 = ((x150 >> 1) | ((x152 << 31) & 0xffffffff)); + let x210: u32 = ((x152 >> 1) | ((x154 << 31) & 0xffffffff)); + let x211: u32 = ((x154 >> 1) | ((x156 << 31) & 0xffffffff)); + let x212: u32 = ((x156 >> 1) | ((x158 << 31) & 0xffffffff)); + let x213: u32 = ((x158 >> 1) | ((x160 << 31) & 0xffffffff)); + let x214: u32 = ((x160 & 0x80000000) | (x160 >> 1)); + let mut x215: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x215, x84, x67, x51); + let mut x216: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x216, x84, x69, x53); + let mut x217: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x217, x84, x71, x55); + let mut x218: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x218, x84, x73, x57); + let mut x219: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x219, x84, x75, x59); + let mut x220: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x220, x84, x77, x61); + let mut x221: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x221, x84, x79, x63); + let mut x222: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x222, x84, x81, x65); + let mut x223: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x223, x203, x186, x170); + let mut x224: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x224, x203, x188, x172); + let mut x225: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x225, x203, x190, x174); + let mut x226: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x226, x203, x192, x176); + let mut x227: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x227, x203, x194, x178); + let mut x228: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x228, x203, x196, x180); + let mut x229: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x229, x203, x198, x182); + let mut x230: u32 = 0; + fiat_p256_scalar_cmovznz_u32(&mut x230, x203, x200, x184); + *out1 = x204; + out2[0] = x7; + out2[1] = x8; + out2[2] = x9; + out2[3] = x10; + out2[4] = x11; + out2[5] = x12; + out2[6] = x13; + out2[7] = x14; + out2[8] = x15; + out3[0] = x206; + out3[1] = x207; + out3[2] = x208; + out3[3] = x209; + out3[4] = x210; + out3[5] = x211; + out3[6] = x212; + out3[7] = x213; + out3[8] = x214; + out4[0] = x215; + out4[1] = x216; + out4[2] = x217; + out4[3] = x218; + out4[4] = x219; + out4[5] = x220; + out4[6] = x221; + out4[7] = x222; + out5[0] = x223; + out5[1] = x224; + out5[2] = x225; + out5[3] = x226; + out5[4] = x227; + out5[5] = x228; + out5[6] = x229; + out5[7] = x230; +} + +/// The function fiat_p256_scalar_divstep_precomp returns the precomputed value for Bernstein-Yang-inversion (in montgomery form). +/// +/// Postconditions: +/// eval (from_montgomery out1) = ⌊(m - 1) / 2⌋^(if ⌊log2 m⌋ + 1 < 46 then ⌊(49 * (⌊log2 m⌋ + 1) + 80) / 17⌋ else ⌊(49 * (⌊log2 m⌋ + 1) + 57) / 17⌋) +/// 0 ≤ eval out1 < m +/// +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +#[inline] +pub fn fiat_p256_scalar_divstep_precomp(out1: &mut [u32; 8]) -> () { + out1[0] = 0xb7fcfbb5; + out1[1] = 0xd739262f; + out1[2] = 0x20074414; + out1[3] = 0x8ac6f75d; + out1[4] = 0xb5e3c256; + out1[5] = 0xc67428bf; + out1[6] = 0xeda7aedf; + out1[7] = 0x444962f2; +} diff --git a/vendor/fiat-crypto/src/p256_scalar_64.rs b/vendor/fiat-crypto/src/p256_scalar_64.rs new file mode 100644 index 000000000..3467605c9 --- /dev/null +++ b/vendor/fiat-crypto/src/p256_scalar_64.rs @@ -0,0 +1,1997 @@ +//! Autogenerated: 'src/ExtractionOCaml/word_by_word_montgomery' --lang Rust --inline p256_scalar 64 '2^256 - 2^224 + 2^192 - 89188191075325690597107910205041859247' mul square add sub opp from_montgomery to_montgomery nonzero selectznz to_bytes from_bytes one msat divstep divstep_precomp +//! curve description: p256_scalar +//! machine_wordsize = 64 (from "64") +//! requested operations: mul, square, add, sub, opp, from_montgomery, to_montgomery, nonzero, selectznz, to_bytes, from_bytes, one, msat, divstep, divstep_precomp +//! m = 0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551 (from "2^256 - 2^224 + 2^192 - 89188191075325690597107910205041859247") +//! +//! NOTE: In addition to the bounds specified above each function, all +//! functions synthesized for this Montgomery arithmetic require the +//! input to be strictly less than the prime modulus (m), and also +//! require the input to be in the unique saturated representation. +//! All functions also ensure that these two properties are true of +//! return values. +//! +//! Computed values: +//! eval z = z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) +//! bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248) +//! twos_complement_eval z = let x1 := z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) in +//! if x1 & (2^256-1) < 2^255 then x1 & (2^256-1) else (x1 & (2^256-1)) - 2^256 + +#![allow(unused_parens)] +#![allow(non_camel_case_types)] + +pub type fiat_p256_scalar_u1 = u8; +pub type fiat_p256_scalar_i1 = i8; +pub type fiat_p256_scalar_u2 = u8; +pub type fiat_p256_scalar_i2 = i8; + +/* The type fiat_p256_scalar_montgomery_domain_field_element is a field element in the Montgomery domain. */ +/* Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] */ +pub type fiat_p256_scalar_montgomery_domain_field_element = [u64; 4]; + +/* The type fiat_p256_scalar_non_montgomery_domain_field_element is a field element NOT in the Montgomery domain. */ +/* Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] */ +pub type fiat_p256_scalar_non_montgomery_domain_field_element = [u64; 4]; + + +/// The function fiat_p256_scalar_addcarryx_u64 is an addition with carry. +/// +/// Postconditions: +/// out1 = (arg1 + arg2 + arg3) mod 2^64 +/// out2 = ⌊(arg1 + arg2 + arg3) / 2^64⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffffffffffff] +/// arg3: [0x0 ~> 0xffffffffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_p256_scalar_addcarryx_u64(out1: &mut u64, out2: &mut fiat_p256_scalar_u1, arg1: fiat_p256_scalar_u1, arg2: u64, arg3: u64) -> () { + let x1: u128 = (((arg1 as u128) + (arg2 as u128)) + (arg3 as u128)); + let x2: u64 = ((x1 & (0xffffffffffffffff as u128)) as u64); + let x3: fiat_p256_scalar_u1 = ((x1 >> 64) as fiat_p256_scalar_u1); + *out1 = x2; + *out2 = x3; +} + +/// The function fiat_p256_scalar_subborrowx_u64 is a subtraction with borrow. +/// +/// Postconditions: +/// out1 = (-arg1 + arg2 + -arg3) mod 2^64 +/// out2 = -⌊(-arg1 + arg2 + -arg3) / 2^64⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffffffffffff] +/// arg3: [0x0 ~> 0xffffffffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_p256_scalar_subborrowx_u64(out1: &mut u64, out2: &mut fiat_p256_scalar_u1, arg1: fiat_p256_scalar_u1, arg2: u64, arg3: u64) -> () { + let x1: i128 = (((arg2 as i128) - (arg1 as i128)) - (arg3 as i128)); + let x2: fiat_p256_scalar_i1 = ((x1 >> 64) as fiat_p256_scalar_i1); + let x3: u64 = ((x1 & (0xffffffffffffffff as i128)) as u64); + *out1 = x3; + *out2 = (((0x0 as fiat_p256_scalar_i2) - (x2 as fiat_p256_scalar_i2)) as fiat_p256_scalar_u1); +} + +/// The function fiat_p256_scalar_mulx_u64 is a multiplication, returning the full double-width result. +/// +/// Postconditions: +/// out1 = (arg1 * arg2) mod 2^64 +/// out2 = ⌊arg1 * arg2 / 2^64⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0xffffffffffffffff] +/// arg2: [0x0 ~> 0xffffffffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +/// out2: [0x0 ~> 0xffffffffffffffff] +#[inline] +pub fn fiat_p256_scalar_mulx_u64(out1: &mut u64, out2: &mut u64, arg1: u64, arg2: u64) -> () { + let x1: u128 = ((arg1 as u128) * (arg2 as u128)); + let x2: u64 = ((x1 & (0xffffffffffffffff as u128)) as u64); + let x3: u64 = ((x1 >> 64) as u64); + *out1 = x2; + *out2 = x3; +} + +/// The function fiat_p256_scalar_cmovznz_u64 is a single-word conditional move. +/// +/// Postconditions: +/// out1 = (if arg1 = 0 then arg2 else arg3) +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffffffffffff] +/// arg3: [0x0 ~> 0xffffffffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +#[inline] +pub fn fiat_p256_scalar_cmovznz_u64(out1: &mut u64, arg1: fiat_p256_scalar_u1, arg2: u64, arg3: u64) -> () { + let x1: fiat_p256_scalar_u1 = (!(!arg1)); + let x2: u64 = ((((((0x0 as fiat_p256_scalar_i2) - (x1 as fiat_p256_scalar_i2)) as fiat_p256_scalar_i1) as i128) & (0xffffffffffffffff as i128)) as u64); + let x3: u64 = ((x2 & arg3) | ((!x2) & arg2)); + *out1 = x3; +} + +/// The function fiat_p256_scalar_mul multiplies two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p256_scalar_mul(out1: &mut fiat_p256_scalar_montgomery_domain_field_element, arg1: &fiat_p256_scalar_montgomery_domain_field_element, arg2: &fiat_p256_scalar_montgomery_domain_field_element) -> () { + let x1: u64 = (arg1[1]); + let x2: u64 = (arg1[2]); + let x3: u64 = (arg1[3]); + let x4: u64 = (arg1[0]); + let mut x5: u64 = 0; + let mut x6: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x5, &mut x6, x4, (arg2[3])); + let mut x7: u64 = 0; + let mut x8: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x7, &mut x8, x4, (arg2[2])); + let mut x9: u64 = 0; + let mut x10: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x9, &mut x10, x4, (arg2[1])); + let mut x11: u64 = 0; + let mut x12: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x11, &mut x12, x4, (arg2[0])); + let mut x13: u64 = 0; + let mut x14: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x13, &mut x14, 0x0, x12, x9); + let mut x15: u64 = 0; + let mut x16: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x15, &mut x16, x14, x10, x7); + let mut x17: u64 = 0; + let mut x18: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x17, &mut x18, x16, x8, x5); + let x19: u64 = ((x18 as u64) + x6); + let mut x20: u64 = 0; + let mut x21: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x20, &mut x21, x11, 0xccd1c8aaee00bc4f); + let mut x22: u64 = 0; + let mut x23: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x22, &mut x23, x20, 0xffffffff00000000); + let mut x24: u64 = 0; + let mut x25: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x24, &mut x25, x20, 0xffffffffffffffff); + let mut x26: u64 = 0; + let mut x27: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x26, &mut x27, x20, 0xbce6faada7179e84); + let mut x28: u64 = 0; + let mut x29: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x28, &mut x29, x20, 0xf3b9cac2fc632551); + let mut x30: u64 = 0; + let mut x31: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x30, &mut x31, 0x0, x29, x26); + let mut x32: u64 = 0; + let mut x33: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x32, &mut x33, x31, x27, x24); + let mut x34: u64 = 0; + let mut x35: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x34, &mut x35, x33, x25, x22); + let x36: u64 = ((x35 as u64) + x23); + let mut x37: u64 = 0; + let mut x38: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x37, &mut x38, 0x0, x11, x28); + let mut x39: u64 = 0; + let mut x40: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x39, &mut x40, x38, x13, x30); + let mut x41: u64 = 0; + let mut x42: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x41, &mut x42, x40, x15, x32); + let mut x43: u64 = 0; + let mut x44: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x43, &mut x44, x42, x17, x34); + let mut x45: u64 = 0; + let mut x46: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x45, &mut x46, x44, x19, x36); + let mut x47: u64 = 0; + let mut x48: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x47, &mut x48, x1, (arg2[3])); + let mut x49: u64 = 0; + let mut x50: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x49, &mut x50, x1, (arg2[2])); + let mut x51: u64 = 0; + let mut x52: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x51, &mut x52, x1, (arg2[1])); + let mut x53: u64 = 0; + let mut x54: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x53, &mut x54, x1, (arg2[0])); + let mut x55: u64 = 0; + let mut x56: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x55, &mut x56, 0x0, x54, x51); + let mut x57: u64 = 0; + let mut x58: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x57, &mut x58, x56, x52, x49); + let mut x59: u64 = 0; + let mut x60: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x59, &mut x60, x58, x50, x47); + let x61: u64 = ((x60 as u64) + x48); + let mut x62: u64 = 0; + let mut x63: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x62, &mut x63, 0x0, x39, x53); + let mut x64: u64 = 0; + let mut x65: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x64, &mut x65, x63, x41, x55); + let mut x66: u64 = 0; + let mut x67: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x66, &mut x67, x65, x43, x57); + let mut x68: u64 = 0; + let mut x69: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x68, &mut x69, x67, x45, x59); + let mut x70: u64 = 0; + let mut x71: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x70, &mut x71, x69, (x46 as u64), x61); + let mut x72: u64 = 0; + let mut x73: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x72, &mut x73, x62, 0xccd1c8aaee00bc4f); + let mut x74: u64 = 0; + let mut x75: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x74, &mut x75, x72, 0xffffffff00000000); + let mut x76: u64 = 0; + let mut x77: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x76, &mut x77, x72, 0xffffffffffffffff); + let mut x78: u64 = 0; + let mut x79: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x78, &mut x79, x72, 0xbce6faada7179e84); + let mut x80: u64 = 0; + let mut x81: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x80, &mut x81, x72, 0xf3b9cac2fc632551); + let mut x82: u64 = 0; + let mut x83: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x82, &mut x83, 0x0, x81, x78); + let mut x84: u64 = 0; + let mut x85: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x84, &mut x85, x83, x79, x76); + let mut x86: u64 = 0; + let mut x87: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x86, &mut x87, x85, x77, x74); + let x88: u64 = ((x87 as u64) + x75); + let mut x89: u64 = 0; + let mut x90: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x89, &mut x90, 0x0, x62, x80); + let mut x91: u64 = 0; + let mut x92: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x91, &mut x92, x90, x64, x82); + let mut x93: u64 = 0; + let mut x94: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x93, &mut x94, x92, x66, x84); + let mut x95: u64 = 0; + let mut x96: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x95, &mut x96, x94, x68, x86); + let mut x97: u64 = 0; + let mut x98: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x97, &mut x98, x96, x70, x88); + let x99: u64 = ((x98 as u64) + (x71 as u64)); + let mut x100: u64 = 0; + let mut x101: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x100, &mut x101, x2, (arg2[3])); + let mut x102: u64 = 0; + let mut x103: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x102, &mut x103, x2, (arg2[2])); + let mut x104: u64 = 0; + let mut x105: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x104, &mut x105, x2, (arg2[1])); + let mut x106: u64 = 0; + let mut x107: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x106, &mut x107, x2, (arg2[0])); + let mut x108: u64 = 0; + let mut x109: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x108, &mut x109, 0x0, x107, x104); + let mut x110: u64 = 0; + let mut x111: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x110, &mut x111, x109, x105, x102); + let mut x112: u64 = 0; + let mut x113: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x112, &mut x113, x111, x103, x100); + let x114: u64 = ((x113 as u64) + x101); + let mut x115: u64 = 0; + let mut x116: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x115, &mut x116, 0x0, x91, x106); + let mut x117: u64 = 0; + let mut x118: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x117, &mut x118, x116, x93, x108); + let mut x119: u64 = 0; + let mut x120: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x119, &mut x120, x118, x95, x110); + let mut x121: u64 = 0; + let mut x122: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x121, &mut x122, x120, x97, x112); + let mut x123: u64 = 0; + let mut x124: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x123, &mut x124, x122, x99, x114); + let mut x125: u64 = 0; + let mut x126: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x125, &mut x126, x115, 0xccd1c8aaee00bc4f); + let mut x127: u64 = 0; + let mut x128: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x127, &mut x128, x125, 0xffffffff00000000); + let mut x129: u64 = 0; + let mut x130: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x129, &mut x130, x125, 0xffffffffffffffff); + let mut x131: u64 = 0; + let mut x132: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x131, &mut x132, x125, 0xbce6faada7179e84); + let mut x133: u64 = 0; + let mut x134: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x133, &mut x134, x125, 0xf3b9cac2fc632551); + let mut x135: u64 = 0; + let mut x136: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x135, &mut x136, 0x0, x134, x131); + let mut x137: u64 = 0; + let mut x138: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x137, &mut x138, x136, x132, x129); + let mut x139: u64 = 0; + let mut x140: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x139, &mut x140, x138, x130, x127); + let x141: u64 = ((x140 as u64) + x128); + let mut x142: u64 = 0; + let mut x143: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x142, &mut x143, 0x0, x115, x133); + let mut x144: u64 = 0; + let mut x145: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x144, &mut x145, x143, x117, x135); + let mut x146: u64 = 0; + let mut x147: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x146, &mut x147, x145, x119, x137); + let mut x148: u64 = 0; + let mut x149: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x148, &mut x149, x147, x121, x139); + let mut x150: u64 = 0; + let mut x151: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x150, &mut x151, x149, x123, x141); + let x152: u64 = ((x151 as u64) + (x124 as u64)); + let mut x153: u64 = 0; + let mut x154: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x153, &mut x154, x3, (arg2[3])); + let mut x155: u64 = 0; + let mut x156: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x155, &mut x156, x3, (arg2[2])); + let mut x157: u64 = 0; + let mut x158: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x157, &mut x158, x3, (arg2[1])); + let mut x159: u64 = 0; + let mut x160: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x159, &mut x160, x3, (arg2[0])); + let mut x161: u64 = 0; + let mut x162: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x161, &mut x162, 0x0, x160, x157); + let mut x163: u64 = 0; + let mut x164: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x163, &mut x164, x162, x158, x155); + let mut x165: u64 = 0; + let mut x166: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x165, &mut x166, x164, x156, x153); + let x167: u64 = ((x166 as u64) + x154); + let mut x168: u64 = 0; + let mut x169: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x168, &mut x169, 0x0, x144, x159); + let mut x170: u64 = 0; + let mut x171: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x170, &mut x171, x169, x146, x161); + let mut x172: u64 = 0; + let mut x173: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x172, &mut x173, x171, x148, x163); + let mut x174: u64 = 0; + let mut x175: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x174, &mut x175, x173, x150, x165); + let mut x176: u64 = 0; + let mut x177: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x176, &mut x177, x175, x152, x167); + let mut x178: u64 = 0; + let mut x179: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x178, &mut x179, x168, 0xccd1c8aaee00bc4f); + let mut x180: u64 = 0; + let mut x181: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x180, &mut x181, x178, 0xffffffff00000000); + let mut x182: u64 = 0; + let mut x183: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x182, &mut x183, x178, 0xffffffffffffffff); + let mut x184: u64 = 0; + let mut x185: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x184, &mut x185, x178, 0xbce6faada7179e84); + let mut x186: u64 = 0; + let mut x187: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x186, &mut x187, x178, 0xf3b9cac2fc632551); + let mut x188: u64 = 0; + let mut x189: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x188, &mut x189, 0x0, x187, x184); + let mut x190: u64 = 0; + let mut x191: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x190, &mut x191, x189, x185, x182); + let mut x192: u64 = 0; + let mut x193: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x192, &mut x193, x191, x183, x180); + let x194: u64 = ((x193 as u64) + x181); + let mut x195: u64 = 0; + let mut x196: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x195, &mut x196, 0x0, x168, x186); + let mut x197: u64 = 0; + let mut x198: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x197, &mut x198, x196, x170, x188); + let mut x199: u64 = 0; + let mut x200: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x199, &mut x200, x198, x172, x190); + let mut x201: u64 = 0; + let mut x202: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x201, &mut x202, x200, x174, x192); + let mut x203: u64 = 0; + let mut x204: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x203, &mut x204, x202, x176, x194); + let x205: u64 = ((x204 as u64) + (x177 as u64)); + let mut x206: u64 = 0; + let mut x207: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u64(&mut x206, &mut x207, 0x0, x197, 0xf3b9cac2fc632551); + let mut x208: u64 = 0; + let mut x209: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u64(&mut x208, &mut x209, x207, x199, 0xbce6faada7179e84); + let mut x210: u64 = 0; + let mut x211: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u64(&mut x210, &mut x211, x209, x201, 0xffffffffffffffff); + let mut x212: u64 = 0; + let mut x213: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u64(&mut x212, &mut x213, x211, x203, 0xffffffff00000000); + let mut x214: u64 = 0; + let mut x215: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u64(&mut x214, &mut x215, x213, x205, (0x0 as u64)); + let mut x216: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x216, x215, x206, x197); + let mut x217: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x217, x215, x208, x199); + let mut x218: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x218, x215, x210, x201); + let mut x219: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x219, x215, x212, x203); + out1[0] = x216; + out1[1] = x217; + out1[2] = x218; + out1[3] = x219; +} + +/// The function fiat_p256_scalar_square squares a field element in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg1)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p256_scalar_square(out1: &mut fiat_p256_scalar_montgomery_domain_field_element, arg1: &fiat_p256_scalar_montgomery_domain_field_element) -> () { + let x1: u64 = (arg1[1]); + let x2: u64 = (arg1[2]); + let x3: u64 = (arg1[3]); + let x4: u64 = (arg1[0]); + let mut x5: u64 = 0; + let mut x6: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x5, &mut x6, x4, (arg1[3])); + let mut x7: u64 = 0; + let mut x8: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x7, &mut x8, x4, (arg1[2])); + let mut x9: u64 = 0; + let mut x10: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x9, &mut x10, x4, (arg1[1])); + let mut x11: u64 = 0; + let mut x12: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x11, &mut x12, x4, (arg1[0])); + let mut x13: u64 = 0; + let mut x14: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x13, &mut x14, 0x0, x12, x9); + let mut x15: u64 = 0; + let mut x16: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x15, &mut x16, x14, x10, x7); + let mut x17: u64 = 0; + let mut x18: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x17, &mut x18, x16, x8, x5); + let x19: u64 = ((x18 as u64) + x6); + let mut x20: u64 = 0; + let mut x21: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x20, &mut x21, x11, 0xccd1c8aaee00bc4f); + let mut x22: u64 = 0; + let mut x23: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x22, &mut x23, x20, 0xffffffff00000000); + let mut x24: u64 = 0; + let mut x25: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x24, &mut x25, x20, 0xffffffffffffffff); + let mut x26: u64 = 0; + let mut x27: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x26, &mut x27, x20, 0xbce6faada7179e84); + let mut x28: u64 = 0; + let mut x29: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x28, &mut x29, x20, 0xf3b9cac2fc632551); + let mut x30: u64 = 0; + let mut x31: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x30, &mut x31, 0x0, x29, x26); + let mut x32: u64 = 0; + let mut x33: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x32, &mut x33, x31, x27, x24); + let mut x34: u64 = 0; + let mut x35: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x34, &mut x35, x33, x25, x22); + let x36: u64 = ((x35 as u64) + x23); + let mut x37: u64 = 0; + let mut x38: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x37, &mut x38, 0x0, x11, x28); + let mut x39: u64 = 0; + let mut x40: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x39, &mut x40, x38, x13, x30); + let mut x41: u64 = 0; + let mut x42: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x41, &mut x42, x40, x15, x32); + let mut x43: u64 = 0; + let mut x44: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x43, &mut x44, x42, x17, x34); + let mut x45: u64 = 0; + let mut x46: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x45, &mut x46, x44, x19, x36); + let mut x47: u64 = 0; + let mut x48: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x47, &mut x48, x1, (arg1[3])); + let mut x49: u64 = 0; + let mut x50: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x49, &mut x50, x1, (arg1[2])); + let mut x51: u64 = 0; + let mut x52: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x51, &mut x52, x1, (arg1[1])); + let mut x53: u64 = 0; + let mut x54: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x53, &mut x54, x1, (arg1[0])); + let mut x55: u64 = 0; + let mut x56: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x55, &mut x56, 0x0, x54, x51); + let mut x57: u64 = 0; + let mut x58: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x57, &mut x58, x56, x52, x49); + let mut x59: u64 = 0; + let mut x60: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x59, &mut x60, x58, x50, x47); + let x61: u64 = ((x60 as u64) + x48); + let mut x62: u64 = 0; + let mut x63: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x62, &mut x63, 0x0, x39, x53); + let mut x64: u64 = 0; + let mut x65: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x64, &mut x65, x63, x41, x55); + let mut x66: u64 = 0; + let mut x67: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x66, &mut x67, x65, x43, x57); + let mut x68: u64 = 0; + let mut x69: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x68, &mut x69, x67, x45, x59); + let mut x70: u64 = 0; + let mut x71: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x70, &mut x71, x69, (x46 as u64), x61); + let mut x72: u64 = 0; + let mut x73: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x72, &mut x73, x62, 0xccd1c8aaee00bc4f); + let mut x74: u64 = 0; + let mut x75: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x74, &mut x75, x72, 0xffffffff00000000); + let mut x76: u64 = 0; + let mut x77: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x76, &mut x77, x72, 0xffffffffffffffff); + let mut x78: u64 = 0; + let mut x79: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x78, &mut x79, x72, 0xbce6faada7179e84); + let mut x80: u64 = 0; + let mut x81: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x80, &mut x81, x72, 0xf3b9cac2fc632551); + let mut x82: u64 = 0; + let mut x83: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x82, &mut x83, 0x0, x81, x78); + let mut x84: u64 = 0; + let mut x85: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x84, &mut x85, x83, x79, x76); + let mut x86: u64 = 0; + let mut x87: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x86, &mut x87, x85, x77, x74); + let x88: u64 = ((x87 as u64) + x75); + let mut x89: u64 = 0; + let mut x90: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x89, &mut x90, 0x0, x62, x80); + let mut x91: u64 = 0; + let mut x92: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x91, &mut x92, x90, x64, x82); + let mut x93: u64 = 0; + let mut x94: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x93, &mut x94, x92, x66, x84); + let mut x95: u64 = 0; + let mut x96: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x95, &mut x96, x94, x68, x86); + let mut x97: u64 = 0; + let mut x98: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x97, &mut x98, x96, x70, x88); + let x99: u64 = ((x98 as u64) + (x71 as u64)); + let mut x100: u64 = 0; + let mut x101: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x100, &mut x101, x2, (arg1[3])); + let mut x102: u64 = 0; + let mut x103: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x102, &mut x103, x2, (arg1[2])); + let mut x104: u64 = 0; + let mut x105: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x104, &mut x105, x2, (arg1[1])); + let mut x106: u64 = 0; + let mut x107: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x106, &mut x107, x2, (arg1[0])); + let mut x108: u64 = 0; + let mut x109: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x108, &mut x109, 0x0, x107, x104); + let mut x110: u64 = 0; + let mut x111: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x110, &mut x111, x109, x105, x102); + let mut x112: u64 = 0; + let mut x113: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x112, &mut x113, x111, x103, x100); + let x114: u64 = ((x113 as u64) + x101); + let mut x115: u64 = 0; + let mut x116: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x115, &mut x116, 0x0, x91, x106); + let mut x117: u64 = 0; + let mut x118: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x117, &mut x118, x116, x93, x108); + let mut x119: u64 = 0; + let mut x120: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x119, &mut x120, x118, x95, x110); + let mut x121: u64 = 0; + let mut x122: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x121, &mut x122, x120, x97, x112); + let mut x123: u64 = 0; + let mut x124: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x123, &mut x124, x122, x99, x114); + let mut x125: u64 = 0; + let mut x126: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x125, &mut x126, x115, 0xccd1c8aaee00bc4f); + let mut x127: u64 = 0; + let mut x128: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x127, &mut x128, x125, 0xffffffff00000000); + let mut x129: u64 = 0; + let mut x130: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x129, &mut x130, x125, 0xffffffffffffffff); + let mut x131: u64 = 0; + let mut x132: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x131, &mut x132, x125, 0xbce6faada7179e84); + let mut x133: u64 = 0; + let mut x134: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x133, &mut x134, x125, 0xf3b9cac2fc632551); + let mut x135: u64 = 0; + let mut x136: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x135, &mut x136, 0x0, x134, x131); + let mut x137: u64 = 0; + let mut x138: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x137, &mut x138, x136, x132, x129); + let mut x139: u64 = 0; + let mut x140: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x139, &mut x140, x138, x130, x127); + let x141: u64 = ((x140 as u64) + x128); + let mut x142: u64 = 0; + let mut x143: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x142, &mut x143, 0x0, x115, x133); + let mut x144: u64 = 0; + let mut x145: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x144, &mut x145, x143, x117, x135); + let mut x146: u64 = 0; + let mut x147: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x146, &mut x147, x145, x119, x137); + let mut x148: u64 = 0; + let mut x149: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x148, &mut x149, x147, x121, x139); + let mut x150: u64 = 0; + let mut x151: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x150, &mut x151, x149, x123, x141); + let x152: u64 = ((x151 as u64) + (x124 as u64)); + let mut x153: u64 = 0; + let mut x154: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x153, &mut x154, x3, (arg1[3])); + let mut x155: u64 = 0; + let mut x156: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x155, &mut x156, x3, (arg1[2])); + let mut x157: u64 = 0; + let mut x158: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x157, &mut x158, x3, (arg1[1])); + let mut x159: u64 = 0; + let mut x160: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x159, &mut x160, x3, (arg1[0])); + let mut x161: u64 = 0; + let mut x162: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x161, &mut x162, 0x0, x160, x157); + let mut x163: u64 = 0; + let mut x164: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x163, &mut x164, x162, x158, x155); + let mut x165: u64 = 0; + let mut x166: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x165, &mut x166, x164, x156, x153); + let x167: u64 = ((x166 as u64) + x154); + let mut x168: u64 = 0; + let mut x169: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x168, &mut x169, 0x0, x144, x159); + let mut x170: u64 = 0; + let mut x171: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x170, &mut x171, x169, x146, x161); + let mut x172: u64 = 0; + let mut x173: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x172, &mut x173, x171, x148, x163); + let mut x174: u64 = 0; + let mut x175: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x174, &mut x175, x173, x150, x165); + let mut x176: u64 = 0; + let mut x177: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x176, &mut x177, x175, x152, x167); + let mut x178: u64 = 0; + let mut x179: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x178, &mut x179, x168, 0xccd1c8aaee00bc4f); + let mut x180: u64 = 0; + let mut x181: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x180, &mut x181, x178, 0xffffffff00000000); + let mut x182: u64 = 0; + let mut x183: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x182, &mut x183, x178, 0xffffffffffffffff); + let mut x184: u64 = 0; + let mut x185: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x184, &mut x185, x178, 0xbce6faada7179e84); + let mut x186: u64 = 0; + let mut x187: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x186, &mut x187, x178, 0xf3b9cac2fc632551); + let mut x188: u64 = 0; + let mut x189: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x188, &mut x189, 0x0, x187, x184); + let mut x190: u64 = 0; + let mut x191: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x190, &mut x191, x189, x185, x182); + let mut x192: u64 = 0; + let mut x193: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x192, &mut x193, x191, x183, x180); + let x194: u64 = ((x193 as u64) + x181); + let mut x195: u64 = 0; + let mut x196: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x195, &mut x196, 0x0, x168, x186); + let mut x197: u64 = 0; + let mut x198: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x197, &mut x198, x196, x170, x188); + let mut x199: u64 = 0; + let mut x200: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x199, &mut x200, x198, x172, x190); + let mut x201: u64 = 0; + let mut x202: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x201, &mut x202, x200, x174, x192); + let mut x203: u64 = 0; + let mut x204: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x203, &mut x204, x202, x176, x194); + let x205: u64 = ((x204 as u64) + (x177 as u64)); + let mut x206: u64 = 0; + let mut x207: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u64(&mut x206, &mut x207, 0x0, x197, 0xf3b9cac2fc632551); + let mut x208: u64 = 0; + let mut x209: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u64(&mut x208, &mut x209, x207, x199, 0xbce6faada7179e84); + let mut x210: u64 = 0; + let mut x211: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u64(&mut x210, &mut x211, x209, x201, 0xffffffffffffffff); + let mut x212: u64 = 0; + let mut x213: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u64(&mut x212, &mut x213, x211, x203, 0xffffffff00000000); + let mut x214: u64 = 0; + let mut x215: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u64(&mut x214, &mut x215, x213, x205, (0x0 as u64)); + let mut x216: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x216, x215, x206, x197); + let mut x217: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x217, x215, x208, x199); + let mut x218: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x218, x215, x210, x201); + let mut x219: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x219, x215, x212, x203); + out1[0] = x216; + out1[1] = x217; + out1[2] = x218; + out1[3] = x219; +} + +/// The function fiat_p256_scalar_add adds two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) + eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p256_scalar_add(out1: &mut fiat_p256_scalar_montgomery_domain_field_element, arg1: &fiat_p256_scalar_montgomery_domain_field_element, arg2: &fiat_p256_scalar_montgomery_domain_field_element) -> () { + let mut x1: u64 = 0; + let mut x2: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x1, &mut x2, 0x0, (arg1[0]), (arg2[0])); + let mut x3: u64 = 0; + let mut x4: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x3, &mut x4, x2, (arg1[1]), (arg2[1])); + let mut x5: u64 = 0; + let mut x6: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x5, &mut x6, x4, (arg1[2]), (arg2[2])); + let mut x7: u64 = 0; + let mut x8: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x7, &mut x8, x6, (arg1[3]), (arg2[3])); + let mut x9: u64 = 0; + let mut x10: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u64(&mut x9, &mut x10, 0x0, x1, 0xf3b9cac2fc632551); + let mut x11: u64 = 0; + let mut x12: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u64(&mut x11, &mut x12, x10, x3, 0xbce6faada7179e84); + let mut x13: u64 = 0; + let mut x14: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u64(&mut x13, &mut x14, x12, x5, 0xffffffffffffffff); + let mut x15: u64 = 0; + let mut x16: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u64(&mut x15, &mut x16, x14, x7, 0xffffffff00000000); + let mut x17: u64 = 0; + let mut x18: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u64(&mut x17, &mut x18, x16, (x8 as u64), (0x0 as u64)); + let mut x19: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x19, x18, x9, x1); + let mut x20: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x20, x18, x11, x3); + let mut x21: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x21, x18, x13, x5); + let mut x22: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x22, x18, x15, x7); + out1[0] = x19; + out1[1] = x20; + out1[2] = x21; + out1[3] = x22; +} + +/// The function fiat_p256_scalar_sub subtracts two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) - eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p256_scalar_sub(out1: &mut fiat_p256_scalar_montgomery_domain_field_element, arg1: &fiat_p256_scalar_montgomery_domain_field_element, arg2: &fiat_p256_scalar_montgomery_domain_field_element) -> () { + let mut x1: u64 = 0; + let mut x2: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u64(&mut x1, &mut x2, 0x0, (arg1[0]), (arg2[0])); + let mut x3: u64 = 0; + let mut x4: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u64(&mut x3, &mut x4, x2, (arg1[1]), (arg2[1])); + let mut x5: u64 = 0; + let mut x6: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u64(&mut x5, &mut x6, x4, (arg1[2]), (arg2[2])); + let mut x7: u64 = 0; + let mut x8: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u64(&mut x7, &mut x8, x6, (arg1[3]), (arg2[3])); + let mut x9: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x9, x8, (0x0 as u64), 0xffffffffffffffff); + let mut x10: u64 = 0; + let mut x11: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x10, &mut x11, 0x0, x1, (x9 & 0xf3b9cac2fc632551)); + let mut x12: u64 = 0; + let mut x13: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x12, &mut x13, x11, x3, (x9 & 0xbce6faada7179e84)); + let mut x14: u64 = 0; + let mut x15: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x14, &mut x15, x13, x5, x9); + let mut x16: u64 = 0; + let mut x17: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x16, &mut x17, x15, x7, (x9 & 0xffffffff00000000)); + out1[0] = x10; + out1[1] = x12; + out1[2] = x14; + out1[3] = x16; +} + +/// The function fiat_p256_scalar_opp negates a field element in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = -eval (from_montgomery arg1) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p256_scalar_opp(out1: &mut fiat_p256_scalar_montgomery_domain_field_element, arg1: &fiat_p256_scalar_montgomery_domain_field_element) -> () { + let mut x1: u64 = 0; + let mut x2: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u64(&mut x1, &mut x2, 0x0, (0x0 as u64), (arg1[0])); + let mut x3: u64 = 0; + let mut x4: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u64(&mut x3, &mut x4, x2, (0x0 as u64), (arg1[1])); + let mut x5: u64 = 0; + let mut x6: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u64(&mut x5, &mut x6, x4, (0x0 as u64), (arg1[2])); + let mut x7: u64 = 0; + let mut x8: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u64(&mut x7, &mut x8, x6, (0x0 as u64), (arg1[3])); + let mut x9: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x9, x8, (0x0 as u64), 0xffffffffffffffff); + let mut x10: u64 = 0; + let mut x11: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x10, &mut x11, 0x0, x1, (x9 & 0xf3b9cac2fc632551)); + let mut x12: u64 = 0; + let mut x13: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x12, &mut x13, x11, x3, (x9 & 0xbce6faada7179e84)); + let mut x14: u64 = 0; + let mut x15: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x14, &mut x15, x13, x5, x9); + let mut x16: u64 = 0; + let mut x17: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x16, &mut x17, x15, x7, (x9 & 0xffffffff00000000)); + out1[0] = x10; + out1[1] = x12; + out1[2] = x14; + out1[3] = x16; +} + +/// The function fiat_p256_scalar_from_montgomery translates a field element out of the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval out1 mod m = (eval arg1 * ((2^64)⁻¹ mod m)^4) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p256_scalar_from_montgomery(out1: &mut fiat_p256_scalar_non_montgomery_domain_field_element, arg1: &fiat_p256_scalar_montgomery_domain_field_element) -> () { + let x1: u64 = (arg1[0]); + let mut x2: u64 = 0; + let mut x3: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x2, &mut x3, x1, 0xccd1c8aaee00bc4f); + let mut x4: u64 = 0; + let mut x5: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x4, &mut x5, x2, 0xffffffff00000000); + let mut x6: u64 = 0; + let mut x7: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x6, &mut x7, x2, 0xffffffffffffffff); + let mut x8: u64 = 0; + let mut x9: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x8, &mut x9, x2, 0xbce6faada7179e84); + let mut x10: u64 = 0; + let mut x11: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x10, &mut x11, x2, 0xf3b9cac2fc632551); + let mut x12: u64 = 0; + let mut x13: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x12, &mut x13, 0x0, x11, x8); + let mut x14: u64 = 0; + let mut x15: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x14, &mut x15, x13, x9, x6); + let mut x16: u64 = 0; + let mut x17: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x16, &mut x17, x15, x7, x4); + let mut x18: u64 = 0; + let mut x19: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x18, &mut x19, 0x0, x1, x10); + let mut x20: u64 = 0; + let mut x21: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x20, &mut x21, x19, (0x0 as u64), x12); + let mut x22: u64 = 0; + let mut x23: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x22, &mut x23, x21, (0x0 as u64), x14); + let mut x24: u64 = 0; + let mut x25: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x24, &mut x25, x23, (0x0 as u64), x16); + let mut x26: u64 = 0; + let mut x27: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x26, &mut x27, 0x0, x20, (arg1[1])); + let mut x28: u64 = 0; + let mut x29: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x28, &mut x29, x27, x22, (0x0 as u64)); + let mut x30: u64 = 0; + let mut x31: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x30, &mut x31, x29, x24, (0x0 as u64)); + let mut x32: u64 = 0; + let mut x33: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x32, &mut x33, x26, 0xccd1c8aaee00bc4f); + let mut x34: u64 = 0; + let mut x35: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x34, &mut x35, x32, 0xffffffff00000000); + let mut x36: u64 = 0; + let mut x37: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x36, &mut x37, x32, 0xffffffffffffffff); + let mut x38: u64 = 0; + let mut x39: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x38, &mut x39, x32, 0xbce6faada7179e84); + let mut x40: u64 = 0; + let mut x41: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x40, &mut x41, x32, 0xf3b9cac2fc632551); + let mut x42: u64 = 0; + let mut x43: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x42, &mut x43, 0x0, x41, x38); + let mut x44: u64 = 0; + let mut x45: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x44, &mut x45, x43, x39, x36); + let mut x46: u64 = 0; + let mut x47: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x46, &mut x47, x45, x37, x34); + let mut x48: u64 = 0; + let mut x49: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x48, &mut x49, 0x0, x26, x40); + let mut x50: u64 = 0; + let mut x51: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x50, &mut x51, x49, x28, x42); + let mut x52: u64 = 0; + let mut x53: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x52, &mut x53, x51, x30, x44); + let mut x54: u64 = 0; + let mut x55: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x54, &mut x55, x53, ((x31 as u64) + ((x25 as u64) + ((x17 as u64) + x5))), x46); + let mut x56: u64 = 0; + let mut x57: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x56, &mut x57, 0x0, x50, (arg1[2])); + let mut x58: u64 = 0; + let mut x59: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x58, &mut x59, x57, x52, (0x0 as u64)); + let mut x60: u64 = 0; + let mut x61: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x60, &mut x61, x59, x54, (0x0 as u64)); + let mut x62: u64 = 0; + let mut x63: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x62, &mut x63, x56, 0xccd1c8aaee00bc4f); + let mut x64: u64 = 0; + let mut x65: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x64, &mut x65, x62, 0xffffffff00000000); + let mut x66: u64 = 0; + let mut x67: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x66, &mut x67, x62, 0xffffffffffffffff); + let mut x68: u64 = 0; + let mut x69: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x68, &mut x69, x62, 0xbce6faada7179e84); + let mut x70: u64 = 0; + let mut x71: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x70, &mut x71, x62, 0xf3b9cac2fc632551); + let mut x72: u64 = 0; + let mut x73: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x72, &mut x73, 0x0, x71, x68); + let mut x74: u64 = 0; + let mut x75: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x74, &mut x75, x73, x69, x66); + let mut x76: u64 = 0; + let mut x77: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x76, &mut x77, x75, x67, x64); + let mut x78: u64 = 0; + let mut x79: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x78, &mut x79, 0x0, x56, x70); + let mut x80: u64 = 0; + let mut x81: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x80, &mut x81, x79, x58, x72); + let mut x82: u64 = 0; + let mut x83: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x82, &mut x83, x81, x60, x74); + let mut x84: u64 = 0; + let mut x85: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x84, &mut x85, x83, ((x61 as u64) + ((x55 as u64) + ((x47 as u64) + x35))), x76); + let mut x86: u64 = 0; + let mut x87: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x86, &mut x87, 0x0, x80, (arg1[3])); + let mut x88: u64 = 0; + let mut x89: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x88, &mut x89, x87, x82, (0x0 as u64)); + let mut x90: u64 = 0; + let mut x91: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x90, &mut x91, x89, x84, (0x0 as u64)); + let mut x92: u64 = 0; + let mut x93: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x92, &mut x93, x86, 0xccd1c8aaee00bc4f); + let mut x94: u64 = 0; + let mut x95: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x94, &mut x95, x92, 0xffffffff00000000); + let mut x96: u64 = 0; + let mut x97: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x96, &mut x97, x92, 0xffffffffffffffff); + let mut x98: u64 = 0; + let mut x99: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x98, &mut x99, x92, 0xbce6faada7179e84); + let mut x100: u64 = 0; + let mut x101: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x100, &mut x101, x92, 0xf3b9cac2fc632551); + let mut x102: u64 = 0; + let mut x103: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x102, &mut x103, 0x0, x101, x98); + let mut x104: u64 = 0; + let mut x105: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x104, &mut x105, x103, x99, x96); + let mut x106: u64 = 0; + let mut x107: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x106, &mut x107, x105, x97, x94); + let mut x108: u64 = 0; + let mut x109: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x108, &mut x109, 0x0, x86, x100); + let mut x110: u64 = 0; + let mut x111: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x110, &mut x111, x109, x88, x102); + let mut x112: u64 = 0; + let mut x113: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x112, &mut x113, x111, x90, x104); + let mut x114: u64 = 0; + let mut x115: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x114, &mut x115, x113, ((x91 as u64) + ((x85 as u64) + ((x77 as u64) + x65))), x106); + let x116: u64 = ((x115 as u64) + ((x107 as u64) + x95)); + let mut x117: u64 = 0; + let mut x118: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u64(&mut x117, &mut x118, 0x0, x110, 0xf3b9cac2fc632551); + let mut x119: u64 = 0; + let mut x120: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u64(&mut x119, &mut x120, x118, x112, 0xbce6faada7179e84); + let mut x121: u64 = 0; + let mut x122: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u64(&mut x121, &mut x122, x120, x114, 0xffffffffffffffff); + let mut x123: u64 = 0; + let mut x124: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u64(&mut x123, &mut x124, x122, x116, 0xffffffff00000000); + let mut x125: u64 = 0; + let mut x126: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u64(&mut x125, &mut x126, x124, (0x0 as u64), (0x0 as u64)); + let mut x127: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x127, x126, x117, x110); + let mut x128: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x128, x126, x119, x112); + let mut x129: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x129, x126, x121, x114); + let mut x130: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x130, x126, x123, x116); + out1[0] = x127; + out1[1] = x128; + out1[2] = x129; + out1[3] = x130; +} + +/// The function fiat_p256_scalar_to_montgomery translates a field element into the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = eval arg1 mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p256_scalar_to_montgomery(out1: &mut fiat_p256_scalar_montgomery_domain_field_element, arg1: &fiat_p256_scalar_non_montgomery_domain_field_element) -> () { + let x1: u64 = (arg1[1]); + let x2: u64 = (arg1[2]); + let x3: u64 = (arg1[3]); + let x4: u64 = (arg1[0]); + let mut x5: u64 = 0; + let mut x6: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x5, &mut x6, x4, 0x66e12d94f3d95620); + let mut x7: u64 = 0; + let mut x8: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x7, &mut x8, x4, 0x2845b2392b6bec59); + let mut x9: u64 = 0; + let mut x10: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x9, &mut x10, x4, 0x4699799c49bd6fa6); + let mut x11: u64 = 0; + let mut x12: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x11, &mut x12, x4, 0x83244c95be79eea2); + let mut x13: u64 = 0; + let mut x14: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x13, &mut x14, 0x0, x12, x9); + let mut x15: u64 = 0; + let mut x16: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x15, &mut x16, x14, x10, x7); + let mut x17: u64 = 0; + let mut x18: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x17, &mut x18, x16, x8, x5); + let mut x19: u64 = 0; + let mut x20: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x19, &mut x20, x11, 0xccd1c8aaee00bc4f); + let mut x21: u64 = 0; + let mut x22: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x21, &mut x22, x19, 0xffffffff00000000); + let mut x23: u64 = 0; + let mut x24: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x23, &mut x24, x19, 0xffffffffffffffff); + let mut x25: u64 = 0; + let mut x26: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x25, &mut x26, x19, 0xbce6faada7179e84); + let mut x27: u64 = 0; + let mut x28: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x27, &mut x28, x19, 0xf3b9cac2fc632551); + let mut x29: u64 = 0; + let mut x30: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x29, &mut x30, 0x0, x28, x25); + let mut x31: u64 = 0; + let mut x32: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x31, &mut x32, x30, x26, x23); + let mut x33: u64 = 0; + let mut x34: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x33, &mut x34, x32, x24, x21); + let mut x35: u64 = 0; + let mut x36: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x35, &mut x36, 0x0, x11, x27); + let mut x37: u64 = 0; + let mut x38: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x37, &mut x38, x36, x13, x29); + let mut x39: u64 = 0; + let mut x40: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x39, &mut x40, x38, x15, x31); + let mut x41: u64 = 0; + let mut x42: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x41, &mut x42, x40, x17, x33); + let mut x43: u64 = 0; + let mut x44: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x43, &mut x44, x42, ((x18 as u64) + x6), ((x34 as u64) + x22)); + let mut x45: u64 = 0; + let mut x46: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x45, &mut x46, x1, 0x66e12d94f3d95620); + let mut x47: u64 = 0; + let mut x48: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x47, &mut x48, x1, 0x2845b2392b6bec59); + let mut x49: u64 = 0; + let mut x50: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x49, &mut x50, x1, 0x4699799c49bd6fa6); + let mut x51: u64 = 0; + let mut x52: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x51, &mut x52, x1, 0x83244c95be79eea2); + let mut x53: u64 = 0; + let mut x54: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x53, &mut x54, 0x0, x52, x49); + let mut x55: u64 = 0; + let mut x56: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x55, &mut x56, x54, x50, x47); + let mut x57: u64 = 0; + let mut x58: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x57, &mut x58, x56, x48, x45); + let mut x59: u64 = 0; + let mut x60: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x59, &mut x60, 0x0, x37, x51); + let mut x61: u64 = 0; + let mut x62: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x61, &mut x62, x60, x39, x53); + let mut x63: u64 = 0; + let mut x64: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x63, &mut x64, x62, x41, x55); + let mut x65: u64 = 0; + let mut x66: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x65, &mut x66, x64, x43, x57); + let mut x67: u64 = 0; + let mut x68: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x67, &mut x68, x59, 0xccd1c8aaee00bc4f); + let mut x69: u64 = 0; + let mut x70: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x69, &mut x70, x67, 0xffffffff00000000); + let mut x71: u64 = 0; + let mut x72: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x71, &mut x72, x67, 0xffffffffffffffff); + let mut x73: u64 = 0; + let mut x74: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x73, &mut x74, x67, 0xbce6faada7179e84); + let mut x75: u64 = 0; + let mut x76: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x75, &mut x76, x67, 0xf3b9cac2fc632551); + let mut x77: u64 = 0; + let mut x78: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x77, &mut x78, 0x0, x76, x73); + let mut x79: u64 = 0; + let mut x80: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x79, &mut x80, x78, x74, x71); + let mut x81: u64 = 0; + let mut x82: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x81, &mut x82, x80, x72, x69); + let mut x83: u64 = 0; + let mut x84: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x83, &mut x84, 0x0, x59, x75); + let mut x85: u64 = 0; + let mut x86: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x85, &mut x86, x84, x61, x77); + let mut x87: u64 = 0; + let mut x88: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x87, &mut x88, x86, x63, x79); + let mut x89: u64 = 0; + let mut x90: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x89, &mut x90, x88, x65, x81); + let mut x91: u64 = 0; + let mut x92: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x91, &mut x92, x90, (((x66 as u64) + (x44 as u64)) + ((x58 as u64) + x46)), ((x82 as u64) + x70)); + let mut x93: u64 = 0; + let mut x94: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x93, &mut x94, x2, 0x66e12d94f3d95620); + let mut x95: u64 = 0; + let mut x96: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x95, &mut x96, x2, 0x2845b2392b6bec59); + let mut x97: u64 = 0; + let mut x98: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x97, &mut x98, x2, 0x4699799c49bd6fa6); + let mut x99: u64 = 0; + let mut x100: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x99, &mut x100, x2, 0x83244c95be79eea2); + let mut x101: u64 = 0; + let mut x102: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x101, &mut x102, 0x0, x100, x97); + let mut x103: u64 = 0; + let mut x104: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x103, &mut x104, x102, x98, x95); + let mut x105: u64 = 0; + let mut x106: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x105, &mut x106, x104, x96, x93); + let mut x107: u64 = 0; + let mut x108: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x107, &mut x108, 0x0, x85, x99); + let mut x109: u64 = 0; + let mut x110: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x109, &mut x110, x108, x87, x101); + let mut x111: u64 = 0; + let mut x112: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x111, &mut x112, x110, x89, x103); + let mut x113: u64 = 0; + let mut x114: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x113, &mut x114, x112, x91, x105); + let mut x115: u64 = 0; + let mut x116: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x115, &mut x116, x107, 0xccd1c8aaee00bc4f); + let mut x117: u64 = 0; + let mut x118: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x117, &mut x118, x115, 0xffffffff00000000); + let mut x119: u64 = 0; + let mut x120: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x119, &mut x120, x115, 0xffffffffffffffff); + let mut x121: u64 = 0; + let mut x122: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x121, &mut x122, x115, 0xbce6faada7179e84); + let mut x123: u64 = 0; + let mut x124: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x123, &mut x124, x115, 0xf3b9cac2fc632551); + let mut x125: u64 = 0; + let mut x126: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x125, &mut x126, 0x0, x124, x121); + let mut x127: u64 = 0; + let mut x128: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x127, &mut x128, x126, x122, x119); + let mut x129: u64 = 0; + let mut x130: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x129, &mut x130, x128, x120, x117); + let mut x131: u64 = 0; + let mut x132: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x131, &mut x132, 0x0, x107, x123); + let mut x133: u64 = 0; + let mut x134: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x133, &mut x134, x132, x109, x125); + let mut x135: u64 = 0; + let mut x136: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x135, &mut x136, x134, x111, x127); + let mut x137: u64 = 0; + let mut x138: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x137, &mut x138, x136, x113, x129); + let mut x139: u64 = 0; + let mut x140: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x139, &mut x140, x138, (((x114 as u64) + (x92 as u64)) + ((x106 as u64) + x94)), ((x130 as u64) + x118)); + let mut x141: u64 = 0; + let mut x142: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x141, &mut x142, x3, 0x66e12d94f3d95620); + let mut x143: u64 = 0; + let mut x144: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x143, &mut x144, x3, 0x2845b2392b6bec59); + let mut x145: u64 = 0; + let mut x146: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x145, &mut x146, x3, 0x4699799c49bd6fa6); + let mut x147: u64 = 0; + let mut x148: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x147, &mut x148, x3, 0x83244c95be79eea2); + let mut x149: u64 = 0; + let mut x150: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x149, &mut x150, 0x0, x148, x145); + let mut x151: u64 = 0; + let mut x152: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x151, &mut x152, x150, x146, x143); + let mut x153: u64 = 0; + let mut x154: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x153, &mut x154, x152, x144, x141); + let mut x155: u64 = 0; + let mut x156: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x155, &mut x156, 0x0, x133, x147); + let mut x157: u64 = 0; + let mut x158: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x157, &mut x158, x156, x135, x149); + let mut x159: u64 = 0; + let mut x160: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x159, &mut x160, x158, x137, x151); + let mut x161: u64 = 0; + let mut x162: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x161, &mut x162, x160, x139, x153); + let mut x163: u64 = 0; + let mut x164: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x163, &mut x164, x155, 0xccd1c8aaee00bc4f); + let mut x165: u64 = 0; + let mut x166: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x165, &mut x166, x163, 0xffffffff00000000); + let mut x167: u64 = 0; + let mut x168: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x167, &mut x168, x163, 0xffffffffffffffff); + let mut x169: u64 = 0; + let mut x170: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x169, &mut x170, x163, 0xbce6faada7179e84); + let mut x171: u64 = 0; + let mut x172: u64 = 0; + fiat_p256_scalar_mulx_u64(&mut x171, &mut x172, x163, 0xf3b9cac2fc632551); + let mut x173: u64 = 0; + let mut x174: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x173, &mut x174, 0x0, x172, x169); + let mut x175: u64 = 0; + let mut x176: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x175, &mut x176, x174, x170, x167); + let mut x177: u64 = 0; + let mut x178: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x177, &mut x178, x176, x168, x165); + let mut x179: u64 = 0; + let mut x180: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x179, &mut x180, 0x0, x155, x171); + let mut x181: u64 = 0; + let mut x182: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x181, &mut x182, x180, x157, x173); + let mut x183: u64 = 0; + let mut x184: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x183, &mut x184, x182, x159, x175); + let mut x185: u64 = 0; + let mut x186: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x185, &mut x186, x184, x161, x177); + let mut x187: u64 = 0; + let mut x188: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x187, &mut x188, x186, (((x162 as u64) + (x140 as u64)) + ((x154 as u64) + x142)), ((x178 as u64) + x166)); + let mut x189: u64 = 0; + let mut x190: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u64(&mut x189, &mut x190, 0x0, x181, 0xf3b9cac2fc632551); + let mut x191: u64 = 0; + let mut x192: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u64(&mut x191, &mut x192, x190, x183, 0xbce6faada7179e84); + let mut x193: u64 = 0; + let mut x194: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u64(&mut x193, &mut x194, x192, x185, 0xffffffffffffffff); + let mut x195: u64 = 0; + let mut x196: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u64(&mut x195, &mut x196, x194, x187, 0xffffffff00000000); + let mut x197: u64 = 0; + let mut x198: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u64(&mut x197, &mut x198, x196, (x188 as u64), (0x0 as u64)); + let mut x199: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x199, x198, x189, x181); + let mut x200: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x200, x198, x191, x183); + let mut x201: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x201, x198, x193, x185); + let mut x202: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x202, x198, x195, x187); + out1[0] = x199; + out1[1] = x200; + out1[2] = x201; + out1[3] = x202; +} + +/// The function fiat_p256_scalar_nonzero outputs a single non-zero word if the input is non-zero and zero otherwise. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// out1 = 0 ↔ eval (from_montgomery arg1) mod m = 0 +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +#[inline] +pub fn fiat_p256_scalar_nonzero(out1: &mut u64, arg1: &[u64; 4]) -> () { + let x1: u64 = ((arg1[0]) | ((arg1[1]) | ((arg1[2]) | (arg1[3])))); + *out1 = x1; +} + +/// The function fiat_p256_scalar_selectznz is a multi-limb conditional select. +/// +/// Postconditions: +/// out1 = (if arg1 = 0 then arg2 else arg3) +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +#[inline] +pub fn fiat_p256_scalar_selectznz(out1: &mut [u64; 4], arg1: fiat_p256_scalar_u1, arg2: &[u64; 4], arg3: &[u64; 4]) -> () { + let mut x1: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x1, arg1, (arg2[0]), (arg3[0])); + let mut x2: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x2, arg1, (arg2[1]), (arg3[1])); + let mut x3: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x3, arg1, (arg2[2]), (arg3[2])); + let mut x4: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x4, arg1, (arg2[3]), (arg3[3])); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; + out1[3] = x4; +} + +/// The function fiat_p256_scalar_to_bytes serializes a field element NOT in the Montgomery domain to bytes in little-endian order. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..31] +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] +#[inline] +pub fn fiat_p256_scalar_to_bytes(out1: &mut [u8; 32], arg1: &[u64; 4]) -> () { + let x1: u64 = (arg1[3]); + let x2: u64 = (arg1[2]); + let x3: u64 = (arg1[1]); + let x4: u64 = (arg1[0]); + let x5: u8 = ((x4 & (0xff as u64)) as u8); + let x6: u64 = (x4 >> 8); + let x7: u8 = ((x6 & (0xff as u64)) as u8); + let x8: u64 = (x6 >> 8); + let x9: u8 = ((x8 & (0xff as u64)) as u8); + let x10: u64 = (x8 >> 8); + let x11: u8 = ((x10 & (0xff as u64)) as u8); + let x12: u64 = (x10 >> 8); + let x13: u8 = ((x12 & (0xff as u64)) as u8); + let x14: u64 = (x12 >> 8); + let x15: u8 = ((x14 & (0xff as u64)) as u8); + let x16: u64 = (x14 >> 8); + let x17: u8 = ((x16 & (0xff as u64)) as u8); + let x18: u8 = ((x16 >> 8) as u8); + let x19: u8 = ((x3 & (0xff as u64)) as u8); + let x20: u64 = (x3 >> 8); + let x21: u8 = ((x20 & (0xff as u64)) as u8); + let x22: u64 = (x20 >> 8); + let x23: u8 = ((x22 & (0xff as u64)) as u8); + let x24: u64 = (x22 >> 8); + let x25: u8 = ((x24 & (0xff as u64)) as u8); + let x26: u64 = (x24 >> 8); + let x27: u8 = ((x26 & (0xff as u64)) as u8); + let x28: u64 = (x26 >> 8); + let x29: u8 = ((x28 & (0xff as u64)) as u8); + let x30: u64 = (x28 >> 8); + let x31: u8 = ((x30 & (0xff as u64)) as u8); + let x32: u8 = ((x30 >> 8) as u8); + let x33: u8 = ((x2 & (0xff as u64)) as u8); + let x34: u64 = (x2 >> 8); + let x35: u8 = ((x34 & (0xff as u64)) as u8); + let x36: u64 = (x34 >> 8); + let x37: u8 = ((x36 & (0xff as u64)) as u8); + let x38: u64 = (x36 >> 8); + let x39: u8 = ((x38 & (0xff as u64)) as u8); + let x40: u64 = (x38 >> 8); + let x41: u8 = ((x40 & (0xff as u64)) as u8); + let x42: u64 = (x40 >> 8); + let x43: u8 = ((x42 & (0xff as u64)) as u8); + let x44: u64 = (x42 >> 8); + let x45: u8 = ((x44 & (0xff as u64)) as u8); + let x46: u8 = ((x44 >> 8) as u8); + let x47: u8 = ((x1 & (0xff as u64)) as u8); + let x48: u64 = (x1 >> 8); + let x49: u8 = ((x48 & (0xff as u64)) as u8); + let x50: u64 = (x48 >> 8); + let x51: u8 = ((x50 & (0xff as u64)) as u8); + let x52: u64 = (x50 >> 8); + let x53: u8 = ((x52 & (0xff as u64)) as u8); + let x54: u64 = (x52 >> 8); + let x55: u8 = ((x54 & (0xff as u64)) as u8); + let x56: u64 = (x54 >> 8); + let x57: u8 = ((x56 & (0xff as u64)) as u8); + let x58: u64 = (x56 >> 8); + let x59: u8 = ((x58 & (0xff as u64)) as u8); + let x60: u8 = ((x58 >> 8) as u8); + out1[0] = x5; + out1[1] = x7; + out1[2] = x9; + out1[3] = x11; + out1[4] = x13; + out1[5] = x15; + out1[6] = x17; + out1[7] = x18; + out1[8] = x19; + out1[9] = x21; + out1[10] = x23; + out1[11] = x25; + out1[12] = x27; + out1[13] = x29; + out1[14] = x31; + out1[15] = x32; + out1[16] = x33; + out1[17] = x35; + out1[18] = x37; + out1[19] = x39; + out1[20] = x41; + out1[21] = x43; + out1[22] = x45; + out1[23] = x46; + out1[24] = x47; + out1[25] = x49; + out1[26] = x51; + out1[27] = x53; + out1[28] = x55; + out1[29] = x57; + out1[30] = x59; + out1[31] = x60; +} + +/// The function fiat_p256_scalar_from_bytes deserializes a field element NOT in the Montgomery domain from bytes in little-endian order. +/// +/// Preconditions: +/// 0 ≤ bytes_eval arg1 < m +/// Postconditions: +/// eval out1 mod m = bytes_eval arg1 mod m +/// 0 ≤ eval out1 < m +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +#[inline] +pub fn fiat_p256_scalar_from_bytes(out1: &mut [u64; 4], arg1: &[u8; 32]) -> () { + let x1: u64 = (((arg1[31]) as u64) << 56); + let x2: u64 = (((arg1[30]) as u64) << 48); + let x3: u64 = (((arg1[29]) as u64) << 40); + let x4: u64 = (((arg1[28]) as u64) << 32); + let x5: u64 = (((arg1[27]) as u64) << 24); + let x6: u64 = (((arg1[26]) as u64) << 16); + let x7: u64 = (((arg1[25]) as u64) << 8); + let x8: u8 = (arg1[24]); + let x9: u64 = (((arg1[23]) as u64) << 56); + let x10: u64 = (((arg1[22]) as u64) << 48); + let x11: u64 = (((arg1[21]) as u64) << 40); + let x12: u64 = (((arg1[20]) as u64) << 32); + let x13: u64 = (((arg1[19]) as u64) << 24); + let x14: u64 = (((arg1[18]) as u64) << 16); + let x15: u64 = (((arg1[17]) as u64) << 8); + let x16: u8 = (arg1[16]); + let x17: u64 = (((arg1[15]) as u64) << 56); + let x18: u64 = (((arg1[14]) as u64) << 48); + let x19: u64 = (((arg1[13]) as u64) << 40); + let x20: u64 = (((arg1[12]) as u64) << 32); + let x21: u64 = (((arg1[11]) as u64) << 24); + let x22: u64 = (((arg1[10]) as u64) << 16); + let x23: u64 = (((arg1[9]) as u64) << 8); + let x24: u8 = (arg1[8]); + let x25: u64 = (((arg1[7]) as u64) << 56); + let x26: u64 = (((arg1[6]) as u64) << 48); + let x27: u64 = (((arg1[5]) as u64) << 40); + let x28: u64 = (((arg1[4]) as u64) << 32); + let x29: u64 = (((arg1[3]) as u64) << 24); + let x30: u64 = (((arg1[2]) as u64) << 16); + let x31: u64 = (((arg1[1]) as u64) << 8); + let x32: u8 = (arg1[0]); + let x33: u64 = (x31 + (x32 as u64)); + let x34: u64 = (x30 + x33); + let x35: u64 = (x29 + x34); + let x36: u64 = (x28 + x35); + let x37: u64 = (x27 + x36); + let x38: u64 = (x26 + x37); + let x39: u64 = (x25 + x38); + let x40: u64 = (x23 + (x24 as u64)); + let x41: u64 = (x22 + x40); + let x42: u64 = (x21 + x41); + let x43: u64 = (x20 + x42); + let x44: u64 = (x19 + x43); + let x45: u64 = (x18 + x44); + let x46: u64 = (x17 + x45); + let x47: u64 = (x15 + (x16 as u64)); + let x48: u64 = (x14 + x47); + let x49: u64 = (x13 + x48); + let x50: u64 = (x12 + x49); + let x51: u64 = (x11 + x50); + let x52: u64 = (x10 + x51); + let x53: u64 = (x9 + x52); + let x54: u64 = (x7 + (x8 as u64)); + let x55: u64 = (x6 + x54); + let x56: u64 = (x5 + x55); + let x57: u64 = (x4 + x56); + let x58: u64 = (x3 + x57); + let x59: u64 = (x2 + x58); + let x60: u64 = (x1 + x59); + out1[0] = x39; + out1[1] = x46; + out1[2] = x53; + out1[3] = x60; +} + +/// The function fiat_p256_scalar_set_one returns the field element one in the Montgomery domain. +/// +/// Postconditions: +/// eval (from_montgomery out1) mod m = 1 mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p256_scalar_set_one(out1: &mut fiat_p256_scalar_montgomery_domain_field_element) -> () { + out1[0] = 0xc46353d039cdaaf; + out1[1] = 0x4319055258e8617b; + out1[2] = (0x0 as u64); + out1[3] = 0xffffffff; +} + +/// The function fiat_p256_scalar_msat returns the saturated representation of the prime modulus. +/// +/// Postconditions: +/// twos_complement_eval out1 = m +/// 0 ≤ eval out1 < m +/// +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +#[inline] +pub fn fiat_p256_scalar_msat(out1: &mut [u64; 5]) -> () { + out1[0] = 0xf3b9cac2fc632551; + out1[1] = 0xbce6faada7179e84; + out1[2] = 0xffffffffffffffff; + out1[3] = 0xffffffff00000000; + out1[4] = (0x0 as u64); +} + +/// The function fiat_p256_scalar_divstep computes a divstep. +/// +/// Preconditions: +/// 0 ≤ eval arg4 < m +/// 0 ≤ eval arg5 < m +/// Postconditions: +/// out1 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then 1 - arg1 else 1 + arg1) +/// twos_complement_eval out2 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then twos_complement_eval arg3 else twos_complement_eval arg2) +/// twos_complement_eval out3 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then ⌊(twos_complement_eval arg3 - twos_complement_eval arg2) / 2⌋ else ⌊(twos_complement_eval arg3 + (twos_complement_eval arg3 mod 2) * twos_complement_eval arg2) / 2⌋) +/// eval (from_montgomery out4) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (2 * eval (from_montgomery arg5)) mod m else (2 * eval (from_montgomery arg4)) mod m) +/// eval (from_montgomery out5) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (eval (from_montgomery arg4) - eval (from_montgomery arg4)) mod m else (eval (from_montgomery arg5) + (twos_complement_eval arg3 mod 2) * eval (from_montgomery arg4)) mod m) +/// 0 ≤ eval out5 < m +/// 0 ≤ eval out5 < m +/// 0 ≤ eval out2 < m +/// 0 ≤ eval out3 < m +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0xffffffffffffffff] +/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// arg4: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// arg5: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +/// out2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// out3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// out4: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// out5: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +#[inline] +pub fn fiat_p256_scalar_divstep(out1: &mut u64, out2: &mut [u64; 5], out3: &mut [u64; 5], out4: &mut [u64; 4], out5: &mut [u64; 4], arg1: u64, arg2: &[u64; 5], arg3: &[u64; 5], arg4: &[u64; 4], arg5: &[u64; 4]) -> () { + let mut x1: u64 = 0; + let mut x2: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x1, &mut x2, 0x0, (!arg1), (0x1 as u64)); + let x3: fiat_p256_scalar_u1 = (((x1 >> 63) as fiat_p256_scalar_u1) & (((arg3[0]) & (0x1 as u64)) as fiat_p256_scalar_u1)); + let mut x4: u64 = 0; + let mut x5: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x4, &mut x5, 0x0, (!arg1), (0x1 as u64)); + let mut x6: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x6, x3, arg1, x4); + let mut x7: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x7, x3, (arg2[0]), (arg3[0])); + let mut x8: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x8, x3, (arg2[1]), (arg3[1])); + let mut x9: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x9, x3, (arg2[2]), (arg3[2])); + let mut x10: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x10, x3, (arg2[3]), (arg3[3])); + let mut x11: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x11, x3, (arg2[4]), (arg3[4])); + let mut x12: u64 = 0; + let mut x13: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x12, &mut x13, 0x0, (0x1 as u64), (!(arg2[0]))); + let mut x14: u64 = 0; + let mut x15: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x14, &mut x15, x13, (0x0 as u64), (!(arg2[1]))); + let mut x16: u64 = 0; + let mut x17: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x16, &mut x17, x15, (0x0 as u64), (!(arg2[2]))); + let mut x18: u64 = 0; + let mut x19: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x18, &mut x19, x17, (0x0 as u64), (!(arg2[3]))); + let mut x20: u64 = 0; + let mut x21: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x20, &mut x21, x19, (0x0 as u64), (!(arg2[4]))); + let mut x22: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x22, x3, (arg3[0]), x12); + let mut x23: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x23, x3, (arg3[1]), x14); + let mut x24: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x24, x3, (arg3[2]), x16); + let mut x25: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x25, x3, (arg3[3]), x18); + let mut x26: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x26, x3, (arg3[4]), x20); + let mut x27: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x27, x3, (arg4[0]), (arg5[0])); + let mut x28: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x28, x3, (arg4[1]), (arg5[1])); + let mut x29: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x29, x3, (arg4[2]), (arg5[2])); + let mut x30: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x30, x3, (arg4[3]), (arg5[3])); + let mut x31: u64 = 0; + let mut x32: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x31, &mut x32, 0x0, x27, x27); + let mut x33: u64 = 0; + let mut x34: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x33, &mut x34, x32, x28, x28); + let mut x35: u64 = 0; + let mut x36: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x35, &mut x36, x34, x29, x29); + let mut x37: u64 = 0; + let mut x38: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x37, &mut x38, x36, x30, x30); + let mut x39: u64 = 0; + let mut x40: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u64(&mut x39, &mut x40, 0x0, x31, 0xf3b9cac2fc632551); + let mut x41: u64 = 0; + let mut x42: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u64(&mut x41, &mut x42, x40, x33, 0xbce6faada7179e84); + let mut x43: u64 = 0; + let mut x44: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u64(&mut x43, &mut x44, x42, x35, 0xffffffffffffffff); + let mut x45: u64 = 0; + let mut x46: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u64(&mut x45, &mut x46, x44, x37, 0xffffffff00000000); + let mut x47: u64 = 0; + let mut x48: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u64(&mut x47, &mut x48, x46, (x38 as u64), (0x0 as u64)); + let x49: u64 = (arg4[3]); + let x50: u64 = (arg4[2]); + let x51: u64 = (arg4[1]); + let x52: u64 = (arg4[0]); + let mut x53: u64 = 0; + let mut x54: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u64(&mut x53, &mut x54, 0x0, (0x0 as u64), x52); + let mut x55: u64 = 0; + let mut x56: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u64(&mut x55, &mut x56, x54, (0x0 as u64), x51); + let mut x57: u64 = 0; + let mut x58: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u64(&mut x57, &mut x58, x56, (0x0 as u64), x50); + let mut x59: u64 = 0; + let mut x60: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u64(&mut x59, &mut x60, x58, (0x0 as u64), x49); + let mut x61: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x61, x60, (0x0 as u64), 0xffffffffffffffff); + let mut x62: u64 = 0; + let mut x63: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x62, &mut x63, 0x0, x53, (x61 & 0xf3b9cac2fc632551)); + let mut x64: u64 = 0; + let mut x65: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x64, &mut x65, x63, x55, (x61 & 0xbce6faada7179e84)); + let mut x66: u64 = 0; + let mut x67: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x66, &mut x67, x65, x57, x61); + let mut x68: u64 = 0; + let mut x69: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x68, &mut x69, x67, x59, (x61 & 0xffffffff00000000)); + let mut x70: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x70, x3, (arg5[0]), x62); + let mut x71: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x71, x3, (arg5[1]), x64); + let mut x72: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x72, x3, (arg5[2]), x66); + let mut x73: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x73, x3, (arg5[3]), x68); + let x74: fiat_p256_scalar_u1 = ((x22 & (0x1 as u64)) as fiat_p256_scalar_u1); + let mut x75: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x75, x74, (0x0 as u64), x7); + let mut x76: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x76, x74, (0x0 as u64), x8); + let mut x77: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x77, x74, (0x0 as u64), x9); + let mut x78: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x78, x74, (0x0 as u64), x10); + let mut x79: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x79, x74, (0x0 as u64), x11); + let mut x80: u64 = 0; + let mut x81: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x80, &mut x81, 0x0, x22, x75); + let mut x82: u64 = 0; + let mut x83: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x82, &mut x83, x81, x23, x76); + let mut x84: u64 = 0; + let mut x85: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x84, &mut x85, x83, x24, x77); + let mut x86: u64 = 0; + let mut x87: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x86, &mut x87, x85, x25, x78); + let mut x88: u64 = 0; + let mut x89: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x88, &mut x89, x87, x26, x79); + let mut x90: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x90, x74, (0x0 as u64), x27); + let mut x91: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x91, x74, (0x0 as u64), x28); + let mut x92: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x92, x74, (0x0 as u64), x29); + let mut x93: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x93, x74, (0x0 as u64), x30); + let mut x94: u64 = 0; + let mut x95: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x94, &mut x95, 0x0, x70, x90); + let mut x96: u64 = 0; + let mut x97: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x96, &mut x97, x95, x71, x91); + let mut x98: u64 = 0; + let mut x99: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x98, &mut x99, x97, x72, x92); + let mut x100: u64 = 0; + let mut x101: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x100, &mut x101, x99, x73, x93); + let mut x102: u64 = 0; + let mut x103: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u64(&mut x102, &mut x103, 0x0, x94, 0xf3b9cac2fc632551); + let mut x104: u64 = 0; + let mut x105: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u64(&mut x104, &mut x105, x103, x96, 0xbce6faada7179e84); + let mut x106: u64 = 0; + let mut x107: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u64(&mut x106, &mut x107, x105, x98, 0xffffffffffffffff); + let mut x108: u64 = 0; + let mut x109: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u64(&mut x108, &mut x109, x107, x100, 0xffffffff00000000); + let mut x110: u64 = 0; + let mut x111: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_subborrowx_u64(&mut x110, &mut x111, x109, (x101 as u64), (0x0 as u64)); + let mut x112: u64 = 0; + let mut x113: fiat_p256_scalar_u1 = 0; + fiat_p256_scalar_addcarryx_u64(&mut x112, &mut x113, 0x0, x6, (0x1 as u64)); + let x114: u64 = ((x80 >> 1) | ((x82 << 63) & 0xffffffffffffffff)); + let x115: u64 = ((x82 >> 1) | ((x84 << 63) & 0xffffffffffffffff)); + let x116: u64 = ((x84 >> 1) | ((x86 << 63) & 0xffffffffffffffff)); + let x117: u64 = ((x86 >> 1) | ((x88 << 63) & 0xffffffffffffffff)); + let x118: u64 = ((x88 & 0x8000000000000000) | (x88 >> 1)); + let mut x119: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x119, x48, x39, x31); + let mut x120: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x120, x48, x41, x33); + let mut x121: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x121, x48, x43, x35); + let mut x122: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x122, x48, x45, x37); + let mut x123: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x123, x111, x102, x94); + let mut x124: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x124, x111, x104, x96); + let mut x125: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x125, x111, x106, x98); + let mut x126: u64 = 0; + fiat_p256_scalar_cmovznz_u64(&mut x126, x111, x108, x100); + *out1 = x112; + out2[0] = x7; + out2[1] = x8; + out2[2] = x9; + out2[3] = x10; + out2[4] = x11; + out3[0] = x114; + out3[1] = x115; + out3[2] = x116; + out3[3] = x117; + out3[4] = x118; + out4[0] = x119; + out4[1] = x120; + out4[2] = x121; + out4[3] = x122; + out5[0] = x123; + out5[1] = x124; + out5[2] = x125; + out5[3] = x126; +} + +/// The function fiat_p256_scalar_divstep_precomp returns the precomputed value for Bernstein-Yang-inversion (in montgomery form). +/// +/// Postconditions: +/// eval (from_montgomery out1) = ⌊(m - 1) / 2⌋^(if ⌊log2 m⌋ + 1 < 46 then ⌊(49 * (⌊log2 m⌋ + 1) + 80) / 17⌋ else ⌊(49 * (⌊log2 m⌋ + 1) + 57) / 17⌋) +/// 0 ≤ eval out1 < m +/// +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +#[inline] +pub fn fiat_p256_scalar_divstep_precomp(out1: &mut [u64; 4]) -> () { + out1[0] = 0xd739262fb7fcfbb5; + out1[1] = 0x8ac6f75d20074414; + out1[2] = 0xc67428bfb5e3c256; + out1[3] = 0x444962f2eda7aedf; +} diff --git a/vendor/fiat-crypto/src/p384_32.rs b/vendor/fiat-crypto/src/p384_32.rs new file mode 100644 index 000000000..8160e28ea --- /dev/null +++ b/vendor/fiat-crypto/src/p384_32.rs @@ -0,0 +1,9793 @@ +//! Autogenerated: 'src/ExtractionOCaml/word_by_word_montgomery' --lang Rust --inline p384 32 '2^384 - 2^128 - 2^96 + 2^32 - 1' mul square add sub opp from_montgomery to_montgomery nonzero selectznz to_bytes from_bytes one msat divstep divstep_precomp +//! curve description: p384 +//! machine_wordsize = 32 (from "32") +//! requested operations: mul, square, add, sub, opp, from_montgomery, to_montgomery, nonzero, selectznz, to_bytes, from_bytes, one, msat, divstep, divstep_precomp +//! m = 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffff0000000000000000ffffffff (from "2^384 - 2^128 - 2^96 + 2^32 - 1") +//! +//! NOTE: In addition to the bounds specified above each function, all +//! functions synthesized for this Montgomery arithmetic require the +//! input to be strictly less than the prime modulus (m), and also +//! require the input to be in the unique saturated representation. +//! All functions also ensure that these two properties are true of +//! return values. +//! +//! Computed values: +//! eval z = z[0] + (z[1] << 32) + (z[2] << 64) + (z[3] << 96) + (z[4] << 128) + (z[5] << 160) + (z[6] << 192) + (z[7] << 224) + (z[8] << 256) + (z[9] << 0x120) + (z[10] << 0x140) + (z[11] << 0x160) +//! bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248) + (z[32] << 256) + (z[33] << 0x108) + (z[34] << 0x110) + (z[35] << 0x118) + (z[36] << 0x120) + (z[37] << 0x128) + (z[38] << 0x130) + (z[39] << 0x138) + (z[40] << 0x140) + (z[41] << 0x148) + (z[42] << 0x150) + (z[43] << 0x158) + (z[44] << 0x160) + (z[45] << 0x168) + (z[46] << 0x170) + (z[47] << 0x178) +//! twos_complement_eval z = let x1 := z[0] + (z[1] << 32) + (z[2] << 64) + (z[3] << 96) + (z[4] << 128) + (z[5] << 160) + (z[6] << 192) + (z[7] << 224) + (z[8] << 256) + (z[9] << 0x120) + (z[10] << 0x140) + (z[11] << 0x160) in +//! if x1 & (2^384-1) < 2^383 then x1 & (2^384-1) else (x1 & (2^384-1)) - 2^384 + +#![allow(unused_parens)] +#![allow(non_camel_case_types)] + +pub type fiat_p384_u1 = u8; +pub type fiat_p384_i1 = i8; +pub type fiat_p384_u2 = u8; +pub type fiat_p384_i2 = i8; + +/* The type fiat_p384_montgomery_domain_field_element is a field element in the Montgomery domain. */ +/* Bounds: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] */ +pub type fiat_p384_montgomery_domain_field_element = [u32; 12]; + +/* The type fiat_p384_non_montgomery_domain_field_element is a field element NOT in the Montgomery domain. */ +/* Bounds: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] */ +pub type fiat_p384_non_montgomery_domain_field_element = [u32; 12]; + + +/// The function fiat_p384_addcarryx_u32 is an addition with carry. +/// +/// Postconditions: +/// out1 = (arg1 + arg2 + arg3) mod 2^32 +/// out2 = ⌊(arg1 + arg2 + arg3) / 2^32⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffff] +/// arg3: [0x0 ~> 0xffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_p384_addcarryx_u32(out1: &mut u32, out2: &mut fiat_p384_u1, arg1: fiat_p384_u1, arg2: u32, arg3: u32) -> () { + let x1: u64 = (((arg1 as u64) + (arg2 as u64)) + (arg3 as u64)); + let x2: u32 = ((x1 & (0xffffffff as u64)) as u32); + let x3: fiat_p384_u1 = ((x1 >> 32) as fiat_p384_u1); + *out1 = x2; + *out2 = x3; +} + +/// The function fiat_p384_subborrowx_u32 is a subtraction with borrow. +/// +/// Postconditions: +/// out1 = (-arg1 + arg2 + -arg3) mod 2^32 +/// out2 = -⌊(-arg1 + arg2 + -arg3) / 2^32⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffff] +/// arg3: [0x0 ~> 0xffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_p384_subborrowx_u32(out1: &mut u32, out2: &mut fiat_p384_u1, arg1: fiat_p384_u1, arg2: u32, arg3: u32) -> () { + let x1: i64 = (((arg2 as i64) - (arg1 as i64)) - (arg3 as i64)); + let x2: fiat_p384_i1 = ((x1 >> 32) as fiat_p384_i1); + let x3: u32 = ((x1 & (0xffffffff as i64)) as u32); + *out1 = x3; + *out2 = (((0x0 as fiat_p384_i2) - (x2 as fiat_p384_i2)) as fiat_p384_u1); +} + +/// The function fiat_p384_mulx_u32 is a multiplication, returning the full double-width result. +/// +/// Postconditions: +/// out1 = (arg1 * arg2) mod 2^32 +/// out2 = ⌊arg1 * arg2 / 2^32⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0xffffffff] +/// arg2: [0x0 ~> 0xffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +/// out2: [0x0 ~> 0xffffffff] +#[inline] +pub fn fiat_p384_mulx_u32(out1: &mut u32, out2: &mut u32, arg1: u32, arg2: u32) -> () { + let x1: u64 = ((arg1 as u64) * (arg2 as u64)); + let x2: u32 = ((x1 & (0xffffffff as u64)) as u32); + let x3: u32 = ((x1 >> 32) as u32); + *out1 = x2; + *out2 = x3; +} + +/// The function fiat_p384_cmovznz_u32 is a single-word conditional move. +/// +/// Postconditions: +/// out1 = (if arg1 = 0 then arg2 else arg3) +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffff] +/// arg3: [0x0 ~> 0xffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +#[inline] +pub fn fiat_p384_cmovznz_u32(out1: &mut u32, arg1: fiat_p384_u1, arg2: u32, arg3: u32) -> () { + let x1: fiat_p384_u1 = (!(!arg1)); + let x2: u32 = ((((((0x0 as fiat_p384_i2) - (x1 as fiat_p384_i2)) as fiat_p384_i1) as i64) & (0xffffffff as i64)) as u32); + let x3: u32 = ((x2 & arg3) | ((!x2) & arg2)); + *out1 = x3; +} + +/// The function fiat_p384_mul multiplies two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p384_mul(out1: &mut fiat_p384_montgomery_domain_field_element, arg1: &fiat_p384_montgomery_domain_field_element, arg2: &fiat_p384_montgomery_domain_field_element) -> () { + let x1: u32 = (arg1[1]); + let x2: u32 = (arg1[2]); + let x3: u32 = (arg1[3]); + let x4: u32 = (arg1[4]); + let x5: u32 = (arg1[5]); + let x6: u32 = (arg1[6]); + let x7: u32 = (arg1[7]); + let x8: u32 = (arg1[8]); + let x9: u32 = (arg1[9]); + let x10: u32 = (arg1[10]); + let x11: u32 = (arg1[11]); + let x12: u32 = (arg1[0]); + let mut x13: u32 = 0; + let mut x14: u32 = 0; + fiat_p384_mulx_u32(&mut x13, &mut x14, x12, (arg2[11])); + let mut x15: u32 = 0; + let mut x16: u32 = 0; + fiat_p384_mulx_u32(&mut x15, &mut x16, x12, (arg2[10])); + let mut x17: u32 = 0; + let mut x18: u32 = 0; + fiat_p384_mulx_u32(&mut x17, &mut x18, x12, (arg2[9])); + let mut x19: u32 = 0; + let mut x20: u32 = 0; + fiat_p384_mulx_u32(&mut x19, &mut x20, x12, (arg2[8])); + let mut x21: u32 = 0; + let mut x22: u32 = 0; + fiat_p384_mulx_u32(&mut x21, &mut x22, x12, (arg2[7])); + let mut x23: u32 = 0; + let mut x24: u32 = 0; + fiat_p384_mulx_u32(&mut x23, &mut x24, x12, (arg2[6])); + let mut x25: u32 = 0; + let mut x26: u32 = 0; + fiat_p384_mulx_u32(&mut x25, &mut x26, x12, (arg2[5])); + let mut x27: u32 = 0; + let mut x28: u32 = 0; + fiat_p384_mulx_u32(&mut x27, &mut x28, x12, (arg2[4])); + let mut x29: u32 = 0; + let mut x30: u32 = 0; + fiat_p384_mulx_u32(&mut x29, &mut x30, x12, (arg2[3])); + let mut x31: u32 = 0; + let mut x32: u32 = 0; + fiat_p384_mulx_u32(&mut x31, &mut x32, x12, (arg2[2])); + let mut x33: u32 = 0; + let mut x34: u32 = 0; + fiat_p384_mulx_u32(&mut x33, &mut x34, x12, (arg2[1])); + let mut x35: u32 = 0; + let mut x36: u32 = 0; + fiat_p384_mulx_u32(&mut x35, &mut x36, x12, (arg2[0])); + let mut x37: u32 = 0; + let mut x38: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x37, &mut x38, 0x0, x36, x33); + let mut x39: u32 = 0; + let mut x40: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x39, &mut x40, x38, x34, x31); + let mut x41: u32 = 0; + let mut x42: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x41, &mut x42, x40, x32, x29); + let mut x43: u32 = 0; + let mut x44: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x43, &mut x44, x42, x30, x27); + let mut x45: u32 = 0; + let mut x46: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x45, &mut x46, x44, x28, x25); + let mut x47: u32 = 0; + let mut x48: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x47, &mut x48, x46, x26, x23); + let mut x49: u32 = 0; + let mut x50: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x49, &mut x50, x48, x24, x21); + let mut x51: u32 = 0; + let mut x52: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x51, &mut x52, x50, x22, x19); + let mut x53: u32 = 0; + let mut x54: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x53, &mut x54, x52, x20, x17); + let mut x55: u32 = 0; + let mut x56: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x55, &mut x56, x54, x18, x15); + let mut x57: u32 = 0; + let mut x58: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x57, &mut x58, x56, x16, x13); + let x59: u32 = ((x58 as u32) + x14); + let mut x60: u32 = 0; + let mut x61: u32 = 0; + fiat_p384_mulx_u32(&mut x60, &mut x61, x35, 0xffffffff); + let mut x62: u32 = 0; + let mut x63: u32 = 0; + fiat_p384_mulx_u32(&mut x62, &mut x63, x35, 0xffffffff); + let mut x64: u32 = 0; + let mut x65: u32 = 0; + fiat_p384_mulx_u32(&mut x64, &mut x65, x35, 0xffffffff); + let mut x66: u32 = 0; + let mut x67: u32 = 0; + fiat_p384_mulx_u32(&mut x66, &mut x67, x35, 0xffffffff); + let mut x68: u32 = 0; + let mut x69: u32 = 0; + fiat_p384_mulx_u32(&mut x68, &mut x69, x35, 0xffffffff); + let mut x70: u32 = 0; + let mut x71: u32 = 0; + fiat_p384_mulx_u32(&mut x70, &mut x71, x35, 0xffffffff); + let mut x72: u32 = 0; + let mut x73: u32 = 0; + fiat_p384_mulx_u32(&mut x72, &mut x73, x35, 0xffffffff); + let mut x74: u32 = 0; + let mut x75: u32 = 0; + fiat_p384_mulx_u32(&mut x74, &mut x75, x35, 0xfffffffe); + let mut x76: u32 = 0; + let mut x77: u32 = 0; + fiat_p384_mulx_u32(&mut x76, &mut x77, x35, 0xffffffff); + let mut x78: u32 = 0; + let mut x79: u32 = 0; + fiat_p384_mulx_u32(&mut x78, &mut x79, x35, 0xffffffff); + let mut x80: u32 = 0; + let mut x81: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x80, &mut x81, 0x0, x77, x74); + let mut x82: u32 = 0; + let mut x83: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x82, &mut x83, x81, x75, x72); + let mut x84: u32 = 0; + let mut x85: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x84, &mut x85, x83, x73, x70); + let mut x86: u32 = 0; + let mut x87: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x86, &mut x87, x85, x71, x68); + let mut x88: u32 = 0; + let mut x89: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x88, &mut x89, x87, x69, x66); + let mut x90: u32 = 0; + let mut x91: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x90, &mut x91, x89, x67, x64); + let mut x92: u32 = 0; + let mut x93: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x92, &mut x93, x91, x65, x62); + let mut x94: u32 = 0; + let mut x95: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x94, &mut x95, x93, x63, x60); + let x96: u32 = ((x95 as u32) + x61); + let mut x97: u32 = 0; + let mut x98: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x97, &mut x98, 0x0, x35, x78); + let mut x99: u32 = 0; + let mut x100: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x99, &mut x100, x98, x37, x79); + let mut x101: u32 = 0; + let mut x102: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x101, &mut x102, x100, x39, (0x0 as u32)); + let mut x103: u32 = 0; + let mut x104: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x103, &mut x104, x102, x41, x76); + let mut x105: u32 = 0; + let mut x106: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x105, &mut x106, x104, x43, x80); + let mut x107: u32 = 0; + let mut x108: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x107, &mut x108, x106, x45, x82); + let mut x109: u32 = 0; + let mut x110: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x109, &mut x110, x108, x47, x84); + let mut x111: u32 = 0; + let mut x112: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x111, &mut x112, x110, x49, x86); + let mut x113: u32 = 0; + let mut x114: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x113, &mut x114, x112, x51, x88); + let mut x115: u32 = 0; + let mut x116: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x115, &mut x116, x114, x53, x90); + let mut x117: u32 = 0; + let mut x118: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x117, &mut x118, x116, x55, x92); + let mut x119: u32 = 0; + let mut x120: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x119, &mut x120, x118, x57, x94); + let mut x121: u32 = 0; + let mut x122: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x121, &mut x122, x120, x59, x96); + let mut x123: u32 = 0; + let mut x124: u32 = 0; + fiat_p384_mulx_u32(&mut x123, &mut x124, x1, (arg2[11])); + let mut x125: u32 = 0; + let mut x126: u32 = 0; + fiat_p384_mulx_u32(&mut x125, &mut x126, x1, (arg2[10])); + let mut x127: u32 = 0; + let mut x128: u32 = 0; + fiat_p384_mulx_u32(&mut x127, &mut x128, x1, (arg2[9])); + let mut x129: u32 = 0; + let mut x130: u32 = 0; + fiat_p384_mulx_u32(&mut x129, &mut x130, x1, (arg2[8])); + let mut x131: u32 = 0; + let mut x132: u32 = 0; + fiat_p384_mulx_u32(&mut x131, &mut x132, x1, (arg2[7])); + let mut x133: u32 = 0; + let mut x134: u32 = 0; + fiat_p384_mulx_u32(&mut x133, &mut x134, x1, (arg2[6])); + let mut x135: u32 = 0; + let mut x136: u32 = 0; + fiat_p384_mulx_u32(&mut x135, &mut x136, x1, (arg2[5])); + let mut x137: u32 = 0; + let mut x138: u32 = 0; + fiat_p384_mulx_u32(&mut x137, &mut x138, x1, (arg2[4])); + let mut x139: u32 = 0; + let mut x140: u32 = 0; + fiat_p384_mulx_u32(&mut x139, &mut x140, x1, (arg2[3])); + let mut x141: u32 = 0; + let mut x142: u32 = 0; + fiat_p384_mulx_u32(&mut x141, &mut x142, x1, (arg2[2])); + let mut x143: u32 = 0; + let mut x144: u32 = 0; + fiat_p384_mulx_u32(&mut x143, &mut x144, x1, (arg2[1])); + let mut x145: u32 = 0; + let mut x146: u32 = 0; + fiat_p384_mulx_u32(&mut x145, &mut x146, x1, (arg2[0])); + let mut x147: u32 = 0; + let mut x148: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x147, &mut x148, 0x0, x146, x143); + let mut x149: u32 = 0; + let mut x150: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x149, &mut x150, x148, x144, x141); + let mut x151: u32 = 0; + let mut x152: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x151, &mut x152, x150, x142, x139); + let mut x153: u32 = 0; + let mut x154: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x153, &mut x154, x152, x140, x137); + let mut x155: u32 = 0; + let mut x156: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x155, &mut x156, x154, x138, x135); + let mut x157: u32 = 0; + let mut x158: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x157, &mut x158, x156, x136, x133); + let mut x159: u32 = 0; + let mut x160: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x159, &mut x160, x158, x134, x131); + let mut x161: u32 = 0; + let mut x162: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x161, &mut x162, x160, x132, x129); + let mut x163: u32 = 0; + let mut x164: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x163, &mut x164, x162, x130, x127); + let mut x165: u32 = 0; + let mut x166: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x165, &mut x166, x164, x128, x125); + let mut x167: u32 = 0; + let mut x168: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x167, &mut x168, x166, x126, x123); + let x169: u32 = ((x168 as u32) + x124); + let mut x170: u32 = 0; + let mut x171: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x170, &mut x171, 0x0, x99, x145); + let mut x172: u32 = 0; + let mut x173: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x172, &mut x173, x171, x101, x147); + let mut x174: u32 = 0; + let mut x175: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x174, &mut x175, x173, x103, x149); + let mut x176: u32 = 0; + let mut x177: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x176, &mut x177, x175, x105, x151); + let mut x178: u32 = 0; + let mut x179: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x178, &mut x179, x177, x107, x153); + let mut x180: u32 = 0; + let mut x181: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x180, &mut x181, x179, x109, x155); + let mut x182: u32 = 0; + let mut x183: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x182, &mut x183, x181, x111, x157); + let mut x184: u32 = 0; + let mut x185: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x184, &mut x185, x183, x113, x159); + let mut x186: u32 = 0; + let mut x187: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x186, &mut x187, x185, x115, x161); + let mut x188: u32 = 0; + let mut x189: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x188, &mut x189, x187, x117, x163); + let mut x190: u32 = 0; + let mut x191: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x190, &mut x191, x189, x119, x165); + let mut x192: u32 = 0; + let mut x193: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x192, &mut x193, x191, x121, x167); + let mut x194: u32 = 0; + let mut x195: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x194, &mut x195, x193, (x122 as u32), x169); + let mut x196: u32 = 0; + let mut x197: u32 = 0; + fiat_p384_mulx_u32(&mut x196, &mut x197, x170, 0xffffffff); + let mut x198: u32 = 0; + let mut x199: u32 = 0; + fiat_p384_mulx_u32(&mut x198, &mut x199, x170, 0xffffffff); + let mut x200: u32 = 0; + let mut x201: u32 = 0; + fiat_p384_mulx_u32(&mut x200, &mut x201, x170, 0xffffffff); + let mut x202: u32 = 0; + let mut x203: u32 = 0; + fiat_p384_mulx_u32(&mut x202, &mut x203, x170, 0xffffffff); + let mut x204: u32 = 0; + let mut x205: u32 = 0; + fiat_p384_mulx_u32(&mut x204, &mut x205, x170, 0xffffffff); + let mut x206: u32 = 0; + let mut x207: u32 = 0; + fiat_p384_mulx_u32(&mut x206, &mut x207, x170, 0xffffffff); + let mut x208: u32 = 0; + let mut x209: u32 = 0; + fiat_p384_mulx_u32(&mut x208, &mut x209, x170, 0xffffffff); + let mut x210: u32 = 0; + let mut x211: u32 = 0; + fiat_p384_mulx_u32(&mut x210, &mut x211, x170, 0xfffffffe); + let mut x212: u32 = 0; + let mut x213: u32 = 0; + fiat_p384_mulx_u32(&mut x212, &mut x213, x170, 0xffffffff); + let mut x214: u32 = 0; + let mut x215: u32 = 0; + fiat_p384_mulx_u32(&mut x214, &mut x215, x170, 0xffffffff); + let mut x216: u32 = 0; + let mut x217: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x216, &mut x217, 0x0, x213, x210); + let mut x218: u32 = 0; + let mut x219: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x218, &mut x219, x217, x211, x208); + let mut x220: u32 = 0; + let mut x221: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x220, &mut x221, x219, x209, x206); + let mut x222: u32 = 0; + let mut x223: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x222, &mut x223, x221, x207, x204); + let mut x224: u32 = 0; + let mut x225: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x224, &mut x225, x223, x205, x202); + let mut x226: u32 = 0; + let mut x227: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x226, &mut x227, x225, x203, x200); + let mut x228: u32 = 0; + let mut x229: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x228, &mut x229, x227, x201, x198); + let mut x230: u32 = 0; + let mut x231: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x230, &mut x231, x229, x199, x196); + let x232: u32 = ((x231 as u32) + x197); + let mut x233: u32 = 0; + let mut x234: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x233, &mut x234, 0x0, x170, x214); + let mut x235: u32 = 0; + let mut x236: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x235, &mut x236, x234, x172, x215); + let mut x237: u32 = 0; + let mut x238: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x237, &mut x238, x236, x174, (0x0 as u32)); + let mut x239: u32 = 0; + let mut x240: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x239, &mut x240, x238, x176, x212); + let mut x241: u32 = 0; + let mut x242: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x241, &mut x242, x240, x178, x216); + let mut x243: u32 = 0; + let mut x244: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x243, &mut x244, x242, x180, x218); + let mut x245: u32 = 0; + let mut x246: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x245, &mut x246, x244, x182, x220); + let mut x247: u32 = 0; + let mut x248: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x247, &mut x248, x246, x184, x222); + let mut x249: u32 = 0; + let mut x250: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x249, &mut x250, x248, x186, x224); + let mut x251: u32 = 0; + let mut x252: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x251, &mut x252, x250, x188, x226); + let mut x253: u32 = 0; + let mut x254: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x253, &mut x254, x252, x190, x228); + let mut x255: u32 = 0; + let mut x256: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x255, &mut x256, x254, x192, x230); + let mut x257: u32 = 0; + let mut x258: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x257, &mut x258, x256, x194, x232); + let x259: u32 = ((x258 as u32) + (x195 as u32)); + let mut x260: u32 = 0; + let mut x261: u32 = 0; + fiat_p384_mulx_u32(&mut x260, &mut x261, x2, (arg2[11])); + let mut x262: u32 = 0; + let mut x263: u32 = 0; + fiat_p384_mulx_u32(&mut x262, &mut x263, x2, (arg2[10])); + let mut x264: u32 = 0; + let mut x265: u32 = 0; + fiat_p384_mulx_u32(&mut x264, &mut x265, x2, (arg2[9])); + let mut x266: u32 = 0; + let mut x267: u32 = 0; + fiat_p384_mulx_u32(&mut x266, &mut x267, x2, (arg2[8])); + let mut x268: u32 = 0; + let mut x269: u32 = 0; + fiat_p384_mulx_u32(&mut x268, &mut x269, x2, (arg2[7])); + let mut x270: u32 = 0; + let mut x271: u32 = 0; + fiat_p384_mulx_u32(&mut x270, &mut x271, x2, (arg2[6])); + let mut x272: u32 = 0; + let mut x273: u32 = 0; + fiat_p384_mulx_u32(&mut x272, &mut x273, x2, (arg2[5])); + let mut x274: u32 = 0; + let mut x275: u32 = 0; + fiat_p384_mulx_u32(&mut x274, &mut x275, x2, (arg2[4])); + let mut x276: u32 = 0; + let mut x277: u32 = 0; + fiat_p384_mulx_u32(&mut x276, &mut x277, x2, (arg2[3])); + let mut x278: u32 = 0; + let mut x279: u32 = 0; + fiat_p384_mulx_u32(&mut x278, &mut x279, x2, (arg2[2])); + let mut x280: u32 = 0; + let mut x281: u32 = 0; + fiat_p384_mulx_u32(&mut x280, &mut x281, x2, (arg2[1])); + let mut x282: u32 = 0; + let mut x283: u32 = 0; + fiat_p384_mulx_u32(&mut x282, &mut x283, x2, (arg2[0])); + let mut x284: u32 = 0; + let mut x285: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x284, &mut x285, 0x0, x283, x280); + let mut x286: u32 = 0; + let mut x287: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x286, &mut x287, x285, x281, x278); + let mut x288: u32 = 0; + let mut x289: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x288, &mut x289, x287, x279, x276); + let mut x290: u32 = 0; + let mut x291: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x290, &mut x291, x289, x277, x274); + let mut x292: u32 = 0; + let mut x293: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x292, &mut x293, x291, x275, x272); + let mut x294: u32 = 0; + let mut x295: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x294, &mut x295, x293, x273, x270); + let mut x296: u32 = 0; + let mut x297: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x296, &mut x297, x295, x271, x268); + let mut x298: u32 = 0; + let mut x299: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x298, &mut x299, x297, x269, x266); + let mut x300: u32 = 0; + let mut x301: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x300, &mut x301, x299, x267, x264); + let mut x302: u32 = 0; + let mut x303: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x302, &mut x303, x301, x265, x262); + let mut x304: u32 = 0; + let mut x305: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x304, &mut x305, x303, x263, x260); + let x306: u32 = ((x305 as u32) + x261); + let mut x307: u32 = 0; + let mut x308: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x307, &mut x308, 0x0, x235, x282); + let mut x309: u32 = 0; + let mut x310: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x309, &mut x310, x308, x237, x284); + let mut x311: u32 = 0; + let mut x312: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x311, &mut x312, x310, x239, x286); + let mut x313: u32 = 0; + let mut x314: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x313, &mut x314, x312, x241, x288); + let mut x315: u32 = 0; + let mut x316: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x315, &mut x316, x314, x243, x290); + let mut x317: u32 = 0; + let mut x318: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x317, &mut x318, x316, x245, x292); + let mut x319: u32 = 0; + let mut x320: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x319, &mut x320, x318, x247, x294); + let mut x321: u32 = 0; + let mut x322: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x321, &mut x322, x320, x249, x296); + let mut x323: u32 = 0; + let mut x324: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x323, &mut x324, x322, x251, x298); + let mut x325: u32 = 0; + let mut x326: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x325, &mut x326, x324, x253, x300); + let mut x327: u32 = 0; + let mut x328: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x327, &mut x328, x326, x255, x302); + let mut x329: u32 = 0; + let mut x330: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x329, &mut x330, x328, x257, x304); + let mut x331: u32 = 0; + let mut x332: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x331, &mut x332, x330, x259, x306); + let mut x333: u32 = 0; + let mut x334: u32 = 0; + fiat_p384_mulx_u32(&mut x333, &mut x334, x307, 0xffffffff); + let mut x335: u32 = 0; + let mut x336: u32 = 0; + fiat_p384_mulx_u32(&mut x335, &mut x336, x307, 0xffffffff); + let mut x337: u32 = 0; + let mut x338: u32 = 0; + fiat_p384_mulx_u32(&mut x337, &mut x338, x307, 0xffffffff); + let mut x339: u32 = 0; + let mut x340: u32 = 0; + fiat_p384_mulx_u32(&mut x339, &mut x340, x307, 0xffffffff); + let mut x341: u32 = 0; + let mut x342: u32 = 0; + fiat_p384_mulx_u32(&mut x341, &mut x342, x307, 0xffffffff); + let mut x343: u32 = 0; + let mut x344: u32 = 0; + fiat_p384_mulx_u32(&mut x343, &mut x344, x307, 0xffffffff); + let mut x345: u32 = 0; + let mut x346: u32 = 0; + fiat_p384_mulx_u32(&mut x345, &mut x346, x307, 0xffffffff); + let mut x347: u32 = 0; + let mut x348: u32 = 0; + fiat_p384_mulx_u32(&mut x347, &mut x348, x307, 0xfffffffe); + let mut x349: u32 = 0; + let mut x350: u32 = 0; + fiat_p384_mulx_u32(&mut x349, &mut x350, x307, 0xffffffff); + let mut x351: u32 = 0; + let mut x352: u32 = 0; + fiat_p384_mulx_u32(&mut x351, &mut x352, x307, 0xffffffff); + let mut x353: u32 = 0; + let mut x354: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x353, &mut x354, 0x0, x350, x347); + let mut x355: u32 = 0; + let mut x356: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x355, &mut x356, x354, x348, x345); + let mut x357: u32 = 0; + let mut x358: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x357, &mut x358, x356, x346, x343); + let mut x359: u32 = 0; + let mut x360: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x359, &mut x360, x358, x344, x341); + let mut x361: u32 = 0; + let mut x362: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x361, &mut x362, x360, x342, x339); + let mut x363: u32 = 0; + let mut x364: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x363, &mut x364, x362, x340, x337); + let mut x365: u32 = 0; + let mut x366: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x365, &mut x366, x364, x338, x335); + let mut x367: u32 = 0; + let mut x368: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x367, &mut x368, x366, x336, x333); + let x369: u32 = ((x368 as u32) + x334); + let mut x370: u32 = 0; + let mut x371: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x370, &mut x371, 0x0, x307, x351); + let mut x372: u32 = 0; + let mut x373: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x372, &mut x373, x371, x309, x352); + let mut x374: u32 = 0; + let mut x375: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x374, &mut x375, x373, x311, (0x0 as u32)); + let mut x376: u32 = 0; + let mut x377: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x376, &mut x377, x375, x313, x349); + let mut x378: u32 = 0; + let mut x379: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x378, &mut x379, x377, x315, x353); + let mut x380: u32 = 0; + let mut x381: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x380, &mut x381, x379, x317, x355); + let mut x382: u32 = 0; + let mut x383: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x382, &mut x383, x381, x319, x357); + let mut x384: u32 = 0; + let mut x385: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x384, &mut x385, x383, x321, x359); + let mut x386: u32 = 0; + let mut x387: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x386, &mut x387, x385, x323, x361); + let mut x388: u32 = 0; + let mut x389: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x388, &mut x389, x387, x325, x363); + let mut x390: u32 = 0; + let mut x391: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x390, &mut x391, x389, x327, x365); + let mut x392: u32 = 0; + let mut x393: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x392, &mut x393, x391, x329, x367); + let mut x394: u32 = 0; + let mut x395: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x394, &mut x395, x393, x331, x369); + let x396: u32 = ((x395 as u32) + (x332 as u32)); + let mut x397: u32 = 0; + let mut x398: u32 = 0; + fiat_p384_mulx_u32(&mut x397, &mut x398, x3, (arg2[11])); + let mut x399: u32 = 0; + let mut x400: u32 = 0; + fiat_p384_mulx_u32(&mut x399, &mut x400, x3, (arg2[10])); + let mut x401: u32 = 0; + let mut x402: u32 = 0; + fiat_p384_mulx_u32(&mut x401, &mut x402, x3, (arg2[9])); + let mut x403: u32 = 0; + let mut x404: u32 = 0; + fiat_p384_mulx_u32(&mut x403, &mut x404, x3, (arg2[8])); + let mut x405: u32 = 0; + let mut x406: u32 = 0; + fiat_p384_mulx_u32(&mut x405, &mut x406, x3, (arg2[7])); + let mut x407: u32 = 0; + let mut x408: u32 = 0; + fiat_p384_mulx_u32(&mut x407, &mut x408, x3, (arg2[6])); + let mut x409: u32 = 0; + let mut x410: u32 = 0; + fiat_p384_mulx_u32(&mut x409, &mut x410, x3, (arg2[5])); + let mut x411: u32 = 0; + let mut x412: u32 = 0; + fiat_p384_mulx_u32(&mut x411, &mut x412, x3, (arg2[4])); + let mut x413: u32 = 0; + let mut x414: u32 = 0; + fiat_p384_mulx_u32(&mut x413, &mut x414, x3, (arg2[3])); + let mut x415: u32 = 0; + let mut x416: u32 = 0; + fiat_p384_mulx_u32(&mut x415, &mut x416, x3, (arg2[2])); + let mut x417: u32 = 0; + let mut x418: u32 = 0; + fiat_p384_mulx_u32(&mut x417, &mut x418, x3, (arg2[1])); + let mut x419: u32 = 0; + let mut x420: u32 = 0; + fiat_p384_mulx_u32(&mut x419, &mut x420, x3, (arg2[0])); + let mut x421: u32 = 0; + let mut x422: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x421, &mut x422, 0x0, x420, x417); + let mut x423: u32 = 0; + let mut x424: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x423, &mut x424, x422, x418, x415); + let mut x425: u32 = 0; + let mut x426: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x425, &mut x426, x424, x416, x413); + let mut x427: u32 = 0; + let mut x428: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x427, &mut x428, x426, x414, x411); + let mut x429: u32 = 0; + let mut x430: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x429, &mut x430, x428, x412, x409); + let mut x431: u32 = 0; + let mut x432: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x431, &mut x432, x430, x410, x407); + let mut x433: u32 = 0; + let mut x434: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x433, &mut x434, x432, x408, x405); + let mut x435: u32 = 0; + let mut x436: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x435, &mut x436, x434, x406, x403); + let mut x437: u32 = 0; + let mut x438: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x437, &mut x438, x436, x404, x401); + let mut x439: u32 = 0; + let mut x440: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x439, &mut x440, x438, x402, x399); + let mut x441: u32 = 0; + let mut x442: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x441, &mut x442, x440, x400, x397); + let x443: u32 = ((x442 as u32) + x398); + let mut x444: u32 = 0; + let mut x445: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x444, &mut x445, 0x0, x372, x419); + let mut x446: u32 = 0; + let mut x447: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x446, &mut x447, x445, x374, x421); + let mut x448: u32 = 0; + let mut x449: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x448, &mut x449, x447, x376, x423); + let mut x450: u32 = 0; + let mut x451: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x450, &mut x451, x449, x378, x425); + let mut x452: u32 = 0; + let mut x453: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x452, &mut x453, x451, x380, x427); + let mut x454: u32 = 0; + let mut x455: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x454, &mut x455, x453, x382, x429); + let mut x456: u32 = 0; + let mut x457: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x456, &mut x457, x455, x384, x431); + let mut x458: u32 = 0; + let mut x459: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x458, &mut x459, x457, x386, x433); + let mut x460: u32 = 0; + let mut x461: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x460, &mut x461, x459, x388, x435); + let mut x462: u32 = 0; + let mut x463: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x462, &mut x463, x461, x390, x437); + let mut x464: u32 = 0; + let mut x465: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x464, &mut x465, x463, x392, x439); + let mut x466: u32 = 0; + let mut x467: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x466, &mut x467, x465, x394, x441); + let mut x468: u32 = 0; + let mut x469: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x468, &mut x469, x467, x396, x443); + let mut x470: u32 = 0; + let mut x471: u32 = 0; + fiat_p384_mulx_u32(&mut x470, &mut x471, x444, 0xffffffff); + let mut x472: u32 = 0; + let mut x473: u32 = 0; + fiat_p384_mulx_u32(&mut x472, &mut x473, x444, 0xffffffff); + let mut x474: u32 = 0; + let mut x475: u32 = 0; + fiat_p384_mulx_u32(&mut x474, &mut x475, x444, 0xffffffff); + let mut x476: u32 = 0; + let mut x477: u32 = 0; + fiat_p384_mulx_u32(&mut x476, &mut x477, x444, 0xffffffff); + let mut x478: u32 = 0; + let mut x479: u32 = 0; + fiat_p384_mulx_u32(&mut x478, &mut x479, x444, 0xffffffff); + let mut x480: u32 = 0; + let mut x481: u32 = 0; + fiat_p384_mulx_u32(&mut x480, &mut x481, x444, 0xffffffff); + let mut x482: u32 = 0; + let mut x483: u32 = 0; + fiat_p384_mulx_u32(&mut x482, &mut x483, x444, 0xffffffff); + let mut x484: u32 = 0; + let mut x485: u32 = 0; + fiat_p384_mulx_u32(&mut x484, &mut x485, x444, 0xfffffffe); + let mut x486: u32 = 0; + let mut x487: u32 = 0; + fiat_p384_mulx_u32(&mut x486, &mut x487, x444, 0xffffffff); + let mut x488: u32 = 0; + let mut x489: u32 = 0; + fiat_p384_mulx_u32(&mut x488, &mut x489, x444, 0xffffffff); + let mut x490: u32 = 0; + let mut x491: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x490, &mut x491, 0x0, x487, x484); + let mut x492: u32 = 0; + let mut x493: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x492, &mut x493, x491, x485, x482); + let mut x494: u32 = 0; + let mut x495: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x494, &mut x495, x493, x483, x480); + let mut x496: u32 = 0; + let mut x497: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x496, &mut x497, x495, x481, x478); + let mut x498: u32 = 0; + let mut x499: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x498, &mut x499, x497, x479, x476); + let mut x500: u32 = 0; + let mut x501: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x500, &mut x501, x499, x477, x474); + let mut x502: u32 = 0; + let mut x503: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x502, &mut x503, x501, x475, x472); + let mut x504: u32 = 0; + let mut x505: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x504, &mut x505, x503, x473, x470); + let x506: u32 = ((x505 as u32) + x471); + let mut x507: u32 = 0; + let mut x508: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x507, &mut x508, 0x0, x444, x488); + let mut x509: u32 = 0; + let mut x510: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x509, &mut x510, x508, x446, x489); + let mut x511: u32 = 0; + let mut x512: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x511, &mut x512, x510, x448, (0x0 as u32)); + let mut x513: u32 = 0; + let mut x514: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x513, &mut x514, x512, x450, x486); + let mut x515: u32 = 0; + let mut x516: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x515, &mut x516, x514, x452, x490); + let mut x517: u32 = 0; + let mut x518: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x517, &mut x518, x516, x454, x492); + let mut x519: u32 = 0; + let mut x520: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x519, &mut x520, x518, x456, x494); + let mut x521: u32 = 0; + let mut x522: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x521, &mut x522, x520, x458, x496); + let mut x523: u32 = 0; + let mut x524: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x523, &mut x524, x522, x460, x498); + let mut x525: u32 = 0; + let mut x526: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x525, &mut x526, x524, x462, x500); + let mut x527: u32 = 0; + let mut x528: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x527, &mut x528, x526, x464, x502); + let mut x529: u32 = 0; + let mut x530: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x529, &mut x530, x528, x466, x504); + let mut x531: u32 = 0; + let mut x532: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x531, &mut x532, x530, x468, x506); + let x533: u32 = ((x532 as u32) + (x469 as u32)); + let mut x534: u32 = 0; + let mut x535: u32 = 0; + fiat_p384_mulx_u32(&mut x534, &mut x535, x4, (arg2[11])); + let mut x536: u32 = 0; + let mut x537: u32 = 0; + fiat_p384_mulx_u32(&mut x536, &mut x537, x4, (arg2[10])); + let mut x538: u32 = 0; + let mut x539: u32 = 0; + fiat_p384_mulx_u32(&mut x538, &mut x539, x4, (arg2[9])); + let mut x540: u32 = 0; + let mut x541: u32 = 0; + fiat_p384_mulx_u32(&mut x540, &mut x541, x4, (arg2[8])); + let mut x542: u32 = 0; + let mut x543: u32 = 0; + fiat_p384_mulx_u32(&mut x542, &mut x543, x4, (arg2[7])); + let mut x544: u32 = 0; + let mut x545: u32 = 0; + fiat_p384_mulx_u32(&mut x544, &mut x545, x4, (arg2[6])); + let mut x546: u32 = 0; + let mut x547: u32 = 0; + fiat_p384_mulx_u32(&mut x546, &mut x547, x4, (arg2[5])); + let mut x548: u32 = 0; + let mut x549: u32 = 0; + fiat_p384_mulx_u32(&mut x548, &mut x549, x4, (arg2[4])); + let mut x550: u32 = 0; + let mut x551: u32 = 0; + fiat_p384_mulx_u32(&mut x550, &mut x551, x4, (arg2[3])); + let mut x552: u32 = 0; + let mut x553: u32 = 0; + fiat_p384_mulx_u32(&mut x552, &mut x553, x4, (arg2[2])); + let mut x554: u32 = 0; + let mut x555: u32 = 0; + fiat_p384_mulx_u32(&mut x554, &mut x555, x4, (arg2[1])); + let mut x556: u32 = 0; + let mut x557: u32 = 0; + fiat_p384_mulx_u32(&mut x556, &mut x557, x4, (arg2[0])); + let mut x558: u32 = 0; + let mut x559: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x558, &mut x559, 0x0, x557, x554); + let mut x560: u32 = 0; + let mut x561: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x560, &mut x561, x559, x555, x552); + let mut x562: u32 = 0; + let mut x563: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x562, &mut x563, x561, x553, x550); + let mut x564: u32 = 0; + let mut x565: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x564, &mut x565, x563, x551, x548); + let mut x566: u32 = 0; + let mut x567: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x566, &mut x567, x565, x549, x546); + let mut x568: u32 = 0; + let mut x569: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x568, &mut x569, x567, x547, x544); + let mut x570: u32 = 0; + let mut x571: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x570, &mut x571, x569, x545, x542); + let mut x572: u32 = 0; + let mut x573: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x572, &mut x573, x571, x543, x540); + let mut x574: u32 = 0; + let mut x575: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x574, &mut x575, x573, x541, x538); + let mut x576: u32 = 0; + let mut x577: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x576, &mut x577, x575, x539, x536); + let mut x578: u32 = 0; + let mut x579: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x578, &mut x579, x577, x537, x534); + let x580: u32 = ((x579 as u32) + x535); + let mut x581: u32 = 0; + let mut x582: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x581, &mut x582, 0x0, x509, x556); + let mut x583: u32 = 0; + let mut x584: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x583, &mut x584, x582, x511, x558); + let mut x585: u32 = 0; + let mut x586: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x585, &mut x586, x584, x513, x560); + let mut x587: u32 = 0; + let mut x588: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x587, &mut x588, x586, x515, x562); + let mut x589: u32 = 0; + let mut x590: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x589, &mut x590, x588, x517, x564); + let mut x591: u32 = 0; + let mut x592: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x591, &mut x592, x590, x519, x566); + let mut x593: u32 = 0; + let mut x594: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x593, &mut x594, x592, x521, x568); + let mut x595: u32 = 0; + let mut x596: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x595, &mut x596, x594, x523, x570); + let mut x597: u32 = 0; + let mut x598: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x597, &mut x598, x596, x525, x572); + let mut x599: u32 = 0; + let mut x600: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x599, &mut x600, x598, x527, x574); + let mut x601: u32 = 0; + let mut x602: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x601, &mut x602, x600, x529, x576); + let mut x603: u32 = 0; + let mut x604: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x603, &mut x604, x602, x531, x578); + let mut x605: u32 = 0; + let mut x606: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x605, &mut x606, x604, x533, x580); + let mut x607: u32 = 0; + let mut x608: u32 = 0; + fiat_p384_mulx_u32(&mut x607, &mut x608, x581, 0xffffffff); + let mut x609: u32 = 0; + let mut x610: u32 = 0; + fiat_p384_mulx_u32(&mut x609, &mut x610, x581, 0xffffffff); + let mut x611: u32 = 0; + let mut x612: u32 = 0; + fiat_p384_mulx_u32(&mut x611, &mut x612, x581, 0xffffffff); + let mut x613: u32 = 0; + let mut x614: u32 = 0; + fiat_p384_mulx_u32(&mut x613, &mut x614, x581, 0xffffffff); + let mut x615: u32 = 0; + let mut x616: u32 = 0; + fiat_p384_mulx_u32(&mut x615, &mut x616, x581, 0xffffffff); + let mut x617: u32 = 0; + let mut x618: u32 = 0; + fiat_p384_mulx_u32(&mut x617, &mut x618, x581, 0xffffffff); + let mut x619: u32 = 0; + let mut x620: u32 = 0; + fiat_p384_mulx_u32(&mut x619, &mut x620, x581, 0xffffffff); + let mut x621: u32 = 0; + let mut x622: u32 = 0; + fiat_p384_mulx_u32(&mut x621, &mut x622, x581, 0xfffffffe); + let mut x623: u32 = 0; + let mut x624: u32 = 0; + fiat_p384_mulx_u32(&mut x623, &mut x624, x581, 0xffffffff); + let mut x625: u32 = 0; + let mut x626: u32 = 0; + fiat_p384_mulx_u32(&mut x625, &mut x626, x581, 0xffffffff); + let mut x627: u32 = 0; + let mut x628: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x627, &mut x628, 0x0, x624, x621); + let mut x629: u32 = 0; + let mut x630: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x629, &mut x630, x628, x622, x619); + let mut x631: u32 = 0; + let mut x632: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x631, &mut x632, x630, x620, x617); + let mut x633: u32 = 0; + let mut x634: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x633, &mut x634, x632, x618, x615); + let mut x635: u32 = 0; + let mut x636: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x635, &mut x636, x634, x616, x613); + let mut x637: u32 = 0; + let mut x638: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x637, &mut x638, x636, x614, x611); + let mut x639: u32 = 0; + let mut x640: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x639, &mut x640, x638, x612, x609); + let mut x641: u32 = 0; + let mut x642: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x641, &mut x642, x640, x610, x607); + let x643: u32 = ((x642 as u32) + x608); + let mut x644: u32 = 0; + let mut x645: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x644, &mut x645, 0x0, x581, x625); + let mut x646: u32 = 0; + let mut x647: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x646, &mut x647, x645, x583, x626); + let mut x648: u32 = 0; + let mut x649: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x648, &mut x649, x647, x585, (0x0 as u32)); + let mut x650: u32 = 0; + let mut x651: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x650, &mut x651, x649, x587, x623); + let mut x652: u32 = 0; + let mut x653: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x652, &mut x653, x651, x589, x627); + let mut x654: u32 = 0; + let mut x655: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x654, &mut x655, x653, x591, x629); + let mut x656: u32 = 0; + let mut x657: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x656, &mut x657, x655, x593, x631); + let mut x658: u32 = 0; + let mut x659: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x658, &mut x659, x657, x595, x633); + let mut x660: u32 = 0; + let mut x661: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x660, &mut x661, x659, x597, x635); + let mut x662: u32 = 0; + let mut x663: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x662, &mut x663, x661, x599, x637); + let mut x664: u32 = 0; + let mut x665: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x664, &mut x665, x663, x601, x639); + let mut x666: u32 = 0; + let mut x667: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x666, &mut x667, x665, x603, x641); + let mut x668: u32 = 0; + let mut x669: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x668, &mut x669, x667, x605, x643); + let x670: u32 = ((x669 as u32) + (x606 as u32)); + let mut x671: u32 = 0; + let mut x672: u32 = 0; + fiat_p384_mulx_u32(&mut x671, &mut x672, x5, (arg2[11])); + let mut x673: u32 = 0; + let mut x674: u32 = 0; + fiat_p384_mulx_u32(&mut x673, &mut x674, x5, (arg2[10])); + let mut x675: u32 = 0; + let mut x676: u32 = 0; + fiat_p384_mulx_u32(&mut x675, &mut x676, x5, (arg2[9])); + let mut x677: u32 = 0; + let mut x678: u32 = 0; + fiat_p384_mulx_u32(&mut x677, &mut x678, x5, (arg2[8])); + let mut x679: u32 = 0; + let mut x680: u32 = 0; + fiat_p384_mulx_u32(&mut x679, &mut x680, x5, (arg2[7])); + let mut x681: u32 = 0; + let mut x682: u32 = 0; + fiat_p384_mulx_u32(&mut x681, &mut x682, x5, (arg2[6])); + let mut x683: u32 = 0; + let mut x684: u32 = 0; + fiat_p384_mulx_u32(&mut x683, &mut x684, x5, (arg2[5])); + let mut x685: u32 = 0; + let mut x686: u32 = 0; + fiat_p384_mulx_u32(&mut x685, &mut x686, x5, (arg2[4])); + let mut x687: u32 = 0; + let mut x688: u32 = 0; + fiat_p384_mulx_u32(&mut x687, &mut x688, x5, (arg2[3])); + let mut x689: u32 = 0; + let mut x690: u32 = 0; + fiat_p384_mulx_u32(&mut x689, &mut x690, x5, (arg2[2])); + let mut x691: u32 = 0; + let mut x692: u32 = 0; + fiat_p384_mulx_u32(&mut x691, &mut x692, x5, (arg2[1])); + let mut x693: u32 = 0; + let mut x694: u32 = 0; + fiat_p384_mulx_u32(&mut x693, &mut x694, x5, (arg2[0])); + let mut x695: u32 = 0; + let mut x696: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x695, &mut x696, 0x0, x694, x691); + let mut x697: u32 = 0; + let mut x698: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x697, &mut x698, x696, x692, x689); + let mut x699: u32 = 0; + let mut x700: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x699, &mut x700, x698, x690, x687); + let mut x701: u32 = 0; + let mut x702: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x701, &mut x702, x700, x688, x685); + let mut x703: u32 = 0; + let mut x704: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x703, &mut x704, x702, x686, x683); + let mut x705: u32 = 0; + let mut x706: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x705, &mut x706, x704, x684, x681); + let mut x707: u32 = 0; + let mut x708: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x707, &mut x708, x706, x682, x679); + let mut x709: u32 = 0; + let mut x710: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x709, &mut x710, x708, x680, x677); + let mut x711: u32 = 0; + let mut x712: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x711, &mut x712, x710, x678, x675); + let mut x713: u32 = 0; + let mut x714: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x713, &mut x714, x712, x676, x673); + let mut x715: u32 = 0; + let mut x716: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x715, &mut x716, x714, x674, x671); + let x717: u32 = ((x716 as u32) + x672); + let mut x718: u32 = 0; + let mut x719: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x718, &mut x719, 0x0, x646, x693); + let mut x720: u32 = 0; + let mut x721: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x720, &mut x721, x719, x648, x695); + let mut x722: u32 = 0; + let mut x723: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x722, &mut x723, x721, x650, x697); + let mut x724: u32 = 0; + let mut x725: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x724, &mut x725, x723, x652, x699); + let mut x726: u32 = 0; + let mut x727: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x726, &mut x727, x725, x654, x701); + let mut x728: u32 = 0; + let mut x729: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x728, &mut x729, x727, x656, x703); + let mut x730: u32 = 0; + let mut x731: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x730, &mut x731, x729, x658, x705); + let mut x732: u32 = 0; + let mut x733: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x732, &mut x733, x731, x660, x707); + let mut x734: u32 = 0; + let mut x735: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x734, &mut x735, x733, x662, x709); + let mut x736: u32 = 0; + let mut x737: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x736, &mut x737, x735, x664, x711); + let mut x738: u32 = 0; + let mut x739: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x738, &mut x739, x737, x666, x713); + let mut x740: u32 = 0; + let mut x741: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x740, &mut x741, x739, x668, x715); + let mut x742: u32 = 0; + let mut x743: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x742, &mut x743, x741, x670, x717); + let mut x744: u32 = 0; + let mut x745: u32 = 0; + fiat_p384_mulx_u32(&mut x744, &mut x745, x718, 0xffffffff); + let mut x746: u32 = 0; + let mut x747: u32 = 0; + fiat_p384_mulx_u32(&mut x746, &mut x747, x718, 0xffffffff); + let mut x748: u32 = 0; + let mut x749: u32 = 0; + fiat_p384_mulx_u32(&mut x748, &mut x749, x718, 0xffffffff); + let mut x750: u32 = 0; + let mut x751: u32 = 0; + fiat_p384_mulx_u32(&mut x750, &mut x751, x718, 0xffffffff); + let mut x752: u32 = 0; + let mut x753: u32 = 0; + fiat_p384_mulx_u32(&mut x752, &mut x753, x718, 0xffffffff); + let mut x754: u32 = 0; + let mut x755: u32 = 0; + fiat_p384_mulx_u32(&mut x754, &mut x755, x718, 0xffffffff); + let mut x756: u32 = 0; + let mut x757: u32 = 0; + fiat_p384_mulx_u32(&mut x756, &mut x757, x718, 0xffffffff); + let mut x758: u32 = 0; + let mut x759: u32 = 0; + fiat_p384_mulx_u32(&mut x758, &mut x759, x718, 0xfffffffe); + let mut x760: u32 = 0; + let mut x761: u32 = 0; + fiat_p384_mulx_u32(&mut x760, &mut x761, x718, 0xffffffff); + let mut x762: u32 = 0; + let mut x763: u32 = 0; + fiat_p384_mulx_u32(&mut x762, &mut x763, x718, 0xffffffff); + let mut x764: u32 = 0; + let mut x765: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x764, &mut x765, 0x0, x761, x758); + let mut x766: u32 = 0; + let mut x767: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x766, &mut x767, x765, x759, x756); + let mut x768: u32 = 0; + let mut x769: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x768, &mut x769, x767, x757, x754); + let mut x770: u32 = 0; + let mut x771: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x770, &mut x771, x769, x755, x752); + let mut x772: u32 = 0; + let mut x773: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x772, &mut x773, x771, x753, x750); + let mut x774: u32 = 0; + let mut x775: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x774, &mut x775, x773, x751, x748); + let mut x776: u32 = 0; + let mut x777: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x776, &mut x777, x775, x749, x746); + let mut x778: u32 = 0; + let mut x779: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x778, &mut x779, x777, x747, x744); + let x780: u32 = ((x779 as u32) + x745); + let mut x781: u32 = 0; + let mut x782: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x781, &mut x782, 0x0, x718, x762); + let mut x783: u32 = 0; + let mut x784: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x783, &mut x784, x782, x720, x763); + let mut x785: u32 = 0; + let mut x786: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x785, &mut x786, x784, x722, (0x0 as u32)); + let mut x787: u32 = 0; + let mut x788: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x787, &mut x788, x786, x724, x760); + let mut x789: u32 = 0; + let mut x790: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x789, &mut x790, x788, x726, x764); + let mut x791: u32 = 0; + let mut x792: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x791, &mut x792, x790, x728, x766); + let mut x793: u32 = 0; + let mut x794: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x793, &mut x794, x792, x730, x768); + let mut x795: u32 = 0; + let mut x796: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x795, &mut x796, x794, x732, x770); + let mut x797: u32 = 0; + let mut x798: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x797, &mut x798, x796, x734, x772); + let mut x799: u32 = 0; + let mut x800: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x799, &mut x800, x798, x736, x774); + let mut x801: u32 = 0; + let mut x802: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x801, &mut x802, x800, x738, x776); + let mut x803: u32 = 0; + let mut x804: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x803, &mut x804, x802, x740, x778); + let mut x805: u32 = 0; + let mut x806: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x805, &mut x806, x804, x742, x780); + let x807: u32 = ((x806 as u32) + (x743 as u32)); + let mut x808: u32 = 0; + let mut x809: u32 = 0; + fiat_p384_mulx_u32(&mut x808, &mut x809, x6, (arg2[11])); + let mut x810: u32 = 0; + let mut x811: u32 = 0; + fiat_p384_mulx_u32(&mut x810, &mut x811, x6, (arg2[10])); + let mut x812: u32 = 0; + let mut x813: u32 = 0; + fiat_p384_mulx_u32(&mut x812, &mut x813, x6, (arg2[9])); + let mut x814: u32 = 0; + let mut x815: u32 = 0; + fiat_p384_mulx_u32(&mut x814, &mut x815, x6, (arg2[8])); + let mut x816: u32 = 0; + let mut x817: u32 = 0; + fiat_p384_mulx_u32(&mut x816, &mut x817, x6, (arg2[7])); + let mut x818: u32 = 0; + let mut x819: u32 = 0; + fiat_p384_mulx_u32(&mut x818, &mut x819, x6, (arg2[6])); + let mut x820: u32 = 0; + let mut x821: u32 = 0; + fiat_p384_mulx_u32(&mut x820, &mut x821, x6, (arg2[5])); + let mut x822: u32 = 0; + let mut x823: u32 = 0; + fiat_p384_mulx_u32(&mut x822, &mut x823, x6, (arg2[4])); + let mut x824: u32 = 0; + let mut x825: u32 = 0; + fiat_p384_mulx_u32(&mut x824, &mut x825, x6, (arg2[3])); + let mut x826: u32 = 0; + let mut x827: u32 = 0; + fiat_p384_mulx_u32(&mut x826, &mut x827, x6, (arg2[2])); + let mut x828: u32 = 0; + let mut x829: u32 = 0; + fiat_p384_mulx_u32(&mut x828, &mut x829, x6, (arg2[1])); + let mut x830: u32 = 0; + let mut x831: u32 = 0; + fiat_p384_mulx_u32(&mut x830, &mut x831, x6, (arg2[0])); + let mut x832: u32 = 0; + let mut x833: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x832, &mut x833, 0x0, x831, x828); + let mut x834: u32 = 0; + let mut x835: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x834, &mut x835, x833, x829, x826); + let mut x836: u32 = 0; + let mut x837: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x836, &mut x837, x835, x827, x824); + let mut x838: u32 = 0; + let mut x839: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x838, &mut x839, x837, x825, x822); + let mut x840: u32 = 0; + let mut x841: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x840, &mut x841, x839, x823, x820); + let mut x842: u32 = 0; + let mut x843: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x842, &mut x843, x841, x821, x818); + let mut x844: u32 = 0; + let mut x845: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x844, &mut x845, x843, x819, x816); + let mut x846: u32 = 0; + let mut x847: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x846, &mut x847, x845, x817, x814); + let mut x848: u32 = 0; + let mut x849: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x848, &mut x849, x847, x815, x812); + let mut x850: u32 = 0; + let mut x851: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x850, &mut x851, x849, x813, x810); + let mut x852: u32 = 0; + let mut x853: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x852, &mut x853, x851, x811, x808); + let x854: u32 = ((x853 as u32) + x809); + let mut x855: u32 = 0; + let mut x856: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x855, &mut x856, 0x0, x783, x830); + let mut x857: u32 = 0; + let mut x858: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x857, &mut x858, x856, x785, x832); + let mut x859: u32 = 0; + let mut x860: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x859, &mut x860, x858, x787, x834); + let mut x861: u32 = 0; + let mut x862: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x861, &mut x862, x860, x789, x836); + let mut x863: u32 = 0; + let mut x864: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x863, &mut x864, x862, x791, x838); + let mut x865: u32 = 0; + let mut x866: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x865, &mut x866, x864, x793, x840); + let mut x867: u32 = 0; + let mut x868: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x867, &mut x868, x866, x795, x842); + let mut x869: u32 = 0; + let mut x870: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x869, &mut x870, x868, x797, x844); + let mut x871: u32 = 0; + let mut x872: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x871, &mut x872, x870, x799, x846); + let mut x873: u32 = 0; + let mut x874: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x873, &mut x874, x872, x801, x848); + let mut x875: u32 = 0; + let mut x876: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x875, &mut x876, x874, x803, x850); + let mut x877: u32 = 0; + let mut x878: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x877, &mut x878, x876, x805, x852); + let mut x879: u32 = 0; + let mut x880: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x879, &mut x880, x878, x807, x854); + let mut x881: u32 = 0; + let mut x882: u32 = 0; + fiat_p384_mulx_u32(&mut x881, &mut x882, x855, 0xffffffff); + let mut x883: u32 = 0; + let mut x884: u32 = 0; + fiat_p384_mulx_u32(&mut x883, &mut x884, x855, 0xffffffff); + let mut x885: u32 = 0; + let mut x886: u32 = 0; + fiat_p384_mulx_u32(&mut x885, &mut x886, x855, 0xffffffff); + let mut x887: u32 = 0; + let mut x888: u32 = 0; + fiat_p384_mulx_u32(&mut x887, &mut x888, x855, 0xffffffff); + let mut x889: u32 = 0; + let mut x890: u32 = 0; + fiat_p384_mulx_u32(&mut x889, &mut x890, x855, 0xffffffff); + let mut x891: u32 = 0; + let mut x892: u32 = 0; + fiat_p384_mulx_u32(&mut x891, &mut x892, x855, 0xffffffff); + let mut x893: u32 = 0; + let mut x894: u32 = 0; + fiat_p384_mulx_u32(&mut x893, &mut x894, x855, 0xffffffff); + let mut x895: u32 = 0; + let mut x896: u32 = 0; + fiat_p384_mulx_u32(&mut x895, &mut x896, x855, 0xfffffffe); + let mut x897: u32 = 0; + let mut x898: u32 = 0; + fiat_p384_mulx_u32(&mut x897, &mut x898, x855, 0xffffffff); + let mut x899: u32 = 0; + let mut x900: u32 = 0; + fiat_p384_mulx_u32(&mut x899, &mut x900, x855, 0xffffffff); + let mut x901: u32 = 0; + let mut x902: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x901, &mut x902, 0x0, x898, x895); + let mut x903: u32 = 0; + let mut x904: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x903, &mut x904, x902, x896, x893); + let mut x905: u32 = 0; + let mut x906: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x905, &mut x906, x904, x894, x891); + let mut x907: u32 = 0; + let mut x908: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x907, &mut x908, x906, x892, x889); + let mut x909: u32 = 0; + let mut x910: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x909, &mut x910, x908, x890, x887); + let mut x911: u32 = 0; + let mut x912: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x911, &mut x912, x910, x888, x885); + let mut x913: u32 = 0; + let mut x914: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x913, &mut x914, x912, x886, x883); + let mut x915: u32 = 0; + let mut x916: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x915, &mut x916, x914, x884, x881); + let x917: u32 = ((x916 as u32) + x882); + let mut x918: u32 = 0; + let mut x919: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x918, &mut x919, 0x0, x855, x899); + let mut x920: u32 = 0; + let mut x921: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x920, &mut x921, x919, x857, x900); + let mut x922: u32 = 0; + let mut x923: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x922, &mut x923, x921, x859, (0x0 as u32)); + let mut x924: u32 = 0; + let mut x925: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x924, &mut x925, x923, x861, x897); + let mut x926: u32 = 0; + let mut x927: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x926, &mut x927, x925, x863, x901); + let mut x928: u32 = 0; + let mut x929: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x928, &mut x929, x927, x865, x903); + let mut x930: u32 = 0; + let mut x931: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x930, &mut x931, x929, x867, x905); + let mut x932: u32 = 0; + let mut x933: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x932, &mut x933, x931, x869, x907); + let mut x934: u32 = 0; + let mut x935: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x934, &mut x935, x933, x871, x909); + let mut x936: u32 = 0; + let mut x937: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x936, &mut x937, x935, x873, x911); + let mut x938: u32 = 0; + let mut x939: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x938, &mut x939, x937, x875, x913); + let mut x940: u32 = 0; + let mut x941: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x940, &mut x941, x939, x877, x915); + let mut x942: u32 = 0; + let mut x943: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x942, &mut x943, x941, x879, x917); + let x944: u32 = ((x943 as u32) + (x880 as u32)); + let mut x945: u32 = 0; + let mut x946: u32 = 0; + fiat_p384_mulx_u32(&mut x945, &mut x946, x7, (arg2[11])); + let mut x947: u32 = 0; + let mut x948: u32 = 0; + fiat_p384_mulx_u32(&mut x947, &mut x948, x7, (arg2[10])); + let mut x949: u32 = 0; + let mut x950: u32 = 0; + fiat_p384_mulx_u32(&mut x949, &mut x950, x7, (arg2[9])); + let mut x951: u32 = 0; + let mut x952: u32 = 0; + fiat_p384_mulx_u32(&mut x951, &mut x952, x7, (arg2[8])); + let mut x953: u32 = 0; + let mut x954: u32 = 0; + fiat_p384_mulx_u32(&mut x953, &mut x954, x7, (arg2[7])); + let mut x955: u32 = 0; + let mut x956: u32 = 0; + fiat_p384_mulx_u32(&mut x955, &mut x956, x7, (arg2[6])); + let mut x957: u32 = 0; + let mut x958: u32 = 0; + fiat_p384_mulx_u32(&mut x957, &mut x958, x7, (arg2[5])); + let mut x959: u32 = 0; + let mut x960: u32 = 0; + fiat_p384_mulx_u32(&mut x959, &mut x960, x7, (arg2[4])); + let mut x961: u32 = 0; + let mut x962: u32 = 0; + fiat_p384_mulx_u32(&mut x961, &mut x962, x7, (arg2[3])); + let mut x963: u32 = 0; + let mut x964: u32 = 0; + fiat_p384_mulx_u32(&mut x963, &mut x964, x7, (arg2[2])); + let mut x965: u32 = 0; + let mut x966: u32 = 0; + fiat_p384_mulx_u32(&mut x965, &mut x966, x7, (arg2[1])); + let mut x967: u32 = 0; + let mut x968: u32 = 0; + fiat_p384_mulx_u32(&mut x967, &mut x968, x7, (arg2[0])); + let mut x969: u32 = 0; + let mut x970: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x969, &mut x970, 0x0, x968, x965); + let mut x971: u32 = 0; + let mut x972: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x971, &mut x972, x970, x966, x963); + let mut x973: u32 = 0; + let mut x974: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x973, &mut x974, x972, x964, x961); + let mut x975: u32 = 0; + let mut x976: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x975, &mut x976, x974, x962, x959); + let mut x977: u32 = 0; + let mut x978: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x977, &mut x978, x976, x960, x957); + let mut x979: u32 = 0; + let mut x980: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x979, &mut x980, x978, x958, x955); + let mut x981: u32 = 0; + let mut x982: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x981, &mut x982, x980, x956, x953); + let mut x983: u32 = 0; + let mut x984: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x983, &mut x984, x982, x954, x951); + let mut x985: u32 = 0; + let mut x986: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x985, &mut x986, x984, x952, x949); + let mut x987: u32 = 0; + let mut x988: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x987, &mut x988, x986, x950, x947); + let mut x989: u32 = 0; + let mut x990: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x989, &mut x990, x988, x948, x945); + let x991: u32 = ((x990 as u32) + x946); + let mut x992: u32 = 0; + let mut x993: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x992, &mut x993, 0x0, x920, x967); + let mut x994: u32 = 0; + let mut x995: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x994, &mut x995, x993, x922, x969); + let mut x996: u32 = 0; + let mut x997: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x996, &mut x997, x995, x924, x971); + let mut x998: u32 = 0; + let mut x999: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x998, &mut x999, x997, x926, x973); + let mut x1000: u32 = 0; + let mut x1001: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1000, &mut x1001, x999, x928, x975); + let mut x1002: u32 = 0; + let mut x1003: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1002, &mut x1003, x1001, x930, x977); + let mut x1004: u32 = 0; + let mut x1005: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1004, &mut x1005, x1003, x932, x979); + let mut x1006: u32 = 0; + let mut x1007: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1006, &mut x1007, x1005, x934, x981); + let mut x1008: u32 = 0; + let mut x1009: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1008, &mut x1009, x1007, x936, x983); + let mut x1010: u32 = 0; + let mut x1011: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1010, &mut x1011, x1009, x938, x985); + let mut x1012: u32 = 0; + let mut x1013: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1012, &mut x1013, x1011, x940, x987); + let mut x1014: u32 = 0; + let mut x1015: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1014, &mut x1015, x1013, x942, x989); + let mut x1016: u32 = 0; + let mut x1017: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1016, &mut x1017, x1015, x944, x991); + let mut x1018: u32 = 0; + let mut x1019: u32 = 0; + fiat_p384_mulx_u32(&mut x1018, &mut x1019, x992, 0xffffffff); + let mut x1020: u32 = 0; + let mut x1021: u32 = 0; + fiat_p384_mulx_u32(&mut x1020, &mut x1021, x992, 0xffffffff); + let mut x1022: u32 = 0; + let mut x1023: u32 = 0; + fiat_p384_mulx_u32(&mut x1022, &mut x1023, x992, 0xffffffff); + let mut x1024: u32 = 0; + let mut x1025: u32 = 0; + fiat_p384_mulx_u32(&mut x1024, &mut x1025, x992, 0xffffffff); + let mut x1026: u32 = 0; + let mut x1027: u32 = 0; + fiat_p384_mulx_u32(&mut x1026, &mut x1027, x992, 0xffffffff); + let mut x1028: u32 = 0; + let mut x1029: u32 = 0; + fiat_p384_mulx_u32(&mut x1028, &mut x1029, x992, 0xffffffff); + let mut x1030: u32 = 0; + let mut x1031: u32 = 0; + fiat_p384_mulx_u32(&mut x1030, &mut x1031, x992, 0xffffffff); + let mut x1032: u32 = 0; + let mut x1033: u32 = 0; + fiat_p384_mulx_u32(&mut x1032, &mut x1033, x992, 0xfffffffe); + let mut x1034: u32 = 0; + let mut x1035: u32 = 0; + fiat_p384_mulx_u32(&mut x1034, &mut x1035, x992, 0xffffffff); + let mut x1036: u32 = 0; + let mut x1037: u32 = 0; + fiat_p384_mulx_u32(&mut x1036, &mut x1037, x992, 0xffffffff); + let mut x1038: u32 = 0; + let mut x1039: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1038, &mut x1039, 0x0, x1035, x1032); + let mut x1040: u32 = 0; + let mut x1041: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1040, &mut x1041, x1039, x1033, x1030); + let mut x1042: u32 = 0; + let mut x1043: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1042, &mut x1043, x1041, x1031, x1028); + let mut x1044: u32 = 0; + let mut x1045: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1044, &mut x1045, x1043, x1029, x1026); + let mut x1046: u32 = 0; + let mut x1047: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1046, &mut x1047, x1045, x1027, x1024); + let mut x1048: u32 = 0; + let mut x1049: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1048, &mut x1049, x1047, x1025, x1022); + let mut x1050: u32 = 0; + let mut x1051: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1050, &mut x1051, x1049, x1023, x1020); + let mut x1052: u32 = 0; + let mut x1053: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1052, &mut x1053, x1051, x1021, x1018); + let x1054: u32 = ((x1053 as u32) + x1019); + let mut x1055: u32 = 0; + let mut x1056: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1055, &mut x1056, 0x0, x992, x1036); + let mut x1057: u32 = 0; + let mut x1058: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1057, &mut x1058, x1056, x994, x1037); + let mut x1059: u32 = 0; + let mut x1060: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1059, &mut x1060, x1058, x996, (0x0 as u32)); + let mut x1061: u32 = 0; + let mut x1062: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1061, &mut x1062, x1060, x998, x1034); + let mut x1063: u32 = 0; + let mut x1064: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1063, &mut x1064, x1062, x1000, x1038); + let mut x1065: u32 = 0; + let mut x1066: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1065, &mut x1066, x1064, x1002, x1040); + let mut x1067: u32 = 0; + let mut x1068: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1067, &mut x1068, x1066, x1004, x1042); + let mut x1069: u32 = 0; + let mut x1070: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1069, &mut x1070, x1068, x1006, x1044); + let mut x1071: u32 = 0; + let mut x1072: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1071, &mut x1072, x1070, x1008, x1046); + let mut x1073: u32 = 0; + let mut x1074: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1073, &mut x1074, x1072, x1010, x1048); + let mut x1075: u32 = 0; + let mut x1076: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1075, &mut x1076, x1074, x1012, x1050); + let mut x1077: u32 = 0; + let mut x1078: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1077, &mut x1078, x1076, x1014, x1052); + let mut x1079: u32 = 0; + let mut x1080: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1079, &mut x1080, x1078, x1016, x1054); + let x1081: u32 = ((x1080 as u32) + (x1017 as u32)); + let mut x1082: u32 = 0; + let mut x1083: u32 = 0; + fiat_p384_mulx_u32(&mut x1082, &mut x1083, x8, (arg2[11])); + let mut x1084: u32 = 0; + let mut x1085: u32 = 0; + fiat_p384_mulx_u32(&mut x1084, &mut x1085, x8, (arg2[10])); + let mut x1086: u32 = 0; + let mut x1087: u32 = 0; + fiat_p384_mulx_u32(&mut x1086, &mut x1087, x8, (arg2[9])); + let mut x1088: u32 = 0; + let mut x1089: u32 = 0; + fiat_p384_mulx_u32(&mut x1088, &mut x1089, x8, (arg2[8])); + let mut x1090: u32 = 0; + let mut x1091: u32 = 0; + fiat_p384_mulx_u32(&mut x1090, &mut x1091, x8, (arg2[7])); + let mut x1092: u32 = 0; + let mut x1093: u32 = 0; + fiat_p384_mulx_u32(&mut x1092, &mut x1093, x8, (arg2[6])); + let mut x1094: u32 = 0; + let mut x1095: u32 = 0; + fiat_p384_mulx_u32(&mut x1094, &mut x1095, x8, (arg2[5])); + let mut x1096: u32 = 0; + let mut x1097: u32 = 0; + fiat_p384_mulx_u32(&mut x1096, &mut x1097, x8, (arg2[4])); + let mut x1098: u32 = 0; + let mut x1099: u32 = 0; + fiat_p384_mulx_u32(&mut x1098, &mut x1099, x8, (arg2[3])); + let mut x1100: u32 = 0; + let mut x1101: u32 = 0; + fiat_p384_mulx_u32(&mut x1100, &mut x1101, x8, (arg2[2])); + let mut x1102: u32 = 0; + let mut x1103: u32 = 0; + fiat_p384_mulx_u32(&mut x1102, &mut x1103, x8, (arg2[1])); + let mut x1104: u32 = 0; + let mut x1105: u32 = 0; + fiat_p384_mulx_u32(&mut x1104, &mut x1105, x8, (arg2[0])); + let mut x1106: u32 = 0; + let mut x1107: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1106, &mut x1107, 0x0, x1105, x1102); + let mut x1108: u32 = 0; + let mut x1109: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1108, &mut x1109, x1107, x1103, x1100); + let mut x1110: u32 = 0; + let mut x1111: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1110, &mut x1111, x1109, x1101, x1098); + let mut x1112: u32 = 0; + let mut x1113: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1112, &mut x1113, x1111, x1099, x1096); + let mut x1114: u32 = 0; + let mut x1115: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1114, &mut x1115, x1113, x1097, x1094); + let mut x1116: u32 = 0; + let mut x1117: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1116, &mut x1117, x1115, x1095, x1092); + let mut x1118: u32 = 0; + let mut x1119: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1118, &mut x1119, x1117, x1093, x1090); + let mut x1120: u32 = 0; + let mut x1121: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1120, &mut x1121, x1119, x1091, x1088); + let mut x1122: u32 = 0; + let mut x1123: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1122, &mut x1123, x1121, x1089, x1086); + let mut x1124: u32 = 0; + let mut x1125: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1124, &mut x1125, x1123, x1087, x1084); + let mut x1126: u32 = 0; + let mut x1127: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1126, &mut x1127, x1125, x1085, x1082); + let x1128: u32 = ((x1127 as u32) + x1083); + let mut x1129: u32 = 0; + let mut x1130: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1129, &mut x1130, 0x0, x1057, x1104); + let mut x1131: u32 = 0; + let mut x1132: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1131, &mut x1132, x1130, x1059, x1106); + let mut x1133: u32 = 0; + let mut x1134: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1133, &mut x1134, x1132, x1061, x1108); + let mut x1135: u32 = 0; + let mut x1136: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1135, &mut x1136, x1134, x1063, x1110); + let mut x1137: u32 = 0; + let mut x1138: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1137, &mut x1138, x1136, x1065, x1112); + let mut x1139: u32 = 0; + let mut x1140: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1139, &mut x1140, x1138, x1067, x1114); + let mut x1141: u32 = 0; + let mut x1142: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1141, &mut x1142, x1140, x1069, x1116); + let mut x1143: u32 = 0; + let mut x1144: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1143, &mut x1144, x1142, x1071, x1118); + let mut x1145: u32 = 0; + let mut x1146: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1145, &mut x1146, x1144, x1073, x1120); + let mut x1147: u32 = 0; + let mut x1148: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1147, &mut x1148, x1146, x1075, x1122); + let mut x1149: u32 = 0; + let mut x1150: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1149, &mut x1150, x1148, x1077, x1124); + let mut x1151: u32 = 0; + let mut x1152: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1151, &mut x1152, x1150, x1079, x1126); + let mut x1153: u32 = 0; + let mut x1154: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1153, &mut x1154, x1152, x1081, x1128); + let mut x1155: u32 = 0; + let mut x1156: u32 = 0; + fiat_p384_mulx_u32(&mut x1155, &mut x1156, x1129, 0xffffffff); + let mut x1157: u32 = 0; + let mut x1158: u32 = 0; + fiat_p384_mulx_u32(&mut x1157, &mut x1158, x1129, 0xffffffff); + let mut x1159: u32 = 0; + let mut x1160: u32 = 0; + fiat_p384_mulx_u32(&mut x1159, &mut x1160, x1129, 0xffffffff); + let mut x1161: u32 = 0; + let mut x1162: u32 = 0; + fiat_p384_mulx_u32(&mut x1161, &mut x1162, x1129, 0xffffffff); + let mut x1163: u32 = 0; + let mut x1164: u32 = 0; + fiat_p384_mulx_u32(&mut x1163, &mut x1164, x1129, 0xffffffff); + let mut x1165: u32 = 0; + let mut x1166: u32 = 0; + fiat_p384_mulx_u32(&mut x1165, &mut x1166, x1129, 0xffffffff); + let mut x1167: u32 = 0; + let mut x1168: u32 = 0; + fiat_p384_mulx_u32(&mut x1167, &mut x1168, x1129, 0xffffffff); + let mut x1169: u32 = 0; + let mut x1170: u32 = 0; + fiat_p384_mulx_u32(&mut x1169, &mut x1170, x1129, 0xfffffffe); + let mut x1171: u32 = 0; + let mut x1172: u32 = 0; + fiat_p384_mulx_u32(&mut x1171, &mut x1172, x1129, 0xffffffff); + let mut x1173: u32 = 0; + let mut x1174: u32 = 0; + fiat_p384_mulx_u32(&mut x1173, &mut x1174, x1129, 0xffffffff); + let mut x1175: u32 = 0; + let mut x1176: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1175, &mut x1176, 0x0, x1172, x1169); + let mut x1177: u32 = 0; + let mut x1178: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1177, &mut x1178, x1176, x1170, x1167); + let mut x1179: u32 = 0; + let mut x1180: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1179, &mut x1180, x1178, x1168, x1165); + let mut x1181: u32 = 0; + let mut x1182: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1181, &mut x1182, x1180, x1166, x1163); + let mut x1183: u32 = 0; + let mut x1184: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1183, &mut x1184, x1182, x1164, x1161); + let mut x1185: u32 = 0; + let mut x1186: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1185, &mut x1186, x1184, x1162, x1159); + let mut x1187: u32 = 0; + let mut x1188: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1187, &mut x1188, x1186, x1160, x1157); + let mut x1189: u32 = 0; + let mut x1190: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1189, &mut x1190, x1188, x1158, x1155); + let x1191: u32 = ((x1190 as u32) + x1156); + let mut x1192: u32 = 0; + let mut x1193: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1192, &mut x1193, 0x0, x1129, x1173); + let mut x1194: u32 = 0; + let mut x1195: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1194, &mut x1195, x1193, x1131, x1174); + let mut x1196: u32 = 0; + let mut x1197: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1196, &mut x1197, x1195, x1133, (0x0 as u32)); + let mut x1198: u32 = 0; + let mut x1199: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1198, &mut x1199, x1197, x1135, x1171); + let mut x1200: u32 = 0; + let mut x1201: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1200, &mut x1201, x1199, x1137, x1175); + let mut x1202: u32 = 0; + let mut x1203: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1202, &mut x1203, x1201, x1139, x1177); + let mut x1204: u32 = 0; + let mut x1205: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1204, &mut x1205, x1203, x1141, x1179); + let mut x1206: u32 = 0; + let mut x1207: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1206, &mut x1207, x1205, x1143, x1181); + let mut x1208: u32 = 0; + let mut x1209: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1208, &mut x1209, x1207, x1145, x1183); + let mut x1210: u32 = 0; + let mut x1211: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1210, &mut x1211, x1209, x1147, x1185); + let mut x1212: u32 = 0; + let mut x1213: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1212, &mut x1213, x1211, x1149, x1187); + let mut x1214: u32 = 0; + let mut x1215: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1214, &mut x1215, x1213, x1151, x1189); + let mut x1216: u32 = 0; + let mut x1217: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1216, &mut x1217, x1215, x1153, x1191); + let x1218: u32 = ((x1217 as u32) + (x1154 as u32)); + let mut x1219: u32 = 0; + let mut x1220: u32 = 0; + fiat_p384_mulx_u32(&mut x1219, &mut x1220, x9, (arg2[11])); + let mut x1221: u32 = 0; + let mut x1222: u32 = 0; + fiat_p384_mulx_u32(&mut x1221, &mut x1222, x9, (arg2[10])); + let mut x1223: u32 = 0; + let mut x1224: u32 = 0; + fiat_p384_mulx_u32(&mut x1223, &mut x1224, x9, (arg2[9])); + let mut x1225: u32 = 0; + let mut x1226: u32 = 0; + fiat_p384_mulx_u32(&mut x1225, &mut x1226, x9, (arg2[8])); + let mut x1227: u32 = 0; + let mut x1228: u32 = 0; + fiat_p384_mulx_u32(&mut x1227, &mut x1228, x9, (arg2[7])); + let mut x1229: u32 = 0; + let mut x1230: u32 = 0; + fiat_p384_mulx_u32(&mut x1229, &mut x1230, x9, (arg2[6])); + let mut x1231: u32 = 0; + let mut x1232: u32 = 0; + fiat_p384_mulx_u32(&mut x1231, &mut x1232, x9, (arg2[5])); + let mut x1233: u32 = 0; + let mut x1234: u32 = 0; + fiat_p384_mulx_u32(&mut x1233, &mut x1234, x9, (arg2[4])); + let mut x1235: u32 = 0; + let mut x1236: u32 = 0; + fiat_p384_mulx_u32(&mut x1235, &mut x1236, x9, (arg2[3])); + let mut x1237: u32 = 0; + let mut x1238: u32 = 0; + fiat_p384_mulx_u32(&mut x1237, &mut x1238, x9, (arg2[2])); + let mut x1239: u32 = 0; + let mut x1240: u32 = 0; + fiat_p384_mulx_u32(&mut x1239, &mut x1240, x9, (arg2[1])); + let mut x1241: u32 = 0; + let mut x1242: u32 = 0; + fiat_p384_mulx_u32(&mut x1241, &mut x1242, x9, (arg2[0])); + let mut x1243: u32 = 0; + let mut x1244: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1243, &mut x1244, 0x0, x1242, x1239); + let mut x1245: u32 = 0; + let mut x1246: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1245, &mut x1246, x1244, x1240, x1237); + let mut x1247: u32 = 0; + let mut x1248: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1247, &mut x1248, x1246, x1238, x1235); + let mut x1249: u32 = 0; + let mut x1250: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1249, &mut x1250, x1248, x1236, x1233); + let mut x1251: u32 = 0; + let mut x1252: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1251, &mut x1252, x1250, x1234, x1231); + let mut x1253: u32 = 0; + let mut x1254: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1253, &mut x1254, x1252, x1232, x1229); + let mut x1255: u32 = 0; + let mut x1256: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1255, &mut x1256, x1254, x1230, x1227); + let mut x1257: u32 = 0; + let mut x1258: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1257, &mut x1258, x1256, x1228, x1225); + let mut x1259: u32 = 0; + let mut x1260: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1259, &mut x1260, x1258, x1226, x1223); + let mut x1261: u32 = 0; + let mut x1262: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1261, &mut x1262, x1260, x1224, x1221); + let mut x1263: u32 = 0; + let mut x1264: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1263, &mut x1264, x1262, x1222, x1219); + let x1265: u32 = ((x1264 as u32) + x1220); + let mut x1266: u32 = 0; + let mut x1267: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1266, &mut x1267, 0x0, x1194, x1241); + let mut x1268: u32 = 0; + let mut x1269: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1268, &mut x1269, x1267, x1196, x1243); + let mut x1270: u32 = 0; + let mut x1271: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1270, &mut x1271, x1269, x1198, x1245); + let mut x1272: u32 = 0; + let mut x1273: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1272, &mut x1273, x1271, x1200, x1247); + let mut x1274: u32 = 0; + let mut x1275: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1274, &mut x1275, x1273, x1202, x1249); + let mut x1276: u32 = 0; + let mut x1277: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1276, &mut x1277, x1275, x1204, x1251); + let mut x1278: u32 = 0; + let mut x1279: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1278, &mut x1279, x1277, x1206, x1253); + let mut x1280: u32 = 0; + let mut x1281: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1280, &mut x1281, x1279, x1208, x1255); + let mut x1282: u32 = 0; + let mut x1283: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1282, &mut x1283, x1281, x1210, x1257); + let mut x1284: u32 = 0; + let mut x1285: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1284, &mut x1285, x1283, x1212, x1259); + let mut x1286: u32 = 0; + let mut x1287: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1286, &mut x1287, x1285, x1214, x1261); + let mut x1288: u32 = 0; + let mut x1289: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1288, &mut x1289, x1287, x1216, x1263); + let mut x1290: u32 = 0; + let mut x1291: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1290, &mut x1291, x1289, x1218, x1265); + let mut x1292: u32 = 0; + let mut x1293: u32 = 0; + fiat_p384_mulx_u32(&mut x1292, &mut x1293, x1266, 0xffffffff); + let mut x1294: u32 = 0; + let mut x1295: u32 = 0; + fiat_p384_mulx_u32(&mut x1294, &mut x1295, x1266, 0xffffffff); + let mut x1296: u32 = 0; + let mut x1297: u32 = 0; + fiat_p384_mulx_u32(&mut x1296, &mut x1297, x1266, 0xffffffff); + let mut x1298: u32 = 0; + let mut x1299: u32 = 0; + fiat_p384_mulx_u32(&mut x1298, &mut x1299, x1266, 0xffffffff); + let mut x1300: u32 = 0; + let mut x1301: u32 = 0; + fiat_p384_mulx_u32(&mut x1300, &mut x1301, x1266, 0xffffffff); + let mut x1302: u32 = 0; + let mut x1303: u32 = 0; + fiat_p384_mulx_u32(&mut x1302, &mut x1303, x1266, 0xffffffff); + let mut x1304: u32 = 0; + let mut x1305: u32 = 0; + fiat_p384_mulx_u32(&mut x1304, &mut x1305, x1266, 0xffffffff); + let mut x1306: u32 = 0; + let mut x1307: u32 = 0; + fiat_p384_mulx_u32(&mut x1306, &mut x1307, x1266, 0xfffffffe); + let mut x1308: u32 = 0; + let mut x1309: u32 = 0; + fiat_p384_mulx_u32(&mut x1308, &mut x1309, x1266, 0xffffffff); + let mut x1310: u32 = 0; + let mut x1311: u32 = 0; + fiat_p384_mulx_u32(&mut x1310, &mut x1311, x1266, 0xffffffff); + let mut x1312: u32 = 0; + let mut x1313: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1312, &mut x1313, 0x0, x1309, x1306); + let mut x1314: u32 = 0; + let mut x1315: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1314, &mut x1315, x1313, x1307, x1304); + let mut x1316: u32 = 0; + let mut x1317: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1316, &mut x1317, x1315, x1305, x1302); + let mut x1318: u32 = 0; + let mut x1319: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1318, &mut x1319, x1317, x1303, x1300); + let mut x1320: u32 = 0; + let mut x1321: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1320, &mut x1321, x1319, x1301, x1298); + let mut x1322: u32 = 0; + let mut x1323: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1322, &mut x1323, x1321, x1299, x1296); + let mut x1324: u32 = 0; + let mut x1325: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1324, &mut x1325, x1323, x1297, x1294); + let mut x1326: u32 = 0; + let mut x1327: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1326, &mut x1327, x1325, x1295, x1292); + let x1328: u32 = ((x1327 as u32) + x1293); + let mut x1329: u32 = 0; + let mut x1330: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1329, &mut x1330, 0x0, x1266, x1310); + let mut x1331: u32 = 0; + let mut x1332: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1331, &mut x1332, x1330, x1268, x1311); + let mut x1333: u32 = 0; + let mut x1334: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1333, &mut x1334, x1332, x1270, (0x0 as u32)); + let mut x1335: u32 = 0; + let mut x1336: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1335, &mut x1336, x1334, x1272, x1308); + let mut x1337: u32 = 0; + let mut x1338: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1337, &mut x1338, x1336, x1274, x1312); + let mut x1339: u32 = 0; + let mut x1340: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1339, &mut x1340, x1338, x1276, x1314); + let mut x1341: u32 = 0; + let mut x1342: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1341, &mut x1342, x1340, x1278, x1316); + let mut x1343: u32 = 0; + let mut x1344: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1343, &mut x1344, x1342, x1280, x1318); + let mut x1345: u32 = 0; + let mut x1346: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1345, &mut x1346, x1344, x1282, x1320); + let mut x1347: u32 = 0; + let mut x1348: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1347, &mut x1348, x1346, x1284, x1322); + let mut x1349: u32 = 0; + let mut x1350: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1349, &mut x1350, x1348, x1286, x1324); + let mut x1351: u32 = 0; + let mut x1352: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1351, &mut x1352, x1350, x1288, x1326); + let mut x1353: u32 = 0; + let mut x1354: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1353, &mut x1354, x1352, x1290, x1328); + let x1355: u32 = ((x1354 as u32) + (x1291 as u32)); + let mut x1356: u32 = 0; + let mut x1357: u32 = 0; + fiat_p384_mulx_u32(&mut x1356, &mut x1357, x10, (arg2[11])); + let mut x1358: u32 = 0; + let mut x1359: u32 = 0; + fiat_p384_mulx_u32(&mut x1358, &mut x1359, x10, (arg2[10])); + let mut x1360: u32 = 0; + let mut x1361: u32 = 0; + fiat_p384_mulx_u32(&mut x1360, &mut x1361, x10, (arg2[9])); + let mut x1362: u32 = 0; + let mut x1363: u32 = 0; + fiat_p384_mulx_u32(&mut x1362, &mut x1363, x10, (arg2[8])); + let mut x1364: u32 = 0; + let mut x1365: u32 = 0; + fiat_p384_mulx_u32(&mut x1364, &mut x1365, x10, (arg2[7])); + let mut x1366: u32 = 0; + let mut x1367: u32 = 0; + fiat_p384_mulx_u32(&mut x1366, &mut x1367, x10, (arg2[6])); + let mut x1368: u32 = 0; + let mut x1369: u32 = 0; + fiat_p384_mulx_u32(&mut x1368, &mut x1369, x10, (arg2[5])); + let mut x1370: u32 = 0; + let mut x1371: u32 = 0; + fiat_p384_mulx_u32(&mut x1370, &mut x1371, x10, (arg2[4])); + let mut x1372: u32 = 0; + let mut x1373: u32 = 0; + fiat_p384_mulx_u32(&mut x1372, &mut x1373, x10, (arg2[3])); + let mut x1374: u32 = 0; + let mut x1375: u32 = 0; + fiat_p384_mulx_u32(&mut x1374, &mut x1375, x10, (arg2[2])); + let mut x1376: u32 = 0; + let mut x1377: u32 = 0; + fiat_p384_mulx_u32(&mut x1376, &mut x1377, x10, (arg2[1])); + let mut x1378: u32 = 0; + let mut x1379: u32 = 0; + fiat_p384_mulx_u32(&mut x1378, &mut x1379, x10, (arg2[0])); + let mut x1380: u32 = 0; + let mut x1381: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1380, &mut x1381, 0x0, x1379, x1376); + let mut x1382: u32 = 0; + let mut x1383: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1382, &mut x1383, x1381, x1377, x1374); + let mut x1384: u32 = 0; + let mut x1385: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1384, &mut x1385, x1383, x1375, x1372); + let mut x1386: u32 = 0; + let mut x1387: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1386, &mut x1387, x1385, x1373, x1370); + let mut x1388: u32 = 0; + let mut x1389: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1388, &mut x1389, x1387, x1371, x1368); + let mut x1390: u32 = 0; + let mut x1391: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1390, &mut x1391, x1389, x1369, x1366); + let mut x1392: u32 = 0; + let mut x1393: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1392, &mut x1393, x1391, x1367, x1364); + let mut x1394: u32 = 0; + let mut x1395: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1394, &mut x1395, x1393, x1365, x1362); + let mut x1396: u32 = 0; + let mut x1397: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1396, &mut x1397, x1395, x1363, x1360); + let mut x1398: u32 = 0; + let mut x1399: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1398, &mut x1399, x1397, x1361, x1358); + let mut x1400: u32 = 0; + let mut x1401: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1400, &mut x1401, x1399, x1359, x1356); + let x1402: u32 = ((x1401 as u32) + x1357); + let mut x1403: u32 = 0; + let mut x1404: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1403, &mut x1404, 0x0, x1331, x1378); + let mut x1405: u32 = 0; + let mut x1406: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1405, &mut x1406, x1404, x1333, x1380); + let mut x1407: u32 = 0; + let mut x1408: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1407, &mut x1408, x1406, x1335, x1382); + let mut x1409: u32 = 0; + let mut x1410: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1409, &mut x1410, x1408, x1337, x1384); + let mut x1411: u32 = 0; + let mut x1412: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1411, &mut x1412, x1410, x1339, x1386); + let mut x1413: u32 = 0; + let mut x1414: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1413, &mut x1414, x1412, x1341, x1388); + let mut x1415: u32 = 0; + let mut x1416: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1415, &mut x1416, x1414, x1343, x1390); + let mut x1417: u32 = 0; + let mut x1418: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1417, &mut x1418, x1416, x1345, x1392); + let mut x1419: u32 = 0; + let mut x1420: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1419, &mut x1420, x1418, x1347, x1394); + let mut x1421: u32 = 0; + let mut x1422: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1421, &mut x1422, x1420, x1349, x1396); + let mut x1423: u32 = 0; + let mut x1424: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1423, &mut x1424, x1422, x1351, x1398); + let mut x1425: u32 = 0; + let mut x1426: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1425, &mut x1426, x1424, x1353, x1400); + let mut x1427: u32 = 0; + let mut x1428: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1427, &mut x1428, x1426, x1355, x1402); + let mut x1429: u32 = 0; + let mut x1430: u32 = 0; + fiat_p384_mulx_u32(&mut x1429, &mut x1430, x1403, 0xffffffff); + let mut x1431: u32 = 0; + let mut x1432: u32 = 0; + fiat_p384_mulx_u32(&mut x1431, &mut x1432, x1403, 0xffffffff); + let mut x1433: u32 = 0; + let mut x1434: u32 = 0; + fiat_p384_mulx_u32(&mut x1433, &mut x1434, x1403, 0xffffffff); + let mut x1435: u32 = 0; + let mut x1436: u32 = 0; + fiat_p384_mulx_u32(&mut x1435, &mut x1436, x1403, 0xffffffff); + let mut x1437: u32 = 0; + let mut x1438: u32 = 0; + fiat_p384_mulx_u32(&mut x1437, &mut x1438, x1403, 0xffffffff); + let mut x1439: u32 = 0; + let mut x1440: u32 = 0; + fiat_p384_mulx_u32(&mut x1439, &mut x1440, x1403, 0xffffffff); + let mut x1441: u32 = 0; + let mut x1442: u32 = 0; + fiat_p384_mulx_u32(&mut x1441, &mut x1442, x1403, 0xffffffff); + let mut x1443: u32 = 0; + let mut x1444: u32 = 0; + fiat_p384_mulx_u32(&mut x1443, &mut x1444, x1403, 0xfffffffe); + let mut x1445: u32 = 0; + let mut x1446: u32 = 0; + fiat_p384_mulx_u32(&mut x1445, &mut x1446, x1403, 0xffffffff); + let mut x1447: u32 = 0; + let mut x1448: u32 = 0; + fiat_p384_mulx_u32(&mut x1447, &mut x1448, x1403, 0xffffffff); + let mut x1449: u32 = 0; + let mut x1450: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1449, &mut x1450, 0x0, x1446, x1443); + let mut x1451: u32 = 0; + let mut x1452: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1451, &mut x1452, x1450, x1444, x1441); + let mut x1453: u32 = 0; + let mut x1454: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1453, &mut x1454, x1452, x1442, x1439); + let mut x1455: u32 = 0; + let mut x1456: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1455, &mut x1456, x1454, x1440, x1437); + let mut x1457: u32 = 0; + let mut x1458: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1457, &mut x1458, x1456, x1438, x1435); + let mut x1459: u32 = 0; + let mut x1460: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1459, &mut x1460, x1458, x1436, x1433); + let mut x1461: u32 = 0; + let mut x1462: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1461, &mut x1462, x1460, x1434, x1431); + let mut x1463: u32 = 0; + let mut x1464: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1463, &mut x1464, x1462, x1432, x1429); + let x1465: u32 = ((x1464 as u32) + x1430); + let mut x1466: u32 = 0; + let mut x1467: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1466, &mut x1467, 0x0, x1403, x1447); + let mut x1468: u32 = 0; + let mut x1469: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1468, &mut x1469, x1467, x1405, x1448); + let mut x1470: u32 = 0; + let mut x1471: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1470, &mut x1471, x1469, x1407, (0x0 as u32)); + let mut x1472: u32 = 0; + let mut x1473: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1472, &mut x1473, x1471, x1409, x1445); + let mut x1474: u32 = 0; + let mut x1475: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1474, &mut x1475, x1473, x1411, x1449); + let mut x1476: u32 = 0; + let mut x1477: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1476, &mut x1477, x1475, x1413, x1451); + let mut x1478: u32 = 0; + let mut x1479: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1478, &mut x1479, x1477, x1415, x1453); + let mut x1480: u32 = 0; + let mut x1481: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1480, &mut x1481, x1479, x1417, x1455); + let mut x1482: u32 = 0; + let mut x1483: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1482, &mut x1483, x1481, x1419, x1457); + let mut x1484: u32 = 0; + let mut x1485: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1484, &mut x1485, x1483, x1421, x1459); + let mut x1486: u32 = 0; + let mut x1487: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1486, &mut x1487, x1485, x1423, x1461); + let mut x1488: u32 = 0; + let mut x1489: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1488, &mut x1489, x1487, x1425, x1463); + let mut x1490: u32 = 0; + let mut x1491: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1490, &mut x1491, x1489, x1427, x1465); + let x1492: u32 = ((x1491 as u32) + (x1428 as u32)); + let mut x1493: u32 = 0; + let mut x1494: u32 = 0; + fiat_p384_mulx_u32(&mut x1493, &mut x1494, x11, (arg2[11])); + let mut x1495: u32 = 0; + let mut x1496: u32 = 0; + fiat_p384_mulx_u32(&mut x1495, &mut x1496, x11, (arg2[10])); + let mut x1497: u32 = 0; + let mut x1498: u32 = 0; + fiat_p384_mulx_u32(&mut x1497, &mut x1498, x11, (arg2[9])); + let mut x1499: u32 = 0; + let mut x1500: u32 = 0; + fiat_p384_mulx_u32(&mut x1499, &mut x1500, x11, (arg2[8])); + let mut x1501: u32 = 0; + let mut x1502: u32 = 0; + fiat_p384_mulx_u32(&mut x1501, &mut x1502, x11, (arg2[7])); + let mut x1503: u32 = 0; + let mut x1504: u32 = 0; + fiat_p384_mulx_u32(&mut x1503, &mut x1504, x11, (arg2[6])); + let mut x1505: u32 = 0; + let mut x1506: u32 = 0; + fiat_p384_mulx_u32(&mut x1505, &mut x1506, x11, (arg2[5])); + let mut x1507: u32 = 0; + let mut x1508: u32 = 0; + fiat_p384_mulx_u32(&mut x1507, &mut x1508, x11, (arg2[4])); + let mut x1509: u32 = 0; + let mut x1510: u32 = 0; + fiat_p384_mulx_u32(&mut x1509, &mut x1510, x11, (arg2[3])); + let mut x1511: u32 = 0; + let mut x1512: u32 = 0; + fiat_p384_mulx_u32(&mut x1511, &mut x1512, x11, (arg2[2])); + let mut x1513: u32 = 0; + let mut x1514: u32 = 0; + fiat_p384_mulx_u32(&mut x1513, &mut x1514, x11, (arg2[1])); + let mut x1515: u32 = 0; + let mut x1516: u32 = 0; + fiat_p384_mulx_u32(&mut x1515, &mut x1516, x11, (arg2[0])); + let mut x1517: u32 = 0; + let mut x1518: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1517, &mut x1518, 0x0, x1516, x1513); + let mut x1519: u32 = 0; + let mut x1520: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1519, &mut x1520, x1518, x1514, x1511); + let mut x1521: u32 = 0; + let mut x1522: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1521, &mut x1522, x1520, x1512, x1509); + let mut x1523: u32 = 0; + let mut x1524: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1523, &mut x1524, x1522, x1510, x1507); + let mut x1525: u32 = 0; + let mut x1526: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1525, &mut x1526, x1524, x1508, x1505); + let mut x1527: u32 = 0; + let mut x1528: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1527, &mut x1528, x1526, x1506, x1503); + let mut x1529: u32 = 0; + let mut x1530: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1529, &mut x1530, x1528, x1504, x1501); + let mut x1531: u32 = 0; + let mut x1532: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1531, &mut x1532, x1530, x1502, x1499); + let mut x1533: u32 = 0; + let mut x1534: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1533, &mut x1534, x1532, x1500, x1497); + let mut x1535: u32 = 0; + let mut x1536: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1535, &mut x1536, x1534, x1498, x1495); + let mut x1537: u32 = 0; + let mut x1538: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1537, &mut x1538, x1536, x1496, x1493); + let x1539: u32 = ((x1538 as u32) + x1494); + let mut x1540: u32 = 0; + let mut x1541: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1540, &mut x1541, 0x0, x1468, x1515); + let mut x1542: u32 = 0; + let mut x1543: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1542, &mut x1543, x1541, x1470, x1517); + let mut x1544: u32 = 0; + let mut x1545: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1544, &mut x1545, x1543, x1472, x1519); + let mut x1546: u32 = 0; + let mut x1547: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1546, &mut x1547, x1545, x1474, x1521); + let mut x1548: u32 = 0; + let mut x1549: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1548, &mut x1549, x1547, x1476, x1523); + let mut x1550: u32 = 0; + let mut x1551: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1550, &mut x1551, x1549, x1478, x1525); + let mut x1552: u32 = 0; + let mut x1553: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1552, &mut x1553, x1551, x1480, x1527); + let mut x1554: u32 = 0; + let mut x1555: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1554, &mut x1555, x1553, x1482, x1529); + let mut x1556: u32 = 0; + let mut x1557: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1556, &mut x1557, x1555, x1484, x1531); + let mut x1558: u32 = 0; + let mut x1559: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1558, &mut x1559, x1557, x1486, x1533); + let mut x1560: u32 = 0; + let mut x1561: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1560, &mut x1561, x1559, x1488, x1535); + let mut x1562: u32 = 0; + let mut x1563: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1562, &mut x1563, x1561, x1490, x1537); + let mut x1564: u32 = 0; + let mut x1565: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1564, &mut x1565, x1563, x1492, x1539); + let mut x1566: u32 = 0; + let mut x1567: u32 = 0; + fiat_p384_mulx_u32(&mut x1566, &mut x1567, x1540, 0xffffffff); + let mut x1568: u32 = 0; + let mut x1569: u32 = 0; + fiat_p384_mulx_u32(&mut x1568, &mut x1569, x1540, 0xffffffff); + let mut x1570: u32 = 0; + let mut x1571: u32 = 0; + fiat_p384_mulx_u32(&mut x1570, &mut x1571, x1540, 0xffffffff); + let mut x1572: u32 = 0; + let mut x1573: u32 = 0; + fiat_p384_mulx_u32(&mut x1572, &mut x1573, x1540, 0xffffffff); + let mut x1574: u32 = 0; + let mut x1575: u32 = 0; + fiat_p384_mulx_u32(&mut x1574, &mut x1575, x1540, 0xffffffff); + let mut x1576: u32 = 0; + let mut x1577: u32 = 0; + fiat_p384_mulx_u32(&mut x1576, &mut x1577, x1540, 0xffffffff); + let mut x1578: u32 = 0; + let mut x1579: u32 = 0; + fiat_p384_mulx_u32(&mut x1578, &mut x1579, x1540, 0xffffffff); + let mut x1580: u32 = 0; + let mut x1581: u32 = 0; + fiat_p384_mulx_u32(&mut x1580, &mut x1581, x1540, 0xfffffffe); + let mut x1582: u32 = 0; + let mut x1583: u32 = 0; + fiat_p384_mulx_u32(&mut x1582, &mut x1583, x1540, 0xffffffff); + let mut x1584: u32 = 0; + let mut x1585: u32 = 0; + fiat_p384_mulx_u32(&mut x1584, &mut x1585, x1540, 0xffffffff); + let mut x1586: u32 = 0; + let mut x1587: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1586, &mut x1587, 0x0, x1583, x1580); + let mut x1588: u32 = 0; + let mut x1589: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1588, &mut x1589, x1587, x1581, x1578); + let mut x1590: u32 = 0; + let mut x1591: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1590, &mut x1591, x1589, x1579, x1576); + let mut x1592: u32 = 0; + let mut x1593: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1592, &mut x1593, x1591, x1577, x1574); + let mut x1594: u32 = 0; + let mut x1595: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1594, &mut x1595, x1593, x1575, x1572); + let mut x1596: u32 = 0; + let mut x1597: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1596, &mut x1597, x1595, x1573, x1570); + let mut x1598: u32 = 0; + let mut x1599: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1598, &mut x1599, x1597, x1571, x1568); + let mut x1600: u32 = 0; + let mut x1601: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1600, &mut x1601, x1599, x1569, x1566); + let x1602: u32 = ((x1601 as u32) + x1567); + let mut x1603: u32 = 0; + let mut x1604: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1603, &mut x1604, 0x0, x1540, x1584); + let mut x1605: u32 = 0; + let mut x1606: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1605, &mut x1606, x1604, x1542, x1585); + let mut x1607: u32 = 0; + let mut x1608: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1607, &mut x1608, x1606, x1544, (0x0 as u32)); + let mut x1609: u32 = 0; + let mut x1610: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1609, &mut x1610, x1608, x1546, x1582); + let mut x1611: u32 = 0; + let mut x1612: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1611, &mut x1612, x1610, x1548, x1586); + let mut x1613: u32 = 0; + let mut x1614: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1613, &mut x1614, x1612, x1550, x1588); + let mut x1615: u32 = 0; + let mut x1616: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1615, &mut x1616, x1614, x1552, x1590); + let mut x1617: u32 = 0; + let mut x1618: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1617, &mut x1618, x1616, x1554, x1592); + let mut x1619: u32 = 0; + let mut x1620: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1619, &mut x1620, x1618, x1556, x1594); + let mut x1621: u32 = 0; + let mut x1622: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1621, &mut x1622, x1620, x1558, x1596); + let mut x1623: u32 = 0; + let mut x1624: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1623, &mut x1624, x1622, x1560, x1598); + let mut x1625: u32 = 0; + let mut x1626: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1625, &mut x1626, x1624, x1562, x1600); + let mut x1627: u32 = 0; + let mut x1628: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1627, &mut x1628, x1626, x1564, x1602); + let x1629: u32 = ((x1628 as u32) + (x1565 as u32)); + let mut x1630: u32 = 0; + let mut x1631: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x1630, &mut x1631, 0x0, x1605, 0xffffffff); + let mut x1632: u32 = 0; + let mut x1633: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x1632, &mut x1633, x1631, x1607, (0x0 as u32)); + let mut x1634: u32 = 0; + let mut x1635: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x1634, &mut x1635, x1633, x1609, (0x0 as u32)); + let mut x1636: u32 = 0; + let mut x1637: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x1636, &mut x1637, x1635, x1611, 0xffffffff); + let mut x1638: u32 = 0; + let mut x1639: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x1638, &mut x1639, x1637, x1613, 0xfffffffe); + let mut x1640: u32 = 0; + let mut x1641: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x1640, &mut x1641, x1639, x1615, 0xffffffff); + let mut x1642: u32 = 0; + let mut x1643: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x1642, &mut x1643, x1641, x1617, 0xffffffff); + let mut x1644: u32 = 0; + let mut x1645: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x1644, &mut x1645, x1643, x1619, 0xffffffff); + let mut x1646: u32 = 0; + let mut x1647: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x1646, &mut x1647, x1645, x1621, 0xffffffff); + let mut x1648: u32 = 0; + let mut x1649: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x1648, &mut x1649, x1647, x1623, 0xffffffff); + let mut x1650: u32 = 0; + let mut x1651: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x1650, &mut x1651, x1649, x1625, 0xffffffff); + let mut x1652: u32 = 0; + let mut x1653: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x1652, &mut x1653, x1651, x1627, 0xffffffff); + let mut x1654: u32 = 0; + let mut x1655: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x1654, &mut x1655, x1653, x1629, (0x0 as u32)); + let mut x1656: u32 = 0; + fiat_p384_cmovznz_u32(&mut x1656, x1655, x1630, x1605); + let mut x1657: u32 = 0; + fiat_p384_cmovznz_u32(&mut x1657, x1655, x1632, x1607); + let mut x1658: u32 = 0; + fiat_p384_cmovznz_u32(&mut x1658, x1655, x1634, x1609); + let mut x1659: u32 = 0; + fiat_p384_cmovznz_u32(&mut x1659, x1655, x1636, x1611); + let mut x1660: u32 = 0; + fiat_p384_cmovznz_u32(&mut x1660, x1655, x1638, x1613); + let mut x1661: u32 = 0; + fiat_p384_cmovznz_u32(&mut x1661, x1655, x1640, x1615); + let mut x1662: u32 = 0; + fiat_p384_cmovznz_u32(&mut x1662, x1655, x1642, x1617); + let mut x1663: u32 = 0; + fiat_p384_cmovznz_u32(&mut x1663, x1655, x1644, x1619); + let mut x1664: u32 = 0; + fiat_p384_cmovznz_u32(&mut x1664, x1655, x1646, x1621); + let mut x1665: u32 = 0; + fiat_p384_cmovznz_u32(&mut x1665, x1655, x1648, x1623); + let mut x1666: u32 = 0; + fiat_p384_cmovznz_u32(&mut x1666, x1655, x1650, x1625); + let mut x1667: u32 = 0; + fiat_p384_cmovznz_u32(&mut x1667, x1655, x1652, x1627); + out1[0] = x1656; + out1[1] = x1657; + out1[2] = x1658; + out1[3] = x1659; + out1[4] = x1660; + out1[5] = x1661; + out1[6] = x1662; + out1[7] = x1663; + out1[8] = x1664; + out1[9] = x1665; + out1[10] = x1666; + out1[11] = x1667; +} + +/// The function fiat_p384_square squares a field element in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg1)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p384_square(out1: &mut fiat_p384_montgomery_domain_field_element, arg1: &fiat_p384_montgomery_domain_field_element) -> () { + let x1: u32 = (arg1[1]); + let x2: u32 = (arg1[2]); + let x3: u32 = (arg1[3]); + let x4: u32 = (arg1[4]); + let x5: u32 = (arg1[5]); + let x6: u32 = (arg1[6]); + let x7: u32 = (arg1[7]); + let x8: u32 = (arg1[8]); + let x9: u32 = (arg1[9]); + let x10: u32 = (arg1[10]); + let x11: u32 = (arg1[11]); + let x12: u32 = (arg1[0]); + let mut x13: u32 = 0; + let mut x14: u32 = 0; + fiat_p384_mulx_u32(&mut x13, &mut x14, x12, (arg1[11])); + let mut x15: u32 = 0; + let mut x16: u32 = 0; + fiat_p384_mulx_u32(&mut x15, &mut x16, x12, (arg1[10])); + let mut x17: u32 = 0; + let mut x18: u32 = 0; + fiat_p384_mulx_u32(&mut x17, &mut x18, x12, (arg1[9])); + let mut x19: u32 = 0; + let mut x20: u32 = 0; + fiat_p384_mulx_u32(&mut x19, &mut x20, x12, (arg1[8])); + let mut x21: u32 = 0; + let mut x22: u32 = 0; + fiat_p384_mulx_u32(&mut x21, &mut x22, x12, (arg1[7])); + let mut x23: u32 = 0; + let mut x24: u32 = 0; + fiat_p384_mulx_u32(&mut x23, &mut x24, x12, (arg1[6])); + let mut x25: u32 = 0; + let mut x26: u32 = 0; + fiat_p384_mulx_u32(&mut x25, &mut x26, x12, (arg1[5])); + let mut x27: u32 = 0; + let mut x28: u32 = 0; + fiat_p384_mulx_u32(&mut x27, &mut x28, x12, (arg1[4])); + let mut x29: u32 = 0; + let mut x30: u32 = 0; + fiat_p384_mulx_u32(&mut x29, &mut x30, x12, (arg1[3])); + let mut x31: u32 = 0; + let mut x32: u32 = 0; + fiat_p384_mulx_u32(&mut x31, &mut x32, x12, (arg1[2])); + let mut x33: u32 = 0; + let mut x34: u32 = 0; + fiat_p384_mulx_u32(&mut x33, &mut x34, x12, (arg1[1])); + let mut x35: u32 = 0; + let mut x36: u32 = 0; + fiat_p384_mulx_u32(&mut x35, &mut x36, x12, (arg1[0])); + let mut x37: u32 = 0; + let mut x38: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x37, &mut x38, 0x0, x36, x33); + let mut x39: u32 = 0; + let mut x40: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x39, &mut x40, x38, x34, x31); + let mut x41: u32 = 0; + let mut x42: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x41, &mut x42, x40, x32, x29); + let mut x43: u32 = 0; + let mut x44: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x43, &mut x44, x42, x30, x27); + let mut x45: u32 = 0; + let mut x46: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x45, &mut x46, x44, x28, x25); + let mut x47: u32 = 0; + let mut x48: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x47, &mut x48, x46, x26, x23); + let mut x49: u32 = 0; + let mut x50: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x49, &mut x50, x48, x24, x21); + let mut x51: u32 = 0; + let mut x52: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x51, &mut x52, x50, x22, x19); + let mut x53: u32 = 0; + let mut x54: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x53, &mut x54, x52, x20, x17); + let mut x55: u32 = 0; + let mut x56: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x55, &mut x56, x54, x18, x15); + let mut x57: u32 = 0; + let mut x58: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x57, &mut x58, x56, x16, x13); + let x59: u32 = ((x58 as u32) + x14); + let mut x60: u32 = 0; + let mut x61: u32 = 0; + fiat_p384_mulx_u32(&mut x60, &mut x61, x35, 0xffffffff); + let mut x62: u32 = 0; + let mut x63: u32 = 0; + fiat_p384_mulx_u32(&mut x62, &mut x63, x35, 0xffffffff); + let mut x64: u32 = 0; + let mut x65: u32 = 0; + fiat_p384_mulx_u32(&mut x64, &mut x65, x35, 0xffffffff); + let mut x66: u32 = 0; + let mut x67: u32 = 0; + fiat_p384_mulx_u32(&mut x66, &mut x67, x35, 0xffffffff); + let mut x68: u32 = 0; + let mut x69: u32 = 0; + fiat_p384_mulx_u32(&mut x68, &mut x69, x35, 0xffffffff); + let mut x70: u32 = 0; + let mut x71: u32 = 0; + fiat_p384_mulx_u32(&mut x70, &mut x71, x35, 0xffffffff); + let mut x72: u32 = 0; + let mut x73: u32 = 0; + fiat_p384_mulx_u32(&mut x72, &mut x73, x35, 0xffffffff); + let mut x74: u32 = 0; + let mut x75: u32 = 0; + fiat_p384_mulx_u32(&mut x74, &mut x75, x35, 0xfffffffe); + let mut x76: u32 = 0; + let mut x77: u32 = 0; + fiat_p384_mulx_u32(&mut x76, &mut x77, x35, 0xffffffff); + let mut x78: u32 = 0; + let mut x79: u32 = 0; + fiat_p384_mulx_u32(&mut x78, &mut x79, x35, 0xffffffff); + let mut x80: u32 = 0; + let mut x81: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x80, &mut x81, 0x0, x77, x74); + let mut x82: u32 = 0; + let mut x83: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x82, &mut x83, x81, x75, x72); + let mut x84: u32 = 0; + let mut x85: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x84, &mut x85, x83, x73, x70); + let mut x86: u32 = 0; + let mut x87: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x86, &mut x87, x85, x71, x68); + let mut x88: u32 = 0; + let mut x89: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x88, &mut x89, x87, x69, x66); + let mut x90: u32 = 0; + let mut x91: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x90, &mut x91, x89, x67, x64); + let mut x92: u32 = 0; + let mut x93: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x92, &mut x93, x91, x65, x62); + let mut x94: u32 = 0; + let mut x95: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x94, &mut x95, x93, x63, x60); + let x96: u32 = ((x95 as u32) + x61); + let mut x97: u32 = 0; + let mut x98: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x97, &mut x98, 0x0, x35, x78); + let mut x99: u32 = 0; + let mut x100: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x99, &mut x100, x98, x37, x79); + let mut x101: u32 = 0; + let mut x102: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x101, &mut x102, x100, x39, (0x0 as u32)); + let mut x103: u32 = 0; + let mut x104: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x103, &mut x104, x102, x41, x76); + let mut x105: u32 = 0; + let mut x106: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x105, &mut x106, x104, x43, x80); + let mut x107: u32 = 0; + let mut x108: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x107, &mut x108, x106, x45, x82); + let mut x109: u32 = 0; + let mut x110: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x109, &mut x110, x108, x47, x84); + let mut x111: u32 = 0; + let mut x112: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x111, &mut x112, x110, x49, x86); + let mut x113: u32 = 0; + let mut x114: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x113, &mut x114, x112, x51, x88); + let mut x115: u32 = 0; + let mut x116: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x115, &mut x116, x114, x53, x90); + let mut x117: u32 = 0; + let mut x118: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x117, &mut x118, x116, x55, x92); + let mut x119: u32 = 0; + let mut x120: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x119, &mut x120, x118, x57, x94); + let mut x121: u32 = 0; + let mut x122: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x121, &mut x122, x120, x59, x96); + let mut x123: u32 = 0; + let mut x124: u32 = 0; + fiat_p384_mulx_u32(&mut x123, &mut x124, x1, (arg1[11])); + let mut x125: u32 = 0; + let mut x126: u32 = 0; + fiat_p384_mulx_u32(&mut x125, &mut x126, x1, (arg1[10])); + let mut x127: u32 = 0; + let mut x128: u32 = 0; + fiat_p384_mulx_u32(&mut x127, &mut x128, x1, (arg1[9])); + let mut x129: u32 = 0; + let mut x130: u32 = 0; + fiat_p384_mulx_u32(&mut x129, &mut x130, x1, (arg1[8])); + let mut x131: u32 = 0; + let mut x132: u32 = 0; + fiat_p384_mulx_u32(&mut x131, &mut x132, x1, (arg1[7])); + let mut x133: u32 = 0; + let mut x134: u32 = 0; + fiat_p384_mulx_u32(&mut x133, &mut x134, x1, (arg1[6])); + let mut x135: u32 = 0; + let mut x136: u32 = 0; + fiat_p384_mulx_u32(&mut x135, &mut x136, x1, (arg1[5])); + let mut x137: u32 = 0; + let mut x138: u32 = 0; + fiat_p384_mulx_u32(&mut x137, &mut x138, x1, (arg1[4])); + let mut x139: u32 = 0; + let mut x140: u32 = 0; + fiat_p384_mulx_u32(&mut x139, &mut x140, x1, (arg1[3])); + let mut x141: u32 = 0; + let mut x142: u32 = 0; + fiat_p384_mulx_u32(&mut x141, &mut x142, x1, (arg1[2])); + let mut x143: u32 = 0; + let mut x144: u32 = 0; + fiat_p384_mulx_u32(&mut x143, &mut x144, x1, (arg1[1])); + let mut x145: u32 = 0; + let mut x146: u32 = 0; + fiat_p384_mulx_u32(&mut x145, &mut x146, x1, (arg1[0])); + let mut x147: u32 = 0; + let mut x148: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x147, &mut x148, 0x0, x146, x143); + let mut x149: u32 = 0; + let mut x150: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x149, &mut x150, x148, x144, x141); + let mut x151: u32 = 0; + let mut x152: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x151, &mut x152, x150, x142, x139); + let mut x153: u32 = 0; + let mut x154: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x153, &mut x154, x152, x140, x137); + let mut x155: u32 = 0; + let mut x156: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x155, &mut x156, x154, x138, x135); + let mut x157: u32 = 0; + let mut x158: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x157, &mut x158, x156, x136, x133); + let mut x159: u32 = 0; + let mut x160: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x159, &mut x160, x158, x134, x131); + let mut x161: u32 = 0; + let mut x162: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x161, &mut x162, x160, x132, x129); + let mut x163: u32 = 0; + let mut x164: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x163, &mut x164, x162, x130, x127); + let mut x165: u32 = 0; + let mut x166: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x165, &mut x166, x164, x128, x125); + let mut x167: u32 = 0; + let mut x168: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x167, &mut x168, x166, x126, x123); + let x169: u32 = ((x168 as u32) + x124); + let mut x170: u32 = 0; + let mut x171: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x170, &mut x171, 0x0, x99, x145); + let mut x172: u32 = 0; + let mut x173: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x172, &mut x173, x171, x101, x147); + let mut x174: u32 = 0; + let mut x175: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x174, &mut x175, x173, x103, x149); + let mut x176: u32 = 0; + let mut x177: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x176, &mut x177, x175, x105, x151); + let mut x178: u32 = 0; + let mut x179: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x178, &mut x179, x177, x107, x153); + let mut x180: u32 = 0; + let mut x181: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x180, &mut x181, x179, x109, x155); + let mut x182: u32 = 0; + let mut x183: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x182, &mut x183, x181, x111, x157); + let mut x184: u32 = 0; + let mut x185: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x184, &mut x185, x183, x113, x159); + let mut x186: u32 = 0; + let mut x187: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x186, &mut x187, x185, x115, x161); + let mut x188: u32 = 0; + let mut x189: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x188, &mut x189, x187, x117, x163); + let mut x190: u32 = 0; + let mut x191: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x190, &mut x191, x189, x119, x165); + let mut x192: u32 = 0; + let mut x193: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x192, &mut x193, x191, x121, x167); + let mut x194: u32 = 0; + let mut x195: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x194, &mut x195, x193, (x122 as u32), x169); + let mut x196: u32 = 0; + let mut x197: u32 = 0; + fiat_p384_mulx_u32(&mut x196, &mut x197, x170, 0xffffffff); + let mut x198: u32 = 0; + let mut x199: u32 = 0; + fiat_p384_mulx_u32(&mut x198, &mut x199, x170, 0xffffffff); + let mut x200: u32 = 0; + let mut x201: u32 = 0; + fiat_p384_mulx_u32(&mut x200, &mut x201, x170, 0xffffffff); + let mut x202: u32 = 0; + let mut x203: u32 = 0; + fiat_p384_mulx_u32(&mut x202, &mut x203, x170, 0xffffffff); + let mut x204: u32 = 0; + let mut x205: u32 = 0; + fiat_p384_mulx_u32(&mut x204, &mut x205, x170, 0xffffffff); + let mut x206: u32 = 0; + let mut x207: u32 = 0; + fiat_p384_mulx_u32(&mut x206, &mut x207, x170, 0xffffffff); + let mut x208: u32 = 0; + let mut x209: u32 = 0; + fiat_p384_mulx_u32(&mut x208, &mut x209, x170, 0xffffffff); + let mut x210: u32 = 0; + let mut x211: u32 = 0; + fiat_p384_mulx_u32(&mut x210, &mut x211, x170, 0xfffffffe); + let mut x212: u32 = 0; + let mut x213: u32 = 0; + fiat_p384_mulx_u32(&mut x212, &mut x213, x170, 0xffffffff); + let mut x214: u32 = 0; + let mut x215: u32 = 0; + fiat_p384_mulx_u32(&mut x214, &mut x215, x170, 0xffffffff); + let mut x216: u32 = 0; + let mut x217: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x216, &mut x217, 0x0, x213, x210); + let mut x218: u32 = 0; + let mut x219: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x218, &mut x219, x217, x211, x208); + let mut x220: u32 = 0; + let mut x221: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x220, &mut x221, x219, x209, x206); + let mut x222: u32 = 0; + let mut x223: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x222, &mut x223, x221, x207, x204); + let mut x224: u32 = 0; + let mut x225: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x224, &mut x225, x223, x205, x202); + let mut x226: u32 = 0; + let mut x227: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x226, &mut x227, x225, x203, x200); + let mut x228: u32 = 0; + let mut x229: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x228, &mut x229, x227, x201, x198); + let mut x230: u32 = 0; + let mut x231: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x230, &mut x231, x229, x199, x196); + let x232: u32 = ((x231 as u32) + x197); + let mut x233: u32 = 0; + let mut x234: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x233, &mut x234, 0x0, x170, x214); + let mut x235: u32 = 0; + let mut x236: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x235, &mut x236, x234, x172, x215); + let mut x237: u32 = 0; + let mut x238: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x237, &mut x238, x236, x174, (0x0 as u32)); + let mut x239: u32 = 0; + let mut x240: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x239, &mut x240, x238, x176, x212); + let mut x241: u32 = 0; + let mut x242: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x241, &mut x242, x240, x178, x216); + let mut x243: u32 = 0; + let mut x244: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x243, &mut x244, x242, x180, x218); + let mut x245: u32 = 0; + let mut x246: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x245, &mut x246, x244, x182, x220); + let mut x247: u32 = 0; + let mut x248: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x247, &mut x248, x246, x184, x222); + let mut x249: u32 = 0; + let mut x250: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x249, &mut x250, x248, x186, x224); + let mut x251: u32 = 0; + let mut x252: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x251, &mut x252, x250, x188, x226); + let mut x253: u32 = 0; + let mut x254: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x253, &mut x254, x252, x190, x228); + let mut x255: u32 = 0; + let mut x256: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x255, &mut x256, x254, x192, x230); + let mut x257: u32 = 0; + let mut x258: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x257, &mut x258, x256, x194, x232); + let x259: u32 = ((x258 as u32) + (x195 as u32)); + let mut x260: u32 = 0; + let mut x261: u32 = 0; + fiat_p384_mulx_u32(&mut x260, &mut x261, x2, (arg1[11])); + let mut x262: u32 = 0; + let mut x263: u32 = 0; + fiat_p384_mulx_u32(&mut x262, &mut x263, x2, (arg1[10])); + let mut x264: u32 = 0; + let mut x265: u32 = 0; + fiat_p384_mulx_u32(&mut x264, &mut x265, x2, (arg1[9])); + let mut x266: u32 = 0; + let mut x267: u32 = 0; + fiat_p384_mulx_u32(&mut x266, &mut x267, x2, (arg1[8])); + let mut x268: u32 = 0; + let mut x269: u32 = 0; + fiat_p384_mulx_u32(&mut x268, &mut x269, x2, (arg1[7])); + let mut x270: u32 = 0; + let mut x271: u32 = 0; + fiat_p384_mulx_u32(&mut x270, &mut x271, x2, (arg1[6])); + let mut x272: u32 = 0; + let mut x273: u32 = 0; + fiat_p384_mulx_u32(&mut x272, &mut x273, x2, (arg1[5])); + let mut x274: u32 = 0; + let mut x275: u32 = 0; + fiat_p384_mulx_u32(&mut x274, &mut x275, x2, (arg1[4])); + let mut x276: u32 = 0; + let mut x277: u32 = 0; + fiat_p384_mulx_u32(&mut x276, &mut x277, x2, (arg1[3])); + let mut x278: u32 = 0; + let mut x279: u32 = 0; + fiat_p384_mulx_u32(&mut x278, &mut x279, x2, (arg1[2])); + let mut x280: u32 = 0; + let mut x281: u32 = 0; + fiat_p384_mulx_u32(&mut x280, &mut x281, x2, (arg1[1])); + let mut x282: u32 = 0; + let mut x283: u32 = 0; + fiat_p384_mulx_u32(&mut x282, &mut x283, x2, (arg1[0])); + let mut x284: u32 = 0; + let mut x285: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x284, &mut x285, 0x0, x283, x280); + let mut x286: u32 = 0; + let mut x287: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x286, &mut x287, x285, x281, x278); + let mut x288: u32 = 0; + let mut x289: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x288, &mut x289, x287, x279, x276); + let mut x290: u32 = 0; + let mut x291: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x290, &mut x291, x289, x277, x274); + let mut x292: u32 = 0; + let mut x293: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x292, &mut x293, x291, x275, x272); + let mut x294: u32 = 0; + let mut x295: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x294, &mut x295, x293, x273, x270); + let mut x296: u32 = 0; + let mut x297: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x296, &mut x297, x295, x271, x268); + let mut x298: u32 = 0; + let mut x299: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x298, &mut x299, x297, x269, x266); + let mut x300: u32 = 0; + let mut x301: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x300, &mut x301, x299, x267, x264); + let mut x302: u32 = 0; + let mut x303: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x302, &mut x303, x301, x265, x262); + let mut x304: u32 = 0; + let mut x305: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x304, &mut x305, x303, x263, x260); + let x306: u32 = ((x305 as u32) + x261); + let mut x307: u32 = 0; + let mut x308: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x307, &mut x308, 0x0, x235, x282); + let mut x309: u32 = 0; + let mut x310: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x309, &mut x310, x308, x237, x284); + let mut x311: u32 = 0; + let mut x312: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x311, &mut x312, x310, x239, x286); + let mut x313: u32 = 0; + let mut x314: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x313, &mut x314, x312, x241, x288); + let mut x315: u32 = 0; + let mut x316: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x315, &mut x316, x314, x243, x290); + let mut x317: u32 = 0; + let mut x318: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x317, &mut x318, x316, x245, x292); + let mut x319: u32 = 0; + let mut x320: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x319, &mut x320, x318, x247, x294); + let mut x321: u32 = 0; + let mut x322: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x321, &mut x322, x320, x249, x296); + let mut x323: u32 = 0; + let mut x324: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x323, &mut x324, x322, x251, x298); + let mut x325: u32 = 0; + let mut x326: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x325, &mut x326, x324, x253, x300); + let mut x327: u32 = 0; + let mut x328: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x327, &mut x328, x326, x255, x302); + let mut x329: u32 = 0; + let mut x330: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x329, &mut x330, x328, x257, x304); + let mut x331: u32 = 0; + let mut x332: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x331, &mut x332, x330, x259, x306); + let mut x333: u32 = 0; + let mut x334: u32 = 0; + fiat_p384_mulx_u32(&mut x333, &mut x334, x307, 0xffffffff); + let mut x335: u32 = 0; + let mut x336: u32 = 0; + fiat_p384_mulx_u32(&mut x335, &mut x336, x307, 0xffffffff); + let mut x337: u32 = 0; + let mut x338: u32 = 0; + fiat_p384_mulx_u32(&mut x337, &mut x338, x307, 0xffffffff); + let mut x339: u32 = 0; + let mut x340: u32 = 0; + fiat_p384_mulx_u32(&mut x339, &mut x340, x307, 0xffffffff); + let mut x341: u32 = 0; + let mut x342: u32 = 0; + fiat_p384_mulx_u32(&mut x341, &mut x342, x307, 0xffffffff); + let mut x343: u32 = 0; + let mut x344: u32 = 0; + fiat_p384_mulx_u32(&mut x343, &mut x344, x307, 0xffffffff); + let mut x345: u32 = 0; + let mut x346: u32 = 0; + fiat_p384_mulx_u32(&mut x345, &mut x346, x307, 0xffffffff); + let mut x347: u32 = 0; + let mut x348: u32 = 0; + fiat_p384_mulx_u32(&mut x347, &mut x348, x307, 0xfffffffe); + let mut x349: u32 = 0; + let mut x350: u32 = 0; + fiat_p384_mulx_u32(&mut x349, &mut x350, x307, 0xffffffff); + let mut x351: u32 = 0; + let mut x352: u32 = 0; + fiat_p384_mulx_u32(&mut x351, &mut x352, x307, 0xffffffff); + let mut x353: u32 = 0; + let mut x354: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x353, &mut x354, 0x0, x350, x347); + let mut x355: u32 = 0; + let mut x356: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x355, &mut x356, x354, x348, x345); + let mut x357: u32 = 0; + let mut x358: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x357, &mut x358, x356, x346, x343); + let mut x359: u32 = 0; + let mut x360: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x359, &mut x360, x358, x344, x341); + let mut x361: u32 = 0; + let mut x362: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x361, &mut x362, x360, x342, x339); + let mut x363: u32 = 0; + let mut x364: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x363, &mut x364, x362, x340, x337); + let mut x365: u32 = 0; + let mut x366: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x365, &mut x366, x364, x338, x335); + let mut x367: u32 = 0; + let mut x368: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x367, &mut x368, x366, x336, x333); + let x369: u32 = ((x368 as u32) + x334); + let mut x370: u32 = 0; + let mut x371: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x370, &mut x371, 0x0, x307, x351); + let mut x372: u32 = 0; + let mut x373: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x372, &mut x373, x371, x309, x352); + let mut x374: u32 = 0; + let mut x375: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x374, &mut x375, x373, x311, (0x0 as u32)); + let mut x376: u32 = 0; + let mut x377: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x376, &mut x377, x375, x313, x349); + let mut x378: u32 = 0; + let mut x379: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x378, &mut x379, x377, x315, x353); + let mut x380: u32 = 0; + let mut x381: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x380, &mut x381, x379, x317, x355); + let mut x382: u32 = 0; + let mut x383: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x382, &mut x383, x381, x319, x357); + let mut x384: u32 = 0; + let mut x385: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x384, &mut x385, x383, x321, x359); + let mut x386: u32 = 0; + let mut x387: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x386, &mut x387, x385, x323, x361); + let mut x388: u32 = 0; + let mut x389: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x388, &mut x389, x387, x325, x363); + let mut x390: u32 = 0; + let mut x391: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x390, &mut x391, x389, x327, x365); + let mut x392: u32 = 0; + let mut x393: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x392, &mut x393, x391, x329, x367); + let mut x394: u32 = 0; + let mut x395: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x394, &mut x395, x393, x331, x369); + let x396: u32 = ((x395 as u32) + (x332 as u32)); + let mut x397: u32 = 0; + let mut x398: u32 = 0; + fiat_p384_mulx_u32(&mut x397, &mut x398, x3, (arg1[11])); + let mut x399: u32 = 0; + let mut x400: u32 = 0; + fiat_p384_mulx_u32(&mut x399, &mut x400, x3, (arg1[10])); + let mut x401: u32 = 0; + let mut x402: u32 = 0; + fiat_p384_mulx_u32(&mut x401, &mut x402, x3, (arg1[9])); + let mut x403: u32 = 0; + let mut x404: u32 = 0; + fiat_p384_mulx_u32(&mut x403, &mut x404, x3, (arg1[8])); + let mut x405: u32 = 0; + let mut x406: u32 = 0; + fiat_p384_mulx_u32(&mut x405, &mut x406, x3, (arg1[7])); + let mut x407: u32 = 0; + let mut x408: u32 = 0; + fiat_p384_mulx_u32(&mut x407, &mut x408, x3, (arg1[6])); + let mut x409: u32 = 0; + let mut x410: u32 = 0; + fiat_p384_mulx_u32(&mut x409, &mut x410, x3, (arg1[5])); + let mut x411: u32 = 0; + let mut x412: u32 = 0; + fiat_p384_mulx_u32(&mut x411, &mut x412, x3, (arg1[4])); + let mut x413: u32 = 0; + let mut x414: u32 = 0; + fiat_p384_mulx_u32(&mut x413, &mut x414, x3, (arg1[3])); + let mut x415: u32 = 0; + let mut x416: u32 = 0; + fiat_p384_mulx_u32(&mut x415, &mut x416, x3, (arg1[2])); + let mut x417: u32 = 0; + let mut x418: u32 = 0; + fiat_p384_mulx_u32(&mut x417, &mut x418, x3, (arg1[1])); + let mut x419: u32 = 0; + let mut x420: u32 = 0; + fiat_p384_mulx_u32(&mut x419, &mut x420, x3, (arg1[0])); + let mut x421: u32 = 0; + let mut x422: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x421, &mut x422, 0x0, x420, x417); + let mut x423: u32 = 0; + let mut x424: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x423, &mut x424, x422, x418, x415); + let mut x425: u32 = 0; + let mut x426: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x425, &mut x426, x424, x416, x413); + let mut x427: u32 = 0; + let mut x428: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x427, &mut x428, x426, x414, x411); + let mut x429: u32 = 0; + let mut x430: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x429, &mut x430, x428, x412, x409); + let mut x431: u32 = 0; + let mut x432: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x431, &mut x432, x430, x410, x407); + let mut x433: u32 = 0; + let mut x434: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x433, &mut x434, x432, x408, x405); + let mut x435: u32 = 0; + let mut x436: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x435, &mut x436, x434, x406, x403); + let mut x437: u32 = 0; + let mut x438: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x437, &mut x438, x436, x404, x401); + let mut x439: u32 = 0; + let mut x440: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x439, &mut x440, x438, x402, x399); + let mut x441: u32 = 0; + let mut x442: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x441, &mut x442, x440, x400, x397); + let x443: u32 = ((x442 as u32) + x398); + let mut x444: u32 = 0; + let mut x445: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x444, &mut x445, 0x0, x372, x419); + let mut x446: u32 = 0; + let mut x447: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x446, &mut x447, x445, x374, x421); + let mut x448: u32 = 0; + let mut x449: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x448, &mut x449, x447, x376, x423); + let mut x450: u32 = 0; + let mut x451: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x450, &mut x451, x449, x378, x425); + let mut x452: u32 = 0; + let mut x453: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x452, &mut x453, x451, x380, x427); + let mut x454: u32 = 0; + let mut x455: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x454, &mut x455, x453, x382, x429); + let mut x456: u32 = 0; + let mut x457: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x456, &mut x457, x455, x384, x431); + let mut x458: u32 = 0; + let mut x459: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x458, &mut x459, x457, x386, x433); + let mut x460: u32 = 0; + let mut x461: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x460, &mut x461, x459, x388, x435); + let mut x462: u32 = 0; + let mut x463: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x462, &mut x463, x461, x390, x437); + let mut x464: u32 = 0; + let mut x465: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x464, &mut x465, x463, x392, x439); + let mut x466: u32 = 0; + let mut x467: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x466, &mut x467, x465, x394, x441); + let mut x468: u32 = 0; + let mut x469: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x468, &mut x469, x467, x396, x443); + let mut x470: u32 = 0; + let mut x471: u32 = 0; + fiat_p384_mulx_u32(&mut x470, &mut x471, x444, 0xffffffff); + let mut x472: u32 = 0; + let mut x473: u32 = 0; + fiat_p384_mulx_u32(&mut x472, &mut x473, x444, 0xffffffff); + let mut x474: u32 = 0; + let mut x475: u32 = 0; + fiat_p384_mulx_u32(&mut x474, &mut x475, x444, 0xffffffff); + let mut x476: u32 = 0; + let mut x477: u32 = 0; + fiat_p384_mulx_u32(&mut x476, &mut x477, x444, 0xffffffff); + let mut x478: u32 = 0; + let mut x479: u32 = 0; + fiat_p384_mulx_u32(&mut x478, &mut x479, x444, 0xffffffff); + let mut x480: u32 = 0; + let mut x481: u32 = 0; + fiat_p384_mulx_u32(&mut x480, &mut x481, x444, 0xffffffff); + let mut x482: u32 = 0; + let mut x483: u32 = 0; + fiat_p384_mulx_u32(&mut x482, &mut x483, x444, 0xffffffff); + let mut x484: u32 = 0; + let mut x485: u32 = 0; + fiat_p384_mulx_u32(&mut x484, &mut x485, x444, 0xfffffffe); + let mut x486: u32 = 0; + let mut x487: u32 = 0; + fiat_p384_mulx_u32(&mut x486, &mut x487, x444, 0xffffffff); + let mut x488: u32 = 0; + let mut x489: u32 = 0; + fiat_p384_mulx_u32(&mut x488, &mut x489, x444, 0xffffffff); + let mut x490: u32 = 0; + let mut x491: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x490, &mut x491, 0x0, x487, x484); + let mut x492: u32 = 0; + let mut x493: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x492, &mut x493, x491, x485, x482); + let mut x494: u32 = 0; + let mut x495: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x494, &mut x495, x493, x483, x480); + let mut x496: u32 = 0; + let mut x497: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x496, &mut x497, x495, x481, x478); + let mut x498: u32 = 0; + let mut x499: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x498, &mut x499, x497, x479, x476); + let mut x500: u32 = 0; + let mut x501: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x500, &mut x501, x499, x477, x474); + let mut x502: u32 = 0; + let mut x503: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x502, &mut x503, x501, x475, x472); + let mut x504: u32 = 0; + let mut x505: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x504, &mut x505, x503, x473, x470); + let x506: u32 = ((x505 as u32) + x471); + let mut x507: u32 = 0; + let mut x508: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x507, &mut x508, 0x0, x444, x488); + let mut x509: u32 = 0; + let mut x510: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x509, &mut x510, x508, x446, x489); + let mut x511: u32 = 0; + let mut x512: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x511, &mut x512, x510, x448, (0x0 as u32)); + let mut x513: u32 = 0; + let mut x514: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x513, &mut x514, x512, x450, x486); + let mut x515: u32 = 0; + let mut x516: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x515, &mut x516, x514, x452, x490); + let mut x517: u32 = 0; + let mut x518: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x517, &mut x518, x516, x454, x492); + let mut x519: u32 = 0; + let mut x520: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x519, &mut x520, x518, x456, x494); + let mut x521: u32 = 0; + let mut x522: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x521, &mut x522, x520, x458, x496); + let mut x523: u32 = 0; + let mut x524: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x523, &mut x524, x522, x460, x498); + let mut x525: u32 = 0; + let mut x526: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x525, &mut x526, x524, x462, x500); + let mut x527: u32 = 0; + let mut x528: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x527, &mut x528, x526, x464, x502); + let mut x529: u32 = 0; + let mut x530: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x529, &mut x530, x528, x466, x504); + let mut x531: u32 = 0; + let mut x532: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x531, &mut x532, x530, x468, x506); + let x533: u32 = ((x532 as u32) + (x469 as u32)); + let mut x534: u32 = 0; + let mut x535: u32 = 0; + fiat_p384_mulx_u32(&mut x534, &mut x535, x4, (arg1[11])); + let mut x536: u32 = 0; + let mut x537: u32 = 0; + fiat_p384_mulx_u32(&mut x536, &mut x537, x4, (arg1[10])); + let mut x538: u32 = 0; + let mut x539: u32 = 0; + fiat_p384_mulx_u32(&mut x538, &mut x539, x4, (arg1[9])); + let mut x540: u32 = 0; + let mut x541: u32 = 0; + fiat_p384_mulx_u32(&mut x540, &mut x541, x4, (arg1[8])); + let mut x542: u32 = 0; + let mut x543: u32 = 0; + fiat_p384_mulx_u32(&mut x542, &mut x543, x4, (arg1[7])); + let mut x544: u32 = 0; + let mut x545: u32 = 0; + fiat_p384_mulx_u32(&mut x544, &mut x545, x4, (arg1[6])); + let mut x546: u32 = 0; + let mut x547: u32 = 0; + fiat_p384_mulx_u32(&mut x546, &mut x547, x4, (arg1[5])); + let mut x548: u32 = 0; + let mut x549: u32 = 0; + fiat_p384_mulx_u32(&mut x548, &mut x549, x4, (arg1[4])); + let mut x550: u32 = 0; + let mut x551: u32 = 0; + fiat_p384_mulx_u32(&mut x550, &mut x551, x4, (arg1[3])); + let mut x552: u32 = 0; + let mut x553: u32 = 0; + fiat_p384_mulx_u32(&mut x552, &mut x553, x4, (arg1[2])); + let mut x554: u32 = 0; + let mut x555: u32 = 0; + fiat_p384_mulx_u32(&mut x554, &mut x555, x4, (arg1[1])); + let mut x556: u32 = 0; + let mut x557: u32 = 0; + fiat_p384_mulx_u32(&mut x556, &mut x557, x4, (arg1[0])); + let mut x558: u32 = 0; + let mut x559: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x558, &mut x559, 0x0, x557, x554); + let mut x560: u32 = 0; + let mut x561: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x560, &mut x561, x559, x555, x552); + let mut x562: u32 = 0; + let mut x563: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x562, &mut x563, x561, x553, x550); + let mut x564: u32 = 0; + let mut x565: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x564, &mut x565, x563, x551, x548); + let mut x566: u32 = 0; + let mut x567: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x566, &mut x567, x565, x549, x546); + let mut x568: u32 = 0; + let mut x569: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x568, &mut x569, x567, x547, x544); + let mut x570: u32 = 0; + let mut x571: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x570, &mut x571, x569, x545, x542); + let mut x572: u32 = 0; + let mut x573: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x572, &mut x573, x571, x543, x540); + let mut x574: u32 = 0; + let mut x575: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x574, &mut x575, x573, x541, x538); + let mut x576: u32 = 0; + let mut x577: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x576, &mut x577, x575, x539, x536); + let mut x578: u32 = 0; + let mut x579: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x578, &mut x579, x577, x537, x534); + let x580: u32 = ((x579 as u32) + x535); + let mut x581: u32 = 0; + let mut x582: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x581, &mut x582, 0x0, x509, x556); + let mut x583: u32 = 0; + let mut x584: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x583, &mut x584, x582, x511, x558); + let mut x585: u32 = 0; + let mut x586: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x585, &mut x586, x584, x513, x560); + let mut x587: u32 = 0; + let mut x588: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x587, &mut x588, x586, x515, x562); + let mut x589: u32 = 0; + let mut x590: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x589, &mut x590, x588, x517, x564); + let mut x591: u32 = 0; + let mut x592: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x591, &mut x592, x590, x519, x566); + let mut x593: u32 = 0; + let mut x594: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x593, &mut x594, x592, x521, x568); + let mut x595: u32 = 0; + let mut x596: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x595, &mut x596, x594, x523, x570); + let mut x597: u32 = 0; + let mut x598: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x597, &mut x598, x596, x525, x572); + let mut x599: u32 = 0; + let mut x600: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x599, &mut x600, x598, x527, x574); + let mut x601: u32 = 0; + let mut x602: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x601, &mut x602, x600, x529, x576); + let mut x603: u32 = 0; + let mut x604: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x603, &mut x604, x602, x531, x578); + let mut x605: u32 = 0; + let mut x606: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x605, &mut x606, x604, x533, x580); + let mut x607: u32 = 0; + let mut x608: u32 = 0; + fiat_p384_mulx_u32(&mut x607, &mut x608, x581, 0xffffffff); + let mut x609: u32 = 0; + let mut x610: u32 = 0; + fiat_p384_mulx_u32(&mut x609, &mut x610, x581, 0xffffffff); + let mut x611: u32 = 0; + let mut x612: u32 = 0; + fiat_p384_mulx_u32(&mut x611, &mut x612, x581, 0xffffffff); + let mut x613: u32 = 0; + let mut x614: u32 = 0; + fiat_p384_mulx_u32(&mut x613, &mut x614, x581, 0xffffffff); + let mut x615: u32 = 0; + let mut x616: u32 = 0; + fiat_p384_mulx_u32(&mut x615, &mut x616, x581, 0xffffffff); + let mut x617: u32 = 0; + let mut x618: u32 = 0; + fiat_p384_mulx_u32(&mut x617, &mut x618, x581, 0xffffffff); + let mut x619: u32 = 0; + let mut x620: u32 = 0; + fiat_p384_mulx_u32(&mut x619, &mut x620, x581, 0xffffffff); + let mut x621: u32 = 0; + let mut x622: u32 = 0; + fiat_p384_mulx_u32(&mut x621, &mut x622, x581, 0xfffffffe); + let mut x623: u32 = 0; + let mut x624: u32 = 0; + fiat_p384_mulx_u32(&mut x623, &mut x624, x581, 0xffffffff); + let mut x625: u32 = 0; + let mut x626: u32 = 0; + fiat_p384_mulx_u32(&mut x625, &mut x626, x581, 0xffffffff); + let mut x627: u32 = 0; + let mut x628: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x627, &mut x628, 0x0, x624, x621); + let mut x629: u32 = 0; + let mut x630: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x629, &mut x630, x628, x622, x619); + let mut x631: u32 = 0; + let mut x632: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x631, &mut x632, x630, x620, x617); + let mut x633: u32 = 0; + let mut x634: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x633, &mut x634, x632, x618, x615); + let mut x635: u32 = 0; + let mut x636: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x635, &mut x636, x634, x616, x613); + let mut x637: u32 = 0; + let mut x638: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x637, &mut x638, x636, x614, x611); + let mut x639: u32 = 0; + let mut x640: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x639, &mut x640, x638, x612, x609); + let mut x641: u32 = 0; + let mut x642: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x641, &mut x642, x640, x610, x607); + let x643: u32 = ((x642 as u32) + x608); + let mut x644: u32 = 0; + let mut x645: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x644, &mut x645, 0x0, x581, x625); + let mut x646: u32 = 0; + let mut x647: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x646, &mut x647, x645, x583, x626); + let mut x648: u32 = 0; + let mut x649: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x648, &mut x649, x647, x585, (0x0 as u32)); + let mut x650: u32 = 0; + let mut x651: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x650, &mut x651, x649, x587, x623); + let mut x652: u32 = 0; + let mut x653: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x652, &mut x653, x651, x589, x627); + let mut x654: u32 = 0; + let mut x655: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x654, &mut x655, x653, x591, x629); + let mut x656: u32 = 0; + let mut x657: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x656, &mut x657, x655, x593, x631); + let mut x658: u32 = 0; + let mut x659: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x658, &mut x659, x657, x595, x633); + let mut x660: u32 = 0; + let mut x661: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x660, &mut x661, x659, x597, x635); + let mut x662: u32 = 0; + let mut x663: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x662, &mut x663, x661, x599, x637); + let mut x664: u32 = 0; + let mut x665: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x664, &mut x665, x663, x601, x639); + let mut x666: u32 = 0; + let mut x667: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x666, &mut x667, x665, x603, x641); + let mut x668: u32 = 0; + let mut x669: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x668, &mut x669, x667, x605, x643); + let x670: u32 = ((x669 as u32) + (x606 as u32)); + let mut x671: u32 = 0; + let mut x672: u32 = 0; + fiat_p384_mulx_u32(&mut x671, &mut x672, x5, (arg1[11])); + let mut x673: u32 = 0; + let mut x674: u32 = 0; + fiat_p384_mulx_u32(&mut x673, &mut x674, x5, (arg1[10])); + let mut x675: u32 = 0; + let mut x676: u32 = 0; + fiat_p384_mulx_u32(&mut x675, &mut x676, x5, (arg1[9])); + let mut x677: u32 = 0; + let mut x678: u32 = 0; + fiat_p384_mulx_u32(&mut x677, &mut x678, x5, (arg1[8])); + let mut x679: u32 = 0; + let mut x680: u32 = 0; + fiat_p384_mulx_u32(&mut x679, &mut x680, x5, (arg1[7])); + let mut x681: u32 = 0; + let mut x682: u32 = 0; + fiat_p384_mulx_u32(&mut x681, &mut x682, x5, (arg1[6])); + let mut x683: u32 = 0; + let mut x684: u32 = 0; + fiat_p384_mulx_u32(&mut x683, &mut x684, x5, (arg1[5])); + let mut x685: u32 = 0; + let mut x686: u32 = 0; + fiat_p384_mulx_u32(&mut x685, &mut x686, x5, (arg1[4])); + let mut x687: u32 = 0; + let mut x688: u32 = 0; + fiat_p384_mulx_u32(&mut x687, &mut x688, x5, (arg1[3])); + let mut x689: u32 = 0; + let mut x690: u32 = 0; + fiat_p384_mulx_u32(&mut x689, &mut x690, x5, (arg1[2])); + let mut x691: u32 = 0; + let mut x692: u32 = 0; + fiat_p384_mulx_u32(&mut x691, &mut x692, x5, (arg1[1])); + let mut x693: u32 = 0; + let mut x694: u32 = 0; + fiat_p384_mulx_u32(&mut x693, &mut x694, x5, (arg1[0])); + let mut x695: u32 = 0; + let mut x696: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x695, &mut x696, 0x0, x694, x691); + let mut x697: u32 = 0; + let mut x698: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x697, &mut x698, x696, x692, x689); + let mut x699: u32 = 0; + let mut x700: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x699, &mut x700, x698, x690, x687); + let mut x701: u32 = 0; + let mut x702: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x701, &mut x702, x700, x688, x685); + let mut x703: u32 = 0; + let mut x704: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x703, &mut x704, x702, x686, x683); + let mut x705: u32 = 0; + let mut x706: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x705, &mut x706, x704, x684, x681); + let mut x707: u32 = 0; + let mut x708: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x707, &mut x708, x706, x682, x679); + let mut x709: u32 = 0; + let mut x710: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x709, &mut x710, x708, x680, x677); + let mut x711: u32 = 0; + let mut x712: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x711, &mut x712, x710, x678, x675); + let mut x713: u32 = 0; + let mut x714: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x713, &mut x714, x712, x676, x673); + let mut x715: u32 = 0; + let mut x716: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x715, &mut x716, x714, x674, x671); + let x717: u32 = ((x716 as u32) + x672); + let mut x718: u32 = 0; + let mut x719: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x718, &mut x719, 0x0, x646, x693); + let mut x720: u32 = 0; + let mut x721: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x720, &mut x721, x719, x648, x695); + let mut x722: u32 = 0; + let mut x723: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x722, &mut x723, x721, x650, x697); + let mut x724: u32 = 0; + let mut x725: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x724, &mut x725, x723, x652, x699); + let mut x726: u32 = 0; + let mut x727: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x726, &mut x727, x725, x654, x701); + let mut x728: u32 = 0; + let mut x729: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x728, &mut x729, x727, x656, x703); + let mut x730: u32 = 0; + let mut x731: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x730, &mut x731, x729, x658, x705); + let mut x732: u32 = 0; + let mut x733: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x732, &mut x733, x731, x660, x707); + let mut x734: u32 = 0; + let mut x735: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x734, &mut x735, x733, x662, x709); + let mut x736: u32 = 0; + let mut x737: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x736, &mut x737, x735, x664, x711); + let mut x738: u32 = 0; + let mut x739: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x738, &mut x739, x737, x666, x713); + let mut x740: u32 = 0; + let mut x741: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x740, &mut x741, x739, x668, x715); + let mut x742: u32 = 0; + let mut x743: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x742, &mut x743, x741, x670, x717); + let mut x744: u32 = 0; + let mut x745: u32 = 0; + fiat_p384_mulx_u32(&mut x744, &mut x745, x718, 0xffffffff); + let mut x746: u32 = 0; + let mut x747: u32 = 0; + fiat_p384_mulx_u32(&mut x746, &mut x747, x718, 0xffffffff); + let mut x748: u32 = 0; + let mut x749: u32 = 0; + fiat_p384_mulx_u32(&mut x748, &mut x749, x718, 0xffffffff); + let mut x750: u32 = 0; + let mut x751: u32 = 0; + fiat_p384_mulx_u32(&mut x750, &mut x751, x718, 0xffffffff); + let mut x752: u32 = 0; + let mut x753: u32 = 0; + fiat_p384_mulx_u32(&mut x752, &mut x753, x718, 0xffffffff); + let mut x754: u32 = 0; + let mut x755: u32 = 0; + fiat_p384_mulx_u32(&mut x754, &mut x755, x718, 0xffffffff); + let mut x756: u32 = 0; + let mut x757: u32 = 0; + fiat_p384_mulx_u32(&mut x756, &mut x757, x718, 0xffffffff); + let mut x758: u32 = 0; + let mut x759: u32 = 0; + fiat_p384_mulx_u32(&mut x758, &mut x759, x718, 0xfffffffe); + let mut x760: u32 = 0; + let mut x761: u32 = 0; + fiat_p384_mulx_u32(&mut x760, &mut x761, x718, 0xffffffff); + let mut x762: u32 = 0; + let mut x763: u32 = 0; + fiat_p384_mulx_u32(&mut x762, &mut x763, x718, 0xffffffff); + let mut x764: u32 = 0; + let mut x765: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x764, &mut x765, 0x0, x761, x758); + let mut x766: u32 = 0; + let mut x767: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x766, &mut x767, x765, x759, x756); + let mut x768: u32 = 0; + let mut x769: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x768, &mut x769, x767, x757, x754); + let mut x770: u32 = 0; + let mut x771: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x770, &mut x771, x769, x755, x752); + let mut x772: u32 = 0; + let mut x773: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x772, &mut x773, x771, x753, x750); + let mut x774: u32 = 0; + let mut x775: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x774, &mut x775, x773, x751, x748); + let mut x776: u32 = 0; + let mut x777: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x776, &mut x777, x775, x749, x746); + let mut x778: u32 = 0; + let mut x779: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x778, &mut x779, x777, x747, x744); + let x780: u32 = ((x779 as u32) + x745); + let mut x781: u32 = 0; + let mut x782: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x781, &mut x782, 0x0, x718, x762); + let mut x783: u32 = 0; + let mut x784: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x783, &mut x784, x782, x720, x763); + let mut x785: u32 = 0; + let mut x786: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x785, &mut x786, x784, x722, (0x0 as u32)); + let mut x787: u32 = 0; + let mut x788: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x787, &mut x788, x786, x724, x760); + let mut x789: u32 = 0; + let mut x790: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x789, &mut x790, x788, x726, x764); + let mut x791: u32 = 0; + let mut x792: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x791, &mut x792, x790, x728, x766); + let mut x793: u32 = 0; + let mut x794: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x793, &mut x794, x792, x730, x768); + let mut x795: u32 = 0; + let mut x796: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x795, &mut x796, x794, x732, x770); + let mut x797: u32 = 0; + let mut x798: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x797, &mut x798, x796, x734, x772); + let mut x799: u32 = 0; + let mut x800: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x799, &mut x800, x798, x736, x774); + let mut x801: u32 = 0; + let mut x802: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x801, &mut x802, x800, x738, x776); + let mut x803: u32 = 0; + let mut x804: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x803, &mut x804, x802, x740, x778); + let mut x805: u32 = 0; + let mut x806: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x805, &mut x806, x804, x742, x780); + let x807: u32 = ((x806 as u32) + (x743 as u32)); + let mut x808: u32 = 0; + let mut x809: u32 = 0; + fiat_p384_mulx_u32(&mut x808, &mut x809, x6, (arg1[11])); + let mut x810: u32 = 0; + let mut x811: u32 = 0; + fiat_p384_mulx_u32(&mut x810, &mut x811, x6, (arg1[10])); + let mut x812: u32 = 0; + let mut x813: u32 = 0; + fiat_p384_mulx_u32(&mut x812, &mut x813, x6, (arg1[9])); + let mut x814: u32 = 0; + let mut x815: u32 = 0; + fiat_p384_mulx_u32(&mut x814, &mut x815, x6, (arg1[8])); + let mut x816: u32 = 0; + let mut x817: u32 = 0; + fiat_p384_mulx_u32(&mut x816, &mut x817, x6, (arg1[7])); + let mut x818: u32 = 0; + let mut x819: u32 = 0; + fiat_p384_mulx_u32(&mut x818, &mut x819, x6, (arg1[6])); + let mut x820: u32 = 0; + let mut x821: u32 = 0; + fiat_p384_mulx_u32(&mut x820, &mut x821, x6, (arg1[5])); + let mut x822: u32 = 0; + let mut x823: u32 = 0; + fiat_p384_mulx_u32(&mut x822, &mut x823, x6, (arg1[4])); + let mut x824: u32 = 0; + let mut x825: u32 = 0; + fiat_p384_mulx_u32(&mut x824, &mut x825, x6, (arg1[3])); + let mut x826: u32 = 0; + let mut x827: u32 = 0; + fiat_p384_mulx_u32(&mut x826, &mut x827, x6, (arg1[2])); + let mut x828: u32 = 0; + let mut x829: u32 = 0; + fiat_p384_mulx_u32(&mut x828, &mut x829, x6, (arg1[1])); + let mut x830: u32 = 0; + let mut x831: u32 = 0; + fiat_p384_mulx_u32(&mut x830, &mut x831, x6, (arg1[0])); + let mut x832: u32 = 0; + let mut x833: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x832, &mut x833, 0x0, x831, x828); + let mut x834: u32 = 0; + let mut x835: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x834, &mut x835, x833, x829, x826); + let mut x836: u32 = 0; + let mut x837: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x836, &mut x837, x835, x827, x824); + let mut x838: u32 = 0; + let mut x839: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x838, &mut x839, x837, x825, x822); + let mut x840: u32 = 0; + let mut x841: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x840, &mut x841, x839, x823, x820); + let mut x842: u32 = 0; + let mut x843: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x842, &mut x843, x841, x821, x818); + let mut x844: u32 = 0; + let mut x845: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x844, &mut x845, x843, x819, x816); + let mut x846: u32 = 0; + let mut x847: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x846, &mut x847, x845, x817, x814); + let mut x848: u32 = 0; + let mut x849: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x848, &mut x849, x847, x815, x812); + let mut x850: u32 = 0; + let mut x851: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x850, &mut x851, x849, x813, x810); + let mut x852: u32 = 0; + let mut x853: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x852, &mut x853, x851, x811, x808); + let x854: u32 = ((x853 as u32) + x809); + let mut x855: u32 = 0; + let mut x856: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x855, &mut x856, 0x0, x783, x830); + let mut x857: u32 = 0; + let mut x858: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x857, &mut x858, x856, x785, x832); + let mut x859: u32 = 0; + let mut x860: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x859, &mut x860, x858, x787, x834); + let mut x861: u32 = 0; + let mut x862: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x861, &mut x862, x860, x789, x836); + let mut x863: u32 = 0; + let mut x864: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x863, &mut x864, x862, x791, x838); + let mut x865: u32 = 0; + let mut x866: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x865, &mut x866, x864, x793, x840); + let mut x867: u32 = 0; + let mut x868: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x867, &mut x868, x866, x795, x842); + let mut x869: u32 = 0; + let mut x870: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x869, &mut x870, x868, x797, x844); + let mut x871: u32 = 0; + let mut x872: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x871, &mut x872, x870, x799, x846); + let mut x873: u32 = 0; + let mut x874: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x873, &mut x874, x872, x801, x848); + let mut x875: u32 = 0; + let mut x876: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x875, &mut x876, x874, x803, x850); + let mut x877: u32 = 0; + let mut x878: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x877, &mut x878, x876, x805, x852); + let mut x879: u32 = 0; + let mut x880: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x879, &mut x880, x878, x807, x854); + let mut x881: u32 = 0; + let mut x882: u32 = 0; + fiat_p384_mulx_u32(&mut x881, &mut x882, x855, 0xffffffff); + let mut x883: u32 = 0; + let mut x884: u32 = 0; + fiat_p384_mulx_u32(&mut x883, &mut x884, x855, 0xffffffff); + let mut x885: u32 = 0; + let mut x886: u32 = 0; + fiat_p384_mulx_u32(&mut x885, &mut x886, x855, 0xffffffff); + let mut x887: u32 = 0; + let mut x888: u32 = 0; + fiat_p384_mulx_u32(&mut x887, &mut x888, x855, 0xffffffff); + let mut x889: u32 = 0; + let mut x890: u32 = 0; + fiat_p384_mulx_u32(&mut x889, &mut x890, x855, 0xffffffff); + let mut x891: u32 = 0; + let mut x892: u32 = 0; + fiat_p384_mulx_u32(&mut x891, &mut x892, x855, 0xffffffff); + let mut x893: u32 = 0; + let mut x894: u32 = 0; + fiat_p384_mulx_u32(&mut x893, &mut x894, x855, 0xffffffff); + let mut x895: u32 = 0; + let mut x896: u32 = 0; + fiat_p384_mulx_u32(&mut x895, &mut x896, x855, 0xfffffffe); + let mut x897: u32 = 0; + let mut x898: u32 = 0; + fiat_p384_mulx_u32(&mut x897, &mut x898, x855, 0xffffffff); + let mut x899: u32 = 0; + let mut x900: u32 = 0; + fiat_p384_mulx_u32(&mut x899, &mut x900, x855, 0xffffffff); + let mut x901: u32 = 0; + let mut x902: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x901, &mut x902, 0x0, x898, x895); + let mut x903: u32 = 0; + let mut x904: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x903, &mut x904, x902, x896, x893); + let mut x905: u32 = 0; + let mut x906: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x905, &mut x906, x904, x894, x891); + let mut x907: u32 = 0; + let mut x908: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x907, &mut x908, x906, x892, x889); + let mut x909: u32 = 0; + let mut x910: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x909, &mut x910, x908, x890, x887); + let mut x911: u32 = 0; + let mut x912: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x911, &mut x912, x910, x888, x885); + let mut x913: u32 = 0; + let mut x914: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x913, &mut x914, x912, x886, x883); + let mut x915: u32 = 0; + let mut x916: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x915, &mut x916, x914, x884, x881); + let x917: u32 = ((x916 as u32) + x882); + let mut x918: u32 = 0; + let mut x919: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x918, &mut x919, 0x0, x855, x899); + let mut x920: u32 = 0; + let mut x921: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x920, &mut x921, x919, x857, x900); + let mut x922: u32 = 0; + let mut x923: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x922, &mut x923, x921, x859, (0x0 as u32)); + let mut x924: u32 = 0; + let mut x925: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x924, &mut x925, x923, x861, x897); + let mut x926: u32 = 0; + let mut x927: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x926, &mut x927, x925, x863, x901); + let mut x928: u32 = 0; + let mut x929: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x928, &mut x929, x927, x865, x903); + let mut x930: u32 = 0; + let mut x931: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x930, &mut x931, x929, x867, x905); + let mut x932: u32 = 0; + let mut x933: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x932, &mut x933, x931, x869, x907); + let mut x934: u32 = 0; + let mut x935: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x934, &mut x935, x933, x871, x909); + let mut x936: u32 = 0; + let mut x937: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x936, &mut x937, x935, x873, x911); + let mut x938: u32 = 0; + let mut x939: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x938, &mut x939, x937, x875, x913); + let mut x940: u32 = 0; + let mut x941: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x940, &mut x941, x939, x877, x915); + let mut x942: u32 = 0; + let mut x943: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x942, &mut x943, x941, x879, x917); + let x944: u32 = ((x943 as u32) + (x880 as u32)); + let mut x945: u32 = 0; + let mut x946: u32 = 0; + fiat_p384_mulx_u32(&mut x945, &mut x946, x7, (arg1[11])); + let mut x947: u32 = 0; + let mut x948: u32 = 0; + fiat_p384_mulx_u32(&mut x947, &mut x948, x7, (arg1[10])); + let mut x949: u32 = 0; + let mut x950: u32 = 0; + fiat_p384_mulx_u32(&mut x949, &mut x950, x7, (arg1[9])); + let mut x951: u32 = 0; + let mut x952: u32 = 0; + fiat_p384_mulx_u32(&mut x951, &mut x952, x7, (arg1[8])); + let mut x953: u32 = 0; + let mut x954: u32 = 0; + fiat_p384_mulx_u32(&mut x953, &mut x954, x7, (arg1[7])); + let mut x955: u32 = 0; + let mut x956: u32 = 0; + fiat_p384_mulx_u32(&mut x955, &mut x956, x7, (arg1[6])); + let mut x957: u32 = 0; + let mut x958: u32 = 0; + fiat_p384_mulx_u32(&mut x957, &mut x958, x7, (arg1[5])); + let mut x959: u32 = 0; + let mut x960: u32 = 0; + fiat_p384_mulx_u32(&mut x959, &mut x960, x7, (arg1[4])); + let mut x961: u32 = 0; + let mut x962: u32 = 0; + fiat_p384_mulx_u32(&mut x961, &mut x962, x7, (arg1[3])); + let mut x963: u32 = 0; + let mut x964: u32 = 0; + fiat_p384_mulx_u32(&mut x963, &mut x964, x7, (arg1[2])); + let mut x965: u32 = 0; + let mut x966: u32 = 0; + fiat_p384_mulx_u32(&mut x965, &mut x966, x7, (arg1[1])); + let mut x967: u32 = 0; + let mut x968: u32 = 0; + fiat_p384_mulx_u32(&mut x967, &mut x968, x7, (arg1[0])); + let mut x969: u32 = 0; + let mut x970: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x969, &mut x970, 0x0, x968, x965); + let mut x971: u32 = 0; + let mut x972: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x971, &mut x972, x970, x966, x963); + let mut x973: u32 = 0; + let mut x974: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x973, &mut x974, x972, x964, x961); + let mut x975: u32 = 0; + let mut x976: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x975, &mut x976, x974, x962, x959); + let mut x977: u32 = 0; + let mut x978: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x977, &mut x978, x976, x960, x957); + let mut x979: u32 = 0; + let mut x980: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x979, &mut x980, x978, x958, x955); + let mut x981: u32 = 0; + let mut x982: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x981, &mut x982, x980, x956, x953); + let mut x983: u32 = 0; + let mut x984: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x983, &mut x984, x982, x954, x951); + let mut x985: u32 = 0; + let mut x986: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x985, &mut x986, x984, x952, x949); + let mut x987: u32 = 0; + let mut x988: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x987, &mut x988, x986, x950, x947); + let mut x989: u32 = 0; + let mut x990: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x989, &mut x990, x988, x948, x945); + let x991: u32 = ((x990 as u32) + x946); + let mut x992: u32 = 0; + let mut x993: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x992, &mut x993, 0x0, x920, x967); + let mut x994: u32 = 0; + let mut x995: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x994, &mut x995, x993, x922, x969); + let mut x996: u32 = 0; + let mut x997: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x996, &mut x997, x995, x924, x971); + let mut x998: u32 = 0; + let mut x999: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x998, &mut x999, x997, x926, x973); + let mut x1000: u32 = 0; + let mut x1001: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1000, &mut x1001, x999, x928, x975); + let mut x1002: u32 = 0; + let mut x1003: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1002, &mut x1003, x1001, x930, x977); + let mut x1004: u32 = 0; + let mut x1005: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1004, &mut x1005, x1003, x932, x979); + let mut x1006: u32 = 0; + let mut x1007: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1006, &mut x1007, x1005, x934, x981); + let mut x1008: u32 = 0; + let mut x1009: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1008, &mut x1009, x1007, x936, x983); + let mut x1010: u32 = 0; + let mut x1011: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1010, &mut x1011, x1009, x938, x985); + let mut x1012: u32 = 0; + let mut x1013: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1012, &mut x1013, x1011, x940, x987); + let mut x1014: u32 = 0; + let mut x1015: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1014, &mut x1015, x1013, x942, x989); + let mut x1016: u32 = 0; + let mut x1017: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1016, &mut x1017, x1015, x944, x991); + let mut x1018: u32 = 0; + let mut x1019: u32 = 0; + fiat_p384_mulx_u32(&mut x1018, &mut x1019, x992, 0xffffffff); + let mut x1020: u32 = 0; + let mut x1021: u32 = 0; + fiat_p384_mulx_u32(&mut x1020, &mut x1021, x992, 0xffffffff); + let mut x1022: u32 = 0; + let mut x1023: u32 = 0; + fiat_p384_mulx_u32(&mut x1022, &mut x1023, x992, 0xffffffff); + let mut x1024: u32 = 0; + let mut x1025: u32 = 0; + fiat_p384_mulx_u32(&mut x1024, &mut x1025, x992, 0xffffffff); + let mut x1026: u32 = 0; + let mut x1027: u32 = 0; + fiat_p384_mulx_u32(&mut x1026, &mut x1027, x992, 0xffffffff); + let mut x1028: u32 = 0; + let mut x1029: u32 = 0; + fiat_p384_mulx_u32(&mut x1028, &mut x1029, x992, 0xffffffff); + let mut x1030: u32 = 0; + let mut x1031: u32 = 0; + fiat_p384_mulx_u32(&mut x1030, &mut x1031, x992, 0xffffffff); + let mut x1032: u32 = 0; + let mut x1033: u32 = 0; + fiat_p384_mulx_u32(&mut x1032, &mut x1033, x992, 0xfffffffe); + let mut x1034: u32 = 0; + let mut x1035: u32 = 0; + fiat_p384_mulx_u32(&mut x1034, &mut x1035, x992, 0xffffffff); + let mut x1036: u32 = 0; + let mut x1037: u32 = 0; + fiat_p384_mulx_u32(&mut x1036, &mut x1037, x992, 0xffffffff); + let mut x1038: u32 = 0; + let mut x1039: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1038, &mut x1039, 0x0, x1035, x1032); + let mut x1040: u32 = 0; + let mut x1041: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1040, &mut x1041, x1039, x1033, x1030); + let mut x1042: u32 = 0; + let mut x1043: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1042, &mut x1043, x1041, x1031, x1028); + let mut x1044: u32 = 0; + let mut x1045: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1044, &mut x1045, x1043, x1029, x1026); + let mut x1046: u32 = 0; + let mut x1047: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1046, &mut x1047, x1045, x1027, x1024); + let mut x1048: u32 = 0; + let mut x1049: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1048, &mut x1049, x1047, x1025, x1022); + let mut x1050: u32 = 0; + let mut x1051: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1050, &mut x1051, x1049, x1023, x1020); + let mut x1052: u32 = 0; + let mut x1053: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1052, &mut x1053, x1051, x1021, x1018); + let x1054: u32 = ((x1053 as u32) + x1019); + let mut x1055: u32 = 0; + let mut x1056: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1055, &mut x1056, 0x0, x992, x1036); + let mut x1057: u32 = 0; + let mut x1058: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1057, &mut x1058, x1056, x994, x1037); + let mut x1059: u32 = 0; + let mut x1060: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1059, &mut x1060, x1058, x996, (0x0 as u32)); + let mut x1061: u32 = 0; + let mut x1062: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1061, &mut x1062, x1060, x998, x1034); + let mut x1063: u32 = 0; + let mut x1064: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1063, &mut x1064, x1062, x1000, x1038); + let mut x1065: u32 = 0; + let mut x1066: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1065, &mut x1066, x1064, x1002, x1040); + let mut x1067: u32 = 0; + let mut x1068: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1067, &mut x1068, x1066, x1004, x1042); + let mut x1069: u32 = 0; + let mut x1070: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1069, &mut x1070, x1068, x1006, x1044); + let mut x1071: u32 = 0; + let mut x1072: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1071, &mut x1072, x1070, x1008, x1046); + let mut x1073: u32 = 0; + let mut x1074: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1073, &mut x1074, x1072, x1010, x1048); + let mut x1075: u32 = 0; + let mut x1076: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1075, &mut x1076, x1074, x1012, x1050); + let mut x1077: u32 = 0; + let mut x1078: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1077, &mut x1078, x1076, x1014, x1052); + let mut x1079: u32 = 0; + let mut x1080: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1079, &mut x1080, x1078, x1016, x1054); + let x1081: u32 = ((x1080 as u32) + (x1017 as u32)); + let mut x1082: u32 = 0; + let mut x1083: u32 = 0; + fiat_p384_mulx_u32(&mut x1082, &mut x1083, x8, (arg1[11])); + let mut x1084: u32 = 0; + let mut x1085: u32 = 0; + fiat_p384_mulx_u32(&mut x1084, &mut x1085, x8, (arg1[10])); + let mut x1086: u32 = 0; + let mut x1087: u32 = 0; + fiat_p384_mulx_u32(&mut x1086, &mut x1087, x8, (arg1[9])); + let mut x1088: u32 = 0; + let mut x1089: u32 = 0; + fiat_p384_mulx_u32(&mut x1088, &mut x1089, x8, (arg1[8])); + let mut x1090: u32 = 0; + let mut x1091: u32 = 0; + fiat_p384_mulx_u32(&mut x1090, &mut x1091, x8, (arg1[7])); + let mut x1092: u32 = 0; + let mut x1093: u32 = 0; + fiat_p384_mulx_u32(&mut x1092, &mut x1093, x8, (arg1[6])); + let mut x1094: u32 = 0; + let mut x1095: u32 = 0; + fiat_p384_mulx_u32(&mut x1094, &mut x1095, x8, (arg1[5])); + let mut x1096: u32 = 0; + let mut x1097: u32 = 0; + fiat_p384_mulx_u32(&mut x1096, &mut x1097, x8, (arg1[4])); + let mut x1098: u32 = 0; + let mut x1099: u32 = 0; + fiat_p384_mulx_u32(&mut x1098, &mut x1099, x8, (arg1[3])); + let mut x1100: u32 = 0; + let mut x1101: u32 = 0; + fiat_p384_mulx_u32(&mut x1100, &mut x1101, x8, (arg1[2])); + let mut x1102: u32 = 0; + let mut x1103: u32 = 0; + fiat_p384_mulx_u32(&mut x1102, &mut x1103, x8, (arg1[1])); + let mut x1104: u32 = 0; + let mut x1105: u32 = 0; + fiat_p384_mulx_u32(&mut x1104, &mut x1105, x8, (arg1[0])); + let mut x1106: u32 = 0; + let mut x1107: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1106, &mut x1107, 0x0, x1105, x1102); + let mut x1108: u32 = 0; + let mut x1109: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1108, &mut x1109, x1107, x1103, x1100); + let mut x1110: u32 = 0; + let mut x1111: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1110, &mut x1111, x1109, x1101, x1098); + let mut x1112: u32 = 0; + let mut x1113: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1112, &mut x1113, x1111, x1099, x1096); + let mut x1114: u32 = 0; + let mut x1115: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1114, &mut x1115, x1113, x1097, x1094); + let mut x1116: u32 = 0; + let mut x1117: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1116, &mut x1117, x1115, x1095, x1092); + let mut x1118: u32 = 0; + let mut x1119: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1118, &mut x1119, x1117, x1093, x1090); + let mut x1120: u32 = 0; + let mut x1121: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1120, &mut x1121, x1119, x1091, x1088); + let mut x1122: u32 = 0; + let mut x1123: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1122, &mut x1123, x1121, x1089, x1086); + let mut x1124: u32 = 0; + let mut x1125: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1124, &mut x1125, x1123, x1087, x1084); + let mut x1126: u32 = 0; + let mut x1127: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1126, &mut x1127, x1125, x1085, x1082); + let x1128: u32 = ((x1127 as u32) + x1083); + let mut x1129: u32 = 0; + let mut x1130: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1129, &mut x1130, 0x0, x1057, x1104); + let mut x1131: u32 = 0; + let mut x1132: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1131, &mut x1132, x1130, x1059, x1106); + let mut x1133: u32 = 0; + let mut x1134: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1133, &mut x1134, x1132, x1061, x1108); + let mut x1135: u32 = 0; + let mut x1136: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1135, &mut x1136, x1134, x1063, x1110); + let mut x1137: u32 = 0; + let mut x1138: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1137, &mut x1138, x1136, x1065, x1112); + let mut x1139: u32 = 0; + let mut x1140: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1139, &mut x1140, x1138, x1067, x1114); + let mut x1141: u32 = 0; + let mut x1142: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1141, &mut x1142, x1140, x1069, x1116); + let mut x1143: u32 = 0; + let mut x1144: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1143, &mut x1144, x1142, x1071, x1118); + let mut x1145: u32 = 0; + let mut x1146: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1145, &mut x1146, x1144, x1073, x1120); + let mut x1147: u32 = 0; + let mut x1148: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1147, &mut x1148, x1146, x1075, x1122); + let mut x1149: u32 = 0; + let mut x1150: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1149, &mut x1150, x1148, x1077, x1124); + let mut x1151: u32 = 0; + let mut x1152: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1151, &mut x1152, x1150, x1079, x1126); + let mut x1153: u32 = 0; + let mut x1154: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1153, &mut x1154, x1152, x1081, x1128); + let mut x1155: u32 = 0; + let mut x1156: u32 = 0; + fiat_p384_mulx_u32(&mut x1155, &mut x1156, x1129, 0xffffffff); + let mut x1157: u32 = 0; + let mut x1158: u32 = 0; + fiat_p384_mulx_u32(&mut x1157, &mut x1158, x1129, 0xffffffff); + let mut x1159: u32 = 0; + let mut x1160: u32 = 0; + fiat_p384_mulx_u32(&mut x1159, &mut x1160, x1129, 0xffffffff); + let mut x1161: u32 = 0; + let mut x1162: u32 = 0; + fiat_p384_mulx_u32(&mut x1161, &mut x1162, x1129, 0xffffffff); + let mut x1163: u32 = 0; + let mut x1164: u32 = 0; + fiat_p384_mulx_u32(&mut x1163, &mut x1164, x1129, 0xffffffff); + let mut x1165: u32 = 0; + let mut x1166: u32 = 0; + fiat_p384_mulx_u32(&mut x1165, &mut x1166, x1129, 0xffffffff); + let mut x1167: u32 = 0; + let mut x1168: u32 = 0; + fiat_p384_mulx_u32(&mut x1167, &mut x1168, x1129, 0xffffffff); + let mut x1169: u32 = 0; + let mut x1170: u32 = 0; + fiat_p384_mulx_u32(&mut x1169, &mut x1170, x1129, 0xfffffffe); + let mut x1171: u32 = 0; + let mut x1172: u32 = 0; + fiat_p384_mulx_u32(&mut x1171, &mut x1172, x1129, 0xffffffff); + let mut x1173: u32 = 0; + let mut x1174: u32 = 0; + fiat_p384_mulx_u32(&mut x1173, &mut x1174, x1129, 0xffffffff); + let mut x1175: u32 = 0; + let mut x1176: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1175, &mut x1176, 0x0, x1172, x1169); + let mut x1177: u32 = 0; + let mut x1178: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1177, &mut x1178, x1176, x1170, x1167); + let mut x1179: u32 = 0; + let mut x1180: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1179, &mut x1180, x1178, x1168, x1165); + let mut x1181: u32 = 0; + let mut x1182: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1181, &mut x1182, x1180, x1166, x1163); + let mut x1183: u32 = 0; + let mut x1184: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1183, &mut x1184, x1182, x1164, x1161); + let mut x1185: u32 = 0; + let mut x1186: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1185, &mut x1186, x1184, x1162, x1159); + let mut x1187: u32 = 0; + let mut x1188: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1187, &mut x1188, x1186, x1160, x1157); + let mut x1189: u32 = 0; + let mut x1190: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1189, &mut x1190, x1188, x1158, x1155); + let x1191: u32 = ((x1190 as u32) + x1156); + let mut x1192: u32 = 0; + let mut x1193: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1192, &mut x1193, 0x0, x1129, x1173); + let mut x1194: u32 = 0; + let mut x1195: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1194, &mut x1195, x1193, x1131, x1174); + let mut x1196: u32 = 0; + let mut x1197: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1196, &mut x1197, x1195, x1133, (0x0 as u32)); + let mut x1198: u32 = 0; + let mut x1199: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1198, &mut x1199, x1197, x1135, x1171); + let mut x1200: u32 = 0; + let mut x1201: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1200, &mut x1201, x1199, x1137, x1175); + let mut x1202: u32 = 0; + let mut x1203: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1202, &mut x1203, x1201, x1139, x1177); + let mut x1204: u32 = 0; + let mut x1205: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1204, &mut x1205, x1203, x1141, x1179); + let mut x1206: u32 = 0; + let mut x1207: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1206, &mut x1207, x1205, x1143, x1181); + let mut x1208: u32 = 0; + let mut x1209: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1208, &mut x1209, x1207, x1145, x1183); + let mut x1210: u32 = 0; + let mut x1211: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1210, &mut x1211, x1209, x1147, x1185); + let mut x1212: u32 = 0; + let mut x1213: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1212, &mut x1213, x1211, x1149, x1187); + let mut x1214: u32 = 0; + let mut x1215: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1214, &mut x1215, x1213, x1151, x1189); + let mut x1216: u32 = 0; + let mut x1217: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1216, &mut x1217, x1215, x1153, x1191); + let x1218: u32 = ((x1217 as u32) + (x1154 as u32)); + let mut x1219: u32 = 0; + let mut x1220: u32 = 0; + fiat_p384_mulx_u32(&mut x1219, &mut x1220, x9, (arg1[11])); + let mut x1221: u32 = 0; + let mut x1222: u32 = 0; + fiat_p384_mulx_u32(&mut x1221, &mut x1222, x9, (arg1[10])); + let mut x1223: u32 = 0; + let mut x1224: u32 = 0; + fiat_p384_mulx_u32(&mut x1223, &mut x1224, x9, (arg1[9])); + let mut x1225: u32 = 0; + let mut x1226: u32 = 0; + fiat_p384_mulx_u32(&mut x1225, &mut x1226, x9, (arg1[8])); + let mut x1227: u32 = 0; + let mut x1228: u32 = 0; + fiat_p384_mulx_u32(&mut x1227, &mut x1228, x9, (arg1[7])); + let mut x1229: u32 = 0; + let mut x1230: u32 = 0; + fiat_p384_mulx_u32(&mut x1229, &mut x1230, x9, (arg1[6])); + let mut x1231: u32 = 0; + let mut x1232: u32 = 0; + fiat_p384_mulx_u32(&mut x1231, &mut x1232, x9, (arg1[5])); + let mut x1233: u32 = 0; + let mut x1234: u32 = 0; + fiat_p384_mulx_u32(&mut x1233, &mut x1234, x9, (arg1[4])); + let mut x1235: u32 = 0; + let mut x1236: u32 = 0; + fiat_p384_mulx_u32(&mut x1235, &mut x1236, x9, (arg1[3])); + let mut x1237: u32 = 0; + let mut x1238: u32 = 0; + fiat_p384_mulx_u32(&mut x1237, &mut x1238, x9, (arg1[2])); + let mut x1239: u32 = 0; + let mut x1240: u32 = 0; + fiat_p384_mulx_u32(&mut x1239, &mut x1240, x9, (arg1[1])); + let mut x1241: u32 = 0; + let mut x1242: u32 = 0; + fiat_p384_mulx_u32(&mut x1241, &mut x1242, x9, (arg1[0])); + let mut x1243: u32 = 0; + let mut x1244: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1243, &mut x1244, 0x0, x1242, x1239); + let mut x1245: u32 = 0; + let mut x1246: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1245, &mut x1246, x1244, x1240, x1237); + let mut x1247: u32 = 0; + let mut x1248: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1247, &mut x1248, x1246, x1238, x1235); + let mut x1249: u32 = 0; + let mut x1250: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1249, &mut x1250, x1248, x1236, x1233); + let mut x1251: u32 = 0; + let mut x1252: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1251, &mut x1252, x1250, x1234, x1231); + let mut x1253: u32 = 0; + let mut x1254: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1253, &mut x1254, x1252, x1232, x1229); + let mut x1255: u32 = 0; + let mut x1256: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1255, &mut x1256, x1254, x1230, x1227); + let mut x1257: u32 = 0; + let mut x1258: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1257, &mut x1258, x1256, x1228, x1225); + let mut x1259: u32 = 0; + let mut x1260: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1259, &mut x1260, x1258, x1226, x1223); + let mut x1261: u32 = 0; + let mut x1262: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1261, &mut x1262, x1260, x1224, x1221); + let mut x1263: u32 = 0; + let mut x1264: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1263, &mut x1264, x1262, x1222, x1219); + let x1265: u32 = ((x1264 as u32) + x1220); + let mut x1266: u32 = 0; + let mut x1267: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1266, &mut x1267, 0x0, x1194, x1241); + let mut x1268: u32 = 0; + let mut x1269: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1268, &mut x1269, x1267, x1196, x1243); + let mut x1270: u32 = 0; + let mut x1271: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1270, &mut x1271, x1269, x1198, x1245); + let mut x1272: u32 = 0; + let mut x1273: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1272, &mut x1273, x1271, x1200, x1247); + let mut x1274: u32 = 0; + let mut x1275: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1274, &mut x1275, x1273, x1202, x1249); + let mut x1276: u32 = 0; + let mut x1277: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1276, &mut x1277, x1275, x1204, x1251); + let mut x1278: u32 = 0; + let mut x1279: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1278, &mut x1279, x1277, x1206, x1253); + let mut x1280: u32 = 0; + let mut x1281: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1280, &mut x1281, x1279, x1208, x1255); + let mut x1282: u32 = 0; + let mut x1283: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1282, &mut x1283, x1281, x1210, x1257); + let mut x1284: u32 = 0; + let mut x1285: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1284, &mut x1285, x1283, x1212, x1259); + let mut x1286: u32 = 0; + let mut x1287: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1286, &mut x1287, x1285, x1214, x1261); + let mut x1288: u32 = 0; + let mut x1289: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1288, &mut x1289, x1287, x1216, x1263); + let mut x1290: u32 = 0; + let mut x1291: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1290, &mut x1291, x1289, x1218, x1265); + let mut x1292: u32 = 0; + let mut x1293: u32 = 0; + fiat_p384_mulx_u32(&mut x1292, &mut x1293, x1266, 0xffffffff); + let mut x1294: u32 = 0; + let mut x1295: u32 = 0; + fiat_p384_mulx_u32(&mut x1294, &mut x1295, x1266, 0xffffffff); + let mut x1296: u32 = 0; + let mut x1297: u32 = 0; + fiat_p384_mulx_u32(&mut x1296, &mut x1297, x1266, 0xffffffff); + let mut x1298: u32 = 0; + let mut x1299: u32 = 0; + fiat_p384_mulx_u32(&mut x1298, &mut x1299, x1266, 0xffffffff); + let mut x1300: u32 = 0; + let mut x1301: u32 = 0; + fiat_p384_mulx_u32(&mut x1300, &mut x1301, x1266, 0xffffffff); + let mut x1302: u32 = 0; + let mut x1303: u32 = 0; + fiat_p384_mulx_u32(&mut x1302, &mut x1303, x1266, 0xffffffff); + let mut x1304: u32 = 0; + let mut x1305: u32 = 0; + fiat_p384_mulx_u32(&mut x1304, &mut x1305, x1266, 0xffffffff); + let mut x1306: u32 = 0; + let mut x1307: u32 = 0; + fiat_p384_mulx_u32(&mut x1306, &mut x1307, x1266, 0xfffffffe); + let mut x1308: u32 = 0; + let mut x1309: u32 = 0; + fiat_p384_mulx_u32(&mut x1308, &mut x1309, x1266, 0xffffffff); + let mut x1310: u32 = 0; + let mut x1311: u32 = 0; + fiat_p384_mulx_u32(&mut x1310, &mut x1311, x1266, 0xffffffff); + let mut x1312: u32 = 0; + let mut x1313: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1312, &mut x1313, 0x0, x1309, x1306); + let mut x1314: u32 = 0; + let mut x1315: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1314, &mut x1315, x1313, x1307, x1304); + let mut x1316: u32 = 0; + let mut x1317: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1316, &mut x1317, x1315, x1305, x1302); + let mut x1318: u32 = 0; + let mut x1319: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1318, &mut x1319, x1317, x1303, x1300); + let mut x1320: u32 = 0; + let mut x1321: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1320, &mut x1321, x1319, x1301, x1298); + let mut x1322: u32 = 0; + let mut x1323: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1322, &mut x1323, x1321, x1299, x1296); + let mut x1324: u32 = 0; + let mut x1325: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1324, &mut x1325, x1323, x1297, x1294); + let mut x1326: u32 = 0; + let mut x1327: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1326, &mut x1327, x1325, x1295, x1292); + let x1328: u32 = ((x1327 as u32) + x1293); + let mut x1329: u32 = 0; + let mut x1330: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1329, &mut x1330, 0x0, x1266, x1310); + let mut x1331: u32 = 0; + let mut x1332: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1331, &mut x1332, x1330, x1268, x1311); + let mut x1333: u32 = 0; + let mut x1334: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1333, &mut x1334, x1332, x1270, (0x0 as u32)); + let mut x1335: u32 = 0; + let mut x1336: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1335, &mut x1336, x1334, x1272, x1308); + let mut x1337: u32 = 0; + let mut x1338: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1337, &mut x1338, x1336, x1274, x1312); + let mut x1339: u32 = 0; + let mut x1340: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1339, &mut x1340, x1338, x1276, x1314); + let mut x1341: u32 = 0; + let mut x1342: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1341, &mut x1342, x1340, x1278, x1316); + let mut x1343: u32 = 0; + let mut x1344: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1343, &mut x1344, x1342, x1280, x1318); + let mut x1345: u32 = 0; + let mut x1346: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1345, &mut x1346, x1344, x1282, x1320); + let mut x1347: u32 = 0; + let mut x1348: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1347, &mut x1348, x1346, x1284, x1322); + let mut x1349: u32 = 0; + let mut x1350: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1349, &mut x1350, x1348, x1286, x1324); + let mut x1351: u32 = 0; + let mut x1352: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1351, &mut x1352, x1350, x1288, x1326); + let mut x1353: u32 = 0; + let mut x1354: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1353, &mut x1354, x1352, x1290, x1328); + let x1355: u32 = ((x1354 as u32) + (x1291 as u32)); + let mut x1356: u32 = 0; + let mut x1357: u32 = 0; + fiat_p384_mulx_u32(&mut x1356, &mut x1357, x10, (arg1[11])); + let mut x1358: u32 = 0; + let mut x1359: u32 = 0; + fiat_p384_mulx_u32(&mut x1358, &mut x1359, x10, (arg1[10])); + let mut x1360: u32 = 0; + let mut x1361: u32 = 0; + fiat_p384_mulx_u32(&mut x1360, &mut x1361, x10, (arg1[9])); + let mut x1362: u32 = 0; + let mut x1363: u32 = 0; + fiat_p384_mulx_u32(&mut x1362, &mut x1363, x10, (arg1[8])); + let mut x1364: u32 = 0; + let mut x1365: u32 = 0; + fiat_p384_mulx_u32(&mut x1364, &mut x1365, x10, (arg1[7])); + let mut x1366: u32 = 0; + let mut x1367: u32 = 0; + fiat_p384_mulx_u32(&mut x1366, &mut x1367, x10, (arg1[6])); + let mut x1368: u32 = 0; + let mut x1369: u32 = 0; + fiat_p384_mulx_u32(&mut x1368, &mut x1369, x10, (arg1[5])); + let mut x1370: u32 = 0; + let mut x1371: u32 = 0; + fiat_p384_mulx_u32(&mut x1370, &mut x1371, x10, (arg1[4])); + let mut x1372: u32 = 0; + let mut x1373: u32 = 0; + fiat_p384_mulx_u32(&mut x1372, &mut x1373, x10, (arg1[3])); + let mut x1374: u32 = 0; + let mut x1375: u32 = 0; + fiat_p384_mulx_u32(&mut x1374, &mut x1375, x10, (arg1[2])); + let mut x1376: u32 = 0; + let mut x1377: u32 = 0; + fiat_p384_mulx_u32(&mut x1376, &mut x1377, x10, (arg1[1])); + let mut x1378: u32 = 0; + let mut x1379: u32 = 0; + fiat_p384_mulx_u32(&mut x1378, &mut x1379, x10, (arg1[0])); + let mut x1380: u32 = 0; + let mut x1381: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1380, &mut x1381, 0x0, x1379, x1376); + let mut x1382: u32 = 0; + let mut x1383: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1382, &mut x1383, x1381, x1377, x1374); + let mut x1384: u32 = 0; + let mut x1385: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1384, &mut x1385, x1383, x1375, x1372); + let mut x1386: u32 = 0; + let mut x1387: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1386, &mut x1387, x1385, x1373, x1370); + let mut x1388: u32 = 0; + let mut x1389: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1388, &mut x1389, x1387, x1371, x1368); + let mut x1390: u32 = 0; + let mut x1391: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1390, &mut x1391, x1389, x1369, x1366); + let mut x1392: u32 = 0; + let mut x1393: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1392, &mut x1393, x1391, x1367, x1364); + let mut x1394: u32 = 0; + let mut x1395: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1394, &mut x1395, x1393, x1365, x1362); + let mut x1396: u32 = 0; + let mut x1397: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1396, &mut x1397, x1395, x1363, x1360); + let mut x1398: u32 = 0; + let mut x1399: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1398, &mut x1399, x1397, x1361, x1358); + let mut x1400: u32 = 0; + let mut x1401: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1400, &mut x1401, x1399, x1359, x1356); + let x1402: u32 = ((x1401 as u32) + x1357); + let mut x1403: u32 = 0; + let mut x1404: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1403, &mut x1404, 0x0, x1331, x1378); + let mut x1405: u32 = 0; + let mut x1406: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1405, &mut x1406, x1404, x1333, x1380); + let mut x1407: u32 = 0; + let mut x1408: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1407, &mut x1408, x1406, x1335, x1382); + let mut x1409: u32 = 0; + let mut x1410: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1409, &mut x1410, x1408, x1337, x1384); + let mut x1411: u32 = 0; + let mut x1412: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1411, &mut x1412, x1410, x1339, x1386); + let mut x1413: u32 = 0; + let mut x1414: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1413, &mut x1414, x1412, x1341, x1388); + let mut x1415: u32 = 0; + let mut x1416: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1415, &mut x1416, x1414, x1343, x1390); + let mut x1417: u32 = 0; + let mut x1418: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1417, &mut x1418, x1416, x1345, x1392); + let mut x1419: u32 = 0; + let mut x1420: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1419, &mut x1420, x1418, x1347, x1394); + let mut x1421: u32 = 0; + let mut x1422: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1421, &mut x1422, x1420, x1349, x1396); + let mut x1423: u32 = 0; + let mut x1424: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1423, &mut x1424, x1422, x1351, x1398); + let mut x1425: u32 = 0; + let mut x1426: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1425, &mut x1426, x1424, x1353, x1400); + let mut x1427: u32 = 0; + let mut x1428: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1427, &mut x1428, x1426, x1355, x1402); + let mut x1429: u32 = 0; + let mut x1430: u32 = 0; + fiat_p384_mulx_u32(&mut x1429, &mut x1430, x1403, 0xffffffff); + let mut x1431: u32 = 0; + let mut x1432: u32 = 0; + fiat_p384_mulx_u32(&mut x1431, &mut x1432, x1403, 0xffffffff); + let mut x1433: u32 = 0; + let mut x1434: u32 = 0; + fiat_p384_mulx_u32(&mut x1433, &mut x1434, x1403, 0xffffffff); + let mut x1435: u32 = 0; + let mut x1436: u32 = 0; + fiat_p384_mulx_u32(&mut x1435, &mut x1436, x1403, 0xffffffff); + let mut x1437: u32 = 0; + let mut x1438: u32 = 0; + fiat_p384_mulx_u32(&mut x1437, &mut x1438, x1403, 0xffffffff); + let mut x1439: u32 = 0; + let mut x1440: u32 = 0; + fiat_p384_mulx_u32(&mut x1439, &mut x1440, x1403, 0xffffffff); + let mut x1441: u32 = 0; + let mut x1442: u32 = 0; + fiat_p384_mulx_u32(&mut x1441, &mut x1442, x1403, 0xffffffff); + let mut x1443: u32 = 0; + let mut x1444: u32 = 0; + fiat_p384_mulx_u32(&mut x1443, &mut x1444, x1403, 0xfffffffe); + let mut x1445: u32 = 0; + let mut x1446: u32 = 0; + fiat_p384_mulx_u32(&mut x1445, &mut x1446, x1403, 0xffffffff); + let mut x1447: u32 = 0; + let mut x1448: u32 = 0; + fiat_p384_mulx_u32(&mut x1447, &mut x1448, x1403, 0xffffffff); + let mut x1449: u32 = 0; + let mut x1450: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1449, &mut x1450, 0x0, x1446, x1443); + let mut x1451: u32 = 0; + let mut x1452: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1451, &mut x1452, x1450, x1444, x1441); + let mut x1453: u32 = 0; + let mut x1454: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1453, &mut x1454, x1452, x1442, x1439); + let mut x1455: u32 = 0; + let mut x1456: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1455, &mut x1456, x1454, x1440, x1437); + let mut x1457: u32 = 0; + let mut x1458: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1457, &mut x1458, x1456, x1438, x1435); + let mut x1459: u32 = 0; + let mut x1460: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1459, &mut x1460, x1458, x1436, x1433); + let mut x1461: u32 = 0; + let mut x1462: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1461, &mut x1462, x1460, x1434, x1431); + let mut x1463: u32 = 0; + let mut x1464: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1463, &mut x1464, x1462, x1432, x1429); + let x1465: u32 = ((x1464 as u32) + x1430); + let mut x1466: u32 = 0; + let mut x1467: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1466, &mut x1467, 0x0, x1403, x1447); + let mut x1468: u32 = 0; + let mut x1469: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1468, &mut x1469, x1467, x1405, x1448); + let mut x1470: u32 = 0; + let mut x1471: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1470, &mut x1471, x1469, x1407, (0x0 as u32)); + let mut x1472: u32 = 0; + let mut x1473: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1472, &mut x1473, x1471, x1409, x1445); + let mut x1474: u32 = 0; + let mut x1475: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1474, &mut x1475, x1473, x1411, x1449); + let mut x1476: u32 = 0; + let mut x1477: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1476, &mut x1477, x1475, x1413, x1451); + let mut x1478: u32 = 0; + let mut x1479: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1478, &mut x1479, x1477, x1415, x1453); + let mut x1480: u32 = 0; + let mut x1481: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1480, &mut x1481, x1479, x1417, x1455); + let mut x1482: u32 = 0; + let mut x1483: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1482, &mut x1483, x1481, x1419, x1457); + let mut x1484: u32 = 0; + let mut x1485: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1484, &mut x1485, x1483, x1421, x1459); + let mut x1486: u32 = 0; + let mut x1487: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1486, &mut x1487, x1485, x1423, x1461); + let mut x1488: u32 = 0; + let mut x1489: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1488, &mut x1489, x1487, x1425, x1463); + let mut x1490: u32 = 0; + let mut x1491: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1490, &mut x1491, x1489, x1427, x1465); + let x1492: u32 = ((x1491 as u32) + (x1428 as u32)); + let mut x1493: u32 = 0; + let mut x1494: u32 = 0; + fiat_p384_mulx_u32(&mut x1493, &mut x1494, x11, (arg1[11])); + let mut x1495: u32 = 0; + let mut x1496: u32 = 0; + fiat_p384_mulx_u32(&mut x1495, &mut x1496, x11, (arg1[10])); + let mut x1497: u32 = 0; + let mut x1498: u32 = 0; + fiat_p384_mulx_u32(&mut x1497, &mut x1498, x11, (arg1[9])); + let mut x1499: u32 = 0; + let mut x1500: u32 = 0; + fiat_p384_mulx_u32(&mut x1499, &mut x1500, x11, (arg1[8])); + let mut x1501: u32 = 0; + let mut x1502: u32 = 0; + fiat_p384_mulx_u32(&mut x1501, &mut x1502, x11, (arg1[7])); + let mut x1503: u32 = 0; + let mut x1504: u32 = 0; + fiat_p384_mulx_u32(&mut x1503, &mut x1504, x11, (arg1[6])); + let mut x1505: u32 = 0; + let mut x1506: u32 = 0; + fiat_p384_mulx_u32(&mut x1505, &mut x1506, x11, (arg1[5])); + let mut x1507: u32 = 0; + let mut x1508: u32 = 0; + fiat_p384_mulx_u32(&mut x1507, &mut x1508, x11, (arg1[4])); + let mut x1509: u32 = 0; + let mut x1510: u32 = 0; + fiat_p384_mulx_u32(&mut x1509, &mut x1510, x11, (arg1[3])); + let mut x1511: u32 = 0; + let mut x1512: u32 = 0; + fiat_p384_mulx_u32(&mut x1511, &mut x1512, x11, (arg1[2])); + let mut x1513: u32 = 0; + let mut x1514: u32 = 0; + fiat_p384_mulx_u32(&mut x1513, &mut x1514, x11, (arg1[1])); + let mut x1515: u32 = 0; + let mut x1516: u32 = 0; + fiat_p384_mulx_u32(&mut x1515, &mut x1516, x11, (arg1[0])); + let mut x1517: u32 = 0; + let mut x1518: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1517, &mut x1518, 0x0, x1516, x1513); + let mut x1519: u32 = 0; + let mut x1520: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1519, &mut x1520, x1518, x1514, x1511); + let mut x1521: u32 = 0; + let mut x1522: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1521, &mut x1522, x1520, x1512, x1509); + let mut x1523: u32 = 0; + let mut x1524: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1523, &mut x1524, x1522, x1510, x1507); + let mut x1525: u32 = 0; + let mut x1526: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1525, &mut x1526, x1524, x1508, x1505); + let mut x1527: u32 = 0; + let mut x1528: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1527, &mut x1528, x1526, x1506, x1503); + let mut x1529: u32 = 0; + let mut x1530: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1529, &mut x1530, x1528, x1504, x1501); + let mut x1531: u32 = 0; + let mut x1532: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1531, &mut x1532, x1530, x1502, x1499); + let mut x1533: u32 = 0; + let mut x1534: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1533, &mut x1534, x1532, x1500, x1497); + let mut x1535: u32 = 0; + let mut x1536: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1535, &mut x1536, x1534, x1498, x1495); + let mut x1537: u32 = 0; + let mut x1538: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1537, &mut x1538, x1536, x1496, x1493); + let x1539: u32 = ((x1538 as u32) + x1494); + let mut x1540: u32 = 0; + let mut x1541: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1540, &mut x1541, 0x0, x1468, x1515); + let mut x1542: u32 = 0; + let mut x1543: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1542, &mut x1543, x1541, x1470, x1517); + let mut x1544: u32 = 0; + let mut x1545: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1544, &mut x1545, x1543, x1472, x1519); + let mut x1546: u32 = 0; + let mut x1547: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1546, &mut x1547, x1545, x1474, x1521); + let mut x1548: u32 = 0; + let mut x1549: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1548, &mut x1549, x1547, x1476, x1523); + let mut x1550: u32 = 0; + let mut x1551: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1550, &mut x1551, x1549, x1478, x1525); + let mut x1552: u32 = 0; + let mut x1553: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1552, &mut x1553, x1551, x1480, x1527); + let mut x1554: u32 = 0; + let mut x1555: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1554, &mut x1555, x1553, x1482, x1529); + let mut x1556: u32 = 0; + let mut x1557: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1556, &mut x1557, x1555, x1484, x1531); + let mut x1558: u32 = 0; + let mut x1559: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1558, &mut x1559, x1557, x1486, x1533); + let mut x1560: u32 = 0; + let mut x1561: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1560, &mut x1561, x1559, x1488, x1535); + let mut x1562: u32 = 0; + let mut x1563: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1562, &mut x1563, x1561, x1490, x1537); + let mut x1564: u32 = 0; + let mut x1565: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1564, &mut x1565, x1563, x1492, x1539); + let mut x1566: u32 = 0; + let mut x1567: u32 = 0; + fiat_p384_mulx_u32(&mut x1566, &mut x1567, x1540, 0xffffffff); + let mut x1568: u32 = 0; + let mut x1569: u32 = 0; + fiat_p384_mulx_u32(&mut x1568, &mut x1569, x1540, 0xffffffff); + let mut x1570: u32 = 0; + let mut x1571: u32 = 0; + fiat_p384_mulx_u32(&mut x1570, &mut x1571, x1540, 0xffffffff); + let mut x1572: u32 = 0; + let mut x1573: u32 = 0; + fiat_p384_mulx_u32(&mut x1572, &mut x1573, x1540, 0xffffffff); + let mut x1574: u32 = 0; + let mut x1575: u32 = 0; + fiat_p384_mulx_u32(&mut x1574, &mut x1575, x1540, 0xffffffff); + let mut x1576: u32 = 0; + let mut x1577: u32 = 0; + fiat_p384_mulx_u32(&mut x1576, &mut x1577, x1540, 0xffffffff); + let mut x1578: u32 = 0; + let mut x1579: u32 = 0; + fiat_p384_mulx_u32(&mut x1578, &mut x1579, x1540, 0xffffffff); + let mut x1580: u32 = 0; + let mut x1581: u32 = 0; + fiat_p384_mulx_u32(&mut x1580, &mut x1581, x1540, 0xfffffffe); + let mut x1582: u32 = 0; + let mut x1583: u32 = 0; + fiat_p384_mulx_u32(&mut x1582, &mut x1583, x1540, 0xffffffff); + let mut x1584: u32 = 0; + let mut x1585: u32 = 0; + fiat_p384_mulx_u32(&mut x1584, &mut x1585, x1540, 0xffffffff); + let mut x1586: u32 = 0; + let mut x1587: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1586, &mut x1587, 0x0, x1583, x1580); + let mut x1588: u32 = 0; + let mut x1589: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1588, &mut x1589, x1587, x1581, x1578); + let mut x1590: u32 = 0; + let mut x1591: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1590, &mut x1591, x1589, x1579, x1576); + let mut x1592: u32 = 0; + let mut x1593: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1592, &mut x1593, x1591, x1577, x1574); + let mut x1594: u32 = 0; + let mut x1595: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1594, &mut x1595, x1593, x1575, x1572); + let mut x1596: u32 = 0; + let mut x1597: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1596, &mut x1597, x1595, x1573, x1570); + let mut x1598: u32 = 0; + let mut x1599: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1598, &mut x1599, x1597, x1571, x1568); + let mut x1600: u32 = 0; + let mut x1601: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1600, &mut x1601, x1599, x1569, x1566); + let x1602: u32 = ((x1601 as u32) + x1567); + let mut x1603: u32 = 0; + let mut x1604: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1603, &mut x1604, 0x0, x1540, x1584); + let mut x1605: u32 = 0; + let mut x1606: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1605, &mut x1606, x1604, x1542, x1585); + let mut x1607: u32 = 0; + let mut x1608: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1607, &mut x1608, x1606, x1544, (0x0 as u32)); + let mut x1609: u32 = 0; + let mut x1610: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1609, &mut x1610, x1608, x1546, x1582); + let mut x1611: u32 = 0; + let mut x1612: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1611, &mut x1612, x1610, x1548, x1586); + let mut x1613: u32 = 0; + let mut x1614: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1613, &mut x1614, x1612, x1550, x1588); + let mut x1615: u32 = 0; + let mut x1616: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1615, &mut x1616, x1614, x1552, x1590); + let mut x1617: u32 = 0; + let mut x1618: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1617, &mut x1618, x1616, x1554, x1592); + let mut x1619: u32 = 0; + let mut x1620: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1619, &mut x1620, x1618, x1556, x1594); + let mut x1621: u32 = 0; + let mut x1622: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1621, &mut x1622, x1620, x1558, x1596); + let mut x1623: u32 = 0; + let mut x1624: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1623, &mut x1624, x1622, x1560, x1598); + let mut x1625: u32 = 0; + let mut x1626: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1625, &mut x1626, x1624, x1562, x1600); + let mut x1627: u32 = 0; + let mut x1628: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1627, &mut x1628, x1626, x1564, x1602); + let x1629: u32 = ((x1628 as u32) + (x1565 as u32)); + let mut x1630: u32 = 0; + let mut x1631: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x1630, &mut x1631, 0x0, x1605, 0xffffffff); + let mut x1632: u32 = 0; + let mut x1633: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x1632, &mut x1633, x1631, x1607, (0x0 as u32)); + let mut x1634: u32 = 0; + let mut x1635: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x1634, &mut x1635, x1633, x1609, (0x0 as u32)); + let mut x1636: u32 = 0; + let mut x1637: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x1636, &mut x1637, x1635, x1611, 0xffffffff); + let mut x1638: u32 = 0; + let mut x1639: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x1638, &mut x1639, x1637, x1613, 0xfffffffe); + let mut x1640: u32 = 0; + let mut x1641: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x1640, &mut x1641, x1639, x1615, 0xffffffff); + let mut x1642: u32 = 0; + let mut x1643: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x1642, &mut x1643, x1641, x1617, 0xffffffff); + let mut x1644: u32 = 0; + let mut x1645: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x1644, &mut x1645, x1643, x1619, 0xffffffff); + let mut x1646: u32 = 0; + let mut x1647: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x1646, &mut x1647, x1645, x1621, 0xffffffff); + let mut x1648: u32 = 0; + let mut x1649: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x1648, &mut x1649, x1647, x1623, 0xffffffff); + let mut x1650: u32 = 0; + let mut x1651: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x1650, &mut x1651, x1649, x1625, 0xffffffff); + let mut x1652: u32 = 0; + let mut x1653: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x1652, &mut x1653, x1651, x1627, 0xffffffff); + let mut x1654: u32 = 0; + let mut x1655: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x1654, &mut x1655, x1653, x1629, (0x0 as u32)); + let mut x1656: u32 = 0; + fiat_p384_cmovznz_u32(&mut x1656, x1655, x1630, x1605); + let mut x1657: u32 = 0; + fiat_p384_cmovznz_u32(&mut x1657, x1655, x1632, x1607); + let mut x1658: u32 = 0; + fiat_p384_cmovznz_u32(&mut x1658, x1655, x1634, x1609); + let mut x1659: u32 = 0; + fiat_p384_cmovznz_u32(&mut x1659, x1655, x1636, x1611); + let mut x1660: u32 = 0; + fiat_p384_cmovznz_u32(&mut x1660, x1655, x1638, x1613); + let mut x1661: u32 = 0; + fiat_p384_cmovznz_u32(&mut x1661, x1655, x1640, x1615); + let mut x1662: u32 = 0; + fiat_p384_cmovznz_u32(&mut x1662, x1655, x1642, x1617); + let mut x1663: u32 = 0; + fiat_p384_cmovznz_u32(&mut x1663, x1655, x1644, x1619); + let mut x1664: u32 = 0; + fiat_p384_cmovznz_u32(&mut x1664, x1655, x1646, x1621); + let mut x1665: u32 = 0; + fiat_p384_cmovznz_u32(&mut x1665, x1655, x1648, x1623); + let mut x1666: u32 = 0; + fiat_p384_cmovznz_u32(&mut x1666, x1655, x1650, x1625); + let mut x1667: u32 = 0; + fiat_p384_cmovznz_u32(&mut x1667, x1655, x1652, x1627); + out1[0] = x1656; + out1[1] = x1657; + out1[2] = x1658; + out1[3] = x1659; + out1[4] = x1660; + out1[5] = x1661; + out1[6] = x1662; + out1[7] = x1663; + out1[8] = x1664; + out1[9] = x1665; + out1[10] = x1666; + out1[11] = x1667; +} + +/// The function fiat_p384_add adds two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) + eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p384_add(out1: &mut fiat_p384_montgomery_domain_field_element, arg1: &fiat_p384_montgomery_domain_field_element, arg2: &fiat_p384_montgomery_domain_field_element) -> () { + let mut x1: u32 = 0; + let mut x2: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1, &mut x2, 0x0, (arg1[0]), (arg2[0])); + let mut x3: u32 = 0; + let mut x4: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x3, &mut x4, x2, (arg1[1]), (arg2[1])); + let mut x5: u32 = 0; + let mut x6: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x5, &mut x6, x4, (arg1[2]), (arg2[2])); + let mut x7: u32 = 0; + let mut x8: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x7, &mut x8, x6, (arg1[3]), (arg2[3])); + let mut x9: u32 = 0; + let mut x10: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x9, &mut x10, x8, (arg1[4]), (arg2[4])); + let mut x11: u32 = 0; + let mut x12: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x11, &mut x12, x10, (arg1[5]), (arg2[5])); + let mut x13: u32 = 0; + let mut x14: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x13, &mut x14, x12, (arg1[6]), (arg2[6])); + let mut x15: u32 = 0; + let mut x16: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x15, &mut x16, x14, (arg1[7]), (arg2[7])); + let mut x17: u32 = 0; + let mut x18: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x17, &mut x18, x16, (arg1[8]), (arg2[8])); + let mut x19: u32 = 0; + let mut x20: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x19, &mut x20, x18, (arg1[9]), (arg2[9])); + let mut x21: u32 = 0; + let mut x22: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x21, &mut x22, x20, (arg1[10]), (arg2[10])); + let mut x23: u32 = 0; + let mut x24: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x23, &mut x24, x22, (arg1[11]), (arg2[11])); + let mut x25: u32 = 0; + let mut x26: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x25, &mut x26, 0x0, x1, 0xffffffff); + let mut x27: u32 = 0; + let mut x28: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x27, &mut x28, x26, x3, (0x0 as u32)); + let mut x29: u32 = 0; + let mut x30: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x29, &mut x30, x28, x5, (0x0 as u32)); + let mut x31: u32 = 0; + let mut x32: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x31, &mut x32, x30, x7, 0xffffffff); + let mut x33: u32 = 0; + let mut x34: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x33, &mut x34, x32, x9, 0xfffffffe); + let mut x35: u32 = 0; + let mut x36: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x35, &mut x36, x34, x11, 0xffffffff); + let mut x37: u32 = 0; + let mut x38: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x37, &mut x38, x36, x13, 0xffffffff); + let mut x39: u32 = 0; + let mut x40: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x39, &mut x40, x38, x15, 0xffffffff); + let mut x41: u32 = 0; + let mut x42: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x41, &mut x42, x40, x17, 0xffffffff); + let mut x43: u32 = 0; + let mut x44: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x43, &mut x44, x42, x19, 0xffffffff); + let mut x45: u32 = 0; + let mut x46: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x45, &mut x46, x44, x21, 0xffffffff); + let mut x47: u32 = 0; + let mut x48: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x47, &mut x48, x46, x23, 0xffffffff); + let mut x49: u32 = 0; + let mut x50: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x49, &mut x50, x48, (x24 as u32), (0x0 as u32)); + let mut x51: u32 = 0; + fiat_p384_cmovznz_u32(&mut x51, x50, x25, x1); + let mut x52: u32 = 0; + fiat_p384_cmovznz_u32(&mut x52, x50, x27, x3); + let mut x53: u32 = 0; + fiat_p384_cmovznz_u32(&mut x53, x50, x29, x5); + let mut x54: u32 = 0; + fiat_p384_cmovznz_u32(&mut x54, x50, x31, x7); + let mut x55: u32 = 0; + fiat_p384_cmovznz_u32(&mut x55, x50, x33, x9); + let mut x56: u32 = 0; + fiat_p384_cmovznz_u32(&mut x56, x50, x35, x11); + let mut x57: u32 = 0; + fiat_p384_cmovznz_u32(&mut x57, x50, x37, x13); + let mut x58: u32 = 0; + fiat_p384_cmovznz_u32(&mut x58, x50, x39, x15); + let mut x59: u32 = 0; + fiat_p384_cmovznz_u32(&mut x59, x50, x41, x17); + let mut x60: u32 = 0; + fiat_p384_cmovznz_u32(&mut x60, x50, x43, x19); + let mut x61: u32 = 0; + fiat_p384_cmovznz_u32(&mut x61, x50, x45, x21); + let mut x62: u32 = 0; + fiat_p384_cmovznz_u32(&mut x62, x50, x47, x23); + out1[0] = x51; + out1[1] = x52; + out1[2] = x53; + out1[3] = x54; + out1[4] = x55; + out1[5] = x56; + out1[6] = x57; + out1[7] = x58; + out1[8] = x59; + out1[9] = x60; + out1[10] = x61; + out1[11] = x62; +} + +/// The function fiat_p384_sub subtracts two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) - eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p384_sub(out1: &mut fiat_p384_montgomery_domain_field_element, arg1: &fiat_p384_montgomery_domain_field_element, arg2: &fiat_p384_montgomery_domain_field_element) -> () { + let mut x1: u32 = 0; + let mut x2: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x1, &mut x2, 0x0, (arg1[0]), (arg2[0])); + let mut x3: u32 = 0; + let mut x4: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x3, &mut x4, x2, (arg1[1]), (arg2[1])); + let mut x5: u32 = 0; + let mut x6: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x5, &mut x6, x4, (arg1[2]), (arg2[2])); + let mut x7: u32 = 0; + let mut x8: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x7, &mut x8, x6, (arg1[3]), (arg2[3])); + let mut x9: u32 = 0; + let mut x10: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x9, &mut x10, x8, (arg1[4]), (arg2[4])); + let mut x11: u32 = 0; + let mut x12: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x11, &mut x12, x10, (arg1[5]), (arg2[5])); + let mut x13: u32 = 0; + let mut x14: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x13, &mut x14, x12, (arg1[6]), (arg2[6])); + let mut x15: u32 = 0; + let mut x16: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x15, &mut x16, x14, (arg1[7]), (arg2[7])); + let mut x17: u32 = 0; + let mut x18: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x17, &mut x18, x16, (arg1[8]), (arg2[8])); + let mut x19: u32 = 0; + let mut x20: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x19, &mut x20, x18, (arg1[9]), (arg2[9])); + let mut x21: u32 = 0; + let mut x22: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x21, &mut x22, x20, (arg1[10]), (arg2[10])); + let mut x23: u32 = 0; + let mut x24: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x23, &mut x24, x22, (arg1[11]), (arg2[11])); + let mut x25: u32 = 0; + fiat_p384_cmovznz_u32(&mut x25, x24, (0x0 as u32), 0xffffffff); + let mut x26: u32 = 0; + let mut x27: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x26, &mut x27, 0x0, x1, x25); + let mut x28: u32 = 0; + let mut x29: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x28, &mut x29, x27, x3, (0x0 as u32)); + let mut x30: u32 = 0; + let mut x31: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x30, &mut x31, x29, x5, (0x0 as u32)); + let mut x32: u32 = 0; + let mut x33: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x32, &mut x33, x31, x7, x25); + let mut x34: u32 = 0; + let mut x35: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x34, &mut x35, x33, x9, (x25 & 0xfffffffe)); + let mut x36: u32 = 0; + let mut x37: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x36, &mut x37, x35, x11, x25); + let mut x38: u32 = 0; + let mut x39: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x38, &mut x39, x37, x13, x25); + let mut x40: u32 = 0; + let mut x41: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x40, &mut x41, x39, x15, x25); + let mut x42: u32 = 0; + let mut x43: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x42, &mut x43, x41, x17, x25); + let mut x44: u32 = 0; + let mut x45: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x44, &mut x45, x43, x19, x25); + let mut x46: u32 = 0; + let mut x47: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x46, &mut x47, x45, x21, x25); + let mut x48: u32 = 0; + let mut x49: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x48, &mut x49, x47, x23, x25); + out1[0] = x26; + out1[1] = x28; + out1[2] = x30; + out1[3] = x32; + out1[4] = x34; + out1[5] = x36; + out1[6] = x38; + out1[7] = x40; + out1[8] = x42; + out1[9] = x44; + out1[10] = x46; + out1[11] = x48; +} + +/// The function fiat_p384_opp negates a field element in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = -eval (from_montgomery arg1) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p384_opp(out1: &mut fiat_p384_montgomery_domain_field_element, arg1: &fiat_p384_montgomery_domain_field_element) -> () { + let mut x1: u32 = 0; + let mut x2: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x1, &mut x2, 0x0, (0x0 as u32), (arg1[0])); + let mut x3: u32 = 0; + let mut x4: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x3, &mut x4, x2, (0x0 as u32), (arg1[1])); + let mut x5: u32 = 0; + let mut x6: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x5, &mut x6, x4, (0x0 as u32), (arg1[2])); + let mut x7: u32 = 0; + let mut x8: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x7, &mut x8, x6, (0x0 as u32), (arg1[3])); + let mut x9: u32 = 0; + let mut x10: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x9, &mut x10, x8, (0x0 as u32), (arg1[4])); + let mut x11: u32 = 0; + let mut x12: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x11, &mut x12, x10, (0x0 as u32), (arg1[5])); + let mut x13: u32 = 0; + let mut x14: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x13, &mut x14, x12, (0x0 as u32), (arg1[6])); + let mut x15: u32 = 0; + let mut x16: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x15, &mut x16, x14, (0x0 as u32), (arg1[7])); + let mut x17: u32 = 0; + let mut x18: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x17, &mut x18, x16, (0x0 as u32), (arg1[8])); + let mut x19: u32 = 0; + let mut x20: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x19, &mut x20, x18, (0x0 as u32), (arg1[9])); + let mut x21: u32 = 0; + let mut x22: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x21, &mut x22, x20, (0x0 as u32), (arg1[10])); + let mut x23: u32 = 0; + let mut x24: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x23, &mut x24, x22, (0x0 as u32), (arg1[11])); + let mut x25: u32 = 0; + fiat_p384_cmovznz_u32(&mut x25, x24, (0x0 as u32), 0xffffffff); + let mut x26: u32 = 0; + let mut x27: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x26, &mut x27, 0x0, x1, x25); + let mut x28: u32 = 0; + let mut x29: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x28, &mut x29, x27, x3, (0x0 as u32)); + let mut x30: u32 = 0; + let mut x31: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x30, &mut x31, x29, x5, (0x0 as u32)); + let mut x32: u32 = 0; + let mut x33: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x32, &mut x33, x31, x7, x25); + let mut x34: u32 = 0; + let mut x35: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x34, &mut x35, x33, x9, (x25 & 0xfffffffe)); + let mut x36: u32 = 0; + let mut x37: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x36, &mut x37, x35, x11, x25); + let mut x38: u32 = 0; + let mut x39: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x38, &mut x39, x37, x13, x25); + let mut x40: u32 = 0; + let mut x41: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x40, &mut x41, x39, x15, x25); + let mut x42: u32 = 0; + let mut x43: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x42, &mut x43, x41, x17, x25); + let mut x44: u32 = 0; + let mut x45: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x44, &mut x45, x43, x19, x25); + let mut x46: u32 = 0; + let mut x47: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x46, &mut x47, x45, x21, x25); + let mut x48: u32 = 0; + let mut x49: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x48, &mut x49, x47, x23, x25); + out1[0] = x26; + out1[1] = x28; + out1[2] = x30; + out1[3] = x32; + out1[4] = x34; + out1[5] = x36; + out1[6] = x38; + out1[7] = x40; + out1[8] = x42; + out1[9] = x44; + out1[10] = x46; + out1[11] = x48; +} + +/// The function fiat_p384_from_montgomery translates a field element out of the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval out1 mod m = (eval arg1 * ((2^32)⁻¹ mod m)^12) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p384_from_montgomery(out1: &mut fiat_p384_non_montgomery_domain_field_element, arg1: &fiat_p384_montgomery_domain_field_element) -> () { + let x1: u32 = (arg1[0]); + let mut x2: u32 = 0; + let mut x3: u32 = 0; + fiat_p384_mulx_u32(&mut x2, &mut x3, x1, 0xffffffff); + let mut x4: u32 = 0; + let mut x5: u32 = 0; + fiat_p384_mulx_u32(&mut x4, &mut x5, x1, 0xffffffff); + let mut x6: u32 = 0; + let mut x7: u32 = 0; + fiat_p384_mulx_u32(&mut x6, &mut x7, x1, 0xffffffff); + let mut x8: u32 = 0; + let mut x9: u32 = 0; + fiat_p384_mulx_u32(&mut x8, &mut x9, x1, 0xffffffff); + let mut x10: u32 = 0; + let mut x11: u32 = 0; + fiat_p384_mulx_u32(&mut x10, &mut x11, x1, 0xffffffff); + let mut x12: u32 = 0; + let mut x13: u32 = 0; + fiat_p384_mulx_u32(&mut x12, &mut x13, x1, 0xffffffff); + let mut x14: u32 = 0; + let mut x15: u32 = 0; + fiat_p384_mulx_u32(&mut x14, &mut x15, x1, 0xffffffff); + let mut x16: u32 = 0; + let mut x17: u32 = 0; + fiat_p384_mulx_u32(&mut x16, &mut x17, x1, 0xfffffffe); + let mut x18: u32 = 0; + let mut x19: u32 = 0; + fiat_p384_mulx_u32(&mut x18, &mut x19, x1, 0xffffffff); + let mut x20: u32 = 0; + let mut x21: u32 = 0; + fiat_p384_mulx_u32(&mut x20, &mut x21, x1, 0xffffffff); + let mut x22: u32 = 0; + let mut x23: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x22, &mut x23, 0x0, x19, x16); + let mut x24: u32 = 0; + let mut x25: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x24, &mut x25, x23, x17, x14); + let mut x26: u32 = 0; + let mut x27: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x26, &mut x27, x25, x15, x12); + let mut x28: u32 = 0; + let mut x29: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x28, &mut x29, x27, x13, x10); + let mut x30: u32 = 0; + let mut x31: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x30, &mut x31, x29, x11, x8); + let mut x32: u32 = 0; + let mut x33: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x32, &mut x33, x31, x9, x6); + let mut x34: u32 = 0; + let mut x35: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x34, &mut x35, x33, x7, x4); + let mut x36: u32 = 0; + let mut x37: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x36, &mut x37, x35, x5, x2); + let mut x38: u32 = 0; + let mut x39: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x38, &mut x39, 0x0, x1, x20); + let mut x40: u32 = 0; + let mut x41: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x40, &mut x41, 0x0, ((x39 as u32) + x21), (arg1[1])); + let mut x42: u32 = 0; + let mut x43: u32 = 0; + fiat_p384_mulx_u32(&mut x42, &mut x43, x40, 0xffffffff); + let mut x44: u32 = 0; + let mut x45: u32 = 0; + fiat_p384_mulx_u32(&mut x44, &mut x45, x40, 0xffffffff); + let mut x46: u32 = 0; + let mut x47: u32 = 0; + fiat_p384_mulx_u32(&mut x46, &mut x47, x40, 0xffffffff); + let mut x48: u32 = 0; + let mut x49: u32 = 0; + fiat_p384_mulx_u32(&mut x48, &mut x49, x40, 0xffffffff); + let mut x50: u32 = 0; + let mut x51: u32 = 0; + fiat_p384_mulx_u32(&mut x50, &mut x51, x40, 0xffffffff); + let mut x52: u32 = 0; + let mut x53: u32 = 0; + fiat_p384_mulx_u32(&mut x52, &mut x53, x40, 0xffffffff); + let mut x54: u32 = 0; + let mut x55: u32 = 0; + fiat_p384_mulx_u32(&mut x54, &mut x55, x40, 0xffffffff); + let mut x56: u32 = 0; + let mut x57: u32 = 0; + fiat_p384_mulx_u32(&mut x56, &mut x57, x40, 0xfffffffe); + let mut x58: u32 = 0; + let mut x59: u32 = 0; + fiat_p384_mulx_u32(&mut x58, &mut x59, x40, 0xffffffff); + let mut x60: u32 = 0; + let mut x61: u32 = 0; + fiat_p384_mulx_u32(&mut x60, &mut x61, x40, 0xffffffff); + let mut x62: u32 = 0; + let mut x63: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x62, &mut x63, 0x0, x59, x56); + let mut x64: u32 = 0; + let mut x65: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x64, &mut x65, x63, x57, x54); + let mut x66: u32 = 0; + let mut x67: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x66, &mut x67, x65, x55, x52); + let mut x68: u32 = 0; + let mut x69: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x68, &mut x69, x67, x53, x50); + let mut x70: u32 = 0; + let mut x71: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x70, &mut x71, x69, x51, x48); + let mut x72: u32 = 0; + let mut x73: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x72, &mut x73, x71, x49, x46); + let mut x74: u32 = 0; + let mut x75: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x74, &mut x75, x73, x47, x44); + let mut x76: u32 = 0; + let mut x77: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x76, &mut x77, x75, x45, x42); + let mut x78: u32 = 0; + let mut x79: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x78, &mut x79, 0x0, x40, x60); + let mut x80: u32 = 0; + let mut x81: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x80, &mut x81, x79, (x41 as u32), x61); + let mut x82: u32 = 0; + let mut x83: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x82, &mut x83, x81, x18, (0x0 as u32)); + let mut x84: u32 = 0; + let mut x85: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x84, &mut x85, x83, x22, x58); + let mut x86: u32 = 0; + let mut x87: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x86, &mut x87, x85, x24, x62); + let mut x88: u32 = 0; + let mut x89: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x88, &mut x89, x87, x26, x64); + let mut x90: u32 = 0; + let mut x91: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x90, &mut x91, x89, x28, x66); + let mut x92: u32 = 0; + let mut x93: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x92, &mut x93, x91, x30, x68); + let mut x94: u32 = 0; + let mut x95: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x94, &mut x95, x93, x32, x70); + let mut x96: u32 = 0; + let mut x97: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x96, &mut x97, x95, x34, x72); + let mut x98: u32 = 0; + let mut x99: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x98, &mut x99, x97, x36, x74); + let mut x100: u32 = 0; + let mut x101: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x100, &mut x101, x99, ((x37 as u32) + x3), x76); + let mut x102: u32 = 0; + let mut x103: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x102, &mut x103, x101, (0x0 as u32), ((x77 as u32) + x43)); + let mut x104: u32 = 0; + let mut x105: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x104, &mut x105, 0x0, x80, (arg1[2])); + let mut x106: u32 = 0; + let mut x107: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x106, &mut x107, x105, x82, (0x0 as u32)); + let mut x108: u32 = 0; + let mut x109: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x108, &mut x109, x107, x84, (0x0 as u32)); + let mut x110: u32 = 0; + let mut x111: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x110, &mut x111, x109, x86, (0x0 as u32)); + let mut x112: u32 = 0; + let mut x113: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x112, &mut x113, x111, x88, (0x0 as u32)); + let mut x114: u32 = 0; + let mut x115: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x114, &mut x115, x113, x90, (0x0 as u32)); + let mut x116: u32 = 0; + let mut x117: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x116, &mut x117, x115, x92, (0x0 as u32)); + let mut x118: u32 = 0; + let mut x119: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x118, &mut x119, x117, x94, (0x0 as u32)); + let mut x120: u32 = 0; + let mut x121: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x120, &mut x121, x119, x96, (0x0 as u32)); + let mut x122: u32 = 0; + let mut x123: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x122, &mut x123, x121, x98, (0x0 as u32)); + let mut x124: u32 = 0; + let mut x125: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x124, &mut x125, x123, x100, (0x0 as u32)); + let mut x126: u32 = 0; + let mut x127: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x126, &mut x127, x125, x102, (0x0 as u32)); + let mut x128: u32 = 0; + let mut x129: u32 = 0; + fiat_p384_mulx_u32(&mut x128, &mut x129, x104, 0xffffffff); + let mut x130: u32 = 0; + let mut x131: u32 = 0; + fiat_p384_mulx_u32(&mut x130, &mut x131, x104, 0xffffffff); + let mut x132: u32 = 0; + let mut x133: u32 = 0; + fiat_p384_mulx_u32(&mut x132, &mut x133, x104, 0xffffffff); + let mut x134: u32 = 0; + let mut x135: u32 = 0; + fiat_p384_mulx_u32(&mut x134, &mut x135, x104, 0xffffffff); + let mut x136: u32 = 0; + let mut x137: u32 = 0; + fiat_p384_mulx_u32(&mut x136, &mut x137, x104, 0xffffffff); + let mut x138: u32 = 0; + let mut x139: u32 = 0; + fiat_p384_mulx_u32(&mut x138, &mut x139, x104, 0xffffffff); + let mut x140: u32 = 0; + let mut x141: u32 = 0; + fiat_p384_mulx_u32(&mut x140, &mut x141, x104, 0xffffffff); + let mut x142: u32 = 0; + let mut x143: u32 = 0; + fiat_p384_mulx_u32(&mut x142, &mut x143, x104, 0xfffffffe); + let mut x144: u32 = 0; + let mut x145: u32 = 0; + fiat_p384_mulx_u32(&mut x144, &mut x145, x104, 0xffffffff); + let mut x146: u32 = 0; + let mut x147: u32 = 0; + fiat_p384_mulx_u32(&mut x146, &mut x147, x104, 0xffffffff); + let mut x148: u32 = 0; + let mut x149: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x148, &mut x149, 0x0, x145, x142); + let mut x150: u32 = 0; + let mut x151: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x150, &mut x151, x149, x143, x140); + let mut x152: u32 = 0; + let mut x153: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x152, &mut x153, x151, x141, x138); + let mut x154: u32 = 0; + let mut x155: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x154, &mut x155, x153, x139, x136); + let mut x156: u32 = 0; + let mut x157: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x156, &mut x157, x155, x137, x134); + let mut x158: u32 = 0; + let mut x159: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x158, &mut x159, x157, x135, x132); + let mut x160: u32 = 0; + let mut x161: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x160, &mut x161, x159, x133, x130); + let mut x162: u32 = 0; + let mut x163: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x162, &mut x163, x161, x131, x128); + let mut x164: u32 = 0; + let mut x165: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x164, &mut x165, 0x0, x104, x146); + let mut x166: u32 = 0; + let mut x167: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x166, &mut x167, x165, x106, x147); + let mut x168: u32 = 0; + let mut x169: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x168, &mut x169, x167, x108, (0x0 as u32)); + let mut x170: u32 = 0; + let mut x171: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x170, &mut x171, x169, x110, x144); + let mut x172: u32 = 0; + let mut x173: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x172, &mut x173, x171, x112, x148); + let mut x174: u32 = 0; + let mut x175: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x174, &mut x175, x173, x114, x150); + let mut x176: u32 = 0; + let mut x177: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x176, &mut x177, x175, x116, x152); + let mut x178: u32 = 0; + let mut x179: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x178, &mut x179, x177, x118, x154); + let mut x180: u32 = 0; + let mut x181: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x180, &mut x181, x179, x120, x156); + let mut x182: u32 = 0; + let mut x183: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x182, &mut x183, x181, x122, x158); + let mut x184: u32 = 0; + let mut x185: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x184, &mut x185, x183, x124, x160); + let mut x186: u32 = 0; + let mut x187: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x186, &mut x187, x185, x126, x162); + let mut x188: u32 = 0; + let mut x189: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x188, &mut x189, x187, ((x127 as u32) + (x103 as u32)), ((x163 as u32) + x129)); + let mut x190: u32 = 0; + let mut x191: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x190, &mut x191, 0x0, x166, (arg1[3])); + let mut x192: u32 = 0; + let mut x193: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x192, &mut x193, x191, x168, (0x0 as u32)); + let mut x194: u32 = 0; + let mut x195: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x194, &mut x195, x193, x170, (0x0 as u32)); + let mut x196: u32 = 0; + let mut x197: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x196, &mut x197, x195, x172, (0x0 as u32)); + let mut x198: u32 = 0; + let mut x199: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x198, &mut x199, x197, x174, (0x0 as u32)); + let mut x200: u32 = 0; + let mut x201: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x200, &mut x201, x199, x176, (0x0 as u32)); + let mut x202: u32 = 0; + let mut x203: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x202, &mut x203, x201, x178, (0x0 as u32)); + let mut x204: u32 = 0; + let mut x205: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x204, &mut x205, x203, x180, (0x0 as u32)); + let mut x206: u32 = 0; + let mut x207: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x206, &mut x207, x205, x182, (0x0 as u32)); + let mut x208: u32 = 0; + let mut x209: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x208, &mut x209, x207, x184, (0x0 as u32)); + let mut x210: u32 = 0; + let mut x211: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x210, &mut x211, x209, x186, (0x0 as u32)); + let mut x212: u32 = 0; + let mut x213: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x212, &mut x213, x211, x188, (0x0 as u32)); + let mut x214: u32 = 0; + let mut x215: u32 = 0; + fiat_p384_mulx_u32(&mut x214, &mut x215, x190, 0xffffffff); + let mut x216: u32 = 0; + let mut x217: u32 = 0; + fiat_p384_mulx_u32(&mut x216, &mut x217, x190, 0xffffffff); + let mut x218: u32 = 0; + let mut x219: u32 = 0; + fiat_p384_mulx_u32(&mut x218, &mut x219, x190, 0xffffffff); + let mut x220: u32 = 0; + let mut x221: u32 = 0; + fiat_p384_mulx_u32(&mut x220, &mut x221, x190, 0xffffffff); + let mut x222: u32 = 0; + let mut x223: u32 = 0; + fiat_p384_mulx_u32(&mut x222, &mut x223, x190, 0xffffffff); + let mut x224: u32 = 0; + let mut x225: u32 = 0; + fiat_p384_mulx_u32(&mut x224, &mut x225, x190, 0xffffffff); + let mut x226: u32 = 0; + let mut x227: u32 = 0; + fiat_p384_mulx_u32(&mut x226, &mut x227, x190, 0xffffffff); + let mut x228: u32 = 0; + let mut x229: u32 = 0; + fiat_p384_mulx_u32(&mut x228, &mut x229, x190, 0xfffffffe); + let mut x230: u32 = 0; + let mut x231: u32 = 0; + fiat_p384_mulx_u32(&mut x230, &mut x231, x190, 0xffffffff); + let mut x232: u32 = 0; + let mut x233: u32 = 0; + fiat_p384_mulx_u32(&mut x232, &mut x233, x190, 0xffffffff); + let mut x234: u32 = 0; + let mut x235: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x234, &mut x235, 0x0, x231, x228); + let mut x236: u32 = 0; + let mut x237: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x236, &mut x237, x235, x229, x226); + let mut x238: u32 = 0; + let mut x239: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x238, &mut x239, x237, x227, x224); + let mut x240: u32 = 0; + let mut x241: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x240, &mut x241, x239, x225, x222); + let mut x242: u32 = 0; + let mut x243: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x242, &mut x243, x241, x223, x220); + let mut x244: u32 = 0; + let mut x245: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x244, &mut x245, x243, x221, x218); + let mut x246: u32 = 0; + let mut x247: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x246, &mut x247, x245, x219, x216); + let mut x248: u32 = 0; + let mut x249: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x248, &mut x249, x247, x217, x214); + let mut x250: u32 = 0; + let mut x251: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x250, &mut x251, 0x0, x190, x232); + let mut x252: u32 = 0; + let mut x253: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x252, &mut x253, x251, x192, x233); + let mut x254: u32 = 0; + let mut x255: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x254, &mut x255, x253, x194, (0x0 as u32)); + let mut x256: u32 = 0; + let mut x257: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x256, &mut x257, x255, x196, x230); + let mut x258: u32 = 0; + let mut x259: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x258, &mut x259, x257, x198, x234); + let mut x260: u32 = 0; + let mut x261: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x260, &mut x261, x259, x200, x236); + let mut x262: u32 = 0; + let mut x263: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x262, &mut x263, x261, x202, x238); + let mut x264: u32 = 0; + let mut x265: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x264, &mut x265, x263, x204, x240); + let mut x266: u32 = 0; + let mut x267: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x266, &mut x267, x265, x206, x242); + let mut x268: u32 = 0; + let mut x269: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x268, &mut x269, x267, x208, x244); + let mut x270: u32 = 0; + let mut x271: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x270, &mut x271, x269, x210, x246); + let mut x272: u32 = 0; + let mut x273: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x272, &mut x273, x271, x212, x248); + let mut x274: u32 = 0; + let mut x275: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x274, &mut x275, x273, ((x213 as u32) + (x189 as u32)), ((x249 as u32) + x215)); + let mut x276: u32 = 0; + let mut x277: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x276, &mut x277, 0x0, x252, (arg1[4])); + let mut x278: u32 = 0; + let mut x279: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x278, &mut x279, x277, x254, (0x0 as u32)); + let mut x280: u32 = 0; + let mut x281: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x280, &mut x281, x279, x256, (0x0 as u32)); + let mut x282: u32 = 0; + let mut x283: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x282, &mut x283, x281, x258, (0x0 as u32)); + let mut x284: u32 = 0; + let mut x285: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x284, &mut x285, x283, x260, (0x0 as u32)); + let mut x286: u32 = 0; + let mut x287: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x286, &mut x287, x285, x262, (0x0 as u32)); + let mut x288: u32 = 0; + let mut x289: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x288, &mut x289, x287, x264, (0x0 as u32)); + let mut x290: u32 = 0; + let mut x291: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x290, &mut x291, x289, x266, (0x0 as u32)); + let mut x292: u32 = 0; + let mut x293: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x292, &mut x293, x291, x268, (0x0 as u32)); + let mut x294: u32 = 0; + let mut x295: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x294, &mut x295, x293, x270, (0x0 as u32)); + let mut x296: u32 = 0; + let mut x297: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x296, &mut x297, x295, x272, (0x0 as u32)); + let mut x298: u32 = 0; + let mut x299: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x298, &mut x299, x297, x274, (0x0 as u32)); + let mut x300: u32 = 0; + let mut x301: u32 = 0; + fiat_p384_mulx_u32(&mut x300, &mut x301, x276, 0xffffffff); + let mut x302: u32 = 0; + let mut x303: u32 = 0; + fiat_p384_mulx_u32(&mut x302, &mut x303, x276, 0xffffffff); + let mut x304: u32 = 0; + let mut x305: u32 = 0; + fiat_p384_mulx_u32(&mut x304, &mut x305, x276, 0xffffffff); + let mut x306: u32 = 0; + let mut x307: u32 = 0; + fiat_p384_mulx_u32(&mut x306, &mut x307, x276, 0xffffffff); + let mut x308: u32 = 0; + let mut x309: u32 = 0; + fiat_p384_mulx_u32(&mut x308, &mut x309, x276, 0xffffffff); + let mut x310: u32 = 0; + let mut x311: u32 = 0; + fiat_p384_mulx_u32(&mut x310, &mut x311, x276, 0xffffffff); + let mut x312: u32 = 0; + let mut x313: u32 = 0; + fiat_p384_mulx_u32(&mut x312, &mut x313, x276, 0xffffffff); + let mut x314: u32 = 0; + let mut x315: u32 = 0; + fiat_p384_mulx_u32(&mut x314, &mut x315, x276, 0xfffffffe); + let mut x316: u32 = 0; + let mut x317: u32 = 0; + fiat_p384_mulx_u32(&mut x316, &mut x317, x276, 0xffffffff); + let mut x318: u32 = 0; + let mut x319: u32 = 0; + fiat_p384_mulx_u32(&mut x318, &mut x319, x276, 0xffffffff); + let mut x320: u32 = 0; + let mut x321: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x320, &mut x321, 0x0, x317, x314); + let mut x322: u32 = 0; + let mut x323: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x322, &mut x323, x321, x315, x312); + let mut x324: u32 = 0; + let mut x325: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x324, &mut x325, x323, x313, x310); + let mut x326: u32 = 0; + let mut x327: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x326, &mut x327, x325, x311, x308); + let mut x328: u32 = 0; + let mut x329: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x328, &mut x329, x327, x309, x306); + let mut x330: u32 = 0; + let mut x331: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x330, &mut x331, x329, x307, x304); + let mut x332: u32 = 0; + let mut x333: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x332, &mut x333, x331, x305, x302); + let mut x334: u32 = 0; + let mut x335: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x334, &mut x335, x333, x303, x300); + let mut x336: u32 = 0; + let mut x337: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x336, &mut x337, 0x0, x276, x318); + let mut x338: u32 = 0; + let mut x339: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x338, &mut x339, x337, x278, x319); + let mut x340: u32 = 0; + let mut x341: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x340, &mut x341, x339, x280, (0x0 as u32)); + let mut x342: u32 = 0; + let mut x343: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x342, &mut x343, x341, x282, x316); + let mut x344: u32 = 0; + let mut x345: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x344, &mut x345, x343, x284, x320); + let mut x346: u32 = 0; + let mut x347: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x346, &mut x347, x345, x286, x322); + let mut x348: u32 = 0; + let mut x349: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x348, &mut x349, x347, x288, x324); + let mut x350: u32 = 0; + let mut x351: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x350, &mut x351, x349, x290, x326); + let mut x352: u32 = 0; + let mut x353: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x352, &mut x353, x351, x292, x328); + let mut x354: u32 = 0; + let mut x355: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x354, &mut x355, x353, x294, x330); + let mut x356: u32 = 0; + let mut x357: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x356, &mut x357, x355, x296, x332); + let mut x358: u32 = 0; + let mut x359: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x358, &mut x359, x357, x298, x334); + let mut x360: u32 = 0; + let mut x361: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x360, &mut x361, x359, ((x299 as u32) + (x275 as u32)), ((x335 as u32) + x301)); + let mut x362: u32 = 0; + let mut x363: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x362, &mut x363, 0x0, x338, (arg1[5])); + let mut x364: u32 = 0; + let mut x365: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x364, &mut x365, x363, x340, (0x0 as u32)); + let mut x366: u32 = 0; + let mut x367: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x366, &mut x367, x365, x342, (0x0 as u32)); + let mut x368: u32 = 0; + let mut x369: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x368, &mut x369, x367, x344, (0x0 as u32)); + let mut x370: u32 = 0; + let mut x371: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x370, &mut x371, x369, x346, (0x0 as u32)); + let mut x372: u32 = 0; + let mut x373: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x372, &mut x373, x371, x348, (0x0 as u32)); + let mut x374: u32 = 0; + let mut x375: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x374, &mut x375, x373, x350, (0x0 as u32)); + let mut x376: u32 = 0; + let mut x377: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x376, &mut x377, x375, x352, (0x0 as u32)); + let mut x378: u32 = 0; + let mut x379: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x378, &mut x379, x377, x354, (0x0 as u32)); + let mut x380: u32 = 0; + let mut x381: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x380, &mut x381, x379, x356, (0x0 as u32)); + let mut x382: u32 = 0; + let mut x383: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x382, &mut x383, x381, x358, (0x0 as u32)); + let mut x384: u32 = 0; + let mut x385: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x384, &mut x385, x383, x360, (0x0 as u32)); + let mut x386: u32 = 0; + let mut x387: u32 = 0; + fiat_p384_mulx_u32(&mut x386, &mut x387, x362, 0xffffffff); + let mut x388: u32 = 0; + let mut x389: u32 = 0; + fiat_p384_mulx_u32(&mut x388, &mut x389, x362, 0xffffffff); + let mut x390: u32 = 0; + let mut x391: u32 = 0; + fiat_p384_mulx_u32(&mut x390, &mut x391, x362, 0xffffffff); + let mut x392: u32 = 0; + let mut x393: u32 = 0; + fiat_p384_mulx_u32(&mut x392, &mut x393, x362, 0xffffffff); + let mut x394: u32 = 0; + let mut x395: u32 = 0; + fiat_p384_mulx_u32(&mut x394, &mut x395, x362, 0xffffffff); + let mut x396: u32 = 0; + let mut x397: u32 = 0; + fiat_p384_mulx_u32(&mut x396, &mut x397, x362, 0xffffffff); + let mut x398: u32 = 0; + let mut x399: u32 = 0; + fiat_p384_mulx_u32(&mut x398, &mut x399, x362, 0xffffffff); + let mut x400: u32 = 0; + let mut x401: u32 = 0; + fiat_p384_mulx_u32(&mut x400, &mut x401, x362, 0xfffffffe); + let mut x402: u32 = 0; + let mut x403: u32 = 0; + fiat_p384_mulx_u32(&mut x402, &mut x403, x362, 0xffffffff); + let mut x404: u32 = 0; + let mut x405: u32 = 0; + fiat_p384_mulx_u32(&mut x404, &mut x405, x362, 0xffffffff); + let mut x406: u32 = 0; + let mut x407: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x406, &mut x407, 0x0, x403, x400); + let mut x408: u32 = 0; + let mut x409: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x408, &mut x409, x407, x401, x398); + let mut x410: u32 = 0; + let mut x411: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x410, &mut x411, x409, x399, x396); + let mut x412: u32 = 0; + let mut x413: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x412, &mut x413, x411, x397, x394); + let mut x414: u32 = 0; + let mut x415: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x414, &mut x415, x413, x395, x392); + let mut x416: u32 = 0; + let mut x417: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x416, &mut x417, x415, x393, x390); + let mut x418: u32 = 0; + let mut x419: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x418, &mut x419, x417, x391, x388); + let mut x420: u32 = 0; + let mut x421: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x420, &mut x421, x419, x389, x386); + let mut x422: u32 = 0; + let mut x423: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x422, &mut x423, 0x0, x362, x404); + let mut x424: u32 = 0; + let mut x425: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x424, &mut x425, x423, x364, x405); + let mut x426: u32 = 0; + let mut x427: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x426, &mut x427, x425, x366, (0x0 as u32)); + let mut x428: u32 = 0; + let mut x429: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x428, &mut x429, x427, x368, x402); + let mut x430: u32 = 0; + let mut x431: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x430, &mut x431, x429, x370, x406); + let mut x432: u32 = 0; + let mut x433: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x432, &mut x433, x431, x372, x408); + let mut x434: u32 = 0; + let mut x435: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x434, &mut x435, x433, x374, x410); + let mut x436: u32 = 0; + let mut x437: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x436, &mut x437, x435, x376, x412); + let mut x438: u32 = 0; + let mut x439: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x438, &mut x439, x437, x378, x414); + let mut x440: u32 = 0; + let mut x441: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x440, &mut x441, x439, x380, x416); + let mut x442: u32 = 0; + let mut x443: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x442, &mut x443, x441, x382, x418); + let mut x444: u32 = 0; + let mut x445: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x444, &mut x445, x443, x384, x420); + let mut x446: u32 = 0; + let mut x447: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x446, &mut x447, x445, ((x385 as u32) + (x361 as u32)), ((x421 as u32) + x387)); + let mut x448: u32 = 0; + let mut x449: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x448, &mut x449, 0x0, x424, (arg1[6])); + let mut x450: u32 = 0; + let mut x451: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x450, &mut x451, x449, x426, (0x0 as u32)); + let mut x452: u32 = 0; + let mut x453: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x452, &mut x453, x451, x428, (0x0 as u32)); + let mut x454: u32 = 0; + let mut x455: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x454, &mut x455, x453, x430, (0x0 as u32)); + let mut x456: u32 = 0; + let mut x457: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x456, &mut x457, x455, x432, (0x0 as u32)); + let mut x458: u32 = 0; + let mut x459: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x458, &mut x459, x457, x434, (0x0 as u32)); + let mut x460: u32 = 0; + let mut x461: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x460, &mut x461, x459, x436, (0x0 as u32)); + let mut x462: u32 = 0; + let mut x463: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x462, &mut x463, x461, x438, (0x0 as u32)); + let mut x464: u32 = 0; + let mut x465: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x464, &mut x465, x463, x440, (0x0 as u32)); + let mut x466: u32 = 0; + let mut x467: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x466, &mut x467, x465, x442, (0x0 as u32)); + let mut x468: u32 = 0; + let mut x469: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x468, &mut x469, x467, x444, (0x0 as u32)); + let mut x470: u32 = 0; + let mut x471: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x470, &mut x471, x469, x446, (0x0 as u32)); + let mut x472: u32 = 0; + let mut x473: u32 = 0; + fiat_p384_mulx_u32(&mut x472, &mut x473, x448, 0xffffffff); + let mut x474: u32 = 0; + let mut x475: u32 = 0; + fiat_p384_mulx_u32(&mut x474, &mut x475, x448, 0xffffffff); + let mut x476: u32 = 0; + let mut x477: u32 = 0; + fiat_p384_mulx_u32(&mut x476, &mut x477, x448, 0xffffffff); + let mut x478: u32 = 0; + let mut x479: u32 = 0; + fiat_p384_mulx_u32(&mut x478, &mut x479, x448, 0xffffffff); + let mut x480: u32 = 0; + let mut x481: u32 = 0; + fiat_p384_mulx_u32(&mut x480, &mut x481, x448, 0xffffffff); + let mut x482: u32 = 0; + let mut x483: u32 = 0; + fiat_p384_mulx_u32(&mut x482, &mut x483, x448, 0xffffffff); + let mut x484: u32 = 0; + let mut x485: u32 = 0; + fiat_p384_mulx_u32(&mut x484, &mut x485, x448, 0xffffffff); + let mut x486: u32 = 0; + let mut x487: u32 = 0; + fiat_p384_mulx_u32(&mut x486, &mut x487, x448, 0xfffffffe); + let mut x488: u32 = 0; + let mut x489: u32 = 0; + fiat_p384_mulx_u32(&mut x488, &mut x489, x448, 0xffffffff); + let mut x490: u32 = 0; + let mut x491: u32 = 0; + fiat_p384_mulx_u32(&mut x490, &mut x491, x448, 0xffffffff); + let mut x492: u32 = 0; + let mut x493: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x492, &mut x493, 0x0, x489, x486); + let mut x494: u32 = 0; + let mut x495: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x494, &mut x495, x493, x487, x484); + let mut x496: u32 = 0; + let mut x497: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x496, &mut x497, x495, x485, x482); + let mut x498: u32 = 0; + let mut x499: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x498, &mut x499, x497, x483, x480); + let mut x500: u32 = 0; + let mut x501: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x500, &mut x501, x499, x481, x478); + let mut x502: u32 = 0; + let mut x503: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x502, &mut x503, x501, x479, x476); + let mut x504: u32 = 0; + let mut x505: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x504, &mut x505, x503, x477, x474); + let mut x506: u32 = 0; + let mut x507: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x506, &mut x507, x505, x475, x472); + let mut x508: u32 = 0; + let mut x509: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x508, &mut x509, 0x0, x448, x490); + let mut x510: u32 = 0; + let mut x511: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x510, &mut x511, x509, x450, x491); + let mut x512: u32 = 0; + let mut x513: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x512, &mut x513, x511, x452, (0x0 as u32)); + let mut x514: u32 = 0; + let mut x515: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x514, &mut x515, x513, x454, x488); + let mut x516: u32 = 0; + let mut x517: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x516, &mut x517, x515, x456, x492); + let mut x518: u32 = 0; + let mut x519: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x518, &mut x519, x517, x458, x494); + let mut x520: u32 = 0; + let mut x521: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x520, &mut x521, x519, x460, x496); + let mut x522: u32 = 0; + let mut x523: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x522, &mut x523, x521, x462, x498); + let mut x524: u32 = 0; + let mut x525: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x524, &mut x525, x523, x464, x500); + let mut x526: u32 = 0; + let mut x527: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x526, &mut x527, x525, x466, x502); + let mut x528: u32 = 0; + let mut x529: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x528, &mut x529, x527, x468, x504); + let mut x530: u32 = 0; + let mut x531: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x530, &mut x531, x529, x470, x506); + let mut x532: u32 = 0; + let mut x533: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x532, &mut x533, x531, ((x471 as u32) + (x447 as u32)), ((x507 as u32) + x473)); + let mut x534: u32 = 0; + let mut x535: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x534, &mut x535, 0x0, x510, (arg1[7])); + let mut x536: u32 = 0; + let mut x537: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x536, &mut x537, x535, x512, (0x0 as u32)); + let mut x538: u32 = 0; + let mut x539: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x538, &mut x539, x537, x514, (0x0 as u32)); + let mut x540: u32 = 0; + let mut x541: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x540, &mut x541, x539, x516, (0x0 as u32)); + let mut x542: u32 = 0; + let mut x543: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x542, &mut x543, x541, x518, (0x0 as u32)); + let mut x544: u32 = 0; + let mut x545: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x544, &mut x545, x543, x520, (0x0 as u32)); + let mut x546: u32 = 0; + let mut x547: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x546, &mut x547, x545, x522, (0x0 as u32)); + let mut x548: u32 = 0; + let mut x549: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x548, &mut x549, x547, x524, (0x0 as u32)); + let mut x550: u32 = 0; + let mut x551: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x550, &mut x551, x549, x526, (0x0 as u32)); + let mut x552: u32 = 0; + let mut x553: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x552, &mut x553, x551, x528, (0x0 as u32)); + let mut x554: u32 = 0; + let mut x555: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x554, &mut x555, x553, x530, (0x0 as u32)); + let mut x556: u32 = 0; + let mut x557: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x556, &mut x557, x555, x532, (0x0 as u32)); + let mut x558: u32 = 0; + let mut x559: u32 = 0; + fiat_p384_mulx_u32(&mut x558, &mut x559, x534, 0xffffffff); + let mut x560: u32 = 0; + let mut x561: u32 = 0; + fiat_p384_mulx_u32(&mut x560, &mut x561, x534, 0xffffffff); + let mut x562: u32 = 0; + let mut x563: u32 = 0; + fiat_p384_mulx_u32(&mut x562, &mut x563, x534, 0xffffffff); + let mut x564: u32 = 0; + let mut x565: u32 = 0; + fiat_p384_mulx_u32(&mut x564, &mut x565, x534, 0xffffffff); + let mut x566: u32 = 0; + let mut x567: u32 = 0; + fiat_p384_mulx_u32(&mut x566, &mut x567, x534, 0xffffffff); + let mut x568: u32 = 0; + let mut x569: u32 = 0; + fiat_p384_mulx_u32(&mut x568, &mut x569, x534, 0xffffffff); + let mut x570: u32 = 0; + let mut x571: u32 = 0; + fiat_p384_mulx_u32(&mut x570, &mut x571, x534, 0xffffffff); + let mut x572: u32 = 0; + let mut x573: u32 = 0; + fiat_p384_mulx_u32(&mut x572, &mut x573, x534, 0xfffffffe); + let mut x574: u32 = 0; + let mut x575: u32 = 0; + fiat_p384_mulx_u32(&mut x574, &mut x575, x534, 0xffffffff); + let mut x576: u32 = 0; + let mut x577: u32 = 0; + fiat_p384_mulx_u32(&mut x576, &mut x577, x534, 0xffffffff); + let mut x578: u32 = 0; + let mut x579: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x578, &mut x579, 0x0, x575, x572); + let mut x580: u32 = 0; + let mut x581: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x580, &mut x581, x579, x573, x570); + let mut x582: u32 = 0; + let mut x583: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x582, &mut x583, x581, x571, x568); + let mut x584: u32 = 0; + let mut x585: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x584, &mut x585, x583, x569, x566); + let mut x586: u32 = 0; + let mut x587: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x586, &mut x587, x585, x567, x564); + let mut x588: u32 = 0; + let mut x589: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x588, &mut x589, x587, x565, x562); + let mut x590: u32 = 0; + let mut x591: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x590, &mut x591, x589, x563, x560); + let mut x592: u32 = 0; + let mut x593: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x592, &mut x593, x591, x561, x558); + let mut x594: u32 = 0; + let mut x595: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x594, &mut x595, 0x0, x534, x576); + let mut x596: u32 = 0; + let mut x597: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x596, &mut x597, x595, x536, x577); + let mut x598: u32 = 0; + let mut x599: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x598, &mut x599, x597, x538, (0x0 as u32)); + let mut x600: u32 = 0; + let mut x601: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x600, &mut x601, x599, x540, x574); + let mut x602: u32 = 0; + let mut x603: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x602, &mut x603, x601, x542, x578); + let mut x604: u32 = 0; + let mut x605: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x604, &mut x605, x603, x544, x580); + let mut x606: u32 = 0; + let mut x607: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x606, &mut x607, x605, x546, x582); + let mut x608: u32 = 0; + let mut x609: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x608, &mut x609, x607, x548, x584); + let mut x610: u32 = 0; + let mut x611: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x610, &mut x611, x609, x550, x586); + let mut x612: u32 = 0; + let mut x613: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x612, &mut x613, x611, x552, x588); + let mut x614: u32 = 0; + let mut x615: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x614, &mut x615, x613, x554, x590); + let mut x616: u32 = 0; + let mut x617: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x616, &mut x617, x615, x556, x592); + let mut x618: u32 = 0; + let mut x619: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x618, &mut x619, x617, ((x557 as u32) + (x533 as u32)), ((x593 as u32) + x559)); + let mut x620: u32 = 0; + let mut x621: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x620, &mut x621, 0x0, x596, (arg1[8])); + let mut x622: u32 = 0; + let mut x623: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x622, &mut x623, x621, x598, (0x0 as u32)); + let mut x624: u32 = 0; + let mut x625: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x624, &mut x625, x623, x600, (0x0 as u32)); + let mut x626: u32 = 0; + let mut x627: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x626, &mut x627, x625, x602, (0x0 as u32)); + let mut x628: u32 = 0; + let mut x629: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x628, &mut x629, x627, x604, (0x0 as u32)); + let mut x630: u32 = 0; + let mut x631: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x630, &mut x631, x629, x606, (0x0 as u32)); + let mut x632: u32 = 0; + let mut x633: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x632, &mut x633, x631, x608, (0x0 as u32)); + let mut x634: u32 = 0; + let mut x635: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x634, &mut x635, x633, x610, (0x0 as u32)); + let mut x636: u32 = 0; + let mut x637: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x636, &mut x637, x635, x612, (0x0 as u32)); + let mut x638: u32 = 0; + let mut x639: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x638, &mut x639, x637, x614, (0x0 as u32)); + let mut x640: u32 = 0; + let mut x641: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x640, &mut x641, x639, x616, (0x0 as u32)); + let mut x642: u32 = 0; + let mut x643: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x642, &mut x643, x641, x618, (0x0 as u32)); + let mut x644: u32 = 0; + let mut x645: u32 = 0; + fiat_p384_mulx_u32(&mut x644, &mut x645, x620, 0xffffffff); + let mut x646: u32 = 0; + let mut x647: u32 = 0; + fiat_p384_mulx_u32(&mut x646, &mut x647, x620, 0xffffffff); + let mut x648: u32 = 0; + let mut x649: u32 = 0; + fiat_p384_mulx_u32(&mut x648, &mut x649, x620, 0xffffffff); + let mut x650: u32 = 0; + let mut x651: u32 = 0; + fiat_p384_mulx_u32(&mut x650, &mut x651, x620, 0xffffffff); + let mut x652: u32 = 0; + let mut x653: u32 = 0; + fiat_p384_mulx_u32(&mut x652, &mut x653, x620, 0xffffffff); + let mut x654: u32 = 0; + let mut x655: u32 = 0; + fiat_p384_mulx_u32(&mut x654, &mut x655, x620, 0xffffffff); + let mut x656: u32 = 0; + let mut x657: u32 = 0; + fiat_p384_mulx_u32(&mut x656, &mut x657, x620, 0xffffffff); + let mut x658: u32 = 0; + let mut x659: u32 = 0; + fiat_p384_mulx_u32(&mut x658, &mut x659, x620, 0xfffffffe); + let mut x660: u32 = 0; + let mut x661: u32 = 0; + fiat_p384_mulx_u32(&mut x660, &mut x661, x620, 0xffffffff); + let mut x662: u32 = 0; + let mut x663: u32 = 0; + fiat_p384_mulx_u32(&mut x662, &mut x663, x620, 0xffffffff); + let mut x664: u32 = 0; + let mut x665: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x664, &mut x665, 0x0, x661, x658); + let mut x666: u32 = 0; + let mut x667: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x666, &mut x667, x665, x659, x656); + let mut x668: u32 = 0; + let mut x669: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x668, &mut x669, x667, x657, x654); + let mut x670: u32 = 0; + let mut x671: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x670, &mut x671, x669, x655, x652); + let mut x672: u32 = 0; + let mut x673: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x672, &mut x673, x671, x653, x650); + let mut x674: u32 = 0; + let mut x675: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x674, &mut x675, x673, x651, x648); + let mut x676: u32 = 0; + let mut x677: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x676, &mut x677, x675, x649, x646); + let mut x678: u32 = 0; + let mut x679: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x678, &mut x679, x677, x647, x644); + let mut x680: u32 = 0; + let mut x681: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x680, &mut x681, 0x0, x620, x662); + let mut x682: u32 = 0; + let mut x683: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x682, &mut x683, x681, x622, x663); + let mut x684: u32 = 0; + let mut x685: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x684, &mut x685, x683, x624, (0x0 as u32)); + let mut x686: u32 = 0; + let mut x687: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x686, &mut x687, x685, x626, x660); + let mut x688: u32 = 0; + let mut x689: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x688, &mut x689, x687, x628, x664); + let mut x690: u32 = 0; + let mut x691: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x690, &mut x691, x689, x630, x666); + let mut x692: u32 = 0; + let mut x693: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x692, &mut x693, x691, x632, x668); + let mut x694: u32 = 0; + let mut x695: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x694, &mut x695, x693, x634, x670); + let mut x696: u32 = 0; + let mut x697: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x696, &mut x697, x695, x636, x672); + let mut x698: u32 = 0; + let mut x699: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x698, &mut x699, x697, x638, x674); + let mut x700: u32 = 0; + let mut x701: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x700, &mut x701, x699, x640, x676); + let mut x702: u32 = 0; + let mut x703: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x702, &mut x703, x701, x642, x678); + let mut x704: u32 = 0; + let mut x705: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x704, &mut x705, x703, ((x643 as u32) + (x619 as u32)), ((x679 as u32) + x645)); + let mut x706: u32 = 0; + let mut x707: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x706, &mut x707, 0x0, x682, (arg1[9])); + let mut x708: u32 = 0; + let mut x709: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x708, &mut x709, x707, x684, (0x0 as u32)); + let mut x710: u32 = 0; + let mut x711: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x710, &mut x711, x709, x686, (0x0 as u32)); + let mut x712: u32 = 0; + let mut x713: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x712, &mut x713, x711, x688, (0x0 as u32)); + let mut x714: u32 = 0; + let mut x715: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x714, &mut x715, x713, x690, (0x0 as u32)); + let mut x716: u32 = 0; + let mut x717: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x716, &mut x717, x715, x692, (0x0 as u32)); + let mut x718: u32 = 0; + let mut x719: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x718, &mut x719, x717, x694, (0x0 as u32)); + let mut x720: u32 = 0; + let mut x721: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x720, &mut x721, x719, x696, (0x0 as u32)); + let mut x722: u32 = 0; + let mut x723: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x722, &mut x723, x721, x698, (0x0 as u32)); + let mut x724: u32 = 0; + let mut x725: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x724, &mut x725, x723, x700, (0x0 as u32)); + let mut x726: u32 = 0; + let mut x727: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x726, &mut x727, x725, x702, (0x0 as u32)); + let mut x728: u32 = 0; + let mut x729: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x728, &mut x729, x727, x704, (0x0 as u32)); + let mut x730: u32 = 0; + let mut x731: u32 = 0; + fiat_p384_mulx_u32(&mut x730, &mut x731, x706, 0xffffffff); + let mut x732: u32 = 0; + let mut x733: u32 = 0; + fiat_p384_mulx_u32(&mut x732, &mut x733, x706, 0xffffffff); + let mut x734: u32 = 0; + let mut x735: u32 = 0; + fiat_p384_mulx_u32(&mut x734, &mut x735, x706, 0xffffffff); + let mut x736: u32 = 0; + let mut x737: u32 = 0; + fiat_p384_mulx_u32(&mut x736, &mut x737, x706, 0xffffffff); + let mut x738: u32 = 0; + let mut x739: u32 = 0; + fiat_p384_mulx_u32(&mut x738, &mut x739, x706, 0xffffffff); + let mut x740: u32 = 0; + let mut x741: u32 = 0; + fiat_p384_mulx_u32(&mut x740, &mut x741, x706, 0xffffffff); + let mut x742: u32 = 0; + let mut x743: u32 = 0; + fiat_p384_mulx_u32(&mut x742, &mut x743, x706, 0xffffffff); + let mut x744: u32 = 0; + let mut x745: u32 = 0; + fiat_p384_mulx_u32(&mut x744, &mut x745, x706, 0xfffffffe); + let mut x746: u32 = 0; + let mut x747: u32 = 0; + fiat_p384_mulx_u32(&mut x746, &mut x747, x706, 0xffffffff); + let mut x748: u32 = 0; + let mut x749: u32 = 0; + fiat_p384_mulx_u32(&mut x748, &mut x749, x706, 0xffffffff); + let mut x750: u32 = 0; + let mut x751: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x750, &mut x751, 0x0, x747, x744); + let mut x752: u32 = 0; + let mut x753: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x752, &mut x753, x751, x745, x742); + let mut x754: u32 = 0; + let mut x755: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x754, &mut x755, x753, x743, x740); + let mut x756: u32 = 0; + let mut x757: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x756, &mut x757, x755, x741, x738); + let mut x758: u32 = 0; + let mut x759: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x758, &mut x759, x757, x739, x736); + let mut x760: u32 = 0; + let mut x761: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x760, &mut x761, x759, x737, x734); + let mut x762: u32 = 0; + let mut x763: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x762, &mut x763, x761, x735, x732); + let mut x764: u32 = 0; + let mut x765: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x764, &mut x765, x763, x733, x730); + let mut x766: u32 = 0; + let mut x767: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x766, &mut x767, 0x0, x706, x748); + let mut x768: u32 = 0; + let mut x769: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x768, &mut x769, x767, x708, x749); + let mut x770: u32 = 0; + let mut x771: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x770, &mut x771, x769, x710, (0x0 as u32)); + let mut x772: u32 = 0; + let mut x773: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x772, &mut x773, x771, x712, x746); + let mut x774: u32 = 0; + let mut x775: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x774, &mut x775, x773, x714, x750); + let mut x776: u32 = 0; + let mut x777: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x776, &mut x777, x775, x716, x752); + let mut x778: u32 = 0; + let mut x779: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x778, &mut x779, x777, x718, x754); + let mut x780: u32 = 0; + let mut x781: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x780, &mut x781, x779, x720, x756); + let mut x782: u32 = 0; + let mut x783: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x782, &mut x783, x781, x722, x758); + let mut x784: u32 = 0; + let mut x785: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x784, &mut x785, x783, x724, x760); + let mut x786: u32 = 0; + let mut x787: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x786, &mut x787, x785, x726, x762); + let mut x788: u32 = 0; + let mut x789: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x788, &mut x789, x787, x728, x764); + let mut x790: u32 = 0; + let mut x791: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x790, &mut x791, x789, ((x729 as u32) + (x705 as u32)), ((x765 as u32) + x731)); + let mut x792: u32 = 0; + let mut x793: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x792, &mut x793, 0x0, x768, (arg1[10])); + let mut x794: u32 = 0; + let mut x795: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x794, &mut x795, x793, x770, (0x0 as u32)); + let mut x796: u32 = 0; + let mut x797: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x796, &mut x797, x795, x772, (0x0 as u32)); + let mut x798: u32 = 0; + let mut x799: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x798, &mut x799, x797, x774, (0x0 as u32)); + let mut x800: u32 = 0; + let mut x801: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x800, &mut x801, x799, x776, (0x0 as u32)); + let mut x802: u32 = 0; + let mut x803: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x802, &mut x803, x801, x778, (0x0 as u32)); + let mut x804: u32 = 0; + let mut x805: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x804, &mut x805, x803, x780, (0x0 as u32)); + let mut x806: u32 = 0; + let mut x807: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x806, &mut x807, x805, x782, (0x0 as u32)); + let mut x808: u32 = 0; + let mut x809: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x808, &mut x809, x807, x784, (0x0 as u32)); + let mut x810: u32 = 0; + let mut x811: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x810, &mut x811, x809, x786, (0x0 as u32)); + let mut x812: u32 = 0; + let mut x813: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x812, &mut x813, x811, x788, (0x0 as u32)); + let mut x814: u32 = 0; + let mut x815: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x814, &mut x815, x813, x790, (0x0 as u32)); + let mut x816: u32 = 0; + let mut x817: u32 = 0; + fiat_p384_mulx_u32(&mut x816, &mut x817, x792, 0xffffffff); + let mut x818: u32 = 0; + let mut x819: u32 = 0; + fiat_p384_mulx_u32(&mut x818, &mut x819, x792, 0xffffffff); + let mut x820: u32 = 0; + let mut x821: u32 = 0; + fiat_p384_mulx_u32(&mut x820, &mut x821, x792, 0xffffffff); + let mut x822: u32 = 0; + let mut x823: u32 = 0; + fiat_p384_mulx_u32(&mut x822, &mut x823, x792, 0xffffffff); + let mut x824: u32 = 0; + let mut x825: u32 = 0; + fiat_p384_mulx_u32(&mut x824, &mut x825, x792, 0xffffffff); + let mut x826: u32 = 0; + let mut x827: u32 = 0; + fiat_p384_mulx_u32(&mut x826, &mut x827, x792, 0xffffffff); + let mut x828: u32 = 0; + let mut x829: u32 = 0; + fiat_p384_mulx_u32(&mut x828, &mut x829, x792, 0xffffffff); + let mut x830: u32 = 0; + let mut x831: u32 = 0; + fiat_p384_mulx_u32(&mut x830, &mut x831, x792, 0xfffffffe); + let mut x832: u32 = 0; + let mut x833: u32 = 0; + fiat_p384_mulx_u32(&mut x832, &mut x833, x792, 0xffffffff); + let mut x834: u32 = 0; + let mut x835: u32 = 0; + fiat_p384_mulx_u32(&mut x834, &mut x835, x792, 0xffffffff); + let mut x836: u32 = 0; + let mut x837: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x836, &mut x837, 0x0, x833, x830); + let mut x838: u32 = 0; + let mut x839: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x838, &mut x839, x837, x831, x828); + let mut x840: u32 = 0; + let mut x841: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x840, &mut x841, x839, x829, x826); + let mut x842: u32 = 0; + let mut x843: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x842, &mut x843, x841, x827, x824); + let mut x844: u32 = 0; + let mut x845: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x844, &mut x845, x843, x825, x822); + let mut x846: u32 = 0; + let mut x847: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x846, &mut x847, x845, x823, x820); + let mut x848: u32 = 0; + let mut x849: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x848, &mut x849, x847, x821, x818); + let mut x850: u32 = 0; + let mut x851: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x850, &mut x851, x849, x819, x816); + let mut x852: u32 = 0; + let mut x853: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x852, &mut x853, 0x0, x792, x834); + let mut x854: u32 = 0; + let mut x855: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x854, &mut x855, x853, x794, x835); + let mut x856: u32 = 0; + let mut x857: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x856, &mut x857, x855, x796, (0x0 as u32)); + let mut x858: u32 = 0; + let mut x859: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x858, &mut x859, x857, x798, x832); + let mut x860: u32 = 0; + let mut x861: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x860, &mut x861, x859, x800, x836); + let mut x862: u32 = 0; + let mut x863: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x862, &mut x863, x861, x802, x838); + let mut x864: u32 = 0; + let mut x865: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x864, &mut x865, x863, x804, x840); + let mut x866: u32 = 0; + let mut x867: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x866, &mut x867, x865, x806, x842); + let mut x868: u32 = 0; + let mut x869: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x868, &mut x869, x867, x808, x844); + let mut x870: u32 = 0; + let mut x871: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x870, &mut x871, x869, x810, x846); + let mut x872: u32 = 0; + let mut x873: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x872, &mut x873, x871, x812, x848); + let mut x874: u32 = 0; + let mut x875: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x874, &mut x875, x873, x814, x850); + let mut x876: u32 = 0; + let mut x877: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x876, &mut x877, x875, ((x815 as u32) + (x791 as u32)), ((x851 as u32) + x817)); + let mut x878: u32 = 0; + let mut x879: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x878, &mut x879, 0x0, x854, (arg1[11])); + let mut x880: u32 = 0; + let mut x881: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x880, &mut x881, x879, x856, (0x0 as u32)); + let mut x882: u32 = 0; + let mut x883: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x882, &mut x883, x881, x858, (0x0 as u32)); + let mut x884: u32 = 0; + let mut x885: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x884, &mut x885, x883, x860, (0x0 as u32)); + let mut x886: u32 = 0; + let mut x887: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x886, &mut x887, x885, x862, (0x0 as u32)); + let mut x888: u32 = 0; + let mut x889: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x888, &mut x889, x887, x864, (0x0 as u32)); + let mut x890: u32 = 0; + let mut x891: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x890, &mut x891, x889, x866, (0x0 as u32)); + let mut x892: u32 = 0; + let mut x893: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x892, &mut x893, x891, x868, (0x0 as u32)); + let mut x894: u32 = 0; + let mut x895: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x894, &mut x895, x893, x870, (0x0 as u32)); + let mut x896: u32 = 0; + let mut x897: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x896, &mut x897, x895, x872, (0x0 as u32)); + let mut x898: u32 = 0; + let mut x899: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x898, &mut x899, x897, x874, (0x0 as u32)); + let mut x900: u32 = 0; + let mut x901: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x900, &mut x901, x899, x876, (0x0 as u32)); + let mut x902: u32 = 0; + let mut x903: u32 = 0; + fiat_p384_mulx_u32(&mut x902, &mut x903, x878, 0xffffffff); + let mut x904: u32 = 0; + let mut x905: u32 = 0; + fiat_p384_mulx_u32(&mut x904, &mut x905, x878, 0xffffffff); + let mut x906: u32 = 0; + let mut x907: u32 = 0; + fiat_p384_mulx_u32(&mut x906, &mut x907, x878, 0xffffffff); + let mut x908: u32 = 0; + let mut x909: u32 = 0; + fiat_p384_mulx_u32(&mut x908, &mut x909, x878, 0xffffffff); + let mut x910: u32 = 0; + let mut x911: u32 = 0; + fiat_p384_mulx_u32(&mut x910, &mut x911, x878, 0xffffffff); + let mut x912: u32 = 0; + let mut x913: u32 = 0; + fiat_p384_mulx_u32(&mut x912, &mut x913, x878, 0xffffffff); + let mut x914: u32 = 0; + let mut x915: u32 = 0; + fiat_p384_mulx_u32(&mut x914, &mut x915, x878, 0xffffffff); + let mut x916: u32 = 0; + let mut x917: u32 = 0; + fiat_p384_mulx_u32(&mut x916, &mut x917, x878, 0xfffffffe); + let mut x918: u32 = 0; + let mut x919: u32 = 0; + fiat_p384_mulx_u32(&mut x918, &mut x919, x878, 0xffffffff); + let mut x920: u32 = 0; + let mut x921: u32 = 0; + fiat_p384_mulx_u32(&mut x920, &mut x921, x878, 0xffffffff); + let mut x922: u32 = 0; + let mut x923: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x922, &mut x923, 0x0, x919, x916); + let mut x924: u32 = 0; + let mut x925: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x924, &mut x925, x923, x917, x914); + let mut x926: u32 = 0; + let mut x927: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x926, &mut x927, x925, x915, x912); + let mut x928: u32 = 0; + let mut x929: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x928, &mut x929, x927, x913, x910); + let mut x930: u32 = 0; + let mut x931: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x930, &mut x931, x929, x911, x908); + let mut x932: u32 = 0; + let mut x933: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x932, &mut x933, x931, x909, x906); + let mut x934: u32 = 0; + let mut x935: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x934, &mut x935, x933, x907, x904); + let mut x936: u32 = 0; + let mut x937: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x936, &mut x937, x935, x905, x902); + let mut x938: u32 = 0; + let mut x939: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x938, &mut x939, 0x0, x878, x920); + let mut x940: u32 = 0; + let mut x941: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x940, &mut x941, x939, x880, x921); + let mut x942: u32 = 0; + let mut x943: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x942, &mut x943, x941, x882, (0x0 as u32)); + let mut x944: u32 = 0; + let mut x945: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x944, &mut x945, x943, x884, x918); + let mut x946: u32 = 0; + let mut x947: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x946, &mut x947, x945, x886, x922); + let mut x948: u32 = 0; + let mut x949: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x948, &mut x949, x947, x888, x924); + let mut x950: u32 = 0; + let mut x951: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x950, &mut x951, x949, x890, x926); + let mut x952: u32 = 0; + let mut x953: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x952, &mut x953, x951, x892, x928); + let mut x954: u32 = 0; + let mut x955: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x954, &mut x955, x953, x894, x930); + let mut x956: u32 = 0; + let mut x957: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x956, &mut x957, x955, x896, x932); + let mut x958: u32 = 0; + let mut x959: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x958, &mut x959, x957, x898, x934); + let mut x960: u32 = 0; + let mut x961: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x960, &mut x961, x959, x900, x936); + let mut x962: u32 = 0; + let mut x963: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x962, &mut x963, x961, ((x901 as u32) + (x877 as u32)), ((x937 as u32) + x903)); + let mut x964: u32 = 0; + let mut x965: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x964, &mut x965, 0x0, x940, 0xffffffff); + let mut x966: u32 = 0; + let mut x967: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x966, &mut x967, x965, x942, (0x0 as u32)); + let mut x968: u32 = 0; + let mut x969: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x968, &mut x969, x967, x944, (0x0 as u32)); + let mut x970: u32 = 0; + let mut x971: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x970, &mut x971, x969, x946, 0xffffffff); + let mut x972: u32 = 0; + let mut x973: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x972, &mut x973, x971, x948, 0xfffffffe); + let mut x974: u32 = 0; + let mut x975: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x974, &mut x975, x973, x950, 0xffffffff); + let mut x976: u32 = 0; + let mut x977: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x976, &mut x977, x975, x952, 0xffffffff); + let mut x978: u32 = 0; + let mut x979: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x978, &mut x979, x977, x954, 0xffffffff); + let mut x980: u32 = 0; + let mut x981: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x980, &mut x981, x979, x956, 0xffffffff); + let mut x982: u32 = 0; + let mut x983: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x982, &mut x983, x981, x958, 0xffffffff); + let mut x984: u32 = 0; + let mut x985: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x984, &mut x985, x983, x960, 0xffffffff); + let mut x986: u32 = 0; + let mut x987: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x986, &mut x987, x985, x962, 0xffffffff); + let mut x988: u32 = 0; + let mut x989: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x988, &mut x989, x987, (x963 as u32), (0x0 as u32)); + let mut x990: u32 = 0; + fiat_p384_cmovznz_u32(&mut x990, x989, x964, x940); + let mut x991: u32 = 0; + fiat_p384_cmovznz_u32(&mut x991, x989, x966, x942); + let mut x992: u32 = 0; + fiat_p384_cmovznz_u32(&mut x992, x989, x968, x944); + let mut x993: u32 = 0; + fiat_p384_cmovznz_u32(&mut x993, x989, x970, x946); + let mut x994: u32 = 0; + fiat_p384_cmovznz_u32(&mut x994, x989, x972, x948); + let mut x995: u32 = 0; + fiat_p384_cmovznz_u32(&mut x995, x989, x974, x950); + let mut x996: u32 = 0; + fiat_p384_cmovznz_u32(&mut x996, x989, x976, x952); + let mut x997: u32 = 0; + fiat_p384_cmovznz_u32(&mut x997, x989, x978, x954); + let mut x998: u32 = 0; + fiat_p384_cmovznz_u32(&mut x998, x989, x980, x956); + let mut x999: u32 = 0; + fiat_p384_cmovznz_u32(&mut x999, x989, x982, x958); + let mut x1000: u32 = 0; + fiat_p384_cmovznz_u32(&mut x1000, x989, x984, x960); + let mut x1001: u32 = 0; + fiat_p384_cmovznz_u32(&mut x1001, x989, x986, x962); + out1[0] = x990; + out1[1] = x991; + out1[2] = x992; + out1[3] = x993; + out1[4] = x994; + out1[5] = x995; + out1[6] = x996; + out1[7] = x997; + out1[8] = x998; + out1[9] = x999; + out1[10] = x1000; + out1[11] = x1001; +} + +/// The function fiat_p384_to_montgomery translates a field element into the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = eval arg1 mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p384_to_montgomery(out1: &mut fiat_p384_montgomery_domain_field_element, arg1: &fiat_p384_non_montgomery_domain_field_element) -> () { + let x1: u32 = (arg1[1]); + let x2: u32 = (arg1[2]); + let x3: u32 = (arg1[3]); + let x4: u32 = (arg1[4]); + let x5: u32 = (arg1[5]); + let x6: u32 = (arg1[6]); + let x7: u32 = (arg1[7]); + let x8: u32 = (arg1[8]); + let x9: u32 = (arg1[9]); + let x10: u32 = (arg1[10]); + let x11: u32 = (arg1[11]); + let x12: u32 = (arg1[0]); + let mut x13: u32 = 0; + let mut x14: u32 = 0; + fiat_p384_mulx_u32(&mut x13, &mut x14, x12, 0x2); + let mut x15: u32 = 0; + let mut x16: u32 = 0; + fiat_p384_mulx_u32(&mut x15, &mut x16, x12, 0xfffffffe); + let mut x17: u32 = 0; + let mut x18: u32 = 0; + fiat_p384_mulx_u32(&mut x17, &mut x18, x12, 0x2); + let mut x19: u32 = 0; + let mut x20: u32 = 0; + fiat_p384_mulx_u32(&mut x19, &mut x20, x12, 0xfffffffe); + let mut x21: u32 = 0; + let mut x22: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x21, &mut x22, 0x0, ((x14 as fiat_p384_u1) as u32), x12); + let mut x23: u32 = 0; + let mut x24: u32 = 0; + fiat_p384_mulx_u32(&mut x23, &mut x24, x12, 0xffffffff); + let mut x25: u32 = 0; + let mut x26: u32 = 0; + fiat_p384_mulx_u32(&mut x25, &mut x26, x12, 0xffffffff); + let mut x27: u32 = 0; + let mut x28: u32 = 0; + fiat_p384_mulx_u32(&mut x27, &mut x28, x12, 0xffffffff); + let mut x29: u32 = 0; + let mut x30: u32 = 0; + fiat_p384_mulx_u32(&mut x29, &mut x30, x12, 0xffffffff); + let mut x31: u32 = 0; + let mut x32: u32 = 0; + fiat_p384_mulx_u32(&mut x31, &mut x32, x12, 0xffffffff); + let mut x33: u32 = 0; + let mut x34: u32 = 0; + fiat_p384_mulx_u32(&mut x33, &mut x34, x12, 0xffffffff); + let mut x35: u32 = 0; + let mut x36: u32 = 0; + fiat_p384_mulx_u32(&mut x35, &mut x36, x12, 0xffffffff); + let mut x37: u32 = 0; + let mut x38: u32 = 0; + fiat_p384_mulx_u32(&mut x37, &mut x38, x12, 0xfffffffe); + let mut x39: u32 = 0; + let mut x40: u32 = 0; + fiat_p384_mulx_u32(&mut x39, &mut x40, x12, 0xffffffff); + let mut x41: u32 = 0; + let mut x42: u32 = 0; + fiat_p384_mulx_u32(&mut x41, &mut x42, x12, 0xffffffff); + let mut x43: u32 = 0; + let mut x44: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x43, &mut x44, 0x0, x40, x37); + let mut x45: u32 = 0; + let mut x46: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x45, &mut x46, x44, x38, x35); + let mut x47: u32 = 0; + let mut x48: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x47, &mut x48, x46, x36, x33); + let mut x49: u32 = 0; + let mut x50: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x49, &mut x50, x48, x34, x31); + let mut x51: u32 = 0; + let mut x52: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x51, &mut x52, x50, x32, x29); + let mut x53: u32 = 0; + let mut x54: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x53, &mut x54, x52, x30, x27); + let mut x55: u32 = 0; + let mut x56: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x55, &mut x56, x54, x28, x25); + let mut x57: u32 = 0; + let mut x58: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x57, &mut x58, x56, x26, x23); + let mut x59: u32 = 0; + let mut x60: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x59, &mut x60, 0x0, x12, x41); + let mut x61: u32 = 0; + let mut x62: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x61, &mut x62, x60, x19, x42); + let mut x63: u32 = 0; + let mut x64: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x63, &mut x64, 0x0, x17, x39); + let mut x65: u32 = 0; + let mut x66: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x65, &mut x66, x64, ((x18 as fiat_p384_u1) as u32), x43); + let mut x67: u32 = 0; + let mut x68: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x67, &mut x68, x66, x15, x45); + let mut x69: u32 = 0; + let mut x70: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x69, &mut x70, x68, x16, x47); + let mut x71: u32 = 0; + let mut x72: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x71, &mut x72, x70, x13, x49); + let mut x73: u32 = 0; + let mut x74: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x73, &mut x74, x72, x21, x51); + let mut x75: u32 = 0; + let mut x76: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x75, &mut x76, x74, (x22 as u32), x53); + let mut x77: u32 = 0; + let mut x78: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x77, &mut x78, x76, (0x0 as u32), x55); + let mut x79: u32 = 0; + let mut x80: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x79, &mut x80, x78, (0x0 as u32), x57); + let mut x81: u32 = 0; + let mut x82: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x81, &mut x82, x80, (0x0 as u32), ((x58 as u32) + x24)); + let mut x83: u32 = 0; + let mut x84: u32 = 0; + fiat_p384_mulx_u32(&mut x83, &mut x84, x1, 0x2); + let mut x85: u32 = 0; + let mut x86: u32 = 0; + fiat_p384_mulx_u32(&mut x85, &mut x86, x1, 0xfffffffe); + let mut x87: u32 = 0; + let mut x88: u32 = 0; + fiat_p384_mulx_u32(&mut x87, &mut x88, x1, 0x2); + let mut x89: u32 = 0; + let mut x90: u32 = 0; + fiat_p384_mulx_u32(&mut x89, &mut x90, x1, 0xfffffffe); + let mut x91: u32 = 0; + let mut x92: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x91, &mut x92, 0x0, ((x84 as fiat_p384_u1) as u32), x1); + let mut x93: u32 = 0; + let mut x94: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x93, &mut x94, 0x0, x61, x1); + let mut x95: u32 = 0; + let mut x96: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x95, &mut x96, x94, ((x62 as u32) + x20), x89); + let mut x97: u32 = 0; + let mut x98: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x97, &mut x98, x96, x63, x90); + let mut x99: u32 = 0; + let mut x100: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x99, &mut x100, x98, x65, x87); + let mut x101: u32 = 0; + let mut x102: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x101, &mut x102, x100, x67, ((x88 as fiat_p384_u1) as u32)); + let mut x103: u32 = 0; + let mut x104: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x103, &mut x104, x102, x69, x85); + let mut x105: u32 = 0; + let mut x106: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x105, &mut x106, x104, x71, x86); + let mut x107: u32 = 0; + let mut x108: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x107, &mut x108, x106, x73, x83); + let mut x109: u32 = 0; + let mut x110: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x109, &mut x110, x108, x75, x91); + let mut x111: u32 = 0; + let mut x112: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x111, &mut x112, x110, x77, (x92 as u32)); + let mut x113: u32 = 0; + let mut x114: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x113, &mut x114, x112, x79, (0x0 as u32)); + let mut x115: u32 = 0; + let mut x116: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x115, &mut x116, x114, x81, (0x0 as u32)); + let mut x117: u32 = 0; + let mut x118: u32 = 0; + fiat_p384_mulx_u32(&mut x117, &mut x118, x93, 0xffffffff); + let mut x119: u32 = 0; + let mut x120: u32 = 0; + fiat_p384_mulx_u32(&mut x119, &mut x120, x93, 0xffffffff); + let mut x121: u32 = 0; + let mut x122: u32 = 0; + fiat_p384_mulx_u32(&mut x121, &mut x122, x93, 0xffffffff); + let mut x123: u32 = 0; + let mut x124: u32 = 0; + fiat_p384_mulx_u32(&mut x123, &mut x124, x93, 0xffffffff); + let mut x125: u32 = 0; + let mut x126: u32 = 0; + fiat_p384_mulx_u32(&mut x125, &mut x126, x93, 0xffffffff); + let mut x127: u32 = 0; + let mut x128: u32 = 0; + fiat_p384_mulx_u32(&mut x127, &mut x128, x93, 0xffffffff); + let mut x129: u32 = 0; + let mut x130: u32 = 0; + fiat_p384_mulx_u32(&mut x129, &mut x130, x93, 0xffffffff); + let mut x131: u32 = 0; + let mut x132: u32 = 0; + fiat_p384_mulx_u32(&mut x131, &mut x132, x93, 0xfffffffe); + let mut x133: u32 = 0; + let mut x134: u32 = 0; + fiat_p384_mulx_u32(&mut x133, &mut x134, x93, 0xffffffff); + let mut x135: u32 = 0; + let mut x136: u32 = 0; + fiat_p384_mulx_u32(&mut x135, &mut x136, x93, 0xffffffff); + let mut x137: u32 = 0; + let mut x138: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x137, &mut x138, 0x0, x134, x131); + let mut x139: u32 = 0; + let mut x140: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x139, &mut x140, x138, x132, x129); + let mut x141: u32 = 0; + let mut x142: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x141, &mut x142, x140, x130, x127); + let mut x143: u32 = 0; + let mut x144: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x143, &mut x144, x142, x128, x125); + let mut x145: u32 = 0; + let mut x146: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x145, &mut x146, x144, x126, x123); + let mut x147: u32 = 0; + let mut x148: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x147, &mut x148, x146, x124, x121); + let mut x149: u32 = 0; + let mut x150: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x149, &mut x150, x148, x122, x119); + let mut x151: u32 = 0; + let mut x152: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x151, &mut x152, x150, x120, x117); + let mut x153: u32 = 0; + let mut x154: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x153, &mut x154, 0x0, x93, x135); + let mut x155: u32 = 0; + let mut x156: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x155, &mut x156, x154, x95, x136); + let mut x157: u32 = 0; + let mut x158: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x157, &mut x158, x156, x97, (0x0 as u32)); + let mut x159: u32 = 0; + let mut x160: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x159, &mut x160, x158, x99, x133); + let mut x161: u32 = 0; + let mut x162: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x161, &mut x162, x160, x101, x137); + let mut x163: u32 = 0; + let mut x164: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x163, &mut x164, x162, x103, x139); + let mut x165: u32 = 0; + let mut x166: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x165, &mut x166, x164, x105, x141); + let mut x167: u32 = 0; + let mut x168: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x167, &mut x168, x166, x107, x143); + let mut x169: u32 = 0; + let mut x170: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x169, &mut x170, x168, x109, x145); + let mut x171: u32 = 0; + let mut x172: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x171, &mut x172, x170, x111, x147); + let mut x173: u32 = 0; + let mut x174: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x173, &mut x174, x172, x113, x149); + let mut x175: u32 = 0; + let mut x176: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x175, &mut x176, x174, x115, x151); + let mut x177: u32 = 0; + let mut x178: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x177, &mut x178, x176, ((x116 as u32) + (x82 as u32)), ((x152 as u32) + x118)); + let mut x179: u32 = 0; + let mut x180: u32 = 0; + fiat_p384_mulx_u32(&mut x179, &mut x180, x2, 0x2); + let mut x181: u32 = 0; + let mut x182: u32 = 0; + fiat_p384_mulx_u32(&mut x181, &mut x182, x2, 0xfffffffe); + let mut x183: u32 = 0; + let mut x184: u32 = 0; + fiat_p384_mulx_u32(&mut x183, &mut x184, x2, 0x2); + let mut x185: u32 = 0; + let mut x186: u32 = 0; + fiat_p384_mulx_u32(&mut x185, &mut x186, x2, 0xfffffffe); + let mut x187: u32 = 0; + let mut x188: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x187, &mut x188, 0x0, ((x180 as fiat_p384_u1) as u32), x2); + let mut x189: u32 = 0; + let mut x190: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x189, &mut x190, 0x0, x155, x2); + let mut x191: u32 = 0; + let mut x192: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x191, &mut x192, x190, x157, x185); + let mut x193: u32 = 0; + let mut x194: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x193, &mut x194, x192, x159, x186); + let mut x195: u32 = 0; + let mut x196: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x195, &mut x196, x194, x161, x183); + let mut x197: u32 = 0; + let mut x198: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x197, &mut x198, x196, x163, ((x184 as fiat_p384_u1) as u32)); + let mut x199: u32 = 0; + let mut x200: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x199, &mut x200, x198, x165, x181); + let mut x201: u32 = 0; + let mut x202: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x201, &mut x202, x200, x167, x182); + let mut x203: u32 = 0; + let mut x204: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x203, &mut x204, x202, x169, x179); + let mut x205: u32 = 0; + let mut x206: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x205, &mut x206, x204, x171, x187); + let mut x207: u32 = 0; + let mut x208: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x207, &mut x208, x206, x173, (x188 as u32)); + let mut x209: u32 = 0; + let mut x210: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x209, &mut x210, x208, x175, (0x0 as u32)); + let mut x211: u32 = 0; + let mut x212: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x211, &mut x212, x210, x177, (0x0 as u32)); + let mut x213: u32 = 0; + let mut x214: u32 = 0; + fiat_p384_mulx_u32(&mut x213, &mut x214, x189, 0xffffffff); + let mut x215: u32 = 0; + let mut x216: u32 = 0; + fiat_p384_mulx_u32(&mut x215, &mut x216, x189, 0xffffffff); + let mut x217: u32 = 0; + let mut x218: u32 = 0; + fiat_p384_mulx_u32(&mut x217, &mut x218, x189, 0xffffffff); + let mut x219: u32 = 0; + let mut x220: u32 = 0; + fiat_p384_mulx_u32(&mut x219, &mut x220, x189, 0xffffffff); + let mut x221: u32 = 0; + let mut x222: u32 = 0; + fiat_p384_mulx_u32(&mut x221, &mut x222, x189, 0xffffffff); + let mut x223: u32 = 0; + let mut x224: u32 = 0; + fiat_p384_mulx_u32(&mut x223, &mut x224, x189, 0xffffffff); + let mut x225: u32 = 0; + let mut x226: u32 = 0; + fiat_p384_mulx_u32(&mut x225, &mut x226, x189, 0xffffffff); + let mut x227: u32 = 0; + let mut x228: u32 = 0; + fiat_p384_mulx_u32(&mut x227, &mut x228, x189, 0xfffffffe); + let mut x229: u32 = 0; + let mut x230: u32 = 0; + fiat_p384_mulx_u32(&mut x229, &mut x230, x189, 0xffffffff); + let mut x231: u32 = 0; + let mut x232: u32 = 0; + fiat_p384_mulx_u32(&mut x231, &mut x232, x189, 0xffffffff); + let mut x233: u32 = 0; + let mut x234: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x233, &mut x234, 0x0, x230, x227); + let mut x235: u32 = 0; + let mut x236: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x235, &mut x236, x234, x228, x225); + let mut x237: u32 = 0; + let mut x238: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x237, &mut x238, x236, x226, x223); + let mut x239: u32 = 0; + let mut x240: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x239, &mut x240, x238, x224, x221); + let mut x241: u32 = 0; + let mut x242: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x241, &mut x242, x240, x222, x219); + let mut x243: u32 = 0; + let mut x244: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x243, &mut x244, x242, x220, x217); + let mut x245: u32 = 0; + let mut x246: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x245, &mut x246, x244, x218, x215); + let mut x247: u32 = 0; + let mut x248: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x247, &mut x248, x246, x216, x213); + let mut x249: u32 = 0; + let mut x250: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x249, &mut x250, 0x0, x189, x231); + let mut x251: u32 = 0; + let mut x252: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x251, &mut x252, x250, x191, x232); + let mut x253: u32 = 0; + let mut x254: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x253, &mut x254, x252, x193, (0x0 as u32)); + let mut x255: u32 = 0; + let mut x256: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x255, &mut x256, x254, x195, x229); + let mut x257: u32 = 0; + let mut x258: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x257, &mut x258, x256, x197, x233); + let mut x259: u32 = 0; + let mut x260: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x259, &mut x260, x258, x199, x235); + let mut x261: u32 = 0; + let mut x262: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x261, &mut x262, x260, x201, x237); + let mut x263: u32 = 0; + let mut x264: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x263, &mut x264, x262, x203, x239); + let mut x265: u32 = 0; + let mut x266: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x265, &mut x266, x264, x205, x241); + let mut x267: u32 = 0; + let mut x268: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x267, &mut x268, x266, x207, x243); + let mut x269: u32 = 0; + let mut x270: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x269, &mut x270, x268, x209, x245); + let mut x271: u32 = 0; + let mut x272: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x271, &mut x272, x270, x211, x247); + let mut x273: u32 = 0; + let mut x274: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x273, &mut x274, x272, ((x212 as u32) + (x178 as u32)), ((x248 as u32) + x214)); + let mut x275: u32 = 0; + let mut x276: u32 = 0; + fiat_p384_mulx_u32(&mut x275, &mut x276, x3, 0x2); + let mut x277: u32 = 0; + let mut x278: u32 = 0; + fiat_p384_mulx_u32(&mut x277, &mut x278, x3, 0xfffffffe); + let mut x279: u32 = 0; + let mut x280: u32 = 0; + fiat_p384_mulx_u32(&mut x279, &mut x280, x3, 0x2); + let mut x281: u32 = 0; + let mut x282: u32 = 0; + fiat_p384_mulx_u32(&mut x281, &mut x282, x3, 0xfffffffe); + let mut x283: u32 = 0; + let mut x284: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x283, &mut x284, 0x0, ((x276 as fiat_p384_u1) as u32), x3); + let mut x285: u32 = 0; + let mut x286: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x285, &mut x286, 0x0, x251, x3); + let mut x287: u32 = 0; + let mut x288: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x287, &mut x288, x286, x253, x281); + let mut x289: u32 = 0; + let mut x290: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x289, &mut x290, x288, x255, x282); + let mut x291: u32 = 0; + let mut x292: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x291, &mut x292, x290, x257, x279); + let mut x293: u32 = 0; + let mut x294: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x293, &mut x294, x292, x259, ((x280 as fiat_p384_u1) as u32)); + let mut x295: u32 = 0; + let mut x296: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x295, &mut x296, x294, x261, x277); + let mut x297: u32 = 0; + let mut x298: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x297, &mut x298, x296, x263, x278); + let mut x299: u32 = 0; + let mut x300: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x299, &mut x300, x298, x265, x275); + let mut x301: u32 = 0; + let mut x302: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x301, &mut x302, x300, x267, x283); + let mut x303: u32 = 0; + let mut x304: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x303, &mut x304, x302, x269, (x284 as u32)); + let mut x305: u32 = 0; + let mut x306: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x305, &mut x306, x304, x271, (0x0 as u32)); + let mut x307: u32 = 0; + let mut x308: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x307, &mut x308, x306, x273, (0x0 as u32)); + let mut x309: u32 = 0; + let mut x310: u32 = 0; + fiat_p384_mulx_u32(&mut x309, &mut x310, x285, 0xffffffff); + let mut x311: u32 = 0; + let mut x312: u32 = 0; + fiat_p384_mulx_u32(&mut x311, &mut x312, x285, 0xffffffff); + let mut x313: u32 = 0; + let mut x314: u32 = 0; + fiat_p384_mulx_u32(&mut x313, &mut x314, x285, 0xffffffff); + let mut x315: u32 = 0; + let mut x316: u32 = 0; + fiat_p384_mulx_u32(&mut x315, &mut x316, x285, 0xffffffff); + let mut x317: u32 = 0; + let mut x318: u32 = 0; + fiat_p384_mulx_u32(&mut x317, &mut x318, x285, 0xffffffff); + let mut x319: u32 = 0; + let mut x320: u32 = 0; + fiat_p384_mulx_u32(&mut x319, &mut x320, x285, 0xffffffff); + let mut x321: u32 = 0; + let mut x322: u32 = 0; + fiat_p384_mulx_u32(&mut x321, &mut x322, x285, 0xffffffff); + let mut x323: u32 = 0; + let mut x324: u32 = 0; + fiat_p384_mulx_u32(&mut x323, &mut x324, x285, 0xfffffffe); + let mut x325: u32 = 0; + let mut x326: u32 = 0; + fiat_p384_mulx_u32(&mut x325, &mut x326, x285, 0xffffffff); + let mut x327: u32 = 0; + let mut x328: u32 = 0; + fiat_p384_mulx_u32(&mut x327, &mut x328, x285, 0xffffffff); + let mut x329: u32 = 0; + let mut x330: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x329, &mut x330, 0x0, x326, x323); + let mut x331: u32 = 0; + let mut x332: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x331, &mut x332, x330, x324, x321); + let mut x333: u32 = 0; + let mut x334: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x333, &mut x334, x332, x322, x319); + let mut x335: u32 = 0; + let mut x336: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x335, &mut x336, x334, x320, x317); + let mut x337: u32 = 0; + let mut x338: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x337, &mut x338, x336, x318, x315); + let mut x339: u32 = 0; + let mut x340: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x339, &mut x340, x338, x316, x313); + let mut x341: u32 = 0; + let mut x342: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x341, &mut x342, x340, x314, x311); + let mut x343: u32 = 0; + let mut x344: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x343, &mut x344, x342, x312, x309); + let mut x345: u32 = 0; + let mut x346: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x345, &mut x346, 0x0, x285, x327); + let mut x347: u32 = 0; + let mut x348: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x347, &mut x348, x346, x287, x328); + let mut x349: u32 = 0; + let mut x350: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x349, &mut x350, x348, x289, (0x0 as u32)); + let mut x351: u32 = 0; + let mut x352: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x351, &mut x352, x350, x291, x325); + let mut x353: u32 = 0; + let mut x354: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x353, &mut x354, x352, x293, x329); + let mut x355: u32 = 0; + let mut x356: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x355, &mut x356, x354, x295, x331); + let mut x357: u32 = 0; + let mut x358: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x357, &mut x358, x356, x297, x333); + let mut x359: u32 = 0; + let mut x360: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x359, &mut x360, x358, x299, x335); + let mut x361: u32 = 0; + let mut x362: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x361, &mut x362, x360, x301, x337); + let mut x363: u32 = 0; + let mut x364: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x363, &mut x364, x362, x303, x339); + let mut x365: u32 = 0; + let mut x366: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x365, &mut x366, x364, x305, x341); + let mut x367: u32 = 0; + let mut x368: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x367, &mut x368, x366, x307, x343); + let mut x369: u32 = 0; + let mut x370: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x369, &mut x370, x368, ((x308 as u32) + (x274 as u32)), ((x344 as u32) + x310)); + let mut x371: u32 = 0; + let mut x372: u32 = 0; + fiat_p384_mulx_u32(&mut x371, &mut x372, x4, 0x2); + let mut x373: u32 = 0; + let mut x374: u32 = 0; + fiat_p384_mulx_u32(&mut x373, &mut x374, x4, 0xfffffffe); + let mut x375: u32 = 0; + let mut x376: u32 = 0; + fiat_p384_mulx_u32(&mut x375, &mut x376, x4, 0x2); + let mut x377: u32 = 0; + let mut x378: u32 = 0; + fiat_p384_mulx_u32(&mut x377, &mut x378, x4, 0xfffffffe); + let mut x379: u32 = 0; + let mut x380: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x379, &mut x380, 0x0, ((x372 as fiat_p384_u1) as u32), x4); + let mut x381: u32 = 0; + let mut x382: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x381, &mut x382, 0x0, x347, x4); + let mut x383: u32 = 0; + let mut x384: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x383, &mut x384, x382, x349, x377); + let mut x385: u32 = 0; + let mut x386: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x385, &mut x386, x384, x351, x378); + let mut x387: u32 = 0; + let mut x388: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x387, &mut x388, x386, x353, x375); + let mut x389: u32 = 0; + let mut x390: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x389, &mut x390, x388, x355, ((x376 as fiat_p384_u1) as u32)); + let mut x391: u32 = 0; + let mut x392: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x391, &mut x392, x390, x357, x373); + let mut x393: u32 = 0; + let mut x394: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x393, &mut x394, x392, x359, x374); + let mut x395: u32 = 0; + let mut x396: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x395, &mut x396, x394, x361, x371); + let mut x397: u32 = 0; + let mut x398: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x397, &mut x398, x396, x363, x379); + let mut x399: u32 = 0; + let mut x400: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x399, &mut x400, x398, x365, (x380 as u32)); + let mut x401: u32 = 0; + let mut x402: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x401, &mut x402, x400, x367, (0x0 as u32)); + let mut x403: u32 = 0; + let mut x404: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x403, &mut x404, x402, x369, (0x0 as u32)); + let mut x405: u32 = 0; + let mut x406: u32 = 0; + fiat_p384_mulx_u32(&mut x405, &mut x406, x381, 0xffffffff); + let mut x407: u32 = 0; + let mut x408: u32 = 0; + fiat_p384_mulx_u32(&mut x407, &mut x408, x381, 0xffffffff); + let mut x409: u32 = 0; + let mut x410: u32 = 0; + fiat_p384_mulx_u32(&mut x409, &mut x410, x381, 0xffffffff); + let mut x411: u32 = 0; + let mut x412: u32 = 0; + fiat_p384_mulx_u32(&mut x411, &mut x412, x381, 0xffffffff); + let mut x413: u32 = 0; + let mut x414: u32 = 0; + fiat_p384_mulx_u32(&mut x413, &mut x414, x381, 0xffffffff); + let mut x415: u32 = 0; + let mut x416: u32 = 0; + fiat_p384_mulx_u32(&mut x415, &mut x416, x381, 0xffffffff); + let mut x417: u32 = 0; + let mut x418: u32 = 0; + fiat_p384_mulx_u32(&mut x417, &mut x418, x381, 0xffffffff); + let mut x419: u32 = 0; + let mut x420: u32 = 0; + fiat_p384_mulx_u32(&mut x419, &mut x420, x381, 0xfffffffe); + let mut x421: u32 = 0; + let mut x422: u32 = 0; + fiat_p384_mulx_u32(&mut x421, &mut x422, x381, 0xffffffff); + let mut x423: u32 = 0; + let mut x424: u32 = 0; + fiat_p384_mulx_u32(&mut x423, &mut x424, x381, 0xffffffff); + let mut x425: u32 = 0; + let mut x426: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x425, &mut x426, 0x0, x422, x419); + let mut x427: u32 = 0; + let mut x428: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x427, &mut x428, x426, x420, x417); + let mut x429: u32 = 0; + let mut x430: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x429, &mut x430, x428, x418, x415); + let mut x431: u32 = 0; + let mut x432: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x431, &mut x432, x430, x416, x413); + let mut x433: u32 = 0; + let mut x434: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x433, &mut x434, x432, x414, x411); + let mut x435: u32 = 0; + let mut x436: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x435, &mut x436, x434, x412, x409); + let mut x437: u32 = 0; + let mut x438: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x437, &mut x438, x436, x410, x407); + let mut x439: u32 = 0; + let mut x440: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x439, &mut x440, x438, x408, x405); + let mut x441: u32 = 0; + let mut x442: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x441, &mut x442, 0x0, x381, x423); + let mut x443: u32 = 0; + let mut x444: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x443, &mut x444, x442, x383, x424); + let mut x445: u32 = 0; + let mut x446: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x445, &mut x446, x444, x385, (0x0 as u32)); + let mut x447: u32 = 0; + let mut x448: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x447, &mut x448, x446, x387, x421); + let mut x449: u32 = 0; + let mut x450: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x449, &mut x450, x448, x389, x425); + let mut x451: u32 = 0; + let mut x452: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x451, &mut x452, x450, x391, x427); + let mut x453: u32 = 0; + let mut x454: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x453, &mut x454, x452, x393, x429); + let mut x455: u32 = 0; + let mut x456: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x455, &mut x456, x454, x395, x431); + let mut x457: u32 = 0; + let mut x458: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x457, &mut x458, x456, x397, x433); + let mut x459: u32 = 0; + let mut x460: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x459, &mut x460, x458, x399, x435); + let mut x461: u32 = 0; + let mut x462: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x461, &mut x462, x460, x401, x437); + let mut x463: u32 = 0; + let mut x464: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x463, &mut x464, x462, x403, x439); + let mut x465: u32 = 0; + let mut x466: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x465, &mut x466, x464, ((x404 as u32) + (x370 as u32)), ((x440 as u32) + x406)); + let mut x467: u32 = 0; + let mut x468: u32 = 0; + fiat_p384_mulx_u32(&mut x467, &mut x468, x5, 0x2); + let mut x469: u32 = 0; + let mut x470: u32 = 0; + fiat_p384_mulx_u32(&mut x469, &mut x470, x5, 0xfffffffe); + let mut x471: u32 = 0; + let mut x472: u32 = 0; + fiat_p384_mulx_u32(&mut x471, &mut x472, x5, 0x2); + let mut x473: u32 = 0; + let mut x474: u32 = 0; + fiat_p384_mulx_u32(&mut x473, &mut x474, x5, 0xfffffffe); + let mut x475: u32 = 0; + let mut x476: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x475, &mut x476, 0x0, ((x468 as fiat_p384_u1) as u32), x5); + let mut x477: u32 = 0; + let mut x478: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x477, &mut x478, 0x0, x443, x5); + let mut x479: u32 = 0; + let mut x480: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x479, &mut x480, x478, x445, x473); + let mut x481: u32 = 0; + let mut x482: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x481, &mut x482, x480, x447, x474); + let mut x483: u32 = 0; + let mut x484: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x483, &mut x484, x482, x449, x471); + let mut x485: u32 = 0; + let mut x486: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x485, &mut x486, x484, x451, ((x472 as fiat_p384_u1) as u32)); + let mut x487: u32 = 0; + let mut x488: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x487, &mut x488, x486, x453, x469); + let mut x489: u32 = 0; + let mut x490: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x489, &mut x490, x488, x455, x470); + let mut x491: u32 = 0; + let mut x492: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x491, &mut x492, x490, x457, x467); + let mut x493: u32 = 0; + let mut x494: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x493, &mut x494, x492, x459, x475); + let mut x495: u32 = 0; + let mut x496: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x495, &mut x496, x494, x461, (x476 as u32)); + let mut x497: u32 = 0; + let mut x498: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x497, &mut x498, x496, x463, (0x0 as u32)); + let mut x499: u32 = 0; + let mut x500: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x499, &mut x500, x498, x465, (0x0 as u32)); + let mut x501: u32 = 0; + let mut x502: u32 = 0; + fiat_p384_mulx_u32(&mut x501, &mut x502, x477, 0xffffffff); + let mut x503: u32 = 0; + let mut x504: u32 = 0; + fiat_p384_mulx_u32(&mut x503, &mut x504, x477, 0xffffffff); + let mut x505: u32 = 0; + let mut x506: u32 = 0; + fiat_p384_mulx_u32(&mut x505, &mut x506, x477, 0xffffffff); + let mut x507: u32 = 0; + let mut x508: u32 = 0; + fiat_p384_mulx_u32(&mut x507, &mut x508, x477, 0xffffffff); + let mut x509: u32 = 0; + let mut x510: u32 = 0; + fiat_p384_mulx_u32(&mut x509, &mut x510, x477, 0xffffffff); + let mut x511: u32 = 0; + let mut x512: u32 = 0; + fiat_p384_mulx_u32(&mut x511, &mut x512, x477, 0xffffffff); + let mut x513: u32 = 0; + let mut x514: u32 = 0; + fiat_p384_mulx_u32(&mut x513, &mut x514, x477, 0xffffffff); + let mut x515: u32 = 0; + let mut x516: u32 = 0; + fiat_p384_mulx_u32(&mut x515, &mut x516, x477, 0xfffffffe); + let mut x517: u32 = 0; + let mut x518: u32 = 0; + fiat_p384_mulx_u32(&mut x517, &mut x518, x477, 0xffffffff); + let mut x519: u32 = 0; + let mut x520: u32 = 0; + fiat_p384_mulx_u32(&mut x519, &mut x520, x477, 0xffffffff); + let mut x521: u32 = 0; + let mut x522: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x521, &mut x522, 0x0, x518, x515); + let mut x523: u32 = 0; + let mut x524: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x523, &mut x524, x522, x516, x513); + let mut x525: u32 = 0; + let mut x526: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x525, &mut x526, x524, x514, x511); + let mut x527: u32 = 0; + let mut x528: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x527, &mut x528, x526, x512, x509); + let mut x529: u32 = 0; + let mut x530: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x529, &mut x530, x528, x510, x507); + let mut x531: u32 = 0; + let mut x532: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x531, &mut x532, x530, x508, x505); + let mut x533: u32 = 0; + let mut x534: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x533, &mut x534, x532, x506, x503); + let mut x535: u32 = 0; + let mut x536: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x535, &mut x536, x534, x504, x501); + let mut x537: u32 = 0; + let mut x538: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x537, &mut x538, 0x0, x477, x519); + let mut x539: u32 = 0; + let mut x540: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x539, &mut x540, x538, x479, x520); + let mut x541: u32 = 0; + let mut x542: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x541, &mut x542, x540, x481, (0x0 as u32)); + let mut x543: u32 = 0; + let mut x544: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x543, &mut x544, x542, x483, x517); + let mut x545: u32 = 0; + let mut x546: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x545, &mut x546, x544, x485, x521); + let mut x547: u32 = 0; + let mut x548: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x547, &mut x548, x546, x487, x523); + let mut x549: u32 = 0; + let mut x550: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x549, &mut x550, x548, x489, x525); + let mut x551: u32 = 0; + let mut x552: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x551, &mut x552, x550, x491, x527); + let mut x553: u32 = 0; + let mut x554: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x553, &mut x554, x552, x493, x529); + let mut x555: u32 = 0; + let mut x556: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x555, &mut x556, x554, x495, x531); + let mut x557: u32 = 0; + let mut x558: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x557, &mut x558, x556, x497, x533); + let mut x559: u32 = 0; + let mut x560: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x559, &mut x560, x558, x499, x535); + let mut x561: u32 = 0; + let mut x562: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x561, &mut x562, x560, ((x500 as u32) + (x466 as u32)), ((x536 as u32) + x502)); + let mut x563: u32 = 0; + let mut x564: u32 = 0; + fiat_p384_mulx_u32(&mut x563, &mut x564, x6, 0x2); + let mut x565: u32 = 0; + let mut x566: u32 = 0; + fiat_p384_mulx_u32(&mut x565, &mut x566, x6, 0xfffffffe); + let mut x567: u32 = 0; + let mut x568: u32 = 0; + fiat_p384_mulx_u32(&mut x567, &mut x568, x6, 0x2); + let mut x569: u32 = 0; + let mut x570: u32 = 0; + fiat_p384_mulx_u32(&mut x569, &mut x570, x6, 0xfffffffe); + let mut x571: u32 = 0; + let mut x572: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x571, &mut x572, 0x0, ((x564 as fiat_p384_u1) as u32), x6); + let mut x573: u32 = 0; + let mut x574: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x573, &mut x574, 0x0, x539, x6); + let mut x575: u32 = 0; + let mut x576: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x575, &mut x576, x574, x541, x569); + let mut x577: u32 = 0; + let mut x578: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x577, &mut x578, x576, x543, x570); + let mut x579: u32 = 0; + let mut x580: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x579, &mut x580, x578, x545, x567); + let mut x581: u32 = 0; + let mut x582: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x581, &mut x582, x580, x547, ((x568 as fiat_p384_u1) as u32)); + let mut x583: u32 = 0; + let mut x584: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x583, &mut x584, x582, x549, x565); + let mut x585: u32 = 0; + let mut x586: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x585, &mut x586, x584, x551, x566); + let mut x587: u32 = 0; + let mut x588: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x587, &mut x588, x586, x553, x563); + let mut x589: u32 = 0; + let mut x590: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x589, &mut x590, x588, x555, x571); + let mut x591: u32 = 0; + let mut x592: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x591, &mut x592, x590, x557, (x572 as u32)); + let mut x593: u32 = 0; + let mut x594: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x593, &mut x594, x592, x559, (0x0 as u32)); + let mut x595: u32 = 0; + let mut x596: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x595, &mut x596, x594, x561, (0x0 as u32)); + let mut x597: u32 = 0; + let mut x598: u32 = 0; + fiat_p384_mulx_u32(&mut x597, &mut x598, x573, 0xffffffff); + let mut x599: u32 = 0; + let mut x600: u32 = 0; + fiat_p384_mulx_u32(&mut x599, &mut x600, x573, 0xffffffff); + let mut x601: u32 = 0; + let mut x602: u32 = 0; + fiat_p384_mulx_u32(&mut x601, &mut x602, x573, 0xffffffff); + let mut x603: u32 = 0; + let mut x604: u32 = 0; + fiat_p384_mulx_u32(&mut x603, &mut x604, x573, 0xffffffff); + let mut x605: u32 = 0; + let mut x606: u32 = 0; + fiat_p384_mulx_u32(&mut x605, &mut x606, x573, 0xffffffff); + let mut x607: u32 = 0; + let mut x608: u32 = 0; + fiat_p384_mulx_u32(&mut x607, &mut x608, x573, 0xffffffff); + let mut x609: u32 = 0; + let mut x610: u32 = 0; + fiat_p384_mulx_u32(&mut x609, &mut x610, x573, 0xffffffff); + let mut x611: u32 = 0; + let mut x612: u32 = 0; + fiat_p384_mulx_u32(&mut x611, &mut x612, x573, 0xfffffffe); + let mut x613: u32 = 0; + let mut x614: u32 = 0; + fiat_p384_mulx_u32(&mut x613, &mut x614, x573, 0xffffffff); + let mut x615: u32 = 0; + let mut x616: u32 = 0; + fiat_p384_mulx_u32(&mut x615, &mut x616, x573, 0xffffffff); + let mut x617: u32 = 0; + let mut x618: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x617, &mut x618, 0x0, x614, x611); + let mut x619: u32 = 0; + let mut x620: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x619, &mut x620, x618, x612, x609); + let mut x621: u32 = 0; + let mut x622: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x621, &mut x622, x620, x610, x607); + let mut x623: u32 = 0; + let mut x624: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x623, &mut x624, x622, x608, x605); + let mut x625: u32 = 0; + let mut x626: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x625, &mut x626, x624, x606, x603); + let mut x627: u32 = 0; + let mut x628: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x627, &mut x628, x626, x604, x601); + let mut x629: u32 = 0; + let mut x630: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x629, &mut x630, x628, x602, x599); + let mut x631: u32 = 0; + let mut x632: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x631, &mut x632, x630, x600, x597); + let mut x633: u32 = 0; + let mut x634: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x633, &mut x634, 0x0, x573, x615); + let mut x635: u32 = 0; + let mut x636: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x635, &mut x636, x634, x575, x616); + let mut x637: u32 = 0; + let mut x638: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x637, &mut x638, x636, x577, (0x0 as u32)); + let mut x639: u32 = 0; + let mut x640: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x639, &mut x640, x638, x579, x613); + let mut x641: u32 = 0; + let mut x642: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x641, &mut x642, x640, x581, x617); + let mut x643: u32 = 0; + let mut x644: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x643, &mut x644, x642, x583, x619); + let mut x645: u32 = 0; + let mut x646: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x645, &mut x646, x644, x585, x621); + let mut x647: u32 = 0; + let mut x648: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x647, &mut x648, x646, x587, x623); + let mut x649: u32 = 0; + let mut x650: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x649, &mut x650, x648, x589, x625); + let mut x651: u32 = 0; + let mut x652: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x651, &mut x652, x650, x591, x627); + let mut x653: u32 = 0; + let mut x654: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x653, &mut x654, x652, x593, x629); + let mut x655: u32 = 0; + let mut x656: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x655, &mut x656, x654, x595, x631); + let mut x657: u32 = 0; + let mut x658: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x657, &mut x658, x656, ((x596 as u32) + (x562 as u32)), ((x632 as u32) + x598)); + let mut x659: u32 = 0; + let mut x660: u32 = 0; + fiat_p384_mulx_u32(&mut x659, &mut x660, x7, 0x2); + let mut x661: u32 = 0; + let mut x662: u32 = 0; + fiat_p384_mulx_u32(&mut x661, &mut x662, x7, 0xfffffffe); + let mut x663: u32 = 0; + let mut x664: u32 = 0; + fiat_p384_mulx_u32(&mut x663, &mut x664, x7, 0x2); + let mut x665: u32 = 0; + let mut x666: u32 = 0; + fiat_p384_mulx_u32(&mut x665, &mut x666, x7, 0xfffffffe); + let mut x667: u32 = 0; + let mut x668: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x667, &mut x668, 0x0, ((x660 as fiat_p384_u1) as u32), x7); + let mut x669: u32 = 0; + let mut x670: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x669, &mut x670, 0x0, x635, x7); + let mut x671: u32 = 0; + let mut x672: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x671, &mut x672, x670, x637, x665); + let mut x673: u32 = 0; + let mut x674: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x673, &mut x674, x672, x639, x666); + let mut x675: u32 = 0; + let mut x676: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x675, &mut x676, x674, x641, x663); + let mut x677: u32 = 0; + let mut x678: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x677, &mut x678, x676, x643, ((x664 as fiat_p384_u1) as u32)); + let mut x679: u32 = 0; + let mut x680: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x679, &mut x680, x678, x645, x661); + let mut x681: u32 = 0; + let mut x682: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x681, &mut x682, x680, x647, x662); + let mut x683: u32 = 0; + let mut x684: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x683, &mut x684, x682, x649, x659); + let mut x685: u32 = 0; + let mut x686: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x685, &mut x686, x684, x651, x667); + let mut x687: u32 = 0; + let mut x688: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x687, &mut x688, x686, x653, (x668 as u32)); + let mut x689: u32 = 0; + let mut x690: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x689, &mut x690, x688, x655, (0x0 as u32)); + let mut x691: u32 = 0; + let mut x692: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x691, &mut x692, x690, x657, (0x0 as u32)); + let mut x693: u32 = 0; + let mut x694: u32 = 0; + fiat_p384_mulx_u32(&mut x693, &mut x694, x669, 0xffffffff); + let mut x695: u32 = 0; + let mut x696: u32 = 0; + fiat_p384_mulx_u32(&mut x695, &mut x696, x669, 0xffffffff); + let mut x697: u32 = 0; + let mut x698: u32 = 0; + fiat_p384_mulx_u32(&mut x697, &mut x698, x669, 0xffffffff); + let mut x699: u32 = 0; + let mut x700: u32 = 0; + fiat_p384_mulx_u32(&mut x699, &mut x700, x669, 0xffffffff); + let mut x701: u32 = 0; + let mut x702: u32 = 0; + fiat_p384_mulx_u32(&mut x701, &mut x702, x669, 0xffffffff); + let mut x703: u32 = 0; + let mut x704: u32 = 0; + fiat_p384_mulx_u32(&mut x703, &mut x704, x669, 0xffffffff); + let mut x705: u32 = 0; + let mut x706: u32 = 0; + fiat_p384_mulx_u32(&mut x705, &mut x706, x669, 0xffffffff); + let mut x707: u32 = 0; + let mut x708: u32 = 0; + fiat_p384_mulx_u32(&mut x707, &mut x708, x669, 0xfffffffe); + let mut x709: u32 = 0; + let mut x710: u32 = 0; + fiat_p384_mulx_u32(&mut x709, &mut x710, x669, 0xffffffff); + let mut x711: u32 = 0; + let mut x712: u32 = 0; + fiat_p384_mulx_u32(&mut x711, &mut x712, x669, 0xffffffff); + let mut x713: u32 = 0; + let mut x714: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x713, &mut x714, 0x0, x710, x707); + let mut x715: u32 = 0; + let mut x716: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x715, &mut x716, x714, x708, x705); + let mut x717: u32 = 0; + let mut x718: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x717, &mut x718, x716, x706, x703); + let mut x719: u32 = 0; + let mut x720: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x719, &mut x720, x718, x704, x701); + let mut x721: u32 = 0; + let mut x722: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x721, &mut x722, x720, x702, x699); + let mut x723: u32 = 0; + let mut x724: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x723, &mut x724, x722, x700, x697); + let mut x725: u32 = 0; + let mut x726: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x725, &mut x726, x724, x698, x695); + let mut x727: u32 = 0; + let mut x728: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x727, &mut x728, x726, x696, x693); + let mut x729: u32 = 0; + let mut x730: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x729, &mut x730, 0x0, x669, x711); + let mut x731: u32 = 0; + let mut x732: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x731, &mut x732, x730, x671, x712); + let mut x733: u32 = 0; + let mut x734: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x733, &mut x734, x732, x673, (0x0 as u32)); + let mut x735: u32 = 0; + let mut x736: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x735, &mut x736, x734, x675, x709); + let mut x737: u32 = 0; + let mut x738: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x737, &mut x738, x736, x677, x713); + let mut x739: u32 = 0; + let mut x740: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x739, &mut x740, x738, x679, x715); + let mut x741: u32 = 0; + let mut x742: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x741, &mut x742, x740, x681, x717); + let mut x743: u32 = 0; + let mut x744: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x743, &mut x744, x742, x683, x719); + let mut x745: u32 = 0; + let mut x746: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x745, &mut x746, x744, x685, x721); + let mut x747: u32 = 0; + let mut x748: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x747, &mut x748, x746, x687, x723); + let mut x749: u32 = 0; + let mut x750: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x749, &mut x750, x748, x689, x725); + let mut x751: u32 = 0; + let mut x752: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x751, &mut x752, x750, x691, x727); + let mut x753: u32 = 0; + let mut x754: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x753, &mut x754, x752, ((x692 as u32) + (x658 as u32)), ((x728 as u32) + x694)); + let mut x755: u32 = 0; + let mut x756: u32 = 0; + fiat_p384_mulx_u32(&mut x755, &mut x756, x8, 0x2); + let mut x757: u32 = 0; + let mut x758: u32 = 0; + fiat_p384_mulx_u32(&mut x757, &mut x758, x8, 0xfffffffe); + let mut x759: u32 = 0; + let mut x760: u32 = 0; + fiat_p384_mulx_u32(&mut x759, &mut x760, x8, 0x2); + let mut x761: u32 = 0; + let mut x762: u32 = 0; + fiat_p384_mulx_u32(&mut x761, &mut x762, x8, 0xfffffffe); + let mut x763: u32 = 0; + let mut x764: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x763, &mut x764, 0x0, ((x756 as fiat_p384_u1) as u32), x8); + let mut x765: u32 = 0; + let mut x766: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x765, &mut x766, 0x0, x731, x8); + let mut x767: u32 = 0; + let mut x768: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x767, &mut x768, x766, x733, x761); + let mut x769: u32 = 0; + let mut x770: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x769, &mut x770, x768, x735, x762); + let mut x771: u32 = 0; + let mut x772: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x771, &mut x772, x770, x737, x759); + let mut x773: u32 = 0; + let mut x774: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x773, &mut x774, x772, x739, ((x760 as fiat_p384_u1) as u32)); + let mut x775: u32 = 0; + let mut x776: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x775, &mut x776, x774, x741, x757); + let mut x777: u32 = 0; + let mut x778: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x777, &mut x778, x776, x743, x758); + let mut x779: u32 = 0; + let mut x780: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x779, &mut x780, x778, x745, x755); + let mut x781: u32 = 0; + let mut x782: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x781, &mut x782, x780, x747, x763); + let mut x783: u32 = 0; + let mut x784: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x783, &mut x784, x782, x749, (x764 as u32)); + let mut x785: u32 = 0; + let mut x786: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x785, &mut x786, x784, x751, (0x0 as u32)); + let mut x787: u32 = 0; + let mut x788: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x787, &mut x788, x786, x753, (0x0 as u32)); + let mut x789: u32 = 0; + let mut x790: u32 = 0; + fiat_p384_mulx_u32(&mut x789, &mut x790, x765, 0xffffffff); + let mut x791: u32 = 0; + let mut x792: u32 = 0; + fiat_p384_mulx_u32(&mut x791, &mut x792, x765, 0xffffffff); + let mut x793: u32 = 0; + let mut x794: u32 = 0; + fiat_p384_mulx_u32(&mut x793, &mut x794, x765, 0xffffffff); + let mut x795: u32 = 0; + let mut x796: u32 = 0; + fiat_p384_mulx_u32(&mut x795, &mut x796, x765, 0xffffffff); + let mut x797: u32 = 0; + let mut x798: u32 = 0; + fiat_p384_mulx_u32(&mut x797, &mut x798, x765, 0xffffffff); + let mut x799: u32 = 0; + let mut x800: u32 = 0; + fiat_p384_mulx_u32(&mut x799, &mut x800, x765, 0xffffffff); + let mut x801: u32 = 0; + let mut x802: u32 = 0; + fiat_p384_mulx_u32(&mut x801, &mut x802, x765, 0xffffffff); + let mut x803: u32 = 0; + let mut x804: u32 = 0; + fiat_p384_mulx_u32(&mut x803, &mut x804, x765, 0xfffffffe); + let mut x805: u32 = 0; + let mut x806: u32 = 0; + fiat_p384_mulx_u32(&mut x805, &mut x806, x765, 0xffffffff); + let mut x807: u32 = 0; + let mut x808: u32 = 0; + fiat_p384_mulx_u32(&mut x807, &mut x808, x765, 0xffffffff); + let mut x809: u32 = 0; + let mut x810: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x809, &mut x810, 0x0, x806, x803); + let mut x811: u32 = 0; + let mut x812: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x811, &mut x812, x810, x804, x801); + let mut x813: u32 = 0; + let mut x814: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x813, &mut x814, x812, x802, x799); + let mut x815: u32 = 0; + let mut x816: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x815, &mut x816, x814, x800, x797); + let mut x817: u32 = 0; + let mut x818: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x817, &mut x818, x816, x798, x795); + let mut x819: u32 = 0; + let mut x820: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x819, &mut x820, x818, x796, x793); + let mut x821: u32 = 0; + let mut x822: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x821, &mut x822, x820, x794, x791); + let mut x823: u32 = 0; + let mut x824: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x823, &mut x824, x822, x792, x789); + let mut x825: u32 = 0; + let mut x826: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x825, &mut x826, 0x0, x765, x807); + let mut x827: u32 = 0; + let mut x828: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x827, &mut x828, x826, x767, x808); + let mut x829: u32 = 0; + let mut x830: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x829, &mut x830, x828, x769, (0x0 as u32)); + let mut x831: u32 = 0; + let mut x832: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x831, &mut x832, x830, x771, x805); + let mut x833: u32 = 0; + let mut x834: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x833, &mut x834, x832, x773, x809); + let mut x835: u32 = 0; + let mut x836: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x835, &mut x836, x834, x775, x811); + let mut x837: u32 = 0; + let mut x838: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x837, &mut x838, x836, x777, x813); + let mut x839: u32 = 0; + let mut x840: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x839, &mut x840, x838, x779, x815); + let mut x841: u32 = 0; + let mut x842: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x841, &mut x842, x840, x781, x817); + let mut x843: u32 = 0; + let mut x844: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x843, &mut x844, x842, x783, x819); + let mut x845: u32 = 0; + let mut x846: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x845, &mut x846, x844, x785, x821); + let mut x847: u32 = 0; + let mut x848: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x847, &mut x848, x846, x787, x823); + let mut x849: u32 = 0; + let mut x850: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x849, &mut x850, x848, ((x788 as u32) + (x754 as u32)), ((x824 as u32) + x790)); + let mut x851: u32 = 0; + let mut x852: u32 = 0; + fiat_p384_mulx_u32(&mut x851, &mut x852, x9, 0x2); + let mut x853: u32 = 0; + let mut x854: u32 = 0; + fiat_p384_mulx_u32(&mut x853, &mut x854, x9, 0xfffffffe); + let mut x855: u32 = 0; + let mut x856: u32 = 0; + fiat_p384_mulx_u32(&mut x855, &mut x856, x9, 0x2); + let mut x857: u32 = 0; + let mut x858: u32 = 0; + fiat_p384_mulx_u32(&mut x857, &mut x858, x9, 0xfffffffe); + let mut x859: u32 = 0; + let mut x860: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x859, &mut x860, 0x0, ((x852 as fiat_p384_u1) as u32), x9); + let mut x861: u32 = 0; + let mut x862: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x861, &mut x862, 0x0, x827, x9); + let mut x863: u32 = 0; + let mut x864: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x863, &mut x864, x862, x829, x857); + let mut x865: u32 = 0; + let mut x866: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x865, &mut x866, x864, x831, x858); + let mut x867: u32 = 0; + let mut x868: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x867, &mut x868, x866, x833, x855); + let mut x869: u32 = 0; + let mut x870: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x869, &mut x870, x868, x835, ((x856 as fiat_p384_u1) as u32)); + let mut x871: u32 = 0; + let mut x872: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x871, &mut x872, x870, x837, x853); + let mut x873: u32 = 0; + let mut x874: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x873, &mut x874, x872, x839, x854); + let mut x875: u32 = 0; + let mut x876: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x875, &mut x876, x874, x841, x851); + let mut x877: u32 = 0; + let mut x878: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x877, &mut x878, x876, x843, x859); + let mut x879: u32 = 0; + let mut x880: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x879, &mut x880, x878, x845, (x860 as u32)); + let mut x881: u32 = 0; + let mut x882: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x881, &mut x882, x880, x847, (0x0 as u32)); + let mut x883: u32 = 0; + let mut x884: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x883, &mut x884, x882, x849, (0x0 as u32)); + let mut x885: u32 = 0; + let mut x886: u32 = 0; + fiat_p384_mulx_u32(&mut x885, &mut x886, x861, 0xffffffff); + let mut x887: u32 = 0; + let mut x888: u32 = 0; + fiat_p384_mulx_u32(&mut x887, &mut x888, x861, 0xffffffff); + let mut x889: u32 = 0; + let mut x890: u32 = 0; + fiat_p384_mulx_u32(&mut x889, &mut x890, x861, 0xffffffff); + let mut x891: u32 = 0; + let mut x892: u32 = 0; + fiat_p384_mulx_u32(&mut x891, &mut x892, x861, 0xffffffff); + let mut x893: u32 = 0; + let mut x894: u32 = 0; + fiat_p384_mulx_u32(&mut x893, &mut x894, x861, 0xffffffff); + let mut x895: u32 = 0; + let mut x896: u32 = 0; + fiat_p384_mulx_u32(&mut x895, &mut x896, x861, 0xffffffff); + let mut x897: u32 = 0; + let mut x898: u32 = 0; + fiat_p384_mulx_u32(&mut x897, &mut x898, x861, 0xffffffff); + let mut x899: u32 = 0; + let mut x900: u32 = 0; + fiat_p384_mulx_u32(&mut x899, &mut x900, x861, 0xfffffffe); + let mut x901: u32 = 0; + let mut x902: u32 = 0; + fiat_p384_mulx_u32(&mut x901, &mut x902, x861, 0xffffffff); + let mut x903: u32 = 0; + let mut x904: u32 = 0; + fiat_p384_mulx_u32(&mut x903, &mut x904, x861, 0xffffffff); + let mut x905: u32 = 0; + let mut x906: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x905, &mut x906, 0x0, x902, x899); + let mut x907: u32 = 0; + let mut x908: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x907, &mut x908, x906, x900, x897); + let mut x909: u32 = 0; + let mut x910: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x909, &mut x910, x908, x898, x895); + let mut x911: u32 = 0; + let mut x912: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x911, &mut x912, x910, x896, x893); + let mut x913: u32 = 0; + let mut x914: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x913, &mut x914, x912, x894, x891); + let mut x915: u32 = 0; + let mut x916: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x915, &mut x916, x914, x892, x889); + let mut x917: u32 = 0; + let mut x918: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x917, &mut x918, x916, x890, x887); + let mut x919: u32 = 0; + let mut x920: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x919, &mut x920, x918, x888, x885); + let mut x921: u32 = 0; + let mut x922: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x921, &mut x922, 0x0, x861, x903); + let mut x923: u32 = 0; + let mut x924: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x923, &mut x924, x922, x863, x904); + let mut x925: u32 = 0; + let mut x926: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x925, &mut x926, x924, x865, (0x0 as u32)); + let mut x927: u32 = 0; + let mut x928: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x927, &mut x928, x926, x867, x901); + let mut x929: u32 = 0; + let mut x930: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x929, &mut x930, x928, x869, x905); + let mut x931: u32 = 0; + let mut x932: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x931, &mut x932, x930, x871, x907); + let mut x933: u32 = 0; + let mut x934: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x933, &mut x934, x932, x873, x909); + let mut x935: u32 = 0; + let mut x936: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x935, &mut x936, x934, x875, x911); + let mut x937: u32 = 0; + let mut x938: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x937, &mut x938, x936, x877, x913); + let mut x939: u32 = 0; + let mut x940: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x939, &mut x940, x938, x879, x915); + let mut x941: u32 = 0; + let mut x942: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x941, &mut x942, x940, x881, x917); + let mut x943: u32 = 0; + let mut x944: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x943, &mut x944, x942, x883, x919); + let mut x945: u32 = 0; + let mut x946: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x945, &mut x946, x944, ((x884 as u32) + (x850 as u32)), ((x920 as u32) + x886)); + let mut x947: u32 = 0; + let mut x948: u32 = 0; + fiat_p384_mulx_u32(&mut x947, &mut x948, x10, 0x2); + let mut x949: u32 = 0; + let mut x950: u32 = 0; + fiat_p384_mulx_u32(&mut x949, &mut x950, x10, 0xfffffffe); + let mut x951: u32 = 0; + let mut x952: u32 = 0; + fiat_p384_mulx_u32(&mut x951, &mut x952, x10, 0x2); + let mut x953: u32 = 0; + let mut x954: u32 = 0; + fiat_p384_mulx_u32(&mut x953, &mut x954, x10, 0xfffffffe); + let mut x955: u32 = 0; + let mut x956: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x955, &mut x956, 0x0, ((x948 as fiat_p384_u1) as u32), x10); + let mut x957: u32 = 0; + let mut x958: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x957, &mut x958, 0x0, x923, x10); + let mut x959: u32 = 0; + let mut x960: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x959, &mut x960, x958, x925, x953); + let mut x961: u32 = 0; + let mut x962: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x961, &mut x962, x960, x927, x954); + let mut x963: u32 = 0; + let mut x964: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x963, &mut x964, x962, x929, x951); + let mut x965: u32 = 0; + let mut x966: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x965, &mut x966, x964, x931, ((x952 as fiat_p384_u1) as u32)); + let mut x967: u32 = 0; + let mut x968: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x967, &mut x968, x966, x933, x949); + let mut x969: u32 = 0; + let mut x970: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x969, &mut x970, x968, x935, x950); + let mut x971: u32 = 0; + let mut x972: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x971, &mut x972, x970, x937, x947); + let mut x973: u32 = 0; + let mut x974: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x973, &mut x974, x972, x939, x955); + let mut x975: u32 = 0; + let mut x976: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x975, &mut x976, x974, x941, (x956 as u32)); + let mut x977: u32 = 0; + let mut x978: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x977, &mut x978, x976, x943, (0x0 as u32)); + let mut x979: u32 = 0; + let mut x980: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x979, &mut x980, x978, x945, (0x0 as u32)); + let mut x981: u32 = 0; + let mut x982: u32 = 0; + fiat_p384_mulx_u32(&mut x981, &mut x982, x957, 0xffffffff); + let mut x983: u32 = 0; + let mut x984: u32 = 0; + fiat_p384_mulx_u32(&mut x983, &mut x984, x957, 0xffffffff); + let mut x985: u32 = 0; + let mut x986: u32 = 0; + fiat_p384_mulx_u32(&mut x985, &mut x986, x957, 0xffffffff); + let mut x987: u32 = 0; + let mut x988: u32 = 0; + fiat_p384_mulx_u32(&mut x987, &mut x988, x957, 0xffffffff); + let mut x989: u32 = 0; + let mut x990: u32 = 0; + fiat_p384_mulx_u32(&mut x989, &mut x990, x957, 0xffffffff); + let mut x991: u32 = 0; + let mut x992: u32 = 0; + fiat_p384_mulx_u32(&mut x991, &mut x992, x957, 0xffffffff); + let mut x993: u32 = 0; + let mut x994: u32 = 0; + fiat_p384_mulx_u32(&mut x993, &mut x994, x957, 0xffffffff); + let mut x995: u32 = 0; + let mut x996: u32 = 0; + fiat_p384_mulx_u32(&mut x995, &mut x996, x957, 0xfffffffe); + let mut x997: u32 = 0; + let mut x998: u32 = 0; + fiat_p384_mulx_u32(&mut x997, &mut x998, x957, 0xffffffff); + let mut x999: u32 = 0; + let mut x1000: u32 = 0; + fiat_p384_mulx_u32(&mut x999, &mut x1000, x957, 0xffffffff); + let mut x1001: u32 = 0; + let mut x1002: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1001, &mut x1002, 0x0, x998, x995); + let mut x1003: u32 = 0; + let mut x1004: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1003, &mut x1004, x1002, x996, x993); + let mut x1005: u32 = 0; + let mut x1006: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1005, &mut x1006, x1004, x994, x991); + let mut x1007: u32 = 0; + let mut x1008: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1007, &mut x1008, x1006, x992, x989); + let mut x1009: u32 = 0; + let mut x1010: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1009, &mut x1010, x1008, x990, x987); + let mut x1011: u32 = 0; + let mut x1012: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1011, &mut x1012, x1010, x988, x985); + let mut x1013: u32 = 0; + let mut x1014: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1013, &mut x1014, x1012, x986, x983); + let mut x1015: u32 = 0; + let mut x1016: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1015, &mut x1016, x1014, x984, x981); + let mut x1017: u32 = 0; + let mut x1018: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1017, &mut x1018, 0x0, x957, x999); + let mut x1019: u32 = 0; + let mut x1020: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1019, &mut x1020, x1018, x959, x1000); + let mut x1021: u32 = 0; + let mut x1022: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1021, &mut x1022, x1020, x961, (0x0 as u32)); + let mut x1023: u32 = 0; + let mut x1024: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1023, &mut x1024, x1022, x963, x997); + let mut x1025: u32 = 0; + let mut x1026: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1025, &mut x1026, x1024, x965, x1001); + let mut x1027: u32 = 0; + let mut x1028: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1027, &mut x1028, x1026, x967, x1003); + let mut x1029: u32 = 0; + let mut x1030: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1029, &mut x1030, x1028, x969, x1005); + let mut x1031: u32 = 0; + let mut x1032: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1031, &mut x1032, x1030, x971, x1007); + let mut x1033: u32 = 0; + let mut x1034: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1033, &mut x1034, x1032, x973, x1009); + let mut x1035: u32 = 0; + let mut x1036: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1035, &mut x1036, x1034, x975, x1011); + let mut x1037: u32 = 0; + let mut x1038: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1037, &mut x1038, x1036, x977, x1013); + let mut x1039: u32 = 0; + let mut x1040: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1039, &mut x1040, x1038, x979, x1015); + let mut x1041: u32 = 0; + let mut x1042: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1041, &mut x1042, x1040, ((x980 as u32) + (x946 as u32)), ((x1016 as u32) + x982)); + let mut x1043: u32 = 0; + let mut x1044: u32 = 0; + fiat_p384_mulx_u32(&mut x1043, &mut x1044, x11, 0x2); + let mut x1045: u32 = 0; + let mut x1046: u32 = 0; + fiat_p384_mulx_u32(&mut x1045, &mut x1046, x11, 0xfffffffe); + let mut x1047: u32 = 0; + let mut x1048: u32 = 0; + fiat_p384_mulx_u32(&mut x1047, &mut x1048, x11, 0x2); + let mut x1049: u32 = 0; + let mut x1050: u32 = 0; + fiat_p384_mulx_u32(&mut x1049, &mut x1050, x11, 0xfffffffe); + let mut x1051: u32 = 0; + let mut x1052: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1051, &mut x1052, 0x0, ((x1044 as fiat_p384_u1) as u32), x11); + let mut x1053: u32 = 0; + let mut x1054: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1053, &mut x1054, 0x0, x1019, x11); + let mut x1055: u32 = 0; + let mut x1056: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1055, &mut x1056, x1054, x1021, x1049); + let mut x1057: u32 = 0; + let mut x1058: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1057, &mut x1058, x1056, x1023, x1050); + let mut x1059: u32 = 0; + let mut x1060: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1059, &mut x1060, x1058, x1025, x1047); + let mut x1061: u32 = 0; + let mut x1062: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1061, &mut x1062, x1060, x1027, ((x1048 as fiat_p384_u1) as u32)); + let mut x1063: u32 = 0; + let mut x1064: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1063, &mut x1064, x1062, x1029, x1045); + let mut x1065: u32 = 0; + let mut x1066: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1065, &mut x1066, x1064, x1031, x1046); + let mut x1067: u32 = 0; + let mut x1068: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1067, &mut x1068, x1066, x1033, x1043); + let mut x1069: u32 = 0; + let mut x1070: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1069, &mut x1070, x1068, x1035, x1051); + let mut x1071: u32 = 0; + let mut x1072: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1071, &mut x1072, x1070, x1037, (x1052 as u32)); + let mut x1073: u32 = 0; + let mut x1074: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1073, &mut x1074, x1072, x1039, (0x0 as u32)); + let mut x1075: u32 = 0; + let mut x1076: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1075, &mut x1076, x1074, x1041, (0x0 as u32)); + let mut x1077: u32 = 0; + let mut x1078: u32 = 0; + fiat_p384_mulx_u32(&mut x1077, &mut x1078, x1053, 0xffffffff); + let mut x1079: u32 = 0; + let mut x1080: u32 = 0; + fiat_p384_mulx_u32(&mut x1079, &mut x1080, x1053, 0xffffffff); + let mut x1081: u32 = 0; + let mut x1082: u32 = 0; + fiat_p384_mulx_u32(&mut x1081, &mut x1082, x1053, 0xffffffff); + let mut x1083: u32 = 0; + let mut x1084: u32 = 0; + fiat_p384_mulx_u32(&mut x1083, &mut x1084, x1053, 0xffffffff); + let mut x1085: u32 = 0; + let mut x1086: u32 = 0; + fiat_p384_mulx_u32(&mut x1085, &mut x1086, x1053, 0xffffffff); + let mut x1087: u32 = 0; + let mut x1088: u32 = 0; + fiat_p384_mulx_u32(&mut x1087, &mut x1088, x1053, 0xffffffff); + let mut x1089: u32 = 0; + let mut x1090: u32 = 0; + fiat_p384_mulx_u32(&mut x1089, &mut x1090, x1053, 0xffffffff); + let mut x1091: u32 = 0; + let mut x1092: u32 = 0; + fiat_p384_mulx_u32(&mut x1091, &mut x1092, x1053, 0xfffffffe); + let mut x1093: u32 = 0; + let mut x1094: u32 = 0; + fiat_p384_mulx_u32(&mut x1093, &mut x1094, x1053, 0xffffffff); + let mut x1095: u32 = 0; + let mut x1096: u32 = 0; + fiat_p384_mulx_u32(&mut x1095, &mut x1096, x1053, 0xffffffff); + let mut x1097: u32 = 0; + let mut x1098: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1097, &mut x1098, 0x0, x1094, x1091); + let mut x1099: u32 = 0; + let mut x1100: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1099, &mut x1100, x1098, x1092, x1089); + let mut x1101: u32 = 0; + let mut x1102: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1101, &mut x1102, x1100, x1090, x1087); + let mut x1103: u32 = 0; + let mut x1104: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1103, &mut x1104, x1102, x1088, x1085); + let mut x1105: u32 = 0; + let mut x1106: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1105, &mut x1106, x1104, x1086, x1083); + let mut x1107: u32 = 0; + let mut x1108: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1107, &mut x1108, x1106, x1084, x1081); + let mut x1109: u32 = 0; + let mut x1110: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1109, &mut x1110, x1108, x1082, x1079); + let mut x1111: u32 = 0; + let mut x1112: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1111, &mut x1112, x1110, x1080, x1077); + let mut x1113: u32 = 0; + let mut x1114: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1113, &mut x1114, 0x0, x1053, x1095); + let mut x1115: u32 = 0; + let mut x1116: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1115, &mut x1116, x1114, x1055, x1096); + let mut x1117: u32 = 0; + let mut x1118: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1117, &mut x1118, x1116, x1057, (0x0 as u32)); + let mut x1119: u32 = 0; + let mut x1120: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1119, &mut x1120, x1118, x1059, x1093); + let mut x1121: u32 = 0; + let mut x1122: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1121, &mut x1122, x1120, x1061, x1097); + let mut x1123: u32 = 0; + let mut x1124: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1123, &mut x1124, x1122, x1063, x1099); + let mut x1125: u32 = 0; + let mut x1126: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1125, &mut x1126, x1124, x1065, x1101); + let mut x1127: u32 = 0; + let mut x1128: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1127, &mut x1128, x1126, x1067, x1103); + let mut x1129: u32 = 0; + let mut x1130: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1129, &mut x1130, x1128, x1069, x1105); + let mut x1131: u32 = 0; + let mut x1132: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1131, &mut x1132, x1130, x1071, x1107); + let mut x1133: u32 = 0; + let mut x1134: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1133, &mut x1134, x1132, x1073, x1109); + let mut x1135: u32 = 0; + let mut x1136: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1135, &mut x1136, x1134, x1075, x1111); + let mut x1137: u32 = 0; + let mut x1138: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1137, &mut x1138, x1136, ((x1076 as u32) + (x1042 as u32)), ((x1112 as u32) + x1078)); + let mut x1139: u32 = 0; + let mut x1140: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x1139, &mut x1140, 0x0, x1115, 0xffffffff); + let mut x1141: u32 = 0; + let mut x1142: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x1141, &mut x1142, x1140, x1117, (0x0 as u32)); + let mut x1143: u32 = 0; + let mut x1144: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x1143, &mut x1144, x1142, x1119, (0x0 as u32)); + let mut x1145: u32 = 0; + let mut x1146: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x1145, &mut x1146, x1144, x1121, 0xffffffff); + let mut x1147: u32 = 0; + let mut x1148: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x1147, &mut x1148, x1146, x1123, 0xfffffffe); + let mut x1149: u32 = 0; + let mut x1150: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x1149, &mut x1150, x1148, x1125, 0xffffffff); + let mut x1151: u32 = 0; + let mut x1152: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x1151, &mut x1152, x1150, x1127, 0xffffffff); + let mut x1153: u32 = 0; + let mut x1154: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x1153, &mut x1154, x1152, x1129, 0xffffffff); + let mut x1155: u32 = 0; + let mut x1156: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x1155, &mut x1156, x1154, x1131, 0xffffffff); + let mut x1157: u32 = 0; + let mut x1158: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x1157, &mut x1158, x1156, x1133, 0xffffffff); + let mut x1159: u32 = 0; + let mut x1160: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x1159, &mut x1160, x1158, x1135, 0xffffffff); + let mut x1161: u32 = 0; + let mut x1162: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x1161, &mut x1162, x1160, x1137, 0xffffffff); + let mut x1163: u32 = 0; + let mut x1164: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x1163, &mut x1164, x1162, (x1138 as u32), (0x0 as u32)); + let mut x1165: u32 = 0; + fiat_p384_cmovznz_u32(&mut x1165, x1164, x1139, x1115); + let mut x1166: u32 = 0; + fiat_p384_cmovznz_u32(&mut x1166, x1164, x1141, x1117); + let mut x1167: u32 = 0; + fiat_p384_cmovznz_u32(&mut x1167, x1164, x1143, x1119); + let mut x1168: u32 = 0; + fiat_p384_cmovznz_u32(&mut x1168, x1164, x1145, x1121); + let mut x1169: u32 = 0; + fiat_p384_cmovznz_u32(&mut x1169, x1164, x1147, x1123); + let mut x1170: u32 = 0; + fiat_p384_cmovznz_u32(&mut x1170, x1164, x1149, x1125); + let mut x1171: u32 = 0; + fiat_p384_cmovznz_u32(&mut x1171, x1164, x1151, x1127); + let mut x1172: u32 = 0; + fiat_p384_cmovznz_u32(&mut x1172, x1164, x1153, x1129); + let mut x1173: u32 = 0; + fiat_p384_cmovznz_u32(&mut x1173, x1164, x1155, x1131); + let mut x1174: u32 = 0; + fiat_p384_cmovznz_u32(&mut x1174, x1164, x1157, x1133); + let mut x1175: u32 = 0; + fiat_p384_cmovznz_u32(&mut x1175, x1164, x1159, x1135); + let mut x1176: u32 = 0; + fiat_p384_cmovznz_u32(&mut x1176, x1164, x1161, x1137); + out1[0] = x1165; + out1[1] = x1166; + out1[2] = x1167; + out1[3] = x1168; + out1[4] = x1169; + out1[5] = x1170; + out1[6] = x1171; + out1[7] = x1172; + out1[8] = x1173; + out1[9] = x1174; + out1[10] = x1175; + out1[11] = x1176; +} + +/// The function fiat_p384_nonzero outputs a single non-zero word if the input is non-zero and zero otherwise. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// out1 = 0 ↔ eval (from_montgomery arg1) mod m = 0 +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +#[inline] +pub fn fiat_p384_nonzero(out1: &mut u32, arg1: &[u32; 12]) -> () { + let x1: u32 = ((arg1[0]) | ((arg1[1]) | ((arg1[2]) | ((arg1[3]) | ((arg1[4]) | ((arg1[5]) | ((arg1[6]) | ((arg1[7]) | ((arg1[8]) | ((arg1[9]) | ((arg1[10]) | (arg1[11])))))))))))); + *out1 = x1; +} + +/// The function fiat_p384_selectznz is a multi-limb conditional select. +/// +/// Postconditions: +/// out1 = (if arg1 = 0 then arg2 else arg3) +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// arg3: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +#[inline] +pub fn fiat_p384_selectznz(out1: &mut [u32; 12], arg1: fiat_p384_u1, arg2: &[u32; 12], arg3: &[u32; 12]) -> () { + let mut x1: u32 = 0; + fiat_p384_cmovznz_u32(&mut x1, arg1, (arg2[0]), (arg3[0])); + let mut x2: u32 = 0; + fiat_p384_cmovznz_u32(&mut x2, arg1, (arg2[1]), (arg3[1])); + let mut x3: u32 = 0; + fiat_p384_cmovznz_u32(&mut x3, arg1, (arg2[2]), (arg3[2])); + let mut x4: u32 = 0; + fiat_p384_cmovznz_u32(&mut x4, arg1, (arg2[3]), (arg3[3])); + let mut x5: u32 = 0; + fiat_p384_cmovznz_u32(&mut x5, arg1, (arg2[4]), (arg3[4])); + let mut x6: u32 = 0; + fiat_p384_cmovznz_u32(&mut x6, arg1, (arg2[5]), (arg3[5])); + let mut x7: u32 = 0; + fiat_p384_cmovznz_u32(&mut x7, arg1, (arg2[6]), (arg3[6])); + let mut x8: u32 = 0; + fiat_p384_cmovznz_u32(&mut x8, arg1, (arg2[7]), (arg3[7])); + let mut x9: u32 = 0; + fiat_p384_cmovznz_u32(&mut x9, arg1, (arg2[8]), (arg3[8])); + let mut x10: u32 = 0; + fiat_p384_cmovznz_u32(&mut x10, arg1, (arg2[9]), (arg3[9])); + let mut x11: u32 = 0; + fiat_p384_cmovznz_u32(&mut x11, arg1, (arg2[10]), (arg3[10])); + let mut x12: u32 = 0; + fiat_p384_cmovznz_u32(&mut x12, arg1, (arg2[11]), (arg3[11])); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; + out1[3] = x4; + out1[4] = x5; + out1[5] = x6; + out1[6] = x7; + out1[7] = x8; + out1[8] = x9; + out1[9] = x10; + out1[10] = x11; + out1[11] = x12; +} + +/// The function fiat_p384_to_bytes serializes a field element NOT in the Montgomery domain to bytes in little-endian order. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..47] +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] +#[inline] +pub fn fiat_p384_to_bytes(out1: &mut [u8; 48], arg1: &[u32; 12]) -> () { + let x1: u32 = (arg1[11]); + let x2: u32 = (arg1[10]); + let x3: u32 = (arg1[9]); + let x4: u32 = (arg1[8]); + let x5: u32 = (arg1[7]); + let x6: u32 = (arg1[6]); + let x7: u32 = (arg1[5]); + let x8: u32 = (arg1[4]); + let x9: u32 = (arg1[3]); + let x10: u32 = (arg1[2]); + let x11: u32 = (arg1[1]); + let x12: u32 = (arg1[0]); + let x13: u8 = ((x12 & (0xff as u32)) as u8); + let x14: u32 = (x12 >> 8); + let x15: u8 = ((x14 & (0xff as u32)) as u8); + let x16: u32 = (x14 >> 8); + let x17: u8 = ((x16 & (0xff as u32)) as u8); + let x18: u8 = ((x16 >> 8) as u8); + let x19: u8 = ((x11 & (0xff as u32)) as u8); + let x20: u32 = (x11 >> 8); + let x21: u8 = ((x20 & (0xff as u32)) as u8); + let x22: u32 = (x20 >> 8); + let x23: u8 = ((x22 & (0xff as u32)) as u8); + let x24: u8 = ((x22 >> 8) as u8); + let x25: u8 = ((x10 & (0xff as u32)) as u8); + let x26: u32 = (x10 >> 8); + let x27: u8 = ((x26 & (0xff as u32)) as u8); + let x28: u32 = (x26 >> 8); + let x29: u8 = ((x28 & (0xff as u32)) as u8); + let x30: u8 = ((x28 >> 8) as u8); + let x31: u8 = ((x9 & (0xff as u32)) as u8); + let x32: u32 = (x9 >> 8); + let x33: u8 = ((x32 & (0xff as u32)) as u8); + let x34: u32 = (x32 >> 8); + let x35: u8 = ((x34 & (0xff as u32)) as u8); + let x36: u8 = ((x34 >> 8) as u8); + let x37: u8 = ((x8 & (0xff as u32)) as u8); + let x38: u32 = (x8 >> 8); + let x39: u8 = ((x38 & (0xff as u32)) as u8); + let x40: u32 = (x38 >> 8); + let x41: u8 = ((x40 & (0xff as u32)) as u8); + let x42: u8 = ((x40 >> 8) as u8); + let x43: u8 = ((x7 & (0xff as u32)) as u8); + let x44: u32 = (x7 >> 8); + let x45: u8 = ((x44 & (0xff as u32)) as u8); + let x46: u32 = (x44 >> 8); + let x47: u8 = ((x46 & (0xff as u32)) as u8); + let x48: u8 = ((x46 >> 8) as u8); + let x49: u8 = ((x6 & (0xff as u32)) as u8); + let x50: u32 = (x6 >> 8); + let x51: u8 = ((x50 & (0xff as u32)) as u8); + let x52: u32 = (x50 >> 8); + let x53: u8 = ((x52 & (0xff as u32)) as u8); + let x54: u8 = ((x52 >> 8) as u8); + let x55: u8 = ((x5 & (0xff as u32)) as u8); + let x56: u32 = (x5 >> 8); + let x57: u8 = ((x56 & (0xff as u32)) as u8); + let x58: u32 = (x56 >> 8); + let x59: u8 = ((x58 & (0xff as u32)) as u8); + let x60: u8 = ((x58 >> 8) as u8); + let x61: u8 = ((x4 & (0xff as u32)) as u8); + let x62: u32 = (x4 >> 8); + let x63: u8 = ((x62 & (0xff as u32)) as u8); + let x64: u32 = (x62 >> 8); + let x65: u8 = ((x64 & (0xff as u32)) as u8); + let x66: u8 = ((x64 >> 8) as u8); + let x67: u8 = ((x3 & (0xff as u32)) as u8); + let x68: u32 = (x3 >> 8); + let x69: u8 = ((x68 & (0xff as u32)) as u8); + let x70: u32 = (x68 >> 8); + let x71: u8 = ((x70 & (0xff as u32)) as u8); + let x72: u8 = ((x70 >> 8) as u8); + let x73: u8 = ((x2 & (0xff as u32)) as u8); + let x74: u32 = (x2 >> 8); + let x75: u8 = ((x74 & (0xff as u32)) as u8); + let x76: u32 = (x74 >> 8); + let x77: u8 = ((x76 & (0xff as u32)) as u8); + let x78: u8 = ((x76 >> 8) as u8); + let x79: u8 = ((x1 & (0xff as u32)) as u8); + let x80: u32 = (x1 >> 8); + let x81: u8 = ((x80 & (0xff as u32)) as u8); + let x82: u32 = (x80 >> 8); + let x83: u8 = ((x82 & (0xff as u32)) as u8); + let x84: u8 = ((x82 >> 8) as u8); + out1[0] = x13; + out1[1] = x15; + out1[2] = x17; + out1[3] = x18; + out1[4] = x19; + out1[5] = x21; + out1[6] = x23; + out1[7] = x24; + out1[8] = x25; + out1[9] = x27; + out1[10] = x29; + out1[11] = x30; + out1[12] = x31; + out1[13] = x33; + out1[14] = x35; + out1[15] = x36; + out1[16] = x37; + out1[17] = x39; + out1[18] = x41; + out1[19] = x42; + out1[20] = x43; + out1[21] = x45; + out1[22] = x47; + out1[23] = x48; + out1[24] = x49; + out1[25] = x51; + out1[26] = x53; + out1[27] = x54; + out1[28] = x55; + out1[29] = x57; + out1[30] = x59; + out1[31] = x60; + out1[32] = x61; + out1[33] = x63; + out1[34] = x65; + out1[35] = x66; + out1[36] = x67; + out1[37] = x69; + out1[38] = x71; + out1[39] = x72; + out1[40] = x73; + out1[41] = x75; + out1[42] = x77; + out1[43] = x78; + out1[44] = x79; + out1[45] = x81; + out1[46] = x83; + out1[47] = x84; +} + +/// The function fiat_p384_from_bytes deserializes a field element NOT in the Montgomery domain from bytes in little-endian order. +/// +/// Preconditions: +/// 0 ≤ bytes_eval arg1 < m +/// Postconditions: +/// eval out1 mod m = bytes_eval arg1 mod m +/// 0 ≤ eval out1 < m +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +#[inline] +pub fn fiat_p384_from_bytes(out1: &mut [u32; 12], arg1: &[u8; 48]) -> () { + let x1: u32 = (((arg1[47]) as u32) << 24); + let x2: u32 = (((arg1[46]) as u32) << 16); + let x3: u32 = (((arg1[45]) as u32) << 8); + let x4: u8 = (arg1[44]); + let x5: u32 = (((arg1[43]) as u32) << 24); + let x6: u32 = (((arg1[42]) as u32) << 16); + let x7: u32 = (((arg1[41]) as u32) << 8); + let x8: u8 = (arg1[40]); + let x9: u32 = (((arg1[39]) as u32) << 24); + let x10: u32 = (((arg1[38]) as u32) << 16); + let x11: u32 = (((arg1[37]) as u32) << 8); + let x12: u8 = (arg1[36]); + let x13: u32 = (((arg1[35]) as u32) << 24); + let x14: u32 = (((arg1[34]) as u32) << 16); + let x15: u32 = (((arg1[33]) as u32) << 8); + let x16: u8 = (arg1[32]); + let x17: u32 = (((arg1[31]) as u32) << 24); + let x18: u32 = (((arg1[30]) as u32) << 16); + let x19: u32 = (((arg1[29]) as u32) << 8); + let x20: u8 = (arg1[28]); + let x21: u32 = (((arg1[27]) as u32) << 24); + let x22: u32 = (((arg1[26]) as u32) << 16); + let x23: u32 = (((arg1[25]) as u32) << 8); + let x24: u8 = (arg1[24]); + let x25: u32 = (((arg1[23]) as u32) << 24); + let x26: u32 = (((arg1[22]) as u32) << 16); + let x27: u32 = (((arg1[21]) as u32) << 8); + let x28: u8 = (arg1[20]); + let x29: u32 = (((arg1[19]) as u32) << 24); + let x30: u32 = (((arg1[18]) as u32) << 16); + let x31: u32 = (((arg1[17]) as u32) << 8); + let x32: u8 = (arg1[16]); + let x33: u32 = (((arg1[15]) as u32) << 24); + let x34: u32 = (((arg1[14]) as u32) << 16); + let x35: u32 = (((arg1[13]) as u32) << 8); + let x36: u8 = (arg1[12]); + let x37: u32 = (((arg1[11]) as u32) << 24); + let x38: u32 = (((arg1[10]) as u32) << 16); + let x39: u32 = (((arg1[9]) as u32) << 8); + let x40: u8 = (arg1[8]); + let x41: u32 = (((arg1[7]) as u32) << 24); + let x42: u32 = (((arg1[6]) as u32) << 16); + let x43: u32 = (((arg1[5]) as u32) << 8); + let x44: u8 = (arg1[4]); + let x45: u32 = (((arg1[3]) as u32) << 24); + let x46: u32 = (((arg1[2]) as u32) << 16); + let x47: u32 = (((arg1[1]) as u32) << 8); + let x48: u8 = (arg1[0]); + let x49: u32 = (x47 + (x48 as u32)); + let x50: u32 = (x46 + x49); + let x51: u32 = (x45 + x50); + let x52: u32 = (x43 + (x44 as u32)); + let x53: u32 = (x42 + x52); + let x54: u32 = (x41 + x53); + let x55: u32 = (x39 + (x40 as u32)); + let x56: u32 = (x38 + x55); + let x57: u32 = (x37 + x56); + let x58: u32 = (x35 + (x36 as u32)); + let x59: u32 = (x34 + x58); + let x60: u32 = (x33 + x59); + let x61: u32 = (x31 + (x32 as u32)); + let x62: u32 = (x30 + x61); + let x63: u32 = (x29 + x62); + let x64: u32 = (x27 + (x28 as u32)); + let x65: u32 = (x26 + x64); + let x66: u32 = (x25 + x65); + let x67: u32 = (x23 + (x24 as u32)); + let x68: u32 = (x22 + x67); + let x69: u32 = (x21 + x68); + let x70: u32 = (x19 + (x20 as u32)); + let x71: u32 = (x18 + x70); + let x72: u32 = (x17 + x71); + let x73: u32 = (x15 + (x16 as u32)); + let x74: u32 = (x14 + x73); + let x75: u32 = (x13 + x74); + let x76: u32 = (x11 + (x12 as u32)); + let x77: u32 = (x10 + x76); + let x78: u32 = (x9 + x77); + let x79: u32 = (x7 + (x8 as u32)); + let x80: u32 = (x6 + x79); + let x81: u32 = (x5 + x80); + let x82: u32 = (x3 + (x4 as u32)); + let x83: u32 = (x2 + x82); + let x84: u32 = (x1 + x83); + out1[0] = x51; + out1[1] = x54; + out1[2] = x57; + out1[3] = x60; + out1[4] = x63; + out1[5] = x66; + out1[6] = x69; + out1[7] = x72; + out1[8] = x75; + out1[9] = x78; + out1[10] = x81; + out1[11] = x84; +} + +/// The function fiat_p384_set_one returns the field element one in the Montgomery domain. +/// +/// Postconditions: +/// eval (from_montgomery out1) mod m = 1 mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p384_set_one(out1: &mut fiat_p384_montgomery_domain_field_element) -> () { + out1[0] = (0x1 as u32); + out1[1] = 0xffffffff; + out1[2] = 0xffffffff; + out1[3] = (0x0 as u32); + out1[4] = (0x1 as u32); + out1[5] = (0x0 as u32); + out1[6] = (0x0 as u32); + out1[7] = (0x0 as u32); + out1[8] = (0x0 as u32); + out1[9] = (0x0 as u32); + out1[10] = (0x0 as u32); + out1[11] = (0x0 as u32); +} + +/// The function fiat_p384_msat returns the saturated representation of the prime modulus. +/// +/// Postconditions: +/// twos_complement_eval out1 = m +/// 0 ≤ eval out1 < m +/// +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +#[inline] +pub fn fiat_p384_msat(out1: &mut [u32; 13]) -> () { + out1[0] = 0xffffffff; + out1[1] = (0x0 as u32); + out1[2] = (0x0 as u32); + out1[3] = 0xffffffff; + out1[4] = 0xfffffffe; + out1[5] = 0xffffffff; + out1[6] = 0xffffffff; + out1[7] = 0xffffffff; + out1[8] = 0xffffffff; + out1[9] = 0xffffffff; + out1[10] = 0xffffffff; + out1[11] = 0xffffffff; + out1[12] = (0x0 as u32); +} + +/// The function fiat_p384_divstep computes a divstep. +/// +/// Preconditions: +/// 0 ≤ eval arg4 < m +/// 0 ≤ eval arg5 < m +/// Postconditions: +/// out1 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then 1 - arg1 else 1 + arg1) +/// twos_complement_eval out2 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then twos_complement_eval arg3 else twos_complement_eval arg2) +/// twos_complement_eval out3 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then ⌊(twos_complement_eval arg3 - twos_complement_eval arg2) / 2⌋ else ⌊(twos_complement_eval arg3 + (twos_complement_eval arg3 mod 2) * twos_complement_eval arg2) / 2⌋) +/// eval (from_montgomery out4) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (2 * eval (from_montgomery arg5)) mod m else (2 * eval (from_montgomery arg4)) mod m) +/// eval (from_montgomery out5) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (eval (from_montgomery arg4) - eval (from_montgomery arg4)) mod m else (eval (from_montgomery arg5) + (twos_complement_eval arg3 mod 2) * eval (from_montgomery arg4)) mod m) +/// 0 ≤ eval out5 < m +/// 0 ≤ eval out5 < m +/// 0 ≤ eval out2 < m +/// 0 ≤ eval out3 < m +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0xffffffff] +/// arg2: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// arg3: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// arg4: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// arg5: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +/// out2: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// out3: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// out4: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// out5: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +#[inline] +pub fn fiat_p384_divstep(out1: &mut u32, out2: &mut [u32; 13], out3: &mut [u32; 13], out4: &mut [u32; 12], out5: &mut [u32; 12], arg1: u32, arg2: &[u32; 13], arg3: &[u32; 13], arg4: &[u32; 12], arg5: &[u32; 12]) -> () { + let mut x1: u32 = 0; + let mut x2: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x1, &mut x2, 0x0, (!arg1), (0x1 as u32)); + let x3: fiat_p384_u1 = (((x1 >> 31) as fiat_p384_u1) & (((arg3[0]) & (0x1 as u32)) as fiat_p384_u1)); + let mut x4: u32 = 0; + let mut x5: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x4, &mut x5, 0x0, (!arg1), (0x1 as u32)); + let mut x6: u32 = 0; + fiat_p384_cmovznz_u32(&mut x6, x3, arg1, x4); + let mut x7: u32 = 0; + fiat_p384_cmovznz_u32(&mut x7, x3, (arg2[0]), (arg3[0])); + let mut x8: u32 = 0; + fiat_p384_cmovznz_u32(&mut x8, x3, (arg2[1]), (arg3[1])); + let mut x9: u32 = 0; + fiat_p384_cmovznz_u32(&mut x9, x3, (arg2[2]), (arg3[2])); + let mut x10: u32 = 0; + fiat_p384_cmovznz_u32(&mut x10, x3, (arg2[3]), (arg3[3])); + let mut x11: u32 = 0; + fiat_p384_cmovznz_u32(&mut x11, x3, (arg2[4]), (arg3[4])); + let mut x12: u32 = 0; + fiat_p384_cmovznz_u32(&mut x12, x3, (arg2[5]), (arg3[5])); + let mut x13: u32 = 0; + fiat_p384_cmovznz_u32(&mut x13, x3, (arg2[6]), (arg3[6])); + let mut x14: u32 = 0; + fiat_p384_cmovznz_u32(&mut x14, x3, (arg2[7]), (arg3[7])); + let mut x15: u32 = 0; + fiat_p384_cmovznz_u32(&mut x15, x3, (arg2[8]), (arg3[8])); + let mut x16: u32 = 0; + fiat_p384_cmovznz_u32(&mut x16, x3, (arg2[9]), (arg3[9])); + let mut x17: u32 = 0; + fiat_p384_cmovznz_u32(&mut x17, x3, (arg2[10]), (arg3[10])); + let mut x18: u32 = 0; + fiat_p384_cmovznz_u32(&mut x18, x3, (arg2[11]), (arg3[11])); + let mut x19: u32 = 0; + fiat_p384_cmovznz_u32(&mut x19, x3, (arg2[12]), (arg3[12])); + let mut x20: u32 = 0; + let mut x21: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x20, &mut x21, 0x0, (0x1 as u32), (!(arg2[0]))); + let mut x22: u32 = 0; + let mut x23: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x22, &mut x23, x21, (0x0 as u32), (!(arg2[1]))); + let mut x24: u32 = 0; + let mut x25: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x24, &mut x25, x23, (0x0 as u32), (!(arg2[2]))); + let mut x26: u32 = 0; + let mut x27: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x26, &mut x27, x25, (0x0 as u32), (!(arg2[3]))); + let mut x28: u32 = 0; + let mut x29: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x28, &mut x29, x27, (0x0 as u32), (!(arg2[4]))); + let mut x30: u32 = 0; + let mut x31: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x30, &mut x31, x29, (0x0 as u32), (!(arg2[5]))); + let mut x32: u32 = 0; + let mut x33: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x32, &mut x33, x31, (0x0 as u32), (!(arg2[6]))); + let mut x34: u32 = 0; + let mut x35: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x34, &mut x35, x33, (0x0 as u32), (!(arg2[7]))); + let mut x36: u32 = 0; + let mut x37: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x36, &mut x37, x35, (0x0 as u32), (!(arg2[8]))); + let mut x38: u32 = 0; + let mut x39: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x38, &mut x39, x37, (0x0 as u32), (!(arg2[9]))); + let mut x40: u32 = 0; + let mut x41: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x40, &mut x41, x39, (0x0 as u32), (!(arg2[10]))); + let mut x42: u32 = 0; + let mut x43: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x42, &mut x43, x41, (0x0 as u32), (!(arg2[11]))); + let mut x44: u32 = 0; + let mut x45: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x44, &mut x45, x43, (0x0 as u32), (!(arg2[12]))); + let mut x46: u32 = 0; + fiat_p384_cmovznz_u32(&mut x46, x3, (arg3[0]), x20); + let mut x47: u32 = 0; + fiat_p384_cmovznz_u32(&mut x47, x3, (arg3[1]), x22); + let mut x48: u32 = 0; + fiat_p384_cmovznz_u32(&mut x48, x3, (arg3[2]), x24); + let mut x49: u32 = 0; + fiat_p384_cmovznz_u32(&mut x49, x3, (arg3[3]), x26); + let mut x50: u32 = 0; + fiat_p384_cmovznz_u32(&mut x50, x3, (arg3[4]), x28); + let mut x51: u32 = 0; + fiat_p384_cmovznz_u32(&mut x51, x3, (arg3[5]), x30); + let mut x52: u32 = 0; + fiat_p384_cmovznz_u32(&mut x52, x3, (arg3[6]), x32); + let mut x53: u32 = 0; + fiat_p384_cmovznz_u32(&mut x53, x3, (arg3[7]), x34); + let mut x54: u32 = 0; + fiat_p384_cmovznz_u32(&mut x54, x3, (arg3[8]), x36); + let mut x55: u32 = 0; + fiat_p384_cmovznz_u32(&mut x55, x3, (arg3[9]), x38); + let mut x56: u32 = 0; + fiat_p384_cmovznz_u32(&mut x56, x3, (arg3[10]), x40); + let mut x57: u32 = 0; + fiat_p384_cmovznz_u32(&mut x57, x3, (arg3[11]), x42); + let mut x58: u32 = 0; + fiat_p384_cmovznz_u32(&mut x58, x3, (arg3[12]), x44); + let mut x59: u32 = 0; + fiat_p384_cmovznz_u32(&mut x59, x3, (arg4[0]), (arg5[0])); + let mut x60: u32 = 0; + fiat_p384_cmovznz_u32(&mut x60, x3, (arg4[1]), (arg5[1])); + let mut x61: u32 = 0; + fiat_p384_cmovznz_u32(&mut x61, x3, (arg4[2]), (arg5[2])); + let mut x62: u32 = 0; + fiat_p384_cmovznz_u32(&mut x62, x3, (arg4[3]), (arg5[3])); + let mut x63: u32 = 0; + fiat_p384_cmovznz_u32(&mut x63, x3, (arg4[4]), (arg5[4])); + let mut x64: u32 = 0; + fiat_p384_cmovznz_u32(&mut x64, x3, (arg4[5]), (arg5[5])); + let mut x65: u32 = 0; + fiat_p384_cmovznz_u32(&mut x65, x3, (arg4[6]), (arg5[6])); + let mut x66: u32 = 0; + fiat_p384_cmovznz_u32(&mut x66, x3, (arg4[7]), (arg5[7])); + let mut x67: u32 = 0; + fiat_p384_cmovznz_u32(&mut x67, x3, (arg4[8]), (arg5[8])); + let mut x68: u32 = 0; + fiat_p384_cmovznz_u32(&mut x68, x3, (arg4[9]), (arg5[9])); + let mut x69: u32 = 0; + fiat_p384_cmovznz_u32(&mut x69, x3, (arg4[10]), (arg5[10])); + let mut x70: u32 = 0; + fiat_p384_cmovznz_u32(&mut x70, x3, (arg4[11]), (arg5[11])); + let mut x71: u32 = 0; + let mut x72: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x71, &mut x72, 0x0, x59, x59); + let mut x73: u32 = 0; + let mut x74: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x73, &mut x74, x72, x60, x60); + let mut x75: u32 = 0; + let mut x76: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x75, &mut x76, x74, x61, x61); + let mut x77: u32 = 0; + let mut x78: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x77, &mut x78, x76, x62, x62); + let mut x79: u32 = 0; + let mut x80: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x79, &mut x80, x78, x63, x63); + let mut x81: u32 = 0; + let mut x82: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x81, &mut x82, x80, x64, x64); + let mut x83: u32 = 0; + let mut x84: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x83, &mut x84, x82, x65, x65); + let mut x85: u32 = 0; + let mut x86: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x85, &mut x86, x84, x66, x66); + let mut x87: u32 = 0; + let mut x88: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x87, &mut x88, x86, x67, x67); + let mut x89: u32 = 0; + let mut x90: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x89, &mut x90, x88, x68, x68); + let mut x91: u32 = 0; + let mut x92: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x91, &mut x92, x90, x69, x69); + let mut x93: u32 = 0; + let mut x94: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x93, &mut x94, x92, x70, x70); + let mut x95: u32 = 0; + let mut x96: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x95, &mut x96, 0x0, x71, 0xffffffff); + let mut x97: u32 = 0; + let mut x98: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x97, &mut x98, x96, x73, (0x0 as u32)); + let mut x99: u32 = 0; + let mut x100: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x99, &mut x100, x98, x75, (0x0 as u32)); + let mut x101: u32 = 0; + let mut x102: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x101, &mut x102, x100, x77, 0xffffffff); + let mut x103: u32 = 0; + let mut x104: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x103, &mut x104, x102, x79, 0xfffffffe); + let mut x105: u32 = 0; + let mut x106: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x105, &mut x106, x104, x81, 0xffffffff); + let mut x107: u32 = 0; + let mut x108: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x107, &mut x108, x106, x83, 0xffffffff); + let mut x109: u32 = 0; + let mut x110: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x109, &mut x110, x108, x85, 0xffffffff); + let mut x111: u32 = 0; + let mut x112: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x111, &mut x112, x110, x87, 0xffffffff); + let mut x113: u32 = 0; + let mut x114: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x113, &mut x114, x112, x89, 0xffffffff); + let mut x115: u32 = 0; + let mut x116: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x115, &mut x116, x114, x91, 0xffffffff); + let mut x117: u32 = 0; + let mut x118: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x117, &mut x118, x116, x93, 0xffffffff); + let mut x119: u32 = 0; + let mut x120: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x119, &mut x120, x118, (x94 as u32), (0x0 as u32)); + let x121: u32 = (arg4[11]); + let x122: u32 = (arg4[10]); + let x123: u32 = (arg4[9]); + let x124: u32 = (arg4[8]); + let x125: u32 = (arg4[7]); + let x126: u32 = (arg4[6]); + let x127: u32 = (arg4[5]); + let x128: u32 = (arg4[4]); + let x129: u32 = (arg4[3]); + let x130: u32 = (arg4[2]); + let x131: u32 = (arg4[1]); + let x132: u32 = (arg4[0]); + let mut x133: u32 = 0; + let mut x134: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x133, &mut x134, 0x0, (0x0 as u32), x132); + let mut x135: u32 = 0; + let mut x136: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x135, &mut x136, x134, (0x0 as u32), x131); + let mut x137: u32 = 0; + let mut x138: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x137, &mut x138, x136, (0x0 as u32), x130); + let mut x139: u32 = 0; + let mut x140: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x139, &mut x140, x138, (0x0 as u32), x129); + let mut x141: u32 = 0; + let mut x142: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x141, &mut x142, x140, (0x0 as u32), x128); + let mut x143: u32 = 0; + let mut x144: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x143, &mut x144, x142, (0x0 as u32), x127); + let mut x145: u32 = 0; + let mut x146: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x145, &mut x146, x144, (0x0 as u32), x126); + let mut x147: u32 = 0; + let mut x148: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x147, &mut x148, x146, (0x0 as u32), x125); + let mut x149: u32 = 0; + let mut x150: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x149, &mut x150, x148, (0x0 as u32), x124); + let mut x151: u32 = 0; + let mut x152: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x151, &mut x152, x150, (0x0 as u32), x123); + let mut x153: u32 = 0; + let mut x154: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x153, &mut x154, x152, (0x0 as u32), x122); + let mut x155: u32 = 0; + let mut x156: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x155, &mut x156, x154, (0x0 as u32), x121); + let mut x157: u32 = 0; + fiat_p384_cmovznz_u32(&mut x157, x156, (0x0 as u32), 0xffffffff); + let mut x158: u32 = 0; + let mut x159: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x158, &mut x159, 0x0, x133, x157); + let mut x160: u32 = 0; + let mut x161: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x160, &mut x161, x159, x135, (0x0 as u32)); + let mut x162: u32 = 0; + let mut x163: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x162, &mut x163, x161, x137, (0x0 as u32)); + let mut x164: u32 = 0; + let mut x165: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x164, &mut x165, x163, x139, x157); + let mut x166: u32 = 0; + let mut x167: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x166, &mut x167, x165, x141, (x157 & 0xfffffffe)); + let mut x168: u32 = 0; + let mut x169: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x168, &mut x169, x167, x143, x157); + let mut x170: u32 = 0; + let mut x171: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x170, &mut x171, x169, x145, x157); + let mut x172: u32 = 0; + let mut x173: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x172, &mut x173, x171, x147, x157); + let mut x174: u32 = 0; + let mut x175: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x174, &mut x175, x173, x149, x157); + let mut x176: u32 = 0; + let mut x177: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x176, &mut x177, x175, x151, x157); + let mut x178: u32 = 0; + let mut x179: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x178, &mut x179, x177, x153, x157); + let mut x180: u32 = 0; + let mut x181: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x180, &mut x181, x179, x155, x157); + let mut x182: u32 = 0; + fiat_p384_cmovznz_u32(&mut x182, x3, (arg5[0]), x158); + let mut x183: u32 = 0; + fiat_p384_cmovznz_u32(&mut x183, x3, (arg5[1]), x160); + let mut x184: u32 = 0; + fiat_p384_cmovznz_u32(&mut x184, x3, (arg5[2]), x162); + let mut x185: u32 = 0; + fiat_p384_cmovznz_u32(&mut x185, x3, (arg5[3]), x164); + let mut x186: u32 = 0; + fiat_p384_cmovznz_u32(&mut x186, x3, (arg5[4]), x166); + let mut x187: u32 = 0; + fiat_p384_cmovznz_u32(&mut x187, x3, (arg5[5]), x168); + let mut x188: u32 = 0; + fiat_p384_cmovznz_u32(&mut x188, x3, (arg5[6]), x170); + let mut x189: u32 = 0; + fiat_p384_cmovznz_u32(&mut x189, x3, (arg5[7]), x172); + let mut x190: u32 = 0; + fiat_p384_cmovznz_u32(&mut x190, x3, (arg5[8]), x174); + let mut x191: u32 = 0; + fiat_p384_cmovznz_u32(&mut x191, x3, (arg5[9]), x176); + let mut x192: u32 = 0; + fiat_p384_cmovznz_u32(&mut x192, x3, (arg5[10]), x178); + let mut x193: u32 = 0; + fiat_p384_cmovznz_u32(&mut x193, x3, (arg5[11]), x180); + let x194: fiat_p384_u1 = ((x46 & (0x1 as u32)) as fiat_p384_u1); + let mut x195: u32 = 0; + fiat_p384_cmovznz_u32(&mut x195, x194, (0x0 as u32), x7); + let mut x196: u32 = 0; + fiat_p384_cmovznz_u32(&mut x196, x194, (0x0 as u32), x8); + let mut x197: u32 = 0; + fiat_p384_cmovznz_u32(&mut x197, x194, (0x0 as u32), x9); + let mut x198: u32 = 0; + fiat_p384_cmovznz_u32(&mut x198, x194, (0x0 as u32), x10); + let mut x199: u32 = 0; + fiat_p384_cmovznz_u32(&mut x199, x194, (0x0 as u32), x11); + let mut x200: u32 = 0; + fiat_p384_cmovznz_u32(&mut x200, x194, (0x0 as u32), x12); + let mut x201: u32 = 0; + fiat_p384_cmovznz_u32(&mut x201, x194, (0x0 as u32), x13); + let mut x202: u32 = 0; + fiat_p384_cmovznz_u32(&mut x202, x194, (0x0 as u32), x14); + let mut x203: u32 = 0; + fiat_p384_cmovznz_u32(&mut x203, x194, (0x0 as u32), x15); + let mut x204: u32 = 0; + fiat_p384_cmovznz_u32(&mut x204, x194, (0x0 as u32), x16); + let mut x205: u32 = 0; + fiat_p384_cmovznz_u32(&mut x205, x194, (0x0 as u32), x17); + let mut x206: u32 = 0; + fiat_p384_cmovznz_u32(&mut x206, x194, (0x0 as u32), x18); + let mut x207: u32 = 0; + fiat_p384_cmovznz_u32(&mut x207, x194, (0x0 as u32), x19); + let mut x208: u32 = 0; + let mut x209: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x208, &mut x209, 0x0, x46, x195); + let mut x210: u32 = 0; + let mut x211: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x210, &mut x211, x209, x47, x196); + let mut x212: u32 = 0; + let mut x213: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x212, &mut x213, x211, x48, x197); + let mut x214: u32 = 0; + let mut x215: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x214, &mut x215, x213, x49, x198); + let mut x216: u32 = 0; + let mut x217: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x216, &mut x217, x215, x50, x199); + let mut x218: u32 = 0; + let mut x219: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x218, &mut x219, x217, x51, x200); + let mut x220: u32 = 0; + let mut x221: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x220, &mut x221, x219, x52, x201); + let mut x222: u32 = 0; + let mut x223: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x222, &mut x223, x221, x53, x202); + let mut x224: u32 = 0; + let mut x225: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x224, &mut x225, x223, x54, x203); + let mut x226: u32 = 0; + let mut x227: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x226, &mut x227, x225, x55, x204); + let mut x228: u32 = 0; + let mut x229: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x228, &mut x229, x227, x56, x205); + let mut x230: u32 = 0; + let mut x231: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x230, &mut x231, x229, x57, x206); + let mut x232: u32 = 0; + let mut x233: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x232, &mut x233, x231, x58, x207); + let mut x234: u32 = 0; + fiat_p384_cmovznz_u32(&mut x234, x194, (0x0 as u32), x59); + let mut x235: u32 = 0; + fiat_p384_cmovznz_u32(&mut x235, x194, (0x0 as u32), x60); + let mut x236: u32 = 0; + fiat_p384_cmovznz_u32(&mut x236, x194, (0x0 as u32), x61); + let mut x237: u32 = 0; + fiat_p384_cmovznz_u32(&mut x237, x194, (0x0 as u32), x62); + let mut x238: u32 = 0; + fiat_p384_cmovznz_u32(&mut x238, x194, (0x0 as u32), x63); + let mut x239: u32 = 0; + fiat_p384_cmovznz_u32(&mut x239, x194, (0x0 as u32), x64); + let mut x240: u32 = 0; + fiat_p384_cmovznz_u32(&mut x240, x194, (0x0 as u32), x65); + let mut x241: u32 = 0; + fiat_p384_cmovznz_u32(&mut x241, x194, (0x0 as u32), x66); + let mut x242: u32 = 0; + fiat_p384_cmovznz_u32(&mut x242, x194, (0x0 as u32), x67); + let mut x243: u32 = 0; + fiat_p384_cmovznz_u32(&mut x243, x194, (0x0 as u32), x68); + let mut x244: u32 = 0; + fiat_p384_cmovznz_u32(&mut x244, x194, (0x0 as u32), x69); + let mut x245: u32 = 0; + fiat_p384_cmovznz_u32(&mut x245, x194, (0x0 as u32), x70); + let mut x246: u32 = 0; + let mut x247: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x246, &mut x247, 0x0, x182, x234); + let mut x248: u32 = 0; + let mut x249: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x248, &mut x249, x247, x183, x235); + let mut x250: u32 = 0; + let mut x251: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x250, &mut x251, x249, x184, x236); + let mut x252: u32 = 0; + let mut x253: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x252, &mut x253, x251, x185, x237); + let mut x254: u32 = 0; + let mut x255: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x254, &mut x255, x253, x186, x238); + let mut x256: u32 = 0; + let mut x257: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x256, &mut x257, x255, x187, x239); + let mut x258: u32 = 0; + let mut x259: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x258, &mut x259, x257, x188, x240); + let mut x260: u32 = 0; + let mut x261: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x260, &mut x261, x259, x189, x241); + let mut x262: u32 = 0; + let mut x263: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x262, &mut x263, x261, x190, x242); + let mut x264: u32 = 0; + let mut x265: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x264, &mut x265, x263, x191, x243); + let mut x266: u32 = 0; + let mut x267: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x266, &mut x267, x265, x192, x244); + let mut x268: u32 = 0; + let mut x269: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x268, &mut x269, x267, x193, x245); + let mut x270: u32 = 0; + let mut x271: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x270, &mut x271, 0x0, x246, 0xffffffff); + let mut x272: u32 = 0; + let mut x273: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x272, &mut x273, x271, x248, (0x0 as u32)); + let mut x274: u32 = 0; + let mut x275: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x274, &mut x275, x273, x250, (0x0 as u32)); + let mut x276: u32 = 0; + let mut x277: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x276, &mut x277, x275, x252, 0xffffffff); + let mut x278: u32 = 0; + let mut x279: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x278, &mut x279, x277, x254, 0xfffffffe); + let mut x280: u32 = 0; + let mut x281: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x280, &mut x281, x279, x256, 0xffffffff); + let mut x282: u32 = 0; + let mut x283: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x282, &mut x283, x281, x258, 0xffffffff); + let mut x284: u32 = 0; + let mut x285: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x284, &mut x285, x283, x260, 0xffffffff); + let mut x286: u32 = 0; + let mut x287: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x286, &mut x287, x285, x262, 0xffffffff); + let mut x288: u32 = 0; + let mut x289: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x288, &mut x289, x287, x264, 0xffffffff); + let mut x290: u32 = 0; + let mut x291: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x290, &mut x291, x289, x266, 0xffffffff); + let mut x292: u32 = 0; + let mut x293: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x292, &mut x293, x291, x268, 0xffffffff); + let mut x294: u32 = 0; + let mut x295: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u32(&mut x294, &mut x295, x293, (x269 as u32), (0x0 as u32)); + let mut x296: u32 = 0; + let mut x297: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u32(&mut x296, &mut x297, 0x0, x6, (0x1 as u32)); + let x298: u32 = ((x208 >> 1) | ((x210 << 31) & 0xffffffff)); + let x299: u32 = ((x210 >> 1) | ((x212 << 31) & 0xffffffff)); + let x300: u32 = ((x212 >> 1) | ((x214 << 31) & 0xffffffff)); + let x301: u32 = ((x214 >> 1) | ((x216 << 31) & 0xffffffff)); + let x302: u32 = ((x216 >> 1) | ((x218 << 31) & 0xffffffff)); + let x303: u32 = ((x218 >> 1) | ((x220 << 31) & 0xffffffff)); + let x304: u32 = ((x220 >> 1) | ((x222 << 31) & 0xffffffff)); + let x305: u32 = ((x222 >> 1) | ((x224 << 31) & 0xffffffff)); + let x306: u32 = ((x224 >> 1) | ((x226 << 31) & 0xffffffff)); + let x307: u32 = ((x226 >> 1) | ((x228 << 31) & 0xffffffff)); + let x308: u32 = ((x228 >> 1) | ((x230 << 31) & 0xffffffff)); + let x309: u32 = ((x230 >> 1) | ((x232 << 31) & 0xffffffff)); + let x310: u32 = ((x232 & 0x80000000) | (x232 >> 1)); + let mut x311: u32 = 0; + fiat_p384_cmovznz_u32(&mut x311, x120, x95, x71); + let mut x312: u32 = 0; + fiat_p384_cmovznz_u32(&mut x312, x120, x97, x73); + let mut x313: u32 = 0; + fiat_p384_cmovznz_u32(&mut x313, x120, x99, x75); + let mut x314: u32 = 0; + fiat_p384_cmovznz_u32(&mut x314, x120, x101, x77); + let mut x315: u32 = 0; + fiat_p384_cmovznz_u32(&mut x315, x120, x103, x79); + let mut x316: u32 = 0; + fiat_p384_cmovznz_u32(&mut x316, x120, x105, x81); + let mut x317: u32 = 0; + fiat_p384_cmovznz_u32(&mut x317, x120, x107, x83); + let mut x318: u32 = 0; + fiat_p384_cmovznz_u32(&mut x318, x120, x109, x85); + let mut x319: u32 = 0; + fiat_p384_cmovznz_u32(&mut x319, x120, x111, x87); + let mut x320: u32 = 0; + fiat_p384_cmovznz_u32(&mut x320, x120, x113, x89); + let mut x321: u32 = 0; + fiat_p384_cmovznz_u32(&mut x321, x120, x115, x91); + let mut x322: u32 = 0; + fiat_p384_cmovznz_u32(&mut x322, x120, x117, x93); + let mut x323: u32 = 0; + fiat_p384_cmovznz_u32(&mut x323, x295, x270, x246); + let mut x324: u32 = 0; + fiat_p384_cmovznz_u32(&mut x324, x295, x272, x248); + let mut x325: u32 = 0; + fiat_p384_cmovznz_u32(&mut x325, x295, x274, x250); + let mut x326: u32 = 0; + fiat_p384_cmovznz_u32(&mut x326, x295, x276, x252); + let mut x327: u32 = 0; + fiat_p384_cmovznz_u32(&mut x327, x295, x278, x254); + let mut x328: u32 = 0; + fiat_p384_cmovznz_u32(&mut x328, x295, x280, x256); + let mut x329: u32 = 0; + fiat_p384_cmovznz_u32(&mut x329, x295, x282, x258); + let mut x330: u32 = 0; + fiat_p384_cmovznz_u32(&mut x330, x295, x284, x260); + let mut x331: u32 = 0; + fiat_p384_cmovznz_u32(&mut x331, x295, x286, x262); + let mut x332: u32 = 0; + fiat_p384_cmovznz_u32(&mut x332, x295, x288, x264); + let mut x333: u32 = 0; + fiat_p384_cmovznz_u32(&mut x333, x295, x290, x266); + let mut x334: u32 = 0; + fiat_p384_cmovznz_u32(&mut x334, x295, x292, x268); + *out1 = x296; + out2[0] = x7; + out2[1] = x8; + out2[2] = x9; + out2[3] = x10; + out2[4] = x11; + out2[5] = x12; + out2[6] = x13; + out2[7] = x14; + out2[8] = x15; + out2[9] = x16; + out2[10] = x17; + out2[11] = x18; + out2[12] = x19; + out3[0] = x298; + out3[1] = x299; + out3[2] = x300; + out3[3] = x301; + out3[4] = x302; + out3[5] = x303; + out3[6] = x304; + out3[7] = x305; + out3[8] = x306; + out3[9] = x307; + out3[10] = x308; + out3[11] = x309; + out3[12] = x310; + out4[0] = x311; + out4[1] = x312; + out4[2] = x313; + out4[3] = x314; + out4[4] = x315; + out4[5] = x316; + out4[6] = x317; + out4[7] = x318; + out4[8] = x319; + out4[9] = x320; + out4[10] = x321; + out4[11] = x322; + out5[0] = x323; + out5[1] = x324; + out5[2] = x325; + out5[3] = x326; + out5[4] = x327; + out5[5] = x328; + out5[6] = x329; + out5[7] = x330; + out5[8] = x331; + out5[9] = x332; + out5[10] = x333; + out5[11] = x334; +} + +/// The function fiat_p384_divstep_precomp returns the precomputed value for Bernstein-Yang-inversion (in montgomery form). +/// +/// Postconditions: +/// eval (from_montgomery out1) = ⌊(m - 1) / 2⌋^(if ⌊log2 m⌋ + 1 < 46 then ⌊(49 * (⌊log2 m⌋ + 1) + 80) / 17⌋ else ⌊(49 * (⌊log2 m⌋ + 1) + 57) / 17⌋) +/// 0 ≤ eval out1 < m +/// +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +#[inline] +pub fn fiat_p384_divstep_precomp(out1: &mut [u32; 12]) -> () { + out1[0] = 0xfff18fff; + out1[1] = 0xfff69400; + out1[2] = 0xffffd3ff; + out1[3] = 0x2b7fe; + out1[4] = 0xfffe97ff; + out1[5] = 0xfffedbff; + out1[6] = 0x2fff; + out1[7] = 0x28400; + out1[8] = 0x50400; + out1[9] = 0x60400; + out1[10] = 0x38000; + out1[11] = 0xfffc4800; +} diff --git a/vendor/fiat-crypto/src/p384_64.rs b/vendor/fiat-crypto/src/p384_64.rs new file mode 100644 index 000000000..a14d7d3c2 --- /dev/null +++ b/vendor/fiat-crypto/src/p384_64.rs @@ -0,0 +1,3571 @@ +//! Autogenerated: 'src/ExtractionOCaml/word_by_word_montgomery' --lang Rust --inline p384 64 '2^384 - 2^128 - 2^96 + 2^32 - 1' mul square add sub opp from_montgomery to_montgomery nonzero selectznz to_bytes from_bytes one msat divstep divstep_precomp +//! curve description: p384 +//! machine_wordsize = 64 (from "64") +//! requested operations: mul, square, add, sub, opp, from_montgomery, to_montgomery, nonzero, selectznz, to_bytes, from_bytes, one, msat, divstep, divstep_precomp +//! m = 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffff0000000000000000ffffffff (from "2^384 - 2^128 - 2^96 + 2^32 - 1") +//! +//! NOTE: In addition to the bounds specified above each function, all +//! functions synthesized for this Montgomery arithmetic require the +//! input to be strictly less than the prime modulus (m), and also +//! require the input to be in the unique saturated representation. +//! All functions also ensure that these two properties are true of +//! return values. +//! +//! Computed values: +//! eval z = z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) + (z[4] << 256) + (z[5] << 0x140) +//! bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248) + (z[32] << 256) + (z[33] << 0x108) + (z[34] << 0x110) + (z[35] << 0x118) + (z[36] << 0x120) + (z[37] << 0x128) + (z[38] << 0x130) + (z[39] << 0x138) + (z[40] << 0x140) + (z[41] << 0x148) + (z[42] << 0x150) + (z[43] << 0x158) + (z[44] << 0x160) + (z[45] << 0x168) + (z[46] << 0x170) + (z[47] << 0x178) +//! twos_complement_eval z = let x1 := z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) + (z[4] << 256) + (z[5] << 0x140) in +//! if x1 & (2^384-1) < 2^383 then x1 & (2^384-1) else (x1 & (2^384-1)) - 2^384 + +#![allow(unused_parens)] +#![allow(non_camel_case_types)] + +pub type fiat_p384_u1 = u8; +pub type fiat_p384_i1 = i8; +pub type fiat_p384_u2 = u8; +pub type fiat_p384_i2 = i8; + +/* The type fiat_p384_montgomery_domain_field_element is a field element in the Montgomery domain. */ +/* Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] */ +pub type fiat_p384_montgomery_domain_field_element = [u64; 6]; + +/* The type fiat_p384_non_montgomery_domain_field_element is a field element NOT in the Montgomery domain. */ +/* Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] */ +pub type fiat_p384_non_montgomery_domain_field_element = [u64; 6]; + + +/// The function fiat_p384_addcarryx_u64 is an addition with carry. +/// +/// Postconditions: +/// out1 = (arg1 + arg2 + arg3) mod 2^64 +/// out2 = ⌊(arg1 + arg2 + arg3) / 2^64⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffffffffffff] +/// arg3: [0x0 ~> 0xffffffffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_p384_addcarryx_u64(out1: &mut u64, out2: &mut fiat_p384_u1, arg1: fiat_p384_u1, arg2: u64, arg3: u64) -> () { + let x1: u128 = (((arg1 as u128) + (arg2 as u128)) + (arg3 as u128)); + let x2: u64 = ((x1 & (0xffffffffffffffff as u128)) as u64); + let x3: fiat_p384_u1 = ((x1 >> 64) as fiat_p384_u1); + *out1 = x2; + *out2 = x3; +} + +/// The function fiat_p384_subborrowx_u64 is a subtraction with borrow. +/// +/// Postconditions: +/// out1 = (-arg1 + arg2 + -arg3) mod 2^64 +/// out2 = -⌊(-arg1 + arg2 + -arg3) / 2^64⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffffffffffff] +/// arg3: [0x0 ~> 0xffffffffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_p384_subborrowx_u64(out1: &mut u64, out2: &mut fiat_p384_u1, arg1: fiat_p384_u1, arg2: u64, arg3: u64) -> () { + let x1: i128 = (((arg2 as i128) - (arg1 as i128)) - (arg3 as i128)); + let x2: fiat_p384_i1 = ((x1 >> 64) as fiat_p384_i1); + let x3: u64 = ((x1 & (0xffffffffffffffff as i128)) as u64); + *out1 = x3; + *out2 = (((0x0 as fiat_p384_i2) - (x2 as fiat_p384_i2)) as fiat_p384_u1); +} + +/// The function fiat_p384_mulx_u64 is a multiplication, returning the full double-width result. +/// +/// Postconditions: +/// out1 = (arg1 * arg2) mod 2^64 +/// out2 = ⌊arg1 * arg2 / 2^64⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0xffffffffffffffff] +/// arg2: [0x0 ~> 0xffffffffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +/// out2: [0x0 ~> 0xffffffffffffffff] +#[inline] +pub fn fiat_p384_mulx_u64(out1: &mut u64, out2: &mut u64, arg1: u64, arg2: u64) -> () { + let x1: u128 = ((arg1 as u128) * (arg2 as u128)); + let x2: u64 = ((x1 & (0xffffffffffffffff as u128)) as u64); + let x3: u64 = ((x1 >> 64) as u64); + *out1 = x2; + *out2 = x3; +} + +/// The function fiat_p384_cmovznz_u64 is a single-word conditional move. +/// +/// Postconditions: +/// out1 = (if arg1 = 0 then arg2 else arg3) +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffffffffffff] +/// arg3: [0x0 ~> 0xffffffffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +#[inline] +pub fn fiat_p384_cmovznz_u64(out1: &mut u64, arg1: fiat_p384_u1, arg2: u64, arg3: u64) -> () { + let x1: fiat_p384_u1 = (!(!arg1)); + let x2: u64 = ((((((0x0 as fiat_p384_i2) - (x1 as fiat_p384_i2)) as fiat_p384_i1) as i128) & (0xffffffffffffffff as i128)) as u64); + let x3: u64 = ((x2 & arg3) | ((!x2) & arg2)); + *out1 = x3; +} + +/// The function fiat_p384_mul multiplies two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p384_mul(out1: &mut fiat_p384_montgomery_domain_field_element, arg1: &fiat_p384_montgomery_domain_field_element, arg2: &fiat_p384_montgomery_domain_field_element) -> () { + let x1: u64 = (arg1[1]); + let x2: u64 = (arg1[2]); + let x3: u64 = (arg1[3]); + let x4: u64 = (arg1[4]); + let x5: u64 = (arg1[5]); + let x6: u64 = (arg1[0]); + let mut x7: u64 = 0; + let mut x8: u64 = 0; + fiat_p384_mulx_u64(&mut x7, &mut x8, x6, (arg2[5])); + let mut x9: u64 = 0; + let mut x10: u64 = 0; + fiat_p384_mulx_u64(&mut x9, &mut x10, x6, (arg2[4])); + let mut x11: u64 = 0; + let mut x12: u64 = 0; + fiat_p384_mulx_u64(&mut x11, &mut x12, x6, (arg2[3])); + let mut x13: u64 = 0; + let mut x14: u64 = 0; + fiat_p384_mulx_u64(&mut x13, &mut x14, x6, (arg2[2])); + let mut x15: u64 = 0; + let mut x16: u64 = 0; + fiat_p384_mulx_u64(&mut x15, &mut x16, x6, (arg2[1])); + let mut x17: u64 = 0; + let mut x18: u64 = 0; + fiat_p384_mulx_u64(&mut x17, &mut x18, x6, (arg2[0])); + let mut x19: u64 = 0; + let mut x20: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x19, &mut x20, 0x0, x18, x15); + let mut x21: u64 = 0; + let mut x22: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x21, &mut x22, x20, x16, x13); + let mut x23: u64 = 0; + let mut x24: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x23, &mut x24, x22, x14, x11); + let mut x25: u64 = 0; + let mut x26: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x25, &mut x26, x24, x12, x9); + let mut x27: u64 = 0; + let mut x28: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x27, &mut x28, x26, x10, x7); + let x29: u64 = ((x28 as u64) + x8); + let mut x30: u64 = 0; + let mut x31: u64 = 0; + fiat_p384_mulx_u64(&mut x30, &mut x31, x17, 0x100000001); + let mut x32: u64 = 0; + let mut x33: u64 = 0; + fiat_p384_mulx_u64(&mut x32, &mut x33, x30, 0xffffffffffffffff); + let mut x34: u64 = 0; + let mut x35: u64 = 0; + fiat_p384_mulx_u64(&mut x34, &mut x35, x30, 0xffffffffffffffff); + let mut x36: u64 = 0; + let mut x37: u64 = 0; + fiat_p384_mulx_u64(&mut x36, &mut x37, x30, 0xffffffffffffffff); + let mut x38: u64 = 0; + let mut x39: u64 = 0; + fiat_p384_mulx_u64(&mut x38, &mut x39, x30, 0xfffffffffffffffe); + let mut x40: u64 = 0; + let mut x41: u64 = 0; + fiat_p384_mulx_u64(&mut x40, &mut x41, x30, 0xffffffff00000000); + let mut x42: u64 = 0; + let mut x43: u64 = 0; + fiat_p384_mulx_u64(&mut x42, &mut x43, x30, 0xffffffff); + let mut x44: u64 = 0; + let mut x45: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x44, &mut x45, 0x0, x43, x40); + let mut x46: u64 = 0; + let mut x47: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x46, &mut x47, x45, x41, x38); + let mut x48: u64 = 0; + let mut x49: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x48, &mut x49, x47, x39, x36); + let mut x50: u64 = 0; + let mut x51: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x50, &mut x51, x49, x37, x34); + let mut x52: u64 = 0; + let mut x53: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x52, &mut x53, x51, x35, x32); + let x54: u64 = ((x53 as u64) + x33); + let mut x55: u64 = 0; + let mut x56: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x55, &mut x56, 0x0, x17, x42); + let mut x57: u64 = 0; + let mut x58: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x57, &mut x58, x56, x19, x44); + let mut x59: u64 = 0; + let mut x60: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x59, &mut x60, x58, x21, x46); + let mut x61: u64 = 0; + let mut x62: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x61, &mut x62, x60, x23, x48); + let mut x63: u64 = 0; + let mut x64: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x63, &mut x64, x62, x25, x50); + let mut x65: u64 = 0; + let mut x66: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x65, &mut x66, x64, x27, x52); + let mut x67: u64 = 0; + let mut x68: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x67, &mut x68, x66, x29, x54); + let mut x69: u64 = 0; + let mut x70: u64 = 0; + fiat_p384_mulx_u64(&mut x69, &mut x70, x1, (arg2[5])); + let mut x71: u64 = 0; + let mut x72: u64 = 0; + fiat_p384_mulx_u64(&mut x71, &mut x72, x1, (arg2[4])); + let mut x73: u64 = 0; + let mut x74: u64 = 0; + fiat_p384_mulx_u64(&mut x73, &mut x74, x1, (arg2[3])); + let mut x75: u64 = 0; + let mut x76: u64 = 0; + fiat_p384_mulx_u64(&mut x75, &mut x76, x1, (arg2[2])); + let mut x77: u64 = 0; + let mut x78: u64 = 0; + fiat_p384_mulx_u64(&mut x77, &mut x78, x1, (arg2[1])); + let mut x79: u64 = 0; + let mut x80: u64 = 0; + fiat_p384_mulx_u64(&mut x79, &mut x80, x1, (arg2[0])); + let mut x81: u64 = 0; + let mut x82: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x81, &mut x82, 0x0, x80, x77); + let mut x83: u64 = 0; + let mut x84: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x83, &mut x84, x82, x78, x75); + let mut x85: u64 = 0; + let mut x86: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x85, &mut x86, x84, x76, x73); + let mut x87: u64 = 0; + let mut x88: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x87, &mut x88, x86, x74, x71); + let mut x89: u64 = 0; + let mut x90: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x89, &mut x90, x88, x72, x69); + let x91: u64 = ((x90 as u64) + x70); + let mut x92: u64 = 0; + let mut x93: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x92, &mut x93, 0x0, x57, x79); + let mut x94: u64 = 0; + let mut x95: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x94, &mut x95, x93, x59, x81); + let mut x96: u64 = 0; + let mut x97: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x96, &mut x97, x95, x61, x83); + let mut x98: u64 = 0; + let mut x99: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x98, &mut x99, x97, x63, x85); + let mut x100: u64 = 0; + let mut x101: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x100, &mut x101, x99, x65, x87); + let mut x102: u64 = 0; + let mut x103: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x102, &mut x103, x101, x67, x89); + let mut x104: u64 = 0; + let mut x105: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x104, &mut x105, x103, (x68 as u64), x91); + let mut x106: u64 = 0; + let mut x107: u64 = 0; + fiat_p384_mulx_u64(&mut x106, &mut x107, x92, 0x100000001); + let mut x108: u64 = 0; + let mut x109: u64 = 0; + fiat_p384_mulx_u64(&mut x108, &mut x109, x106, 0xffffffffffffffff); + let mut x110: u64 = 0; + let mut x111: u64 = 0; + fiat_p384_mulx_u64(&mut x110, &mut x111, x106, 0xffffffffffffffff); + let mut x112: u64 = 0; + let mut x113: u64 = 0; + fiat_p384_mulx_u64(&mut x112, &mut x113, x106, 0xffffffffffffffff); + let mut x114: u64 = 0; + let mut x115: u64 = 0; + fiat_p384_mulx_u64(&mut x114, &mut x115, x106, 0xfffffffffffffffe); + let mut x116: u64 = 0; + let mut x117: u64 = 0; + fiat_p384_mulx_u64(&mut x116, &mut x117, x106, 0xffffffff00000000); + let mut x118: u64 = 0; + let mut x119: u64 = 0; + fiat_p384_mulx_u64(&mut x118, &mut x119, x106, 0xffffffff); + let mut x120: u64 = 0; + let mut x121: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x120, &mut x121, 0x0, x119, x116); + let mut x122: u64 = 0; + let mut x123: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x122, &mut x123, x121, x117, x114); + let mut x124: u64 = 0; + let mut x125: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x124, &mut x125, x123, x115, x112); + let mut x126: u64 = 0; + let mut x127: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x126, &mut x127, x125, x113, x110); + let mut x128: u64 = 0; + let mut x129: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x128, &mut x129, x127, x111, x108); + let x130: u64 = ((x129 as u64) + x109); + let mut x131: u64 = 0; + let mut x132: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x131, &mut x132, 0x0, x92, x118); + let mut x133: u64 = 0; + let mut x134: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x133, &mut x134, x132, x94, x120); + let mut x135: u64 = 0; + let mut x136: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x135, &mut x136, x134, x96, x122); + let mut x137: u64 = 0; + let mut x138: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x137, &mut x138, x136, x98, x124); + let mut x139: u64 = 0; + let mut x140: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x139, &mut x140, x138, x100, x126); + let mut x141: u64 = 0; + let mut x142: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x141, &mut x142, x140, x102, x128); + let mut x143: u64 = 0; + let mut x144: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x143, &mut x144, x142, x104, x130); + let x145: u64 = ((x144 as u64) + (x105 as u64)); + let mut x146: u64 = 0; + let mut x147: u64 = 0; + fiat_p384_mulx_u64(&mut x146, &mut x147, x2, (arg2[5])); + let mut x148: u64 = 0; + let mut x149: u64 = 0; + fiat_p384_mulx_u64(&mut x148, &mut x149, x2, (arg2[4])); + let mut x150: u64 = 0; + let mut x151: u64 = 0; + fiat_p384_mulx_u64(&mut x150, &mut x151, x2, (arg2[3])); + let mut x152: u64 = 0; + let mut x153: u64 = 0; + fiat_p384_mulx_u64(&mut x152, &mut x153, x2, (arg2[2])); + let mut x154: u64 = 0; + let mut x155: u64 = 0; + fiat_p384_mulx_u64(&mut x154, &mut x155, x2, (arg2[1])); + let mut x156: u64 = 0; + let mut x157: u64 = 0; + fiat_p384_mulx_u64(&mut x156, &mut x157, x2, (arg2[0])); + let mut x158: u64 = 0; + let mut x159: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x158, &mut x159, 0x0, x157, x154); + let mut x160: u64 = 0; + let mut x161: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x160, &mut x161, x159, x155, x152); + let mut x162: u64 = 0; + let mut x163: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x162, &mut x163, x161, x153, x150); + let mut x164: u64 = 0; + let mut x165: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x164, &mut x165, x163, x151, x148); + let mut x166: u64 = 0; + let mut x167: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x166, &mut x167, x165, x149, x146); + let x168: u64 = ((x167 as u64) + x147); + let mut x169: u64 = 0; + let mut x170: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x169, &mut x170, 0x0, x133, x156); + let mut x171: u64 = 0; + let mut x172: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x171, &mut x172, x170, x135, x158); + let mut x173: u64 = 0; + let mut x174: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x173, &mut x174, x172, x137, x160); + let mut x175: u64 = 0; + let mut x176: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x175, &mut x176, x174, x139, x162); + let mut x177: u64 = 0; + let mut x178: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x177, &mut x178, x176, x141, x164); + let mut x179: u64 = 0; + let mut x180: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x179, &mut x180, x178, x143, x166); + let mut x181: u64 = 0; + let mut x182: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x181, &mut x182, x180, x145, x168); + let mut x183: u64 = 0; + let mut x184: u64 = 0; + fiat_p384_mulx_u64(&mut x183, &mut x184, x169, 0x100000001); + let mut x185: u64 = 0; + let mut x186: u64 = 0; + fiat_p384_mulx_u64(&mut x185, &mut x186, x183, 0xffffffffffffffff); + let mut x187: u64 = 0; + let mut x188: u64 = 0; + fiat_p384_mulx_u64(&mut x187, &mut x188, x183, 0xffffffffffffffff); + let mut x189: u64 = 0; + let mut x190: u64 = 0; + fiat_p384_mulx_u64(&mut x189, &mut x190, x183, 0xffffffffffffffff); + let mut x191: u64 = 0; + let mut x192: u64 = 0; + fiat_p384_mulx_u64(&mut x191, &mut x192, x183, 0xfffffffffffffffe); + let mut x193: u64 = 0; + let mut x194: u64 = 0; + fiat_p384_mulx_u64(&mut x193, &mut x194, x183, 0xffffffff00000000); + let mut x195: u64 = 0; + let mut x196: u64 = 0; + fiat_p384_mulx_u64(&mut x195, &mut x196, x183, 0xffffffff); + let mut x197: u64 = 0; + let mut x198: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x197, &mut x198, 0x0, x196, x193); + let mut x199: u64 = 0; + let mut x200: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x199, &mut x200, x198, x194, x191); + let mut x201: u64 = 0; + let mut x202: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x201, &mut x202, x200, x192, x189); + let mut x203: u64 = 0; + let mut x204: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x203, &mut x204, x202, x190, x187); + let mut x205: u64 = 0; + let mut x206: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x205, &mut x206, x204, x188, x185); + let x207: u64 = ((x206 as u64) + x186); + let mut x208: u64 = 0; + let mut x209: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x208, &mut x209, 0x0, x169, x195); + let mut x210: u64 = 0; + let mut x211: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x210, &mut x211, x209, x171, x197); + let mut x212: u64 = 0; + let mut x213: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x212, &mut x213, x211, x173, x199); + let mut x214: u64 = 0; + let mut x215: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x214, &mut x215, x213, x175, x201); + let mut x216: u64 = 0; + let mut x217: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x216, &mut x217, x215, x177, x203); + let mut x218: u64 = 0; + let mut x219: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x218, &mut x219, x217, x179, x205); + let mut x220: u64 = 0; + let mut x221: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x220, &mut x221, x219, x181, x207); + let x222: u64 = ((x221 as u64) + (x182 as u64)); + let mut x223: u64 = 0; + let mut x224: u64 = 0; + fiat_p384_mulx_u64(&mut x223, &mut x224, x3, (arg2[5])); + let mut x225: u64 = 0; + let mut x226: u64 = 0; + fiat_p384_mulx_u64(&mut x225, &mut x226, x3, (arg2[4])); + let mut x227: u64 = 0; + let mut x228: u64 = 0; + fiat_p384_mulx_u64(&mut x227, &mut x228, x3, (arg2[3])); + let mut x229: u64 = 0; + let mut x230: u64 = 0; + fiat_p384_mulx_u64(&mut x229, &mut x230, x3, (arg2[2])); + let mut x231: u64 = 0; + let mut x232: u64 = 0; + fiat_p384_mulx_u64(&mut x231, &mut x232, x3, (arg2[1])); + let mut x233: u64 = 0; + let mut x234: u64 = 0; + fiat_p384_mulx_u64(&mut x233, &mut x234, x3, (arg2[0])); + let mut x235: u64 = 0; + let mut x236: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x235, &mut x236, 0x0, x234, x231); + let mut x237: u64 = 0; + let mut x238: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x237, &mut x238, x236, x232, x229); + let mut x239: u64 = 0; + let mut x240: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x239, &mut x240, x238, x230, x227); + let mut x241: u64 = 0; + let mut x242: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x241, &mut x242, x240, x228, x225); + let mut x243: u64 = 0; + let mut x244: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x243, &mut x244, x242, x226, x223); + let x245: u64 = ((x244 as u64) + x224); + let mut x246: u64 = 0; + let mut x247: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x246, &mut x247, 0x0, x210, x233); + let mut x248: u64 = 0; + let mut x249: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x248, &mut x249, x247, x212, x235); + let mut x250: u64 = 0; + let mut x251: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x250, &mut x251, x249, x214, x237); + let mut x252: u64 = 0; + let mut x253: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x252, &mut x253, x251, x216, x239); + let mut x254: u64 = 0; + let mut x255: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x254, &mut x255, x253, x218, x241); + let mut x256: u64 = 0; + let mut x257: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x256, &mut x257, x255, x220, x243); + let mut x258: u64 = 0; + let mut x259: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x258, &mut x259, x257, x222, x245); + let mut x260: u64 = 0; + let mut x261: u64 = 0; + fiat_p384_mulx_u64(&mut x260, &mut x261, x246, 0x100000001); + let mut x262: u64 = 0; + let mut x263: u64 = 0; + fiat_p384_mulx_u64(&mut x262, &mut x263, x260, 0xffffffffffffffff); + let mut x264: u64 = 0; + let mut x265: u64 = 0; + fiat_p384_mulx_u64(&mut x264, &mut x265, x260, 0xffffffffffffffff); + let mut x266: u64 = 0; + let mut x267: u64 = 0; + fiat_p384_mulx_u64(&mut x266, &mut x267, x260, 0xffffffffffffffff); + let mut x268: u64 = 0; + let mut x269: u64 = 0; + fiat_p384_mulx_u64(&mut x268, &mut x269, x260, 0xfffffffffffffffe); + let mut x270: u64 = 0; + let mut x271: u64 = 0; + fiat_p384_mulx_u64(&mut x270, &mut x271, x260, 0xffffffff00000000); + let mut x272: u64 = 0; + let mut x273: u64 = 0; + fiat_p384_mulx_u64(&mut x272, &mut x273, x260, 0xffffffff); + let mut x274: u64 = 0; + let mut x275: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x274, &mut x275, 0x0, x273, x270); + let mut x276: u64 = 0; + let mut x277: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x276, &mut x277, x275, x271, x268); + let mut x278: u64 = 0; + let mut x279: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x278, &mut x279, x277, x269, x266); + let mut x280: u64 = 0; + let mut x281: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x280, &mut x281, x279, x267, x264); + let mut x282: u64 = 0; + let mut x283: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x282, &mut x283, x281, x265, x262); + let x284: u64 = ((x283 as u64) + x263); + let mut x285: u64 = 0; + let mut x286: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x285, &mut x286, 0x0, x246, x272); + let mut x287: u64 = 0; + let mut x288: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x287, &mut x288, x286, x248, x274); + let mut x289: u64 = 0; + let mut x290: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x289, &mut x290, x288, x250, x276); + let mut x291: u64 = 0; + let mut x292: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x291, &mut x292, x290, x252, x278); + let mut x293: u64 = 0; + let mut x294: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x293, &mut x294, x292, x254, x280); + let mut x295: u64 = 0; + let mut x296: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x295, &mut x296, x294, x256, x282); + let mut x297: u64 = 0; + let mut x298: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x297, &mut x298, x296, x258, x284); + let x299: u64 = ((x298 as u64) + (x259 as u64)); + let mut x300: u64 = 0; + let mut x301: u64 = 0; + fiat_p384_mulx_u64(&mut x300, &mut x301, x4, (arg2[5])); + let mut x302: u64 = 0; + let mut x303: u64 = 0; + fiat_p384_mulx_u64(&mut x302, &mut x303, x4, (arg2[4])); + let mut x304: u64 = 0; + let mut x305: u64 = 0; + fiat_p384_mulx_u64(&mut x304, &mut x305, x4, (arg2[3])); + let mut x306: u64 = 0; + let mut x307: u64 = 0; + fiat_p384_mulx_u64(&mut x306, &mut x307, x4, (arg2[2])); + let mut x308: u64 = 0; + let mut x309: u64 = 0; + fiat_p384_mulx_u64(&mut x308, &mut x309, x4, (arg2[1])); + let mut x310: u64 = 0; + let mut x311: u64 = 0; + fiat_p384_mulx_u64(&mut x310, &mut x311, x4, (arg2[0])); + let mut x312: u64 = 0; + let mut x313: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x312, &mut x313, 0x0, x311, x308); + let mut x314: u64 = 0; + let mut x315: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x314, &mut x315, x313, x309, x306); + let mut x316: u64 = 0; + let mut x317: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x316, &mut x317, x315, x307, x304); + let mut x318: u64 = 0; + let mut x319: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x318, &mut x319, x317, x305, x302); + let mut x320: u64 = 0; + let mut x321: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x320, &mut x321, x319, x303, x300); + let x322: u64 = ((x321 as u64) + x301); + let mut x323: u64 = 0; + let mut x324: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x323, &mut x324, 0x0, x287, x310); + let mut x325: u64 = 0; + let mut x326: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x325, &mut x326, x324, x289, x312); + let mut x327: u64 = 0; + let mut x328: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x327, &mut x328, x326, x291, x314); + let mut x329: u64 = 0; + let mut x330: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x329, &mut x330, x328, x293, x316); + let mut x331: u64 = 0; + let mut x332: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x331, &mut x332, x330, x295, x318); + let mut x333: u64 = 0; + let mut x334: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x333, &mut x334, x332, x297, x320); + let mut x335: u64 = 0; + let mut x336: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x335, &mut x336, x334, x299, x322); + let mut x337: u64 = 0; + let mut x338: u64 = 0; + fiat_p384_mulx_u64(&mut x337, &mut x338, x323, 0x100000001); + let mut x339: u64 = 0; + let mut x340: u64 = 0; + fiat_p384_mulx_u64(&mut x339, &mut x340, x337, 0xffffffffffffffff); + let mut x341: u64 = 0; + let mut x342: u64 = 0; + fiat_p384_mulx_u64(&mut x341, &mut x342, x337, 0xffffffffffffffff); + let mut x343: u64 = 0; + let mut x344: u64 = 0; + fiat_p384_mulx_u64(&mut x343, &mut x344, x337, 0xffffffffffffffff); + let mut x345: u64 = 0; + let mut x346: u64 = 0; + fiat_p384_mulx_u64(&mut x345, &mut x346, x337, 0xfffffffffffffffe); + let mut x347: u64 = 0; + let mut x348: u64 = 0; + fiat_p384_mulx_u64(&mut x347, &mut x348, x337, 0xffffffff00000000); + let mut x349: u64 = 0; + let mut x350: u64 = 0; + fiat_p384_mulx_u64(&mut x349, &mut x350, x337, 0xffffffff); + let mut x351: u64 = 0; + let mut x352: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x351, &mut x352, 0x0, x350, x347); + let mut x353: u64 = 0; + let mut x354: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x353, &mut x354, x352, x348, x345); + let mut x355: u64 = 0; + let mut x356: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x355, &mut x356, x354, x346, x343); + let mut x357: u64 = 0; + let mut x358: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x357, &mut x358, x356, x344, x341); + let mut x359: u64 = 0; + let mut x360: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x359, &mut x360, x358, x342, x339); + let x361: u64 = ((x360 as u64) + x340); + let mut x362: u64 = 0; + let mut x363: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x362, &mut x363, 0x0, x323, x349); + let mut x364: u64 = 0; + let mut x365: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x364, &mut x365, x363, x325, x351); + let mut x366: u64 = 0; + let mut x367: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x366, &mut x367, x365, x327, x353); + let mut x368: u64 = 0; + let mut x369: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x368, &mut x369, x367, x329, x355); + let mut x370: u64 = 0; + let mut x371: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x370, &mut x371, x369, x331, x357); + let mut x372: u64 = 0; + let mut x373: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x372, &mut x373, x371, x333, x359); + let mut x374: u64 = 0; + let mut x375: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x374, &mut x375, x373, x335, x361); + let x376: u64 = ((x375 as u64) + (x336 as u64)); + let mut x377: u64 = 0; + let mut x378: u64 = 0; + fiat_p384_mulx_u64(&mut x377, &mut x378, x5, (arg2[5])); + let mut x379: u64 = 0; + let mut x380: u64 = 0; + fiat_p384_mulx_u64(&mut x379, &mut x380, x5, (arg2[4])); + let mut x381: u64 = 0; + let mut x382: u64 = 0; + fiat_p384_mulx_u64(&mut x381, &mut x382, x5, (arg2[3])); + let mut x383: u64 = 0; + let mut x384: u64 = 0; + fiat_p384_mulx_u64(&mut x383, &mut x384, x5, (arg2[2])); + let mut x385: u64 = 0; + let mut x386: u64 = 0; + fiat_p384_mulx_u64(&mut x385, &mut x386, x5, (arg2[1])); + let mut x387: u64 = 0; + let mut x388: u64 = 0; + fiat_p384_mulx_u64(&mut x387, &mut x388, x5, (arg2[0])); + let mut x389: u64 = 0; + let mut x390: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x389, &mut x390, 0x0, x388, x385); + let mut x391: u64 = 0; + let mut x392: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x391, &mut x392, x390, x386, x383); + let mut x393: u64 = 0; + let mut x394: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x393, &mut x394, x392, x384, x381); + let mut x395: u64 = 0; + let mut x396: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x395, &mut x396, x394, x382, x379); + let mut x397: u64 = 0; + let mut x398: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x397, &mut x398, x396, x380, x377); + let x399: u64 = ((x398 as u64) + x378); + let mut x400: u64 = 0; + let mut x401: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x400, &mut x401, 0x0, x364, x387); + let mut x402: u64 = 0; + let mut x403: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x402, &mut x403, x401, x366, x389); + let mut x404: u64 = 0; + let mut x405: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x404, &mut x405, x403, x368, x391); + let mut x406: u64 = 0; + let mut x407: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x406, &mut x407, x405, x370, x393); + let mut x408: u64 = 0; + let mut x409: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x408, &mut x409, x407, x372, x395); + let mut x410: u64 = 0; + let mut x411: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x410, &mut x411, x409, x374, x397); + let mut x412: u64 = 0; + let mut x413: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x412, &mut x413, x411, x376, x399); + let mut x414: u64 = 0; + let mut x415: u64 = 0; + fiat_p384_mulx_u64(&mut x414, &mut x415, x400, 0x100000001); + let mut x416: u64 = 0; + let mut x417: u64 = 0; + fiat_p384_mulx_u64(&mut x416, &mut x417, x414, 0xffffffffffffffff); + let mut x418: u64 = 0; + let mut x419: u64 = 0; + fiat_p384_mulx_u64(&mut x418, &mut x419, x414, 0xffffffffffffffff); + let mut x420: u64 = 0; + let mut x421: u64 = 0; + fiat_p384_mulx_u64(&mut x420, &mut x421, x414, 0xffffffffffffffff); + let mut x422: u64 = 0; + let mut x423: u64 = 0; + fiat_p384_mulx_u64(&mut x422, &mut x423, x414, 0xfffffffffffffffe); + let mut x424: u64 = 0; + let mut x425: u64 = 0; + fiat_p384_mulx_u64(&mut x424, &mut x425, x414, 0xffffffff00000000); + let mut x426: u64 = 0; + let mut x427: u64 = 0; + fiat_p384_mulx_u64(&mut x426, &mut x427, x414, 0xffffffff); + let mut x428: u64 = 0; + let mut x429: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x428, &mut x429, 0x0, x427, x424); + let mut x430: u64 = 0; + let mut x431: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x430, &mut x431, x429, x425, x422); + let mut x432: u64 = 0; + let mut x433: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x432, &mut x433, x431, x423, x420); + let mut x434: u64 = 0; + let mut x435: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x434, &mut x435, x433, x421, x418); + let mut x436: u64 = 0; + let mut x437: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x436, &mut x437, x435, x419, x416); + let x438: u64 = ((x437 as u64) + x417); + let mut x439: u64 = 0; + let mut x440: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x439, &mut x440, 0x0, x400, x426); + let mut x441: u64 = 0; + let mut x442: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x441, &mut x442, x440, x402, x428); + let mut x443: u64 = 0; + let mut x444: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x443, &mut x444, x442, x404, x430); + let mut x445: u64 = 0; + let mut x446: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x445, &mut x446, x444, x406, x432); + let mut x447: u64 = 0; + let mut x448: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x447, &mut x448, x446, x408, x434); + let mut x449: u64 = 0; + let mut x450: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x449, &mut x450, x448, x410, x436); + let mut x451: u64 = 0; + let mut x452: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x451, &mut x452, x450, x412, x438); + let x453: u64 = ((x452 as u64) + (x413 as u64)); + let mut x454: u64 = 0; + let mut x455: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x454, &mut x455, 0x0, x441, 0xffffffff); + let mut x456: u64 = 0; + let mut x457: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x456, &mut x457, x455, x443, 0xffffffff00000000); + let mut x458: u64 = 0; + let mut x459: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x458, &mut x459, x457, x445, 0xfffffffffffffffe); + let mut x460: u64 = 0; + let mut x461: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x460, &mut x461, x459, x447, 0xffffffffffffffff); + let mut x462: u64 = 0; + let mut x463: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x462, &mut x463, x461, x449, 0xffffffffffffffff); + let mut x464: u64 = 0; + let mut x465: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x464, &mut x465, x463, x451, 0xffffffffffffffff); + let mut x466: u64 = 0; + let mut x467: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x466, &mut x467, x465, x453, (0x0 as u64)); + let mut x468: u64 = 0; + fiat_p384_cmovznz_u64(&mut x468, x467, x454, x441); + let mut x469: u64 = 0; + fiat_p384_cmovznz_u64(&mut x469, x467, x456, x443); + let mut x470: u64 = 0; + fiat_p384_cmovznz_u64(&mut x470, x467, x458, x445); + let mut x471: u64 = 0; + fiat_p384_cmovznz_u64(&mut x471, x467, x460, x447); + let mut x472: u64 = 0; + fiat_p384_cmovznz_u64(&mut x472, x467, x462, x449); + let mut x473: u64 = 0; + fiat_p384_cmovznz_u64(&mut x473, x467, x464, x451); + out1[0] = x468; + out1[1] = x469; + out1[2] = x470; + out1[3] = x471; + out1[4] = x472; + out1[5] = x473; +} + +/// The function fiat_p384_square squares a field element in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg1)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p384_square(out1: &mut fiat_p384_montgomery_domain_field_element, arg1: &fiat_p384_montgomery_domain_field_element) -> () { + let x1: u64 = (arg1[1]); + let x2: u64 = (arg1[2]); + let x3: u64 = (arg1[3]); + let x4: u64 = (arg1[4]); + let x5: u64 = (arg1[5]); + let x6: u64 = (arg1[0]); + let mut x7: u64 = 0; + let mut x8: u64 = 0; + fiat_p384_mulx_u64(&mut x7, &mut x8, x6, (arg1[5])); + let mut x9: u64 = 0; + let mut x10: u64 = 0; + fiat_p384_mulx_u64(&mut x9, &mut x10, x6, (arg1[4])); + let mut x11: u64 = 0; + let mut x12: u64 = 0; + fiat_p384_mulx_u64(&mut x11, &mut x12, x6, (arg1[3])); + let mut x13: u64 = 0; + let mut x14: u64 = 0; + fiat_p384_mulx_u64(&mut x13, &mut x14, x6, (arg1[2])); + let mut x15: u64 = 0; + let mut x16: u64 = 0; + fiat_p384_mulx_u64(&mut x15, &mut x16, x6, (arg1[1])); + let mut x17: u64 = 0; + let mut x18: u64 = 0; + fiat_p384_mulx_u64(&mut x17, &mut x18, x6, (arg1[0])); + let mut x19: u64 = 0; + let mut x20: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x19, &mut x20, 0x0, x18, x15); + let mut x21: u64 = 0; + let mut x22: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x21, &mut x22, x20, x16, x13); + let mut x23: u64 = 0; + let mut x24: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x23, &mut x24, x22, x14, x11); + let mut x25: u64 = 0; + let mut x26: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x25, &mut x26, x24, x12, x9); + let mut x27: u64 = 0; + let mut x28: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x27, &mut x28, x26, x10, x7); + let x29: u64 = ((x28 as u64) + x8); + let mut x30: u64 = 0; + let mut x31: u64 = 0; + fiat_p384_mulx_u64(&mut x30, &mut x31, x17, 0x100000001); + let mut x32: u64 = 0; + let mut x33: u64 = 0; + fiat_p384_mulx_u64(&mut x32, &mut x33, x30, 0xffffffffffffffff); + let mut x34: u64 = 0; + let mut x35: u64 = 0; + fiat_p384_mulx_u64(&mut x34, &mut x35, x30, 0xffffffffffffffff); + let mut x36: u64 = 0; + let mut x37: u64 = 0; + fiat_p384_mulx_u64(&mut x36, &mut x37, x30, 0xffffffffffffffff); + let mut x38: u64 = 0; + let mut x39: u64 = 0; + fiat_p384_mulx_u64(&mut x38, &mut x39, x30, 0xfffffffffffffffe); + let mut x40: u64 = 0; + let mut x41: u64 = 0; + fiat_p384_mulx_u64(&mut x40, &mut x41, x30, 0xffffffff00000000); + let mut x42: u64 = 0; + let mut x43: u64 = 0; + fiat_p384_mulx_u64(&mut x42, &mut x43, x30, 0xffffffff); + let mut x44: u64 = 0; + let mut x45: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x44, &mut x45, 0x0, x43, x40); + let mut x46: u64 = 0; + let mut x47: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x46, &mut x47, x45, x41, x38); + let mut x48: u64 = 0; + let mut x49: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x48, &mut x49, x47, x39, x36); + let mut x50: u64 = 0; + let mut x51: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x50, &mut x51, x49, x37, x34); + let mut x52: u64 = 0; + let mut x53: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x52, &mut x53, x51, x35, x32); + let x54: u64 = ((x53 as u64) + x33); + let mut x55: u64 = 0; + let mut x56: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x55, &mut x56, 0x0, x17, x42); + let mut x57: u64 = 0; + let mut x58: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x57, &mut x58, x56, x19, x44); + let mut x59: u64 = 0; + let mut x60: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x59, &mut x60, x58, x21, x46); + let mut x61: u64 = 0; + let mut x62: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x61, &mut x62, x60, x23, x48); + let mut x63: u64 = 0; + let mut x64: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x63, &mut x64, x62, x25, x50); + let mut x65: u64 = 0; + let mut x66: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x65, &mut x66, x64, x27, x52); + let mut x67: u64 = 0; + let mut x68: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x67, &mut x68, x66, x29, x54); + let mut x69: u64 = 0; + let mut x70: u64 = 0; + fiat_p384_mulx_u64(&mut x69, &mut x70, x1, (arg1[5])); + let mut x71: u64 = 0; + let mut x72: u64 = 0; + fiat_p384_mulx_u64(&mut x71, &mut x72, x1, (arg1[4])); + let mut x73: u64 = 0; + let mut x74: u64 = 0; + fiat_p384_mulx_u64(&mut x73, &mut x74, x1, (arg1[3])); + let mut x75: u64 = 0; + let mut x76: u64 = 0; + fiat_p384_mulx_u64(&mut x75, &mut x76, x1, (arg1[2])); + let mut x77: u64 = 0; + let mut x78: u64 = 0; + fiat_p384_mulx_u64(&mut x77, &mut x78, x1, (arg1[1])); + let mut x79: u64 = 0; + let mut x80: u64 = 0; + fiat_p384_mulx_u64(&mut x79, &mut x80, x1, (arg1[0])); + let mut x81: u64 = 0; + let mut x82: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x81, &mut x82, 0x0, x80, x77); + let mut x83: u64 = 0; + let mut x84: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x83, &mut x84, x82, x78, x75); + let mut x85: u64 = 0; + let mut x86: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x85, &mut x86, x84, x76, x73); + let mut x87: u64 = 0; + let mut x88: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x87, &mut x88, x86, x74, x71); + let mut x89: u64 = 0; + let mut x90: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x89, &mut x90, x88, x72, x69); + let x91: u64 = ((x90 as u64) + x70); + let mut x92: u64 = 0; + let mut x93: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x92, &mut x93, 0x0, x57, x79); + let mut x94: u64 = 0; + let mut x95: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x94, &mut x95, x93, x59, x81); + let mut x96: u64 = 0; + let mut x97: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x96, &mut x97, x95, x61, x83); + let mut x98: u64 = 0; + let mut x99: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x98, &mut x99, x97, x63, x85); + let mut x100: u64 = 0; + let mut x101: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x100, &mut x101, x99, x65, x87); + let mut x102: u64 = 0; + let mut x103: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x102, &mut x103, x101, x67, x89); + let mut x104: u64 = 0; + let mut x105: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x104, &mut x105, x103, (x68 as u64), x91); + let mut x106: u64 = 0; + let mut x107: u64 = 0; + fiat_p384_mulx_u64(&mut x106, &mut x107, x92, 0x100000001); + let mut x108: u64 = 0; + let mut x109: u64 = 0; + fiat_p384_mulx_u64(&mut x108, &mut x109, x106, 0xffffffffffffffff); + let mut x110: u64 = 0; + let mut x111: u64 = 0; + fiat_p384_mulx_u64(&mut x110, &mut x111, x106, 0xffffffffffffffff); + let mut x112: u64 = 0; + let mut x113: u64 = 0; + fiat_p384_mulx_u64(&mut x112, &mut x113, x106, 0xffffffffffffffff); + let mut x114: u64 = 0; + let mut x115: u64 = 0; + fiat_p384_mulx_u64(&mut x114, &mut x115, x106, 0xfffffffffffffffe); + let mut x116: u64 = 0; + let mut x117: u64 = 0; + fiat_p384_mulx_u64(&mut x116, &mut x117, x106, 0xffffffff00000000); + let mut x118: u64 = 0; + let mut x119: u64 = 0; + fiat_p384_mulx_u64(&mut x118, &mut x119, x106, 0xffffffff); + let mut x120: u64 = 0; + let mut x121: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x120, &mut x121, 0x0, x119, x116); + let mut x122: u64 = 0; + let mut x123: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x122, &mut x123, x121, x117, x114); + let mut x124: u64 = 0; + let mut x125: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x124, &mut x125, x123, x115, x112); + let mut x126: u64 = 0; + let mut x127: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x126, &mut x127, x125, x113, x110); + let mut x128: u64 = 0; + let mut x129: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x128, &mut x129, x127, x111, x108); + let x130: u64 = ((x129 as u64) + x109); + let mut x131: u64 = 0; + let mut x132: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x131, &mut x132, 0x0, x92, x118); + let mut x133: u64 = 0; + let mut x134: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x133, &mut x134, x132, x94, x120); + let mut x135: u64 = 0; + let mut x136: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x135, &mut x136, x134, x96, x122); + let mut x137: u64 = 0; + let mut x138: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x137, &mut x138, x136, x98, x124); + let mut x139: u64 = 0; + let mut x140: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x139, &mut x140, x138, x100, x126); + let mut x141: u64 = 0; + let mut x142: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x141, &mut x142, x140, x102, x128); + let mut x143: u64 = 0; + let mut x144: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x143, &mut x144, x142, x104, x130); + let x145: u64 = ((x144 as u64) + (x105 as u64)); + let mut x146: u64 = 0; + let mut x147: u64 = 0; + fiat_p384_mulx_u64(&mut x146, &mut x147, x2, (arg1[5])); + let mut x148: u64 = 0; + let mut x149: u64 = 0; + fiat_p384_mulx_u64(&mut x148, &mut x149, x2, (arg1[4])); + let mut x150: u64 = 0; + let mut x151: u64 = 0; + fiat_p384_mulx_u64(&mut x150, &mut x151, x2, (arg1[3])); + let mut x152: u64 = 0; + let mut x153: u64 = 0; + fiat_p384_mulx_u64(&mut x152, &mut x153, x2, (arg1[2])); + let mut x154: u64 = 0; + let mut x155: u64 = 0; + fiat_p384_mulx_u64(&mut x154, &mut x155, x2, (arg1[1])); + let mut x156: u64 = 0; + let mut x157: u64 = 0; + fiat_p384_mulx_u64(&mut x156, &mut x157, x2, (arg1[0])); + let mut x158: u64 = 0; + let mut x159: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x158, &mut x159, 0x0, x157, x154); + let mut x160: u64 = 0; + let mut x161: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x160, &mut x161, x159, x155, x152); + let mut x162: u64 = 0; + let mut x163: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x162, &mut x163, x161, x153, x150); + let mut x164: u64 = 0; + let mut x165: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x164, &mut x165, x163, x151, x148); + let mut x166: u64 = 0; + let mut x167: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x166, &mut x167, x165, x149, x146); + let x168: u64 = ((x167 as u64) + x147); + let mut x169: u64 = 0; + let mut x170: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x169, &mut x170, 0x0, x133, x156); + let mut x171: u64 = 0; + let mut x172: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x171, &mut x172, x170, x135, x158); + let mut x173: u64 = 0; + let mut x174: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x173, &mut x174, x172, x137, x160); + let mut x175: u64 = 0; + let mut x176: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x175, &mut x176, x174, x139, x162); + let mut x177: u64 = 0; + let mut x178: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x177, &mut x178, x176, x141, x164); + let mut x179: u64 = 0; + let mut x180: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x179, &mut x180, x178, x143, x166); + let mut x181: u64 = 0; + let mut x182: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x181, &mut x182, x180, x145, x168); + let mut x183: u64 = 0; + let mut x184: u64 = 0; + fiat_p384_mulx_u64(&mut x183, &mut x184, x169, 0x100000001); + let mut x185: u64 = 0; + let mut x186: u64 = 0; + fiat_p384_mulx_u64(&mut x185, &mut x186, x183, 0xffffffffffffffff); + let mut x187: u64 = 0; + let mut x188: u64 = 0; + fiat_p384_mulx_u64(&mut x187, &mut x188, x183, 0xffffffffffffffff); + let mut x189: u64 = 0; + let mut x190: u64 = 0; + fiat_p384_mulx_u64(&mut x189, &mut x190, x183, 0xffffffffffffffff); + let mut x191: u64 = 0; + let mut x192: u64 = 0; + fiat_p384_mulx_u64(&mut x191, &mut x192, x183, 0xfffffffffffffffe); + let mut x193: u64 = 0; + let mut x194: u64 = 0; + fiat_p384_mulx_u64(&mut x193, &mut x194, x183, 0xffffffff00000000); + let mut x195: u64 = 0; + let mut x196: u64 = 0; + fiat_p384_mulx_u64(&mut x195, &mut x196, x183, 0xffffffff); + let mut x197: u64 = 0; + let mut x198: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x197, &mut x198, 0x0, x196, x193); + let mut x199: u64 = 0; + let mut x200: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x199, &mut x200, x198, x194, x191); + let mut x201: u64 = 0; + let mut x202: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x201, &mut x202, x200, x192, x189); + let mut x203: u64 = 0; + let mut x204: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x203, &mut x204, x202, x190, x187); + let mut x205: u64 = 0; + let mut x206: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x205, &mut x206, x204, x188, x185); + let x207: u64 = ((x206 as u64) + x186); + let mut x208: u64 = 0; + let mut x209: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x208, &mut x209, 0x0, x169, x195); + let mut x210: u64 = 0; + let mut x211: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x210, &mut x211, x209, x171, x197); + let mut x212: u64 = 0; + let mut x213: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x212, &mut x213, x211, x173, x199); + let mut x214: u64 = 0; + let mut x215: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x214, &mut x215, x213, x175, x201); + let mut x216: u64 = 0; + let mut x217: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x216, &mut x217, x215, x177, x203); + let mut x218: u64 = 0; + let mut x219: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x218, &mut x219, x217, x179, x205); + let mut x220: u64 = 0; + let mut x221: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x220, &mut x221, x219, x181, x207); + let x222: u64 = ((x221 as u64) + (x182 as u64)); + let mut x223: u64 = 0; + let mut x224: u64 = 0; + fiat_p384_mulx_u64(&mut x223, &mut x224, x3, (arg1[5])); + let mut x225: u64 = 0; + let mut x226: u64 = 0; + fiat_p384_mulx_u64(&mut x225, &mut x226, x3, (arg1[4])); + let mut x227: u64 = 0; + let mut x228: u64 = 0; + fiat_p384_mulx_u64(&mut x227, &mut x228, x3, (arg1[3])); + let mut x229: u64 = 0; + let mut x230: u64 = 0; + fiat_p384_mulx_u64(&mut x229, &mut x230, x3, (arg1[2])); + let mut x231: u64 = 0; + let mut x232: u64 = 0; + fiat_p384_mulx_u64(&mut x231, &mut x232, x3, (arg1[1])); + let mut x233: u64 = 0; + let mut x234: u64 = 0; + fiat_p384_mulx_u64(&mut x233, &mut x234, x3, (arg1[0])); + let mut x235: u64 = 0; + let mut x236: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x235, &mut x236, 0x0, x234, x231); + let mut x237: u64 = 0; + let mut x238: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x237, &mut x238, x236, x232, x229); + let mut x239: u64 = 0; + let mut x240: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x239, &mut x240, x238, x230, x227); + let mut x241: u64 = 0; + let mut x242: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x241, &mut x242, x240, x228, x225); + let mut x243: u64 = 0; + let mut x244: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x243, &mut x244, x242, x226, x223); + let x245: u64 = ((x244 as u64) + x224); + let mut x246: u64 = 0; + let mut x247: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x246, &mut x247, 0x0, x210, x233); + let mut x248: u64 = 0; + let mut x249: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x248, &mut x249, x247, x212, x235); + let mut x250: u64 = 0; + let mut x251: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x250, &mut x251, x249, x214, x237); + let mut x252: u64 = 0; + let mut x253: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x252, &mut x253, x251, x216, x239); + let mut x254: u64 = 0; + let mut x255: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x254, &mut x255, x253, x218, x241); + let mut x256: u64 = 0; + let mut x257: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x256, &mut x257, x255, x220, x243); + let mut x258: u64 = 0; + let mut x259: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x258, &mut x259, x257, x222, x245); + let mut x260: u64 = 0; + let mut x261: u64 = 0; + fiat_p384_mulx_u64(&mut x260, &mut x261, x246, 0x100000001); + let mut x262: u64 = 0; + let mut x263: u64 = 0; + fiat_p384_mulx_u64(&mut x262, &mut x263, x260, 0xffffffffffffffff); + let mut x264: u64 = 0; + let mut x265: u64 = 0; + fiat_p384_mulx_u64(&mut x264, &mut x265, x260, 0xffffffffffffffff); + let mut x266: u64 = 0; + let mut x267: u64 = 0; + fiat_p384_mulx_u64(&mut x266, &mut x267, x260, 0xffffffffffffffff); + let mut x268: u64 = 0; + let mut x269: u64 = 0; + fiat_p384_mulx_u64(&mut x268, &mut x269, x260, 0xfffffffffffffffe); + let mut x270: u64 = 0; + let mut x271: u64 = 0; + fiat_p384_mulx_u64(&mut x270, &mut x271, x260, 0xffffffff00000000); + let mut x272: u64 = 0; + let mut x273: u64 = 0; + fiat_p384_mulx_u64(&mut x272, &mut x273, x260, 0xffffffff); + let mut x274: u64 = 0; + let mut x275: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x274, &mut x275, 0x0, x273, x270); + let mut x276: u64 = 0; + let mut x277: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x276, &mut x277, x275, x271, x268); + let mut x278: u64 = 0; + let mut x279: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x278, &mut x279, x277, x269, x266); + let mut x280: u64 = 0; + let mut x281: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x280, &mut x281, x279, x267, x264); + let mut x282: u64 = 0; + let mut x283: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x282, &mut x283, x281, x265, x262); + let x284: u64 = ((x283 as u64) + x263); + let mut x285: u64 = 0; + let mut x286: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x285, &mut x286, 0x0, x246, x272); + let mut x287: u64 = 0; + let mut x288: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x287, &mut x288, x286, x248, x274); + let mut x289: u64 = 0; + let mut x290: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x289, &mut x290, x288, x250, x276); + let mut x291: u64 = 0; + let mut x292: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x291, &mut x292, x290, x252, x278); + let mut x293: u64 = 0; + let mut x294: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x293, &mut x294, x292, x254, x280); + let mut x295: u64 = 0; + let mut x296: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x295, &mut x296, x294, x256, x282); + let mut x297: u64 = 0; + let mut x298: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x297, &mut x298, x296, x258, x284); + let x299: u64 = ((x298 as u64) + (x259 as u64)); + let mut x300: u64 = 0; + let mut x301: u64 = 0; + fiat_p384_mulx_u64(&mut x300, &mut x301, x4, (arg1[5])); + let mut x302: u64 = 0; + let mut x303: u64 = 0; + fiat_p384_mulx_u64(&mut x302, &mut x303, x4, (arg1[4])); + let mut x304: u64 = 0; + let mut x305: u64 = 0; + fiat_p384_mulx_u64(&mut x304, &mut x305, x4, (arg1[3])); + let mut x306: u64 = 0; + let mut x307: u64 = 0; + fiat_p384_mulx_u64(&mut x306, &mut x307, x4, (arg1[2])); + let mut x308: u64 = 0; + let mut x309: u64 = 0; + fiat_p384_mulx_u64(&mut x308, &mut x309, x4, (arg1[1])); + let mut x310: u64 = 0; + let mut x311: u64 = 0; + fiat_p384_mulx_u64(&mut x310, &mut x311, x4, (arg1[0])); + let mut x312: u64 = 0; + let mut x313: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x312, &mut x313, 0x0, x311, x308); + let mut x314: u64 = 0; + let mut x315: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x314, &mut x315, x313, x309, x306); + let mut x316: u64 = 0; + let mut x317: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x316, &mut x317, x315, x307, x304); + let mut x318: u64 = 0; + let mut x319: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x318, &mut x319, x317, x305, x302); + let mut x320: u64 = 0; + let mut x321: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x320, &mut x321, x319, x303, x300); + let x322: u64 = ((x321 as u64) + x301); + let mut x323: u64 = 0; + let mut x324: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x323, &mut x324, 0x0, x287, x310); + let mut x325: u64 = 0; + let mut x326: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x325, &mut x326, x324, x289, x312); + let mut x327: u64 = 0; + let mut x328: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x327, &mut x328, x326, x291, x314); + let mut x329: u64 = 0; + let mut x330: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x329, &mut x330, x328, x293, x316); + let mut x331: u64 = 0; + let mut x332: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x331, &mut x332, x330, x295, x318); + let mut x333: u64 = 0; + let mut x334: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x333, &mut x334, x332, x297, x320); + let mut x335: u64 = 0; + let mut x336: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x335, &mut x336, x334, x299, x322); + let mut x337: u64 = 0; + let mut x338: u64 = 0; + fiat_p384_mulx_u64(&mut x337, &mut x338, x323, 0x100000001); + let mut x339: u64 = 0; + let mut x340: u64 = 0; + fiat_p384_mulx_u64(&mut x339, &mut x340, x337, 0xffffffffffffffff); + let mut x341: u64 = 0; + let mut x342: u64 = 0; + fiat_p384_mulx_u64(&mut x341, &mut x342, x337, 0xffffffffffffffff); + let mut x343: u64 = 0; + let mut x344: u64 = 0; + fiat_p384_mulx_u64(&mut x343, &mut x344, x337, 0xffffffffffffffff); + let mut x345: u64 = 0; + let mut x346: u64 = 0; + fiat_p384_mulx_u64(&mut x345, &mut x346, x337, 0xfffffffffffffffe); + let mut x347: u64 = 0; + let mut x348: u64 = 0; + fiat_p384_mulx_u64(&mut x347, &mut x348, x337, 0xffffffff00000000); + let mut x349: u64 = 0; + let mut x350: u64 = 0; + fiat_p384_mulx_u64(&mut x349, &mut x350, x337, 0xffffffff); + let mut x351: u64 = 0; + let mut x352: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x351, &mut x352, 0x0, x350, x347); + let mut x353: u64 = 0; + let mut x354: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x353, &mut x354, x352, x348, x345); + let mut x355: u64 = 0; + let mut x356: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x355, &mut x356, x354, x346, x343); + let mut x357: u64 = 0; + let mut x358: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x357, &mut x358, x356, x344, x341); + let mut x359: u64 = 0; + let mut x360: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x359, &mut x360, x358, x342, x339); + let x361: u64 = ((x360 as u64) + x340); + let mut x362: u64 = 0; + let mut x363: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x362, &mut x363, 0x0, x323, x349); + let mut x364: u64 = 0; + let mut x365: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x364, &mut x365, x363, x325, x351); + let mut x366: u64 = 0; + let mut x367: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x366, &mut x367, x365, x327, x353); + let mut x368: u64 = 0; + let mut x369: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x368, &mut x369, x367, x329, x355); + let mut x370: u64 = 0; + let mut x371: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x370, &mut x371, x369, x331, x357); + let mut x372: u64 = 0; + let mut x373: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x372, &mut x373, x371, x333, x359); + let mut x374: u64 = 0; + let mut x375: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x374, &mut x375, x373, x335, x361); + let x376: u64 = ((x375 as u64) + (x336 as u64)); + let mut x377: u64 = 0; + let mut x378: u64 = 0; + fiat_p384_mulx_u64(&mut x377, &mut x378, x5, (arg1[5])); + let mut x379: u64 = 0; + let mut x380: u64 = 0; + fiat_p384_mulx_u64(&mut x379, &mut x380, x5, (arg1[4])); + let mut x381: u64 = 0; + let mut x382: u64 = 0; + fiat_p384_mulx_u64(&mut x381, &mut x382, x5, (arg1[3])); + let mut x383: u64 = 0; + let mut x384: u64 = 0; + fiat_p384_mulx_u64(&mut x383, &mut x384, x5, (arg1[2])); + let mut x385: u64 = 0; + let mut x386: u64 = 0; + fiat_p384_mulx_u64(&mut x385, &mut x386, x5, (arg1[1])); + let mut x387: u64 = 0; + let mut x388: u64 = 0; + fiat_p384_mulx_u64(&mut x387, &mut x388, x5, (arg1[0])); + let mut x389: u64 = 0; + let mut x390: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x389, &mut x390, 0x0, x388, x385); + let mut x391: u64 = 0; + let mut x392: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x391, &mut x392, x390, x386, x383); + let mut x393: u64 = 0; + let mut x394: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x393, &mut x394, x392, x384, x381); + let mut x395: u64 = 0; + let mut x396: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x395, &mut x396, x394, x382, x379); + let mut x397: u64 = 0; + let mut x398: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x397, &mut x398, x396, x380, x377); + let x399: u64 = ((x398 as u64) + x378); + let mut x400: u64 = 0; + let mut x401: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x400, &mut x401, 0x0, x364, x387); + let mut x402: u64 = 0; + let mut x403: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x402, &mut x403, x401, x366, x389); + let mut x404: u64 = 0; + let mut x405: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x404, &mut x405, x403, x368, x391); + let mut x406: u64 = 0; + let mut x407: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x406, &mut x407, x405, x370, x393); + let mut x408: u64 = 0; + let mut x409: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x408, &mut x409, x407, x372, x395); + let mut x410: u64 = 0; + let mut x411: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x410, &mut x411, x409, x374, x397); + let mut x412: u64 = 0; + let mut x413: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x412, &mut x413, x411, x376, x399); + let mut x414: u64 = 0; + let mut x415: u64 = 0; + fiat_p384_mulx_u64(&mut x414, &mut x415, x400, 0x100000001); + let mut x416: u64 = 0; + let mut x417: u64 = 0; + fiat_p384_mulx_u64(&mut x416, &mut x417, x414, 0xffffffffffffffff); + let mut x418: u64 = 0; + let mut x419: u64 = 0; + fiat_p384_mulx_u64(&mut x418, &mut x419, x414, 0xffffffffffffffff); + let mut x420: u64 = 0; + let mut x421: u64 = 0; + fiat_p384_mulx_u64(&mut x420, &mut x421, x414, 0xffffffffffffffff); + let mut x422: u64 = 0; + let mut x423: u64 = 0; + fiat_p384_mulx_u64(&mut x422, &mut x423, x414, 0xfffffffffffffffe); + let mut x424: u64 = 0; + let mut x425: u64 = 0; + fiat_p384_mulx_u64(&mut x424, &mut x425, x414, 0xffffffff00000000); + let mut x426: u64 = 0; + let mut x427: u64 = 0; + fiat_p384_mulx_u64(&mut x426, &mut x427, x414, 0xffffffff); + let mut x428: u64 = 0; + let mut x429: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x428, &mut x429, 0x0, x427, x424); + let mut x430: u64 = 0; + let mut x431: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x430, &mut x431, x429, x425, x422); + let mut x432: u64 = 0; + let mut x433: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x432, &mut x433, x431, x423, x420); + let mut x434: u64 = 0; + let mut x435: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x434, &mut x435, x433, x421, x418); + let mut x436: u64 = 0; + let mut x437: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x436, &mut x437, x435, x419, x416); + let x438: u64 = ((x437 as u64) + x417); + let mut x439: u64 = 0; + let mut x440: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x439, &mut x440, 0x0, x400, x426); + let mut x441: u64 = 0; + let mut x442: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x441, &mut x442, x440, x402, x428); + let mut x443: u64 = 0; + let mut x444: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x443, &mut x444, x442, x404, x430); + let mut x445: u64 = 0; + let mut x446: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x445, &mut x446, x444, x406, x432); + let mut x447: u64 = 0; + let mut x448: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x447, &mut x448, x446, x408, x434); + let mut x449: u64 = 0; + let mut x450: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x449, &mut x450, x448, x410, x436); + let mut x451: u64 = 0; + let mut x452: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x451, &mut x452, x450, x412, x438); + let x453: u64 = ((x452 as u64) + (x413 as u64)); + let mut x454: u64 = 0; + let mut x455: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x454, &mut x455, 0x0, x441, 0xffffffff); + let mut x456: u64 = 0; + let mut x457: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x456, &mut x457, x455, x443, 0xffffffff00000000); + let mut x458: u64 = 0; + let mut x459: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x458, &mut x459, x457, x445, 0xfffffffffffffffe); + let mut x460: u64 = 0; + let mut x461: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x460, &mut x461, x459, x447, 0xffffffffffffffff); + let mut x462: u64 = 0; + let mut x463: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x462, &mut x463, x461, x449, 0xffffffffffffffff); + let mut x464: u64 = 0; + let mut x465: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x464, &mut x465, x463, x451, 0xffffffffffffffff); + let mut x466: u64 = 0; + let mut x467: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x466, &mut x467, x465, x453, (0x0 as u64)); + let mut x468: u64 = 0; + fiat_p384_cmovznz_u64(&mut x468, x467, x454, x441); + let mut x469: u64 = 0; + fiat_p384_cmovznz_u64(&mut x469, x467, x456, x443); + let mut x470: u64 = 0; + fiat_p384_cmovznz_u64(&mut x470, x467, x458, x445); + let mut x471: u64 = 0; + fiat_p384_cmovznz_u64(&mut x471, x467, x460, x447); + let mut x472: u64 = 0; + fiat_p384_cmovznz_u64(&mut x472, x467, x462, x449); + let mut x473: u64 = 0; + fiat_p384_cmovznz_u64(&mut x473, x467, x464, x451); + out1[0] = x468; + out1[1] = x469; + out1[2] = x470; + out1[3] = x471; + out1[4] = x472; + out1[5] = x473; +} + +/// The function fiat_p384_add adds two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) + eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p384_add(out1: &mut fiat_p384_montgomery_domain_field_element, arg1: &fiat_p384_montgomery_domain_field_element, arg2: &fiat_p384_montgomery_domain_field_element) -> () { + let mut x1: u64 = 0; + let mut x2: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x1, &mut x2, 0x0, (arg1[0]), (arg2[0])); + let mut x3: u64 = 0; + let mut x4: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x3, &mut x4, x2, (arg1[1]), (arg2[1])); + let mut x5: u64 = 0; + let mut x6: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x5, &mut x6, x4, (arg1[2]), (arg2[2])); + let mut x7: u64 = 0; + let mut x8: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x7, &mut x8, x6, (arg1[3]), (arg2[3])); + let mut x9: u64 = 0; + let mut x10: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x9, &mut x10, x8, (arg1[4]), (arg2[4])); + let mut x11: u64 = 0; + let mut x12: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x11, &mut x12, x10, (arg1[5]), (arg2[5])); + let mut x13: u64 = 0; + let mut x14: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x13, &mut x14, 0x0, x1, 0xffffffff); + let mut x15: u64 = 0; + let mut x16: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x15, &mut x16, x14, x3, 0xffffffff00000000); + let mut x17: u64 = 0; + let mut x18: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x17, &mut x18, x16, x5, 0xfffffffffffffffe); + let mut x19: u64 = 0; + let mut x20: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x19, &mut x20, x18, x7, 0xffffffffffffffff); + let mut x21: u64 = 0; + let mut x22: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x21, &mut x22, x20, x9, 0xffffffffffffffff); + let mut x23: u64 = 0; + let mut x24: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x23, &mut x24, x22, x11, 0xffffffffffffffff); + let mut x25: u64 = 0; + let mut x26: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x25, &mut x26, x24, (x12 as u64), (0x0 as u64)); + let mut x27: u64 = 0; + fiat_p384_cmovznz_u64(&mut x27, x26, x13, x1); + let mut x28: u64 = 0; + fiat_p384_cmovznz_u64(&mut x28, x26, x15, x3); + let mut x29: u64 = 0; + fiat_p384_cmovznz_u64(&mut x29, x26, x17, x5); + let mut x30: u64 = 0; + fiat_p384_cmovznz_u64(&mut x30, x26, x19, x7); + let mut x31: u64 = 0; + fiat_p384_cmovznz_u64(&mut x31, x26, x21, x9); + let mut x32: u64 = 0; + fiat_p384_cmovznz_u64(&mut x32, x26, x23, x11); + out1[0] = x27; + out1[1] = x28; + out1[2] = x29; + out1[3] = x30; + out1[4] = x31; + out1[5] = x32; +} + +/// The function fiat_p384_sub subtracts two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) - eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p384_sub(out1: &mut fiat_p384_montgomery_domain_field_element, arg1: &fiat_p384_montgomery_domain_field_element, arg2: &fiat_p384_montgomery_domain_field_element) -> () { + let mut x1: u64 = 0; + let mut x2: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x1, &mut x2, 0x0, (arg1[0]), (arg2[0])); + let mut x3: u64 = 0; + let mut x4: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x3, &mut x4, x2, (arg1[1]), (arg2[1])); + let mut x5: u64 = 0; + let mut x6: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x5, &mut x6, x4, (arg1[2]), (arg2[2])); + let mut x7: u64 = 0; + let mut x8: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x7, &mut x8, x6, (arg1[3]), (arg2[3])); + let mut x9: u64 = 0; + let mut x10: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x9, &mut x10, x8, (arg1[4]), (arg2[4])); + let mut x11: u64 = 0; + let mut x12: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x11, &mut x12, x10, (arg1[5]), (arg2[5])); + let mut x13: u64 = 0; + fiat_p384_cmovznz_u64(&mut x13, x12, (0x0 as u64), 0xffffffffffffffff); + let mut x14: u64 = 0; + let mut x15: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x14, &mut x15, 0x0, x1, (x13 & 0xffffffff)); + let mut x16: u64 = 0; + let mut x17: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x16, &mut x17, x15, x3, (x13 & 0xffffffff00000000)); + let mut x18: u64 = 0; + let mut x19: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x18, &mut x19, x17, x5, (x13 & 0xfffffffffffffffe)); + let mut x20: u64 = 0; + let mut x21: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x20, &mut x21, x19, x7, x13); + let mut x22: u64 = 0; + let mut x23: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x22, &mut x23, x21, x9, x13); + let mut x24: u64 = 0; + let mut x25: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x24, &mut x25, x23, x11, x13); + out1[0] = x14; + out1[1] = x16; + out1[2] = x18; + out1[3] = x20; + out1[4] = x22; + out1[5] = x24; +} + +/// The function fiat_p384_opp negates a field element in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = -eval (from_montgomery arg1) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p384_opp(out1: &mut fiat_p384_montgomery_domain_field_element, arg1: &fiat_p384_montgomery_domain_field_element) -> () { + let mut x1: u64 = 0; + let mut x2: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x1, &mut x2, 0x0, (0x0 as u64), (arg1[0])); + let mut x3: u64 = 0; + let mut x4: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x3, &mut x4, x2, (0x0 as u64), (arg1[1])); + let mut x5: u64 = 0; + let mut x6: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x5, &mut x6, x4, (0x0 as u64), (arg1[2])); + let mut x7: u64 = 0; + let mut x8: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x7, &mut x8, x6, (0x0 as u64), (arg1[3])); + let mut x9: u64 = 0; + let mut x10: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x9, &mut x10, x8, (0x0 as u64), (arg1[4])); + let mut x11: u64 = 0; + let mut x12: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x11, &mut x12, x10, (0x0 as u64), (arg1[5])); + let mut x13: u64 = 0; + fiat_p384_cmovznz_u64(&mut x13, x12, (0x0 as u64), 0xffffffffffffffff); + let mut x14: u64 = 0; + let mut x15: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x14, &mut x15, 0x0, x1, (x13 & 0xffffffff)); + let mut x16: u64 = 0; + let mut x17: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x16, &mut x17, x15, x3, (x13 & 0xffffffff00000000)); + let mut x18: u64 = 0; + let mut x19: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x18, &mut x19, x17, x5, (x13 & 0xfffffffffffffffe)); + let mut x20: u64 = 0; + let mut x21: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x20, &mut x21, x19, x7, x13); + let mut x22: u64 = 0; + let mut x23: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x22, &mut x23, x21, x9, x13); + let mut x24: u64 = 0; + let mut x25: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x24, &mut x25, x23, x11, x13); + out1[0] = x14; + out1[1] = x16; + out1[2] = x18; + out1[3] = x20; + out1[4] = x22; + out1[5] = x24; +} + +/// The function fiat_p384_from_montgomery translates a field element out of the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval out1 mod m = (eval arg1 * ((2^64)⁻¹ mod m)^6) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p384_from_montgomery(out1: &mut fiat_p384_non_montgomery_domain_field_element, arg1: &fiat_p384_montgomery_domain_field_element) -> () { + let x1: u64 = (arg1[0]); + let mut x2: u64 = 0; + let mut x3: u64 = 0; + fiat_p384_mulx_u64(&mut x2, &mut x3, x1, 0x100000001); + let mut x4: u64 = 0; + let mut x5: u64 = 0; + fiat_p384_mulx_u64(&mut x4, &mut x5, x2, 0xffffffffffffffff); + let mut x6: u64 = 0; + let mut x7: u64 = 0; + fiat_p384_mulx_u64(&mut x6, &mut x7, x2, 0xffffffffffffffff); + let mut x8: u64 = 0; + let mut x9: u64 = 0; + fiat_p384_mulx_u64(&mut x8, &mut x9, x2, 0xffffffffffffffff); + let mut x10: u64 = 0; + let mut x11: u64 = 0; + fiat_p384_mulx_u64(&mut x10, &mut x11, x2, 0xfffffffffffffffe); + let mut x12: u64 = 0; + let mut x13: u64 = 0; + fiat_p384_mulx_u64(&mut x12, &mut x13, x2, 0xffffffff00000000); + let mut x14: u64 = 0; + let mut x15: u64 = 0; + fiat_p384_mulx_u64(&mut x14, &mut x15, x2, 0xffffffff); + let mut x16: u64 = 0; + let mut x17: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x16, &mut x17, 0x0, x15, x12); + let mut x18: u64 = 0; + let mut x19: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x18, &mut x19, x17, x13, x10); + let mut x20: u64 = 0; + let mut x21: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x20, &mut x21, x19, x11, x8); + let mut x22: u64 = 0; + let mut x23: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x22, &mut x23, x21, x9, x6); + let mut x24: u64 = 0; + let mut x25: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x24, &mut x25, x23, x7, x4); + let mut x26: u64 = 0; + let mut x27: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x26, &mut x27, 0x0, x1, x14); + let mut x28: u64 = 0; + let mut x29: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x28, &mut x29, x27, (0x0 as u64), x16); + let mut x30: u64 = 0; + let mut x31: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x30, &mut x31, x29, (0x0 as u64), x18); + let mut x32: u64 = 0; + let mut x33: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x32, &mut x33, x31, (0x0 as u64), x20); + let mut x34: u64 = 0; + let mut x35: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x34, &mut x35, x33, (0x0 as u64), x22); + let mut x36: u64 = 0; + let mut x37: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x36, &mut x37, x35, (0x0 as u64), x24); + let mut x38: u64 = 0; + let mut x39: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x38, &mut x39, x37, (0x0 as u64), ((x25 as u64) + x5)); + let mut x40: u64 = 0; + let mut x41: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x40, &mut x41, 0x0, x28, (arg1[1])); + let mut x42: u64 = 0; + let mut x43: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x42, &mut x43, x41, x30, (0x0 as u64)); + let mut x44: u64 = 0; + let mut x45: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x44, &mut x45, x43, x32, (0x0 as u64)); + let mut x46: u64 = 0; + let mut x47: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x46, &mut x47, x45, x34, (0x0 as u64)); + let mut x48: u64 = 0; + let mut x49: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x48, &mut x49, x47, x36, (0x0 as u64)); + let mut x50: u64 = 0; + let mut x51: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x50, &mut x51, x49, x38, (0x0 as u64)); + let mut x52: u64 = 0; + let mut x53: u64 = 0; + fiat_p384_mulx_u64(&mut x52, &mut x53, x40, 0x100000001); + let mut x54: u64 = 0; + let mut x55: u64 = 0; + fiat_p384_mulx_u64(&mut x54, &mut x55, x52, 0xffffffffffffffff); + let mut x56: u64 = 0; + let mut x57: u64 = 0; + fiat_p384_mulx_u64(&mut x56, &mut x57, x52, 0xffffffffffffffff); + let mut x58: u64 = 0; + let mut x59: u64 = 0; + fiat_p384_mulx_u64(&mut x58, &mut x59, x52, 0xffffffffffffffff); + let mut x60: u64 = 0; + let mut x61: u64 = 0; + fiat_p384_mulx_u64(&mut x60, &mut x61, x52, 0xfffffffffffffffe); + let mut x62: u64 = 0; + let mut x63: u64 = 0; + fiat_p384_mulx_u64(&mut x62, &mut x63, x52, 0xffffffff00000000); + let mut x64: u64 = 0; + let mut x65: u64 = 0; + fiat_p384_mulx_u64(&mut x64, &mut x65, x52, 0xffffffff); + let mut x66: u64 = 0; + let mut x67: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x66, &mut x67, 0x0, x65, x62); + let mut x68: u64 = 0; + let mut x69: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x68, &mut x69, x67, x63, x60); + let mut x70: u64 = 0; + let mut x71: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x70, &mut x71, x69, x61, x58); + let mut x72: u64 = 0; + let mut x73: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x72, &mut x73, x71, x59, x56); + let mut x74: u64 = 0; + let mut x75: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x74, &mut x75, x73, x57, x54); + let mut x76: u64 = 0; + let mut x77: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x76, &mut x77, 0x0, x40, x64); + let mut x78: u64 = 0; + let mut x79: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x78, &mut x79, x77, x42, x66); + let mut x80: u64 = 0; + let mut x81: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x80, &mut x81, x79, x44, x68); + let mut x82: u64 = 0; + let mut x83: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x82, &mut x83, x81, x46, x70); + let mut x84: u64 = 0; + let mut x85: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x84, &mut x85, x83, x48, x72); + let mut x86: u64 = 0; + let mut x87: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x86, &mut x87, x85, x50, x74); + let mut x88: u64 = 0; + let mut x89: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x88, &mut x89, x87, ((x51 as u64) + (x39 as u64)), ((x75 as u64) + x55)); + let mut x90: u64 = 0; + let mut x91: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x90, &mut x91, 0x0, x78, (arg1[2])); + let mut x92: u64 = 0; + let mut x93: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x92, &mut x93, x91, x80, (0x0 as u64)); + let mut x94: u64 = 0; + let mut x95: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x94, &mut x95, x93, x82, (0x0 as u64)); + let mut x96: u64 = 0; + let mut x97: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x96, &mut x97, x95, x84, (0x0 as u64)); + let mut x98: u64 = 0; + let mut x99: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x98, &mut x99, x97, x86, (0x0 as u64)); + let mut x100: u64 = 0; + let mut x101: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x100, &mut x101, x99, x88, (0x0 as u64)); + let mut x102: u64 = 0; + let mut x103: u64 = 0; + fiat_p384_mulx_u64(&mut x102, &mut x103, x90, 0x100000001); + let mut x104: u64 = 0; + let mut x105: u64 = 0; + fiat_p384_mulx_u64(&mut x104, &mut x105, x102, 0xffffffffffffffff); + let mut x106: u64 = 0; + let mut x107: u64 = 0; + fiat_p384_mulx_u64(&mut x106, &mut x107, x102, 0xffffffffffffffff); + let mut x108: u64 = 0; + let mut x109: u64 = 0; + fiat_p384_mulx_u64(&mut x108, &mut x109, x102, 0xffffffffffffffff); + let mut x110: u64 = 0; + let mut x111: u64 = 0; + fiat_p384_mulx_u64(&mut x110, &mut x111, x102, 0xfffffffffffffffe); + let mut x112: u64 = 0; + let mut x113: u64 = 0; + fiat_p384_mulx_u64(&mut x112, &mut x113, x102, 0xffffffff00000000); + let mut x114: u64 = 0; + let mut x115: u64 = 0; + fiat_p384_mulx_u64(&mut x114, &mut x115, x102, 0xffffffff); + let mut x116: u64 = 0; + let mut x117: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x116, &mut x117, 0x0, x115, x112); + let mut x118: u64 = 0; + let mut x119: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x118, &mut x119, x117, x113, x110); + let mut x120: u64 = 0; + let mut x121: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x120, &mut x121, x119, x111, x108); + let mut x122: u64 = 0; + let mut x123: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x122, &mut x123, x121, x109, x106); + let mut x124: u64 = 0; + let mut x125: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x124, &mut x125, x123, x107, x104); + let mut x126: u64 = 0; + let mut x127: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x126, &mut x127, 0x0, x90, x114); + let mut x128: u64 = 0; + let mut x129: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x128, &mut x129, x127, x92, x116); + let mut x130: u64 = 0; + let mut x131: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x130, &mut x131, x129, x94, x118); + let mut x132: u64 = 0; + let mut x133: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x132, &mut x133, x131, x96, x120); + let mut x134: u64 = 0; + let mut x135: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x134, &mut x135, x133, x98, x122); + let mut x136: u64 = 0; + let mut x137: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x136, &mut x137, x135, x100, x124); + let mut x138: u64 = 0; + let mut x139: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x138, &mut x139, x137, ((x101 as u64) + (x89 as u64)), ((x125 as u64) + x105)); + let mut x140: u64 = 0; + let mut x141: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x140, &mut x141, 0x0, x128, (arg1[3])); + let mut x142: u64 = 0; + let mut x143: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x142, &mut x143, x141, x130, (0x0 as u64)); + let mut x144: u64 = 0; + let mut x145: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x144, &mut x145, x143, x132, (0x0 as u64)); + let mut x146: u64 = 0; + let mut x147: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x146, &mut x147, x145, x134, (0x0 as u64)); + let mut x148: u64 = 0; + let mut x149: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x148, &mut x149, x147, x136, (0x0 as u64)); + let mut x150: u64 = 0; + let mut x151: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x150, &mut x151, x149, x138, (0x0 as u64)); + let mut x152: u64 = 0; + let mut x153: u64 = 0; + fiat_p384_mulx_u64(&mut x152, &mut x153, x140, 0x100000001); + let mut x154: u64 = 0; + let mut x155: u64 = 0; + fiat_p384_mulx_u64(&mut x154, &mut x155, x152, 0xffffffffffffffff); + let mut x156: u64 = 0; + let mut x157: u64 = 0; + fiat_p384_mulx_u64(&mut x156, &mut x157, x152, 0xffffffffffffffff); + let mut x158: u64 = 0; + let mut x159: u64 = 0; + fiat_p384_mulx_u64(&mut x158, &mut x159, x152, 0xffffffffffffffff); + let mut x160: u64 = 0; + let mut x161: u64 = 0; + fiat_p384_mulx_u64(&mut x160, &mut x161, x152, 0xfffffffffffffffe); + let mut x162: u64 = 0; + let mut x163: u64 = 0; + fiat_p384_mulx_u64(&mut x162, &mut x163, x152, 0xffffffff00000000); + let mut x164: u64 = 0; + let mut x165: u64 = 0; + fiat_p384_mulx_u64(&mut x164, &mut x165, x152, 0xffffffff); + let mut x166: u64 = 0; + let mut x167: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x166, &mut x167, 0x0, x165, x162); + let mut x168: u64 = 0; + let mut x169: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x168, &mut x169, x167, x163, x160); + let mut x170: u64 = 0; + let mut x171: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x170, &mut x171, x169, x161, x158); + let mut x172: u64 = 0; + let mut x173: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x172, &mut x173, x171, x159, x156); + let mut x174: u64 = 0; + let mut x175: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x174, &mut x175, x173, x157, x154); + let mut x176: u64 = 0; + let mut x177: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x176, &mut x177, 0x0, x140, x164); + let mut x178: u64 = 0; + let mut x179: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x178, &mut x179, x177, x142, x166); + let mut x180: u64 = 0; + let mut x181: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x180, &mut x181, x179, x144, x168); + let mut x182: u64 = 0; + let mut x183: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x182, &mut x183, x181, x146, x170); + let mut x184: u64 = 0; + let mut x185: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x184, &mut x185, x183, x148, x172); + let mut x186: u64 = 0; + let mut x187: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x186, &mut x187, x185, x150, x174); + let mut x188: u64 = 0; + let mut x189: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x188, &mut x189, x187, ((x151 as u64) + (x139 as u64)), ((x175 as u64) + x155)); + let mut x190: u64 = 0; + let mut x191: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x190, &mut x191, 0x0, x178, (arg1[4])); + let mut x192: u64 = 0; + let mut x193: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x192, &mut x193, x191, x180, (0x0 as u64)); + let mut x194: u64 = 0; + let mut x195: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x194, &mut x195, x193, x182, (0x0 as u64)); + let mut x196: u64 = 0; + let mut x197: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x196, &mut x197, x195, x184, (0x0 as u64)); + let mut x198: u64 = 0; + let mut x199: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x198, &mut x199, x197, x186, (0x0 as u64)); + let mut x200: u64 = 0; + let mut x201: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x200, &mut x201, x199, x188, (0x0 as u64)); + let mut x202: u64 = 0; + let mut x203: u64 = 0; + fiat_p384_mulx_u64(&mut x202, &mut x203, x190, 0x100000001); + let mut x204: u64 = 0; + let mut x205: u64 = 0; + fiat_p384_mulx_u64(&mut x204, &mut x205, x202, 0xffffffffffffffff); + let mut x206: u64 = 0; + let mut x207: u64 = 0; + fiat_p384_mulx_u64(&mut x206, &mut x207, x202, 0xffffffffffffffff); + let mut x208: u64 = 0; + let mut x209: u64 = 0; + fiat_p384_mulx_u64(&mut x208, &mut x209, x202, 0xffffffffffffffff); + let mut x210: u64 = 0; + let mut x211: u64 = 0; + fiat_p384_mulx_u64(&mut x210, &mut x211, x202, 0xfffffffffffffffe); + let mut x212: u64 = 0; + let mut x213: u64 = 0; + fiat_p384_mulx_u64(&mut x212, &mut x213, x202, 0xffffffff00000000); + let mut x214: u64 = 0; + let mut x215: u64 = 0; + fiat_p384_mulx_u64(&mut x214, &mut x215, x202, 0xffffffff); + let mut x216: u64 = 0; + let mut x217: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x216, &mut x217, 0x0, x215, x212); + let mut x218: u64 = 0; + let mut x219: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x218, &mut x219, x217, x213, x210); + let mut x220: u64 = 0; + let mut x221: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x220, &mut x221, x219, x211, x208); + let mut x222: u64 = 0; + let mut x223: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x222, &mut x223, x221, x209, x206); + let mut x224: u64 = 0; + let mut x225: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x224, &mut x225, x223, x207, x204); + let mut x226: u64 = 0; + let mut x227: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x226, &mut x227, 0x0, x190, x214); + let mut x228: u64 = 0; + let mut x229: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x228, &mut x229, x227, x192, x216); + let mut x230: u64 = 0; + let mut x231: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x230, &mut x231, x229, x194, x218); + let mut x232: u64 = 0; + let mut x233: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x232, &mut x233, x231, x196, x220); + let mut x234: u64 = 0; + let mut x235: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x234, &mut x235, x233, x198, x222); + let mut x236: u64 = 0; + let mut x237: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x236, &mut x237, x235, x200, x224); + let mut x238: u64 = 0; + let mut x239: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x238, &mut x239, x237, ((x201 as u64) + (x189 as u64)), ((x225 as u64) + x205)); + let mut x240: u64 = 0; + let mut x241: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x240, &mut x241, 0x0, x228, (arg1[5])); + let mut x242: u64 = 0; + let mut x243: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x242, &mut x243, x241, x230, (0x0 as u64)); + let mut x244: u64 = 0; + let mut x245: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x244, &mut x245, x243, x232, (0x0 as u64)); + let mut x246: u64 = 0; + let mut x247: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x246, &mut x247, x245, x234, (0x0 as u64)); + let mut x248: u64 = 0; + let mut x249: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x248, &mut x249, x247, x236, (0x0 as u64)); + let mut x250: u64 = 0; + let mut x251: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x250, &mut x251, x249, x238, (0x0 as u64)); + let mut x252: u64 = 0; + let mut x253: u64 = 0; + fiat_p384_mulx_u64(&mut x252, &mut x253, x240, 0x100000001); + let mut x254: u64 = 0; + let mut x255: u64 = 0; + fiat_p384_mulx_u64(&mut x254, &mut x255, x252, 0xffffffffffffffff); + let mut x256: u64 = 0; + let mut x257: u64 = 0; + fiat_p384_mulx_u64(&mut x256, &mut x257, x252, 0xffffffffffffffff); + let mut x258: u64 = 0; + let mut x259: u64 = 0; + fiat_p384_mulx_u64(&mut x258, &mut x259, x252, 0xffffffffffffffff); + let mut x260: u64 = 0; + let mut x261: u64 = 0; + fiat_p384_mulx_u64(&mut x260, &mut x261, x252, 0xfffffffffffffffe); + let mut x262: u64 = 0; + let mut x263: u64 = 0; + fiat_p384_mulx_u64(&mut x262, &mut x263, x252, 0xffffffff00000000); + let mut x264: u64 = 0; + let mut x265: u64 = 0; + fiat_p384_mulx_u64(&mut x264, &mut x265, x252, 0xffffffff); + let mut x266: u64 = 0; + let mut x267: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x266, &mut x267, 0x0, x265, x262); + let mut x268: u64 = 0; + let mut x269: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x268, &mut x269, x267, x263, x260); + let mut x270: u64 = 0; + let mut x271: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x270, &mut x271, x269, x261, x258); + let mut x272: u64 = 0; + let mut x273: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x272, &mut x273, x271, x259, x256); + let mut x274: u64 = 0; + let mut x275: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x274, &mut x275, x273, x257, x254); + let mut x276: u64 = 0; + let mut x277: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x276, &mut x277, 0x0, x240, x264); + let mut x278: u64 = 0; + let mut x279: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x278, &mut x279, x277, x242, x266); + let mut x280: u64 = 0; + let mut x281: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x280, &mut x281, x279, x244, x268); + let mut x282: u64 = 0; + let mut x283: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x282, &mut x283, x281, x246, x270); + let mut x284: u64 = 0; + let mut x285: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x284, &mut x285, x283, x248, x272); + let mut x286: u64 = 0; + let mut x287: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x286, &mut x287, x285, x250, x274); + let mut x288: u64 = 0; + let mut x289: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x288, &mut x289, x287, ((x251 as u64) + (x239 as u64)), ((x275 as u64) + x255)); + let mut x290: u64 = 0; + let mut x291: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x290, &mut x291, 0x0, x278, 0xffffffff); + let mut x292: u64 = 0; + let mut x293: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x292, &mut x293, x291, x280, 0xffffffff00000000); + let mut x294: u64 = 0; + let mut x295: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x294, &mut x295, x293, x282, 0xfffffffffffffffe); + let mut x296: u64 = 0; + let mut x297: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x296, &mut x297, x295, x284, 0xffffffffffffffff); + let mut x298: u64 = 0; + let mut x299: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x298, &mut x299, x297, x286, 0xffffffffffffffff); + let mut x300: u64 = 0; + let mut x301: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x300, &mut x301, x299, x288, 0xffffffffffffffff); + let mut x302: u64 = 0; + let mut x303: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x302, &mut x303, x301, (x289 as u64), (0x0 as u64)); + let mut x304: u64 = 0; + fiat_p384_cmovznz_u64(&mut x304, x303, x290, x278); + let mut x305: u64 = 0; + fiat_p384_cmovznz_u64(&mut x305, x303, x292, x280); + let mut x306: u64 = 0; + fiat_p384_cmovznz_u64(&mut x306, x303, x294, x282); + let mut x307: u64 = 0; + fiat_p384_cmovznz_u64(&mut x307, x303, x296, x284); + let mut x308: u64 = 0; + fiat_p384_cmovznz_u64(&mut x308, x303, x298, x286); + let mut x309: u64 = 0; + fiat_p384_cmovznz_u64(&mut x309, x303, x300, x288); + out1[0] = x304; + out1[1] = x305; + out1[2] = x306; + out1[3] = x307; + out1[4] = x308; + out1[5] = x309; +} + +/// The function fiat_p384_to_montgomery translates a field element into the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = eval arg1 mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p384_to_montgomery(out1: &mut fiat_p384_montgomery_domain_field_element, arg1: &fiat_p384_non_montgomery_domain_field_element) -> () { + let x1: u64 = (arg1[1]); + let x2: u64 = (arg1[2]); + let x3: u64 = (arg1[3]); + let x4: u64 = (arg1[4]); + let x5: u64 = (arg1[5]); + let x6: u64 = (arg1[0]); + let mut x7: u64 = 0; + let mut x8: u64 = 0; + fiat_p384_mulx_u64(&mut x7, &mut x8, x6, 0x200000000); + let mut x9: u64 = 0; + let mut x10: u64 = 0; + fiat_p384_mulx_u64(&mut x9, &mut x10, x6, 0xfffffffe00000000); + let mut x11: u64 = 0; + let mut x12: u64 = 0; + fiat_p384_mulx_u64(&mut x11, &mut x12, x6, 0x200000000); + let mut x13: u64 = 0; + let mut x14: u64 = 0; + fiat_p384_mulx_u64(&mut x13, &mut x14, x6, 0xfffffffe00000001); + let mut x15: u64 = 0; + let mut x16: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x15, &mut x16, 0x0, x14, x11); + let mut x17: u64 = 0; + let mut x18: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x17, &mut x18, x16, x12, x9); + let mut x19: u64 = 0; + let mut x20: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x19, &mut x20, x18, x10, x7); + let mut x21: u64 = 0; + let mut x22: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x21, &mut x22, x20, x8, x6); + let mut x23: u64 = 0; + let mut x24: u64 = 0; + fiat_p384_mulx_u64(&mut x23, &mut x24, x13, 0x100000001); + let mut x25: u64 = 0; + let mut x26: u64 = 0; + fiat_p384_mulx_u64(&mut x25, &mut x26, x23, 0xffffffffffffffff); + let mut x27: u64 = 0; + let mut x28: u64 = 0; + fiat_p384_mulx_u64(&mut x27, &mut x28, x23, 0xffffffffffffffff); + let mut x29: u64 = 0; + let mut x30: u64 = 0; + fiat_p384_mulx_u64(&mut x29, &mut x30, x23, 0xffffffffffffffff); + let mut x31: u64 = 0; + let mut x32: u64 = 0; + fiat_p384_mulx_u64(&mut x31, &mut x32, x23, 0xfffffffffffffffe); + let mut x33: u64 = 0; + let mut x34: u64 = 0; + fiat_p384_mulx_u64(&mut x33, &mut x34, x23, 0xffffffff00000000); + let mut x35: u64 = 0; + let mut x36: u64 = 0; + fiat_p384_mulx_u64(&mut x35, &mut x36, x23, 0xffffffff); + let mut x37: u64 = 0; + let mut x38: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x37, &mut x38, 0x0, x36, x33); + let mut x39: u64 = 0; + let mut x40: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x39, &mut x40, x38, x34, x31); + let mut x41: u64 = 0; + let mut x42: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x41, &mut x42, x40, x32, x29); + let mut x43: u64 = 0; + let mut x44: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x43, &mut x44, x42, x30, x27); + let mut x45: u64 = 0; + let mut x46: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x45, &mut x46, x44, x28, x25); + let mut x47: u64 = 0; + let mut x48: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x47, &mut x48, 0x0, x13, x35); + let mut x49: u64 = 0; + let mut x50: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x49, &mut x50, x48, x15, x37); + let mut x51: u64 = 0; + let mut x52: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x51, &mut x52, x50, x17, x39); + let mut x53: u64 = 0; + let mut x54: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x53, &mut x54, x52, x19, x41); + let mut x55: u64 = 0; + let mut x56: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x55, &mut x56, x54, x21, x43); + let mut x57: u64 = 0; + let mut x58: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x57, &mut x58, x56, (x22 as u64), x45); + let mut x59: u64 = 0; + let mut x60: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x59, &mut x60, x58, (0x0 as u64), ((x46 as u64) + x26)); + let mut x61: u64 = 0; + let mut x62: u64 = 0; + fiat_p384_mulx_u64(&mut x61, &mut x62, x1, 0x200000000); + let mut x63: u64 = 0; + let mut x64: u64 = 0; + fiat_p384_mulx_u64(&mut x63, &mut x64, x1, 0xfffffffe00000000); + let mut x65: u64 = 0; + let mut x66: u64 = 0; + fiat_p384_mulx_u64(&mut x65, &mut x66, x1, 0x200000000); + let mut x67: u64 = 0; + let mut x68: u64 = 0; + fiat_p384_mulx_u64(&mut x67, &mut x68, x1, 0xfffffffe00000001); + let mut x69: u64 = 0; + let mut x70: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x69, &mut x70, 0x0, x68, x65); + let mut x71: u64 = 0; + let mut x72: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x71, &mut x72, x70, x66, x63); + let mut x73: u64 = 0; + let mut x74: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x73, &mut x74, x72, x64, x61); + let mut x75: u64 = 0; + let mut x76: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x75, &mut x76, x74, x62, x1); + let mut x77: u64 = 0; + let mut x78: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x77, &mut x78, 0x0, x49, x67); + let mut x79: u64 = 0; + let mut x80: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x79, &mut x80, x78, x51, x69); + let mut x81: u64 = 0; + let mut x82: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x81, &mut x82, x80, x53, x71); + let mut x83: u64 = 0; + let mut x84: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x83, &mut x84, x82, x55, x73); + let mut x85: u64 = 0; + let mut x86: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x85, &mut x86, x84, x57, x75); + let mut x87: u64 = 0; + let mut x88: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x87, &mut x88, x86, x59, (x76 as u64)); + let mut x89: u64 = 0; + let mut x90: u64 = 0; + fiat_p384_mulx_u64(&mut x89, &mut x90, x77, 0x100000001); + let mut x91: u64 = 0; + let mut x92: u64 = 0; + fiat_p384_mulx_u64(&mut x91, &mut x92, x89, 0xffffffffffffffff); + let mut x93: u64 = 0; + let mut x94: u64 = 0; + fiat_p384_mulx_u64(&mut x93, &mut x94, x89, 0xffffffffffffffff); + let mut x95: u64 = 0; + let mut x96: u64 = 0; + fiat_p384_mulx_u64(&mut x95, &mut x96, x89, 0xffffffffffffffff); + let mut x97: u64 = 0; + let mut x98: u64 = 0; + fiat_p384_mulx_u64(&mut x97, &mut x98, x89, 0xfffffffffffffffe); + let mut x99: u64 = 0; + let mut x100: u64 = 0; + fiat_p384_mulx_u64(&mut x99, &mut x100, x89, 0xffffffff00000000); + let mut x101: u64 = 0; + let mut x102: u64 = 0; + fiat_p384_mulx_u64(&mut x101, &mut x102, x89, 0xffffffff); + let mut x103: u64 = 0; + let mut x104: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x103, &mut x104, 0x0, x102, x99); + let mut x105: u64 = 0; + let mut x106: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x105, &mut x106, x104, x100, x97); + let mut x107: u64 = 0; + let mut x108: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x107, &mut x108, x106, x98, x95); + let mut x109: u64 = 0; + let mut x110: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x109, &mut x110, x108, x96, x93); + let mut x111: u64 = 0; + let mut x112: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x111, &mut x112, x110, x94, x91); + let mut x113: u64 = 0; + let mut x114: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x113, &mut x114, 0x0, x77, x101); + let mut x115: u64 = 0; + let mut x116: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x115, &mut x116, x114, x79, x103); + let mut x117: u64 = 0; + let mut x118: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x117, &mut x118, x116, x81, x105); + let mut x119: u64 = 0; + let mut x120: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x119, &mut x120, x118, x83, x107); + let mut x121: u64 = 0; + let mut x122: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x121, &mut x122, x120, x85, x109); + let mut x123: u64 = 0; + let mut x124: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x123, &mut x124, x122, x87, x111); + let mut x125: u64 = 0; + let mut x126: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x125, &mut x126, x124, ((x88 as u64) + (x60 as u64)), ((x112 as u64) + x92)); + let mut x127: u64 = 0; + let mut x128: u64 = 0; + fiat_p384_mulx_u64(&mut x127, &mut x128, x2, 0x200000000); + let mut x129: u64 = 0; + let mut x130: u64 = 0; + fiat_p384_mulx_u64(&mut x129, &mut x130, x2, 0xfffffffe00000000); + let mut x131: u64 = 0; + let mut x132: u64 = 0; + fiat_p384_mulx_u64(&mut x131, &mut x132, x2, 0x200000000); + let mut x133: u64 = 0; + let mut x134: u64 = 0; + fiat_p384_mulx_u64(&mut x133, &mut x134, x2, 0xfffffffe00000001); + let mut x135: u64 = 0; + let mut x136: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x135, &mut x136, 0x0, x134, x131); + let mut x137: u64 = 0; + let mut x138: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x137, &mut x138, x136, x132, x129); + let mut x139: u64 = 0; + let mut x140: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x139, &mut x140, x138, x130, x127); + let mut x141: u64 = 0; + let mut x142: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x141, &mut x142, x140, x128, x2); + let mut x143: u64 = 0; + let mut x144: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x143, &mut x144, 0x0, x115, x133); + let mut x145: u64 = 0; + let mut x146: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x145, &mut x146, x144, x117, x135); + let mut x147: u64 = 0; + let mut x148: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x147, &mut x148, x146, x119, x137); + let mut x149: u64 = 0; + let mut x150: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x149, &mut x150, x148, x121, x139); + let mut x151: u64 = 0; + let mut x152: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x151, &mut x152, x150, x123, x141); + let mut x153: u64 = 0; + let mut x154: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x153, &mut x154, x152, x125, (x142 as u64)); + let mut x155: u64 = 0; + let mut x156: u64 = 0; + fiat_p384_mulx_u64(&mut x155, &mut x156, x143, 0x100000001); + let mut x157: u64 = 0; + let mut x158: u64 = 0; + fiat_p384_mulx_u64(&mut x157, &mut x158, x155, 0xffffffffffffffff); + let mut x159: u64 = 0; + let mut x160: u64 = 0; + fiat_p384_mulx_u64(&mut x159, &mut x160, x155, 0xffffffffffffffff); + let mut x161: u64 = 0; + let mut x162: u64 = 0; + fiat_p384_mulx_u64(&mut x161, &mut x162, x155, 0xffffffffffffffff); + let mut x163: u64 = 0; + let mut x164: u64 = 0; + fiat_p384_mulx_u64(&mut x163, &mut x164, x155, 0xfffffffffffffffe); + let mut x165: u64 = 0; + let mut x166: u64 = 0; + fiat_p384_mulx_u64(&mut x165, &mut x166, x155, 0xffffffff00000000); + let mut x167: u64 = 0; + let mut x168: u64 = 0; + fiat_p384_mulx_u64(&mut x167, &mut x168, x155, 0xffffffff); + let mut x169: u64 = 0; + let mut x170: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x169, &mut x170, 0x0, x168, x165); + let mut x171: u64 = 0; + let mut x172: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x171, &mut x172, x170, x166, x163); + let mut x173: u64 = 0; + let mut x174: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x173, &mut x174, x172, x164, x161); + let mut x175: u64 = 0; + let mut x176: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x175, &mut x176, x174, x162, x159); + let mut x177: u64 = 0; + let mut x178: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x177, &mut x178, x176, x160, x157); + let mut x179: u64 = 0; + let mut x180: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x179, &mut x180, 0x0, x143, x167); + let mut x181: u64 = 0; + let mut x182: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x181, &mut x182, x180, x145, x169); + let mut x183: u64 = 0; + let mut x184: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x183, &mut x184, x182, x147, x171); + let mut x185: u64 = 0; + let mut x186: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x185, &mut x186, x184, x149, x173); + let mut x187: u64 = 0; + let mut x188: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x187, &mut x188, x186, x151, x175); + let mut x189: u64 = 0; + let mut x190: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x189, &mut x190, x188, x153, x177); + let mut x191: u64 = 0; + let mut x192: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x191, &mut x192, x190, ((x154 as u64) + (x126 as u64)), ((x178 as u64) + x158)); + let mut x193: u64 = 0; + let mut x194: u64 = 0; + fiat_p384_mulx_u64(&mut x193, &mut x194, x3, 0x200000000); + let mut x195: u64 = 0; + let mut x196: u64 = 0; + fiat_p384_mulx_u64(&mut x195, &mut x196, x3, 0xfffffffe00000000); + let mut x197: u64 = 0; + let mut x198: u64 = 0; + fiat_p384_mulx_u64(&mut x197, &mut x198, x3, 0x200000000); + let mut x199: u64 = 0; + let mut x200: u64 = 0; + fiat_p384_mulx_u64(&mut x199, &mut x200, x3, 0xfffffffe00000001); + let mut x201: u64 = 0; + let mut x202: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x201, &mut x202, 0x0, x200, x197); + let mut x203: u64 = 0; + let mut x204: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x203, &mut x204, x202, x198, x195); + let mut x205: u64 = 0; + let mut x206: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x205, &mut x206, x204, x196, x193); + let mut x207: u64 = 0; + let mut x208: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x207, &mut x208, x206, x194, x3); + let mut x209: u64 = 0; + let mut x210: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x209, &mut x210, 0x0, x181, x199); + let mut x211: u64 = 0; + let mut x212: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x211, &mut x212, x210, x183, x201); + let mut x213: u64 = 0; + let mut x214: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x213, &mut x214, x212, x185, x203); + let mut x215: u64 = 0; + let mut x216: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x215, &mut x216, x214, x187, x205); + let mut x217: u64 = 0; + let mut x218: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x217, &mut x218, x216, x189, x207); + let mut x219: u64 = 0; + let mut x220: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x219, &mut x220, x218, x191, (x208 as u64)); + let mut x221: u64 = 0; + let mut x222: u64 = 0; + fiat_p384_mulx_u64(&mut x221, &mut x222, x209, 0x100000001); + let mut x223: u64 = 0; + let mut x224: u64 = 0; + fiat_p384_mulx_u64(&mut x223, &mut x224, x221, 0xffffffffffffffff); + let mut x225: u64 = 0; + let mut x226: u64 = 0; + fiat_p384_mulx_u64(&mut x225, &mut x226, x221, 0xffffffffffffffff); + let mut x227: u64 = 0; + let mut x228: u64 = 0; + fiat_p384_mulx_u64(&mut x227, &mut x228, x221, 0xffffffffffffffff); + let mut x229: u64 = 0; + let mut x230: u64 = 0; + fiat_p384_mulx_u64(&mut x229, &mut x230, x221, 0xfffffffffffffffe); + let mut x231: u64 = 0; + let mut x232: u64 = 0; + fiat_p384_mulx_u64(&mut x231, &mut x232, x221, 0xffffffff00000000); + let mut x233: u64 = 0; + let mut x234: u64 = 0; + fiat_p384_mulx_u64(&mut x233, &mut x234, x221, 0xffffffff); + let mut x235: u64 = 0; + let mut x236: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x235, &mut x236, 0x0, x234, x231); + let mut x237: u64 = 0; + let mut x238: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x237, &mut x238, x236, x232, x229); + let mut x239: u64 = 0; + let mut x240: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x239, &mut x240, x238, x230, x227); + let mut x241: u64 = 0; + let mut x242: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x241, &mut x242, x240, x228, x225); + let mut x243: u64 = 0; + let mut x244: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x243, &mut x244, x242, x226, x223); + let mut x245: u64 = 0; + let mut x246: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x245, &mut x246, 0x0, x209, x233); + let mut x247: u64 = 0; + let mut x248: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x247, &mut x248, x246, x211, x235); + let mut x249: u64 = 0; + let mut x250: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x249, &mut x250, x248, x213, x237); + let mut x251: u64 = 0; + let mut x252: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x251, &mut x252, x250, x215, x239); + let mut x253: u64 = 0; + let mut x254: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x253, &mut x254, x252, x217, x241); + let mut x255: u64 = 0; + let mut x256: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x255, &mut x256, x254, x219, x243); + let mut x257: u64 = 0; + let mut x258: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x257, &mut x258, x256, ((x220 as u64) + (x192 as u64)), ((x244 as u64) + x224)); + let mut x259: u64 = 0; + let mut x260: u64 = 0; + fiat_p384_mulx_u64(&mut x259, &mut x260, x4, 0x200000000); + let mut x261: u64 = 0; + let mut x262: u64 = 0; + fiat_p384_mulx_u64(&mut x261, &mut x262, x4, 0xfffffffe00000000); + let mut x263: u64 = 0; + let mut x264: u64 = 0; + fiat_p384_mulx_u64(&mut x263, &mut x264, x4, 0x200000000); + let mut x265: u64 = 0; + let mut x266: u64 = 0; + fiat_p384_mulx_u64(&mut x265, &mut x266, x4, 0xfffffffe00000001); + let mut x267: u64 = 0; + let mut x268: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x267, &mut x268, 0x0, x266, x263); + let mut x269: u64 = 0; + let mut x270: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x269, &mut x270, x268, x264, x261); + let mut x271: u64 = 0; + let mut x272: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x271, &mut x272, x270, x262, x259); + let mut x273: u64 = 0; + let mut x274: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x273, &mut x274, x272, x260, x4); + let mut x275: u64 = 0; + let mut x276: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x275, &mut x276, 0x0, x247, x265); + let mut x277: u64 = 0; + let mut x278: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x277, &mut x278, x276, x249, x267); + let mut x279: u64 = 0; + let mut x280: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x279, &mut x280, x278, x251, x269); + let mut x281: u64 = 0; + let mut x282: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x281, &mut x282, x280, x253, x271); + let mut x283: u64 = 0; + let mut x284: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x283, &mut x284, x282, x255, x273); + let mut x285: u64 = 0; + let mut x286: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x285, &mut x286, x284, x257, (x274 as u64)); + let mut x287: u64 = 0; + let mut x288: u64 = 0; + fiat_p384_mulx_u64(&mut x287, &mut x288, x275, 0x100000001); + let mut x289: u64 = 0; + let mut x290: u64 = 0; + fiat_p384_mulx_u64(&mut x289, &mut x290, x287, 0xffffffffffffffff); + let mut x291: u64 = 0; + let mut x292: u64 = 0; + fiat_p384_mulx_u64(&mut x291, &mut x292, x287, 0xffffffffffffffff); + let mut x293: u64 = 0; + let mut x294: u64 = 0; + fiat_p384_mulx_u64(&mut x293, &mut x294, x287, 0xffffffffffffffff); + let mut x295: u64 = 0; + let mut x296: u64 = 0; + fiat_p384_mulx_u64(&mut x295, &mut x296, x287, 0xfffffffffffffffe); + let mut x297: u64 = 0; + let mut x298: u64 = 0; + fiat_p384_mulx_u64(&mut x297, &mut x298, x287, 0xffffffff00000000); + let mut x299: u64 = 0; + let mut x300: u64 = 0; + fiat_p384_mulx_u64(&mut x299, &mut x300, x287, 0xffffffff); + let mut x301: u64 = 0; + let mut x302: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x301, &mut x302, 0x0, x300, x297); + let mut x303: u64 = 0; + let mut x304: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x303, &mut x304, x302, x298, x295); + let mut x305: u64 = 0; + let mut x306: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x305, &mut x306, x304, x296, x293); + let mut x307: u64 = 0; + let mut x308: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x307, &mut x308, x306, x294, x291); + let mut x309: u64 = 0; + let mut x310: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x309, &mut x310, x308, x292, x289); + let mut x311: u64 = 0; + let mut x312: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x311, &mut x312, 0x0, x275, x299); + let mut x313: u64 = 0; + let mut x314: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x313, &mut x314, x312, x277, x301); + let mut x315: u64 = 0; + let mut x316: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x315, &mut x316, x314, x279, x303); + let mut x317: u64 = 0; + let mut x318: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x317, &mut x318, x316, x281, x305); + let mut x319: u64 = 0; + let mut x320: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x319, &mut x320, x318, x283, x307); + let mut x321: u64 = 0; + let mut x322: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x321, &mut x322, x320, x285, x309); + let mut x323: u64 = 0; + let mut x324: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x323, &mut x324, x322, ((x286 as u64) + (x258 as u64)), ((x310 as u64) + x290)); + let mut x325: u64 = 0; + let mut x326: u64 = 0; + fiat_p384_mulx_u64(&mut x325, &mut x326, x5, 0x200000000); + let mut x327: u64 = 0; + let mut x328: u64 = 0; + fiat_p384_mulx_u64(&mut x327, &mut x328, x5, 0xfffffffe00000000); + let mut x329: u64 = 0; + let mut x330: u64 = 0; + fiat_p384_mulx_u64(&mut x329, &mut x330, x5, 0x200000000); + let mut x331: u64 = 0; + let mut x332: u64 = 0; + fiat_p384_mulx_u64(&mut x331, &mut x332, x5, 0xfffffffe00000001); + let mut x333: u64 = 0; + let mut x334: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x333, &mut x334, 0x0, x332, x329); + let mut x335: u64 = 0; + let mut x336: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x335, &mut x336, x334, x330, x327); + let mut x337: u64 = 0; + let mut x338: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x337, &mut x338, x336, x328, x325); + let mut x339: u64 = 0; + let mut x340: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x339, &mut x340, x338, x326, x5); + let mut x341: u64 = 0; + let mut x342: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x341, &mut x342, 0x0, x313, x331); + let mut x343: u64 = 0; + let mut x344: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x343, &mut x344, x342, x315, x333); + let mut x345: u64 = 0; + let mut x346: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x345, &mut x346, x344, x317, x335); + let mut x347: u64 = 0; + let mut x348: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x347, &mut x348, x346, x319, x337); + let mut x349: u64 = 0; + let mut x350: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x349, &mut x350, x348, x321, x339); + let mut x351: u64 = 0; + let mut x352: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x351, &mut x352, x350, x323, (x340 as u64)); + let mut x353: u64 = 0; + let mut x354: u64 = 0; + fiat_p384_mulx_u64(&mut x353, &mut x354, x341, 0x100000001); + let mut x355: u64 = 0; + let mut x356: u64 = 0; + fiat_p384_mulx_u64(&mut x355, &mut x356, x353, 0xffffffffffffffff); + let mut x357: u64 = 0; + let mut x358: u64 = 0; + fiat_p384_mulx_u64(&mut x357, &mut x358, x353, 0xffffffffffffffff); + let mut x359: u64 = 0; + let mut x360: u64 = 0; + fiat_p384_mulx_u64(&mut x359, &mut x360, x353, 0xffffffffffffffff); + let mut x361: u64 = 0; + let mut x362: u64 = 0; + fiat_p384_mulx_u64(&mut x361, &mut x362, x353, 0xfffffffffffffffe); + let mut x363: u64 = 0; + let mut x364: u64 = 0; + fiat_p384_mulx_u64(&mut x363, &mut x364, x353, 0xffffffff00000000); + let mut x365: u64 = 0; + let mut x366: u64 = 0; + fiat_p384_mulx_u64(&mut x365, &mut x366, x353, 0xffffffff); + let mut x367: u64 = 0; + let mut x368: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x367, &mut x368, 0x0, x366, x363); + let mut x369: u64 = 0; + let mut x370: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x369, &mut x370, x368, x364, x361); + let mut x371: u64 = 0; + let mut x372: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x371, &mut x372, x370, x362, x359); + let mut x373: u64 = 0; + let mut x374: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x373, &mut x374, x372, x360, x357); + let mut x375: u64 = 0; + let mut x376: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x375, &mut x376, x374, x358, x355); + let mut x377: u64 = 0; + let mut x378: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x377, &mut x378, 0x0, x341, x365); + let mut x379: u64 = 0; + let mut x380: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x379, &mut x380, x378, x343, x367); + let mut x381: u64 = 0; + let mut x382: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x381, &mut x382, x380, x345, x369); + let mut x383: u64 = 0; + let mut x384: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x383, &mut x384, x382, x347, x371); + let mut x385: u64 = 0; + let mut x386: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x385, &mut x386, x384, x349, x373); + let mut x387: u64 = 0; + let mut x388: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x387, &mut x388, x386, x351, x375); + let mut x389: u64 = 0; + let mut x390: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x389, &mut x390, x388, ((x352 as u64) + (x324 as u64)), ((x376 as u64) + x356)); + let mut x391: u64 = 0; + let mut x392: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x391, &mut x392, 0x0, x379, 0xffffffff); + let mut x393: u64 = 0; + let mut x394: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x393, &mut x394, x392, x381, 0xffffffff00000000); + let mut x395: u64 = 0; + let mut x396: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x395, &mut x396, x394, x383, 0xfffffffffffffffe); + let mut x397: u64 = 0; + let mut x398: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x397, &mut x398, x396, x385, 0xffffffffffffffff); + let mut x399: u64 = 0; + let mut x400: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x399, &mut x400, x398, x387, 0xffffffffffffffff); + let mut x401: u64 = 0; + let mut x402: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x401, &mut x402, x400, x389, 0xffffffffffffffff); + let mut x403: u64 = 0; + let mut x404: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x403, &mut x404, x402, (x390 as u64), (0x0 as u64)); + let mut x405: u64 = 0; + fiat_p384_cmovznz_u64(&mut x405, x404, x391, x379); + let mut x406: u64 = 0; + fiat_p384_cmovznz_u64(&mut x406, x404, x393, x381); + let mut x407: u64 = 0; + fiat_p384_cmovznz_u64(&mut x407, x404, x395, x383); + let mut x408: u64 = 0; + fiat_p384_cmovznz_u64(&mut x408, x404, x397, x385); + let mut x409: u64 = 0; + fiat_p384_cmovznz_u64(&mut x409, x404, x399, x387); + let mut x410: u64 = 0; + fiat_p384_cmovznz_u64(&mut x410, x404, x401, x389); + out1[0] = x405; + out1[1] = x406; + out1[2] = x407; + out1[3] = x408; + out1[4] = x409; + out1[5] = x410; +} + +/// The function fiat_p384_nonzero outputs a single non-zero word if the input is non-zero and zero otherwise. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// out1 = 0 ↔ eval (from_montgomery arg1) mod m = 0 +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +#[inline] +pub fn fiat_p384_nonzero(out1: &mut u64, arg1: &[u64; 6]) -> () { + let x1: u64 = ((arg1[0]) | ((arg1[1]) | ((arg1[2]) | ((arg1[3]) | ((arg1[4]) | (arg1[5])))))); + *out1 = x1; +} + +/// The function fiat_p384_selectznz is a multi-limb conditional select. +/// +/// Postconditions: +/// out1 = (if arg1 = 0 then arg2 else arg3) +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +#[inline] +pub fn fiat_p384_selectznz(out1: &mut [u64; 6], arg1: fiat_p384_u1, arg2: &[u64; 6], arg3: &[u64; 6]) -> () { + let mut x1: u64 = 0; + fiat_p384_cmovznz_u64(&mut x1, arg1, (arg2[0]), (arg3[0])); + let mut x2: u64 = 0; + fiat_p384_cmovznz_u64(&mut x2, arg1, (arg2[1]), (arg3[1])); + let mut x3: u64 = 0; + fiat_p384_cmovznz_u64(&mut x3, arg1, (arg2[2]), (arg3[2])); + let mut x4: u64 = 0; + fiat_p384_cmovznz_u64(&mut x4, arg1, (arg2[3]), (arg3[3])); + let mut x5: u64 = 0; + fiat_p384_cmovznz_u64(&mut x5, arg1, (arg2[4]), (arg3[4])); + let mut x6: u64 = 0; + fiat_p384_cmovznz_u64(&mut x6, arg1, (arg2[5]), (arg3[5])); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; + out1[3] = x4; + out1[4] = x5; + out1[5] = x6; +} + +/// The function fiat_p384_to_bytes serializes a field element NOT in the Montgomery domain to bytes in little-endian order. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..47] +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] +#[inline] +pub fn fiat_p384_to_bytes(out1: &mut [u8; 48], arg1: &[u64; 6]) -> () { + let x1: u64 = (arg1[5]); + let x2: u64 = (arg1[4]); + let x3: u64 = (arg1[3]); + let x4: u64 = (arg1[2]); + let x5: u64 = (arg1[1]); + let x6: u64 = (arg1[0]); + let x7: u8 = ((x6 & (0xff as u64)) as u8); + let x8: u64 = (x6 >> 8); + let x9: u8 = ((x8 & (0xff as u64)) as u8); + let x10: u64 = (x8 >> 8); + let x11: u8 = ((x10 & (0xff as u64)) as u8); + let x12: u64 = (x10 >> 8); + let x13: u8 = ((x12 & (0xff as u64)) as u8); + let x14: u64 = (x12 >> 8); + let x15: u8 = ((x14 & (0xff as u64)) as u8); + let x16: u64 = (x14 >> 8); + let x17: u8 = ((x16 & (0xff as u64)) as u8); + let x18: u64 = (x16 >> 8); + let x19: u8 = ((x18 & (0xff as u64)) as u8); + let x20: u8 = ((x18 >> 8) as u8); + let x21: u8 = ((x5 & (0xff as u64)) as u8); + let x22: u64 = (x5 >> 8); + let x23: u8 = ((x22 & (0xff as u64)) as u8); + let x24: u64 = (x22 >> 8); + let x25: u8 = ((x24 & (0xff as u64)) as u8); + let x26: u64 = (x24 >> 8); + let x27: u8 = ((x26 & (0xff as u64)) as u8); + let x28: u64 = (x26 >> 8); + let x29: u8 = ((x28 & (0xff as u64)) as u8); + let x30: u64 = (x28 >> 8); + let x31: u8 = ((x30 & (0xff as u64)) as u8); + let x32: u64 = (x30 >> 8); + let x33: u8 = ((x32 & (0xff as u64)) as u8); + let x34: u8 = ((x32 >> 8) as u8); + let x35: u8 = ((x4 & (0xff as u64)) as u8); + let x36: u64 = (x4 >> 8); + let x37: u8 = ((x36 & (0xff as u64)) as u8); + let x38: u64 = (x36 >> 8); + let x39: u8 = ((x38 & (0xff as u64)) as u8); + let x40: u64 = (x38 >> 8); + let x41: u8 = ((x40 & (0xff as u64)) as u8); + let x42: u64 = (x40 >> 8); + let x43: u8 = ((x42 & (0xff as u64)) as u8); + let x44: u64 = (x42 >> 8); + let x45: u8 = ((x44 & (0xff as u64)) as u8); + let x46: u64 = (x44 >> 8); + let x47: u8 = ((x46 & (0xff as u64)) as u8); + let x48: u8 = ((x46 >> 8) as u8); + let x49: u8 = ((x3 & (0xff as u64)) as u8); + let x50: u64 = (x3 >> 8); + let x51: u8 = ((x50 & (0xff as u64)) as u8); + let x52: u64 = (x50 >> 8); + let x53: u8 = ((x52 & (0xff as u64)) as u8); + let x54: u64 = (x52 >> 8); + let x55: u8 = ((x54 & (0xff as u64)) as u8); + let x56: u64 = (x54 >> 8); + let x57: u8 = ((x56 & (0xff as u64)) as u8); + let x58: u64 = (x56 >> 8); + let x59: u8 = ((x58 & (0xff as u64)) as u8); + let x60: u64 = (x58 >> 8); + let x61: u8 = ((x60 & (0xff as u64)) as u8); + let x62: u8 = ((x60 >> 8) as u8); + let x63: u8 = ((x2 & (0xff as u64)) as u8); + let x64: u64 = (x2 >> 8); + let x65: u8 = ((x64 & (0xff as u64)) as u8); + let x66: u64 = (x64 >> 8); + let x67: u8 = ((x66 & (0xff as u64)) as u8); + let x68: u64 = (x66 >> 8); + let x69: u8 = ((x68 & (0xff as u64)) as u8); + let x70: u64 = (x68 >> 8); + let x71: u8 = ((x70 & (0xff as u64)) as u8); + let x72: u64 = (x70 >> 8); + let x73: u8 = ((x72 & (0xff as u64)) as u8); + let x74: u64 = (x72 >> 8); + let x75: u8 = ((x74 & (0xff as u64)) as u8); + let x76: u8 = ((x74 >> 8) as u8); + let x77: u8 = ((x1 & (0xff as u64)) as u8); + let x78: u64 = (x1 >> 8); + let x79: u8 = ((x78 & (0xff as u64)) as u8); + let x80: u64 = (x78 >> 8); + let x81: u8 = ((x80 & (0xff as u64)) as u8); + let x82: u64 = (x80 >> 8); + let x83: u8 = ((x82 & (0xff as u64)) as u8); + let x84: u64 = (x82 >> 8); + let x85: u8 = ((x84 & (0xff as u64)) as u8); + let x86: u64 = (x84 >> 8); + let x87: u8 = ((x86 & (0xff as u64)) as u8); + let x88: u64 = (x86 >> 8); + let x89: u8 = ((x88 & (0xff as u64)) as u8); + let x90: u8 = ((x88 >> 8) as u8); + out1[0] = x7; + out1[1] = x9; + out1[2] = x11; + out1[3] = x13; + out1[4] = x15; + out1[5] = x17; + out1[6] = x19; + out1[7] = x20; + out1[8] = x21; + out1[9] = x23; + out1[10] = x25; + out1[11] = x27; + out1[12] = x29; + out1[13] = x31; + out1[14] = x33; + out1[15] = x34; + out1[16] = x35; + out1[17] = x37; + out1[18] = x39; + out1[19] = x41; + out1[20] = x43; + out1[21] = x45; + out1[22] = x47; + out1[23] = x48; + out1[24] = x49; + out1[25] = x51; + out1[26] = x53; + out1[27] = x55; + out1[28] = x57; + out1[29] = x59; + out1[30] = x61; + out1[31] = x62; + out1[32] = x63; + out1[33] = x65; + out1[34] = x67; + out1[35] = x69; + out1[36] = x71; + out1[37] = x73; + out1[38] = x75; + out1[39] = x76; + out1[40] = x77; + out1[41] = x79; + out1[42] = x81; + out1[43] = x83; + out1[44] = x85; + out1[45] = x87; + out1[46] = x89; + out1[47] = x90; +} + +/// The function fiat_p384_from_bytes deserializes a field element NOT in the Montgomery domain from bytes in little-endian order. +/// +/// Preconditions: +/// 0 ≤ bytes_eval arg1 < m +/// Postconditions: +/// eval out1 mod m = bytes_eval arg1 mod m +/// 0 ≤ eval out1 < m +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +#[inline] +pub fn fiat_p384_from_bytes(out1: &mut [u64; 6], arg1: &[u8; 48]) -> () { + let x1: u64 = (((arg1[47]) as u64) << 56); + let x2: u64 = (((arg1[46]) as u64) << 48); + let x3: u64 = (((arg1[45]) as u64) << 40); + let x4: u64 = (((arg1[44]) as u64) << 32); + let x5: u64 = (((arg1[43]) as u64) << 24); + let x6: u64 = (((arg1[42]) as u64) << 16); + let x7: u64 = (((arg1[41]) as u64) << 8); + let x8: u8 = (arg1[40]); + let x9: u64 = (((arg1[39]) as u64) << 56); + let x10: u64 = (((arg1[38]) as u64) << 48); + let x11: u64 = (((arg1[37]) as u64) << 40); + let x12: u64 = (((arg1[36]) as u64) << 32); + let x13: u64 = (((arg1[35]) as u64) << 24); + let x14: u64 = (((arg1[34]) as u64) << 16); + let x15: u64 = (((arg1[33]) as u64) << 8); + let x16: u8 = (arg1[32]); + let x17: u64 = (((arg1[31]) as u64) << 56); + let x18: u64 = (((arg1[30]) as u64) << 48); + let x19: u64 = (((arg1[29]) as u64) << 40); + let x20: u64 = (((arg1[28]) as u64) << 32); + let x21: u64 = (((arg1[27]) as u64) << 24); + let x22: u64 = (((arg1[26]) as u64) << 16); + let x23: u64 = (((arg1[25]) as u64) << 8); + let x24: u8 = (arg1[24]); + let x25: u64 = (((arg1[23]) as u64) << 56); + let x26: u64 = (((arg1[22]) as u64) << 48); + let x27: u64 = (((arg1[21]) as u64) << 40); + let x28: u64 = (((arg1[20]) as u64) << 32); + let x29: u64 = (((arg1[19]) as u64) << 24); + let x30: u64 = (((arg1[18]) as u64) << 16); + let x31: u64 = (((arg1[17]) as u64) << 8); + let x32: u8 = (arg1[16]); + let x33: u64 = (((arg1[15]) as u64) << 56); + let x34: u64 = (((arg1[14]) as u64) << 48); + let x35: u64 = (((arg1[13]) as u64) << 40); + let x36: u64 = (((arg1[12]) as u64) << 32); + let x37: u64 = (((arg1[11]) as u64) << 24); + let x38: u64 = (((arg1[10]) as u64) << 16); + let x39: u64 = (((arg1[9]) as u64) << 8); + let x40: u8 = (arg1[8]); + let x41: u64 = (((arg1[7]) as u64) << 56); + let x42: u64 = (((arg1[6]) as u64) << 48); + let x43: u64 = (((arg1[5]) as u64) << 40); + let x44: u64 = (((arg1[4]) as u64) << 32); + let x45: u64 = (((arg1[3]) as u64) << 24); + let x46: u64 = (((arg1[2]) as u64) << 16); + let x47: u64 = (((arg1[1]) as u64) << 8); + let x48: u8 = (arg1[0]); + let x49: u64 = (x47 + (x48 as u64)); + let x50: u64 = (x46 + x49); + let x51: u64 = (x45 + x50); + let x52: u64 = (x44 + x51); + let x53: u64 = (x43 + x52); + let x54: u64 = (x42 + x53); + let x55: u64 = (x41 + x54); + let x56: u64 = (x39 + (x40 as u64)); + let x57: u64 = (x38 + x56); + let x58: u64 = (x37 + x57); + let x59: u64 = (x36 + x58); + let x60: u64 = (x35 + x59); + let x61: u64 = (x34 + x60); + let x62: u64 = (x33 + x61); + let x63: u64 = (x31 + (x32 as u64)); + let x64: u64 = (x30 + x63); + let x65: u64 = (x29 + x64); + let x66: u64 = (x28 + x65); + let x67: u64 = (x27 + x66); + let x68: u64 = (x26 + x67); + let x69: u64 = (x25 + x68); + let x70: u64 = (x23 + (x24 as u64)); + let x71: u64 = (x22 + x70); + let x72: u64 = (x21 + x71); + let x73: u64 = (x20 + x72); + let x74: u64 = (x19 + x73); + let x75: u64 = (x18 + x74); + let x76: u64 = (x17 + x75); + let x77: u64 = (x15 + (x16 as u64)); + let x78: u64 = (x14 + x77); + let x79: u64 = (x13 + x78); + let x80: u64 = (x12 + x79); + let x81: u64 = (x11 + x80); + let x82: u64 = (x10 + x81); + let x83: u64 = (x9 + x82); + let x84: u64 = (x7 + (x8 as u64)); + let x85: u64 = (x6 + x84); + let x86: u64 = (x5 + x85); + let x87: u64 = (x4 + x86); + let x88: u64 = (x3 + x87); + let x89: u64 = (x2 + x88); + let x90: u64 = (x1 + x89); + out1[0] = x55; + out1[1] = x62; + out1[2] = x69; + out1[3] = x76; + out1[4] = x83; + out1[5] = x90; +} + +/// The function fiat_p384_set_one returns the field element one in the Montgomery domain. +/// +/// Postconditions: +/// eval (from_montgomery out1) mod m = 1 mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p384_set_one(out1: &mut fiat_p384_montgomery_domain_field_element) -> () { + out1[0] = 0xffffffff00000001; + out1[1] = 0xffffffff; + out1[2] = (0x1 as u64); + out1[3] = (0x0 as u64); + out1[4] = (0x0 as u64); + out1[5] = (0x0 as u64); +} + +/// The function fiat_p384_msat returns the saturated representation of the prime modulus. +/// +/// Postconditions: +/// twos_complement_eval out1 = m +/// 0 ≤ eval out1 < m +/// +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +#[inline] +pub fn fiat_p384_msat(out1: &mut [u64; 7]) -> () { + out1[0] = 0xffffffff; + out1[1] = 0xffffffff00000000; + out1[2] = 0xfffffffffffffffe; + out1[3] = 0xffffffffffffffff; + out1[4] = 0xffffffffffffffff; + out1[5] = 0xffffffffffffffff; + out1[6] = (0x0 as u64); +} + +/// The function fiat_p384_divstep computes a divstep. +/// +/// Preconditions: +/// 0 ≤ eval arg4 < m +/// 0 ≤ eval arg5 < m +/// Postconditions: +/// out1 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then 1 - arg1 else 1 + arg1) +/// twos_complement_eval out2 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then twos_complement_eval arg3 else twos_complement_eval arg2) +/// twos_complement_eval out3 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then ⌊(twos_complement_eval arg3 - twos_complement_eval arg2) / 2⌋ else ⌊(twos_complement_eval arg3 + (twos_complement_eval arg3 mod 2) * twos_complement_eval arg2) / 2⌋) +/// eval (from_montgomery out4) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (2 * eval (from_montgomery arg5)) mod m else (2 * eval (from_montgomery arg4)) mod m) +/// eval (from_montgomery out5) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (eval (from_montgomery arg4) - eval (from_montgomery arg4)) mod m else (eval (from_montgomery arg5) + (twos_complement_eval arg3 mod 2) * eval (from_montgomery arg4)) mod m) +/// 0 ≤ eval out5 < m +/// 0 ≤ eval out5 < m +/// 0 ≤ eval out2 < m +/// 0 ≤ eval out3 < m +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0xffffffffffffffff] +/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// arg4: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// arg5: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +/// out2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// out3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// out4: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// out5: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +#[inline] +pub fn fiat_p384_divstep(out1: &mut u64, out2: &mut [u64; 7], out3: &mut [u64; 7], out4: &mut [u64; 6], out5: &mut [u64; 6], arg1: u64, arg2: &[u64; 7], arg3: &[u64; 7], arg4: &[u64; 6], arg5: &[u64; 6]) -> () { + let mut x1: u64 = 0; + let mut x2: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x1, &mut x2, 0x0, (!arg1), (0x1 as u64)); + let x3: fiat_p384_u1 = (((x1 >> 63) as fiat_p384_u1) & (((arg3[0]) & (0x1 as u64)) as fiat_p384_u1)); + let mut x4: u64 = 0; + let mut x5: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x4, &mut x5, 0x0, (!arg1), (0x1 as u64)); + let mut x6: u64 = 0; + fiat_p384_cmovznz_u64(&mut x6, x3, arg1, x4); + let mut x7: u64 = 0; + fiat_p384_cmovznz_u64(&mut x7, x3, (arg2[0]), (arg3[0])); + let mut x8: u64 = 0; + fiat_p384_cmovznz_u64(&mut x8, x3, (arg2[1]), (arg3[1])); + let mut x9: u64 = 0; + fiat_p384_cmovznz_u64(&mut x9, x3, (arg2[2]), (arg3[2])); + let mut x10: u64 = 0; + fiat_p384_cmovznz_u64(&mut x10, x3, (arg2[3]), (arg3[3])); + let mut x11: u64 = 0; + fiat_p384_cmovznz_u64(&mut x11, x3, (arg2[4]), (arg3[4])); + let mut x12: u64 = 0; + fiat_p384_cmovznz_u64(&mut x12, x3, (arg2[5]), (arg3[5])); + let mut x13: u64 = 0; + fiat_p384_cmovznz_u64(&mut x13, x3, (arg2[6]), (arg3[6])); + let mut x14: u64 = 0; + let mut x15: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x14, &mut x15, 0x0, (0x1 as u64), (!(arg2[0]))); + let mut x16: u64 = 0; + let mut x17: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x16, &mut x17, x15, (0x0 as u64), (!(arg2[1]))); + let mut x18: u64 = 0; + let mut x19: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x18, &mut x19, x17, (0x0 as u64), (!(arg2[2]))); + let mut x20: u64 = 0; + let mut x21: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x20, &mut x21, x19, (0x0 as u64), (!(arg2[3]))); + let mut x22: u64 = 0; + let mut x23: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x22, &mut x23, x21, (0x0 as u64), (!(arg2[4]))); + let mut x24: u64 = 0; + let mut x25: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x24, &mut x25, x23, (0x0 as u64), (!(arg2[5]))); + let mut x26: u64 = 0; + let mut x27: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x26, &mut x27, x25, (0x0 as u64), (!(arg2[6]))); + let mut x28: u64 = 0; + fiat_p384_cmovznz_u64(&mut x28, x3, (arg3[0]), x14); + let mut x29: u64 = 0; + fiat_p384_cmovznz_u64(&mut x29, x3, (arg3[1]), x16); + let mut x30: u64 = 0; + fiat_p384_cmovznz_u64(&mut x30, x3, (arg3[2]), x18); + let mut x31: u64 = 0; + fiat_p384_cmovznz_u64(&mut x31, x3, (arg3[3]), x20); + let mut x32: u64 = 0; + fiat_p384_cmovznz_u64(&mut x32, x3, (arg3[4]), x22); + let mut x33: u64 = 0; + fiat_p384_cmovznz_u64(&mut x33, x3, (arg3[5]), x24); + let mut x34: u64 = 0; + fiat_p384_cmovznz_u64(&mut x34, x3, (arg3[6]), x26); + let mut x35: u64 = 0; + fiat_p384_cmovznz_u64(&mut x35, x3, (arg4[0]), (arg5[0])); + let mut x36: u64 = 0; + fiat_p384_cmovznz_u64(&mut x36, x3, (arg4[1]), (arg5[1])); + let mut x37: u64 = 0; + fiat_p384_cmovznz_u64(&mut x37, x3, (arg4[2]), (arg5[2])); + let mut x38: u64 = 0; + fiat_p384_cmovznz_u64(&mut x38, x3, (arg4[3]), (arg5[3])); + let mut x39: u64 = 0; + fiat_p384_cmovznz_u64(&mut x39, x3, (arg4[4]), (arg5[4])); + let mut x40: u64 = 0; + fiat_p384_cmovznz_u64(&mut x40, x3, (arg4[5]), (arg5[5])); + let mut x41: u64 = 0; + let mut x42: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x41, &mut x42, 0x0, x35, x35); + let mut x43: u64 = 0; + let mut x44: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x43, &mut x44, x42, x36, x36); + let mut x45: u64 = 0; + let mut x46: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x45, &mut x46, x44, x37, x37); + let mut x47: u64 = 0; + let mut x48: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x47, &mut x48, x46, x38, x38); + let mut x49: u64 = 0; + let mut x50: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x49, &mut x50, x48, x39, x39); + let mut x51: u64 = 0; + let mut x52: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x51, &mut x52, x50, x40, x40); + let mut x53: u64 = 0; + let mut x54: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x53, &mut x54, 0x0, x41, 0xffffffff); + let mut x55: u64 = 0; + let mut x56: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x55, &mut x56, x54, x43, 0xffffffff00000000); + let mut x57: u64 = 0; + let mut x58: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x57, &mut x58, x56, x45, 0xfffffffffffffffe); + let mut x59: u64 = 0; + let mut x60: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x59, &mut x60, x58, x47, 0xffffffffffffffff); + let mut x61: u64 = 0; + let mut x62: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x61, &mut x62, x60, x49, 0xffffffffffffffff); + let mut x63: u64 = 0; + let mut x64: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x63, &mut x64, x62, x51, 0xffffffffffffffff); + let mut x65: u64 = 0; + let mut x66: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x65, &mut x66, x64, (x52 as u64), (0x0 as u64)); + let x67: u64 = (arg4[5]); + let x68: u64 = (arg4[4]); + let x69: u64 = (arg4[3]); + let x70: u64 = (arg4[2]); + let x71: u64 = (arg4[1]); + let x72: u64 = (arg4[0]); + let mut x73: u64 = 0; + let mut x74: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x73, &mut x74, 0x0, (0x0 as u64), x72); + let mut x75: u64 = 0; + let mut x76: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x75, &mut x76, x74, (0x0 as u64), x71); + let mut x77: u64 = 0; + let mut x78: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x77, &mut x78, x76, (0x0 as u64), x70); + let mut x79: u64 = 0; + let mut x80: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x79, &mut x80, x78, (0x0 as u64), x69); + let mut x81: u64 = 0; + let mut x82: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x81, &mut x82, x80, (0x0 as u64), x68); + let mut x83: u64 = 0; + let mut x84: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x83, &mut x84, x82, (0x0 as u64), x67); + let mut x85: u64 = 0; + fiat_p384_cmovznz_u64(&mut x85, x84, (0x0 as u64), 0xffffffffffffffff); + let mut x86: u64 = 0; + let mut x87: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x86, &mut x87, 0x0, x73, (x85 & 0xffffffff)); + let mut x88: u64 = 0; + let mut x89: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x88, &mut x89, x87, x75, (x85 & 0xffffffff00000000)); + let mut x90: u64 = 0; + let mut x91: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x90, &mut x91, x89, x77, (x85 & 0xfffffffffffffffe)); + let mut x92: u64 = 0; + let mut x93: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x92, &mut x93, x91, x79, x85); + let mut x94: u64 = 0; + let mut x95: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x94, &mut x95, x93, x81, x85); + let mut x96: u64 = 0; + let mut x97: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x96, &mut x97, x95, x83, x85); + let mut x98: u64 = 0; + fiat_p384_cmovznz_u64(&mut x98, x3, (arg5[0]), x86); + let mut x99: u64 = 0; + fiat_p384_cmovznz_u64(&mut x99, x3, (arg5[1]), x88); + let mut x100: u64 = 0; + fiat_p384_cmovznz_u64(&mut x100, x3, (arg5[2]), x90); + let mut x101: u64 = 0; + fiat_p384_cmovznz_u64(&mut x101, x3, (arg5[3]), x92); + let mut x102: u64 = 0; + fiat_p384_cmovznz_u64(&mut x102, x3, (arg5[4]), x94); + let mut x103: u64 = 0; + fiat_p384_cmovznz_u64(&mut x103, x3, (arg5[5]), x96); + let x104: fiat_p384_u1 = ((x28 & (0x1 as u64)) as fiat_p384_u1); + let mut x105: u64 = 0; + fiat_p384_cmovznz_u64(&mut x105, x104, (0x0 as u64), x7); + let mut x106: u64 = 0; + fiat_p384_cmovznz_u64(&mut x106, x104, (0x0 as u64), x8); + let mut x107: u64 = 0; + fiat_p384_cmovznz_u64(&mut x107, x104, (0x0 as u64), x9); + let mut x108: u64 = 0; + fiat_p384_cmovznz_u64(&mut x108, x104, (0x0 as u64), x10); + let mut x109: u64 = 0; + fiat_p384_cmovznz_u64(&mut x109, x104, (0x0 as u64), x11); + let mut x110: u64 = 0; + fiat_p384_cmovznz_u64(&mut x110, x104, (0x0 as u64), x12); + let mut x111: u64 = 0; + fiat_p384_cmovznz_u64(&mut x111, x104, (0x0 as u64), x13); + let mut x112: u64 = 0; + let mut x113: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x112, &mut x113, 0x0, x28, x105); + let mut x114: u64 = 0; + let mut x115: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x114, &mut x115, x113, x29, x106); + let mut x116: u64 = 0; + let mut x117: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x116, &mut x117, x115, x30, x107); + let mut x118: u64 = 0; + let mut x119: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x118, &mut x119, x117, x31, x108); + let mut x120: u64 = 0; + let mut x121: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x120, &mut x121, x119, x32, x109); + let mut x122: u64 = 0; + let mut x123: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x122, &mut x123, x121, x33, x110); + let mut x124: u64 = 0; + let mut x125: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x124, &mut x125, x123, x34, x111); + let mut x126: u64 = 0; + fiat_p384_cmovznz_u64(&mut x126, x104, (0x0 as u64), x35); + let mut x127: u64 = 0; + fiat_p384_cmovznz_u64(&mut x127, x104, (0x0 as u64), x36); + let mut x128: u64 = 0; + fiat_p384_cmovznz_u64(&mut x128, x104, (0x0 as u64), x37); + let mut x129: u64 = 0; + fiat_p384_cmovznz_u64(&mut x129, x104, (0x0 as u64), x38); + let mut x130: u64 = 0; + fiat_p384_cmovznz_u64(&mut x130, x104, (0x0 as u64), x39); + let mut x131: u64 = 0; + fiat_p384_cmovznz_u64(&mut x131, x104, (0x0 as u64), x40); + let mut x132: u64 = 0; + let mut x133: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x132, &mut x133, 0x0, x98, x126); + let mut x134: u64 = 0; + let mut x135: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x134, &mut x135, x133, x99, x127); + let mut x136: u64 = 0; + let mut x137: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x136, &mut x137, x135, x100, x128); + let mut x138: u64 = 0; + let mut x139: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x138, &mut x139, x137, x101, x129); + let mut x140: u64 = 0; + let mut x141: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x140, &mut x141, x139, x102, x130); + let mut x142: u64 = 0; + let mut x143: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x142, &mut x143, x141, x103, x131); + let mut x144: u64 = 0; + let mut x145: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x144, &mut x145, 0x0, x132, 0xffffffff); + let mut x146: u64 = 0; + let mut x147: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x146, &mut x147, x145, x134, 0xffffffff00000000); + let mut x148: u64 = 0; + let mut x149: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x148, &mut x149, x147, x136, 0xfffffffffffffffe); + let mut x150: u64 = 0; + let mut x151: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x150, &mut x151, x149, x138, 0xffffffffffffffff); + let mut x152: u64 = 0; + let mut x153: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x152, &mut x153, x151, x140, 0xffffffffffffffff); + let mut x154: u64 = 0; + let mut x155: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x154, &mut x155, x153, x142, 0xffffffffffffffff); + let mut x156: u64 = 0; + let mut x157: fiat_p384_u1 = 0; + fiat_p384_subborrowx_u64(&mut x156, &mut x157, x155, (x143 as u64), (0x0 as u64)); + let mut x158: u64 = 0; + let mut x159: fiat_p384_u1 = 0; + fiat_p384_addcarryx_u64(&mut x158, &mut x159, 0x0, x6, (0x1 as u64)); + let x160: u64 = ((x112 >> 1) | ((x114 << 63) & 0xffffffffffffffff)); + let x161: u64 = ((x114 >> 1) | ((x116 << 63) & 0xffffffffffffffff)); + let x162: u64 = ((x116 >> 1) | ((x118 << 63) & 0xffffffffffffffff)); + let x163: u64 = ((x118 >> 1) | ((x120 << 63) & 0xffffffffffffffff)); + let x164: u64 = ((x120 >> 1) | ((x122 << 63) & 0xffffffffffffffff)); + let x165: u64 = ((x122 >> 1) | ((x124 << 63) & 0xffffffffffffffff)); + let x166: u64 = ((x124 & 0x8000000000000000) | (x124 >> 1)); + let mut x167: u64 = 0; + fiat_p384_cmovznz_u64(&mut x167, x66, x53, x41); + let mut x168: u64 = 0; + fiat_p384_cmovznz_u64(&mut x168, x66, x55, x43); + let mut x169: u64 = 0; + fiat_p384_cmovznz_u64(&mut x169, x66, x57, x45); + let mut x170: u64 = 0; + fiat_p384_cmovznz_u64(&mut x170, x66, x59, x47); + let mut x171: u64 = 0; + fiat_p384_cmovznz_u64(&mut x171, x66, x61, x49); + let mut x172: u64 = 0; + fiat_p384_cmovznz_u64(&mut x172, x66, x63, x51); + let mut x173: u64 = 0; + fiat_p384_cmovznz_u64(&mut x173, x157, x144, x132); + let mut x174: u64 = 0; + fiat_p384_cmovznz_u64(&mut x174, x157, x146, x134); + let mut x175: u64 = 0; + fiat_p384_cmovznz_u64(&mut x175, x157, x148, x136); + let mut x176: u64 = 0; + fiat_p384_cmovznz_u64(&mut x176, x157, x150, x138); + let mut x177: u64 = 0; + fiat_p384_cmovznz_u64(&mut x177, x157, x152, x140); + let mut x178: u64 = 0; + fiat_p384_cmovznz_u64(&mut x178, x157, x154, x142); + *out1 = x158; + out2[0] = x7; + out2[1] = x8; + out2[2] = x9; + out2[3] = x10; + out2[4] = x11; + out2[5] = x12; + out2[6] = x13; + out3[0] = x160; + out3[1] = x161; + out3[2] = x162; + out3[3] = x163; + out3[4] = x164; + out3[5] = x165; + out3[6] = x166; + out4[0] = x167; + out4[1] = x168; + out4[2] = x169; + out4[3] = x170; + out4[4] = x171; + out4[5] = x172; + out5[0] = x173; + out5[1] = x174; + out5[2] = x175; + out5[3] = x176; + out5[4] = x177; + out5[5] = x178; +} + +/// The function fiat_p384_divstep_precomp returns the precomputed value for Bernstein-Yang-inversion (in montgomery form). +/// +/// Postconditions: +/// eval (from_montgomery out1) = ⌊(m - 1) / 2⌋^(if ⌊log2 m⌋ + 1 < 46 then ⌊(49 * (⌊log2 m⌋ + 1) + 80) / 17⌋ else ⌊(49 * (⌊log2 m⌋ + 1) + 57) / 17⌋) +/// 0 ≤ eval out1 < m +/// +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +#[inline] +pub fn fiat_p384_divstep_precomp(out1: &mut [u64; 6]) -> () { + out1[0] = 0xfff69400fff18fff; + out1[1] = 0x2b7feffffd3ff; + out1[2] = 0xfffedbfffffe97ff; + out1[3] = 0x2840000002fff; + out1[4] = 0x6040000050400; + out1[5] = 0xfffc480000038000; +} diff --git a/vendor/fiat-crypto/src/p384_scalar_32.rs b/vendor/fiat-crypto/src/p384_scalar_32.rs new file mode 100644 index 000000000..ef07b88f1 --- /dev/null +++ b/vendor/fiat-crypto/src/p384_scalar_32.rs @@ -0,0 +1,11377 @@ +//! Autogenerated: 'src/ExtractionOCaml/word_by_word_montgomery' --lang Rust --inline p384_scalar 32 '2^384 - 1388124618062372383947042015309946732620727252194336364173' mul square add sub opp from_montgomery to_montgomery nonzero selectznz to_bytes from_bytes one msat divstep divstep_precomp +//! curve description: p384_scalar +//! machine_wordsize = 32 (from "32") +//! requested operations: mul, square, add, sub, opp, from_montgomery, to_montgomery, nonzero, selectznz, to_bytes, from_bytes, one, msat, divstep, divstep_precomp +//! m = 0xffffffffffffffffffffffffffffffffffffffffffffffffc7634d81f4372ddf581a0db248b0a77aecec196accc52973 (from "2^384 - 1388124618062372383947042015309946732620727252194336364173") +//! +//! NOTE: In addition to the bounds specified above each function, all +//! functions synthesized for this Montgomery arithmetic require the +//! input to be strictly less than the prime modulus (m), and also +//! require the input to be in the unique saturated representation. +//! All functions also ensure that these two properties are true of +//! return values. +//! +//! Computed values: +//! eval z = z[0] + (z[1] << 32) + (z[2] << 64) + (z[3] << 96) + (z[4] << 128) + (z[5] << 160) + (z[6] << 192) + (z[7] << 224) + (z[8] << 256) + (z[9] << 0x120) + (z[10] << 0x140) + (z[11] << 0x160) +//! bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248) + (z[32] << 256) + (z[33] << 0x108) + (z[34] << 0x110) + (z[35] << 0x118) + (z[36] << 0x120) + (z[37] << 0x128) + (z[38] << 0x130) + (z[39] << 0x138) + (z[40] << 0x140) + (z[41] << 0x148) + (z[42] << 0x150) + (z[43] << 0x158) + (z[44] << 0x160) + (z[45] << 0x168) + (z[46] << 0x170) + (z[47] << 0x178) +//! twos_complement_eval z = let x1 := z[0] + (z[1] << 32) + (z[2] << 64) + (z[3] << 96) + (z[4] << 128) + (z[5] << 160) + (z[6] << 192) + (z[7] << 224) + (z[8] << 256) + (z[9] << 0x120) + (z[10] << 0x140) + (z[11] << 0x160) in +//! if x1 & (2^384-1) < 2^383 then x1 & (2^384-1) else (x1 & (2^384-1)) - 2^384 + +#![allow(unused_parens)] +#![allow(non_camel_case_types)] + +pub type fiat_p384_scalar_u1 = u8; +pub type fiat_p384_scalar_i1 = i8; +pub type fiat_p384_scalar_u2 = u8; +pub type fiat_p384_scalar_i2 = i8; + +/* The type fiat_p384_scalar_montgomery_domain_field_element is a field element in the Montgomery domain. */ +/* Bounds: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] */ +pub type fiat_p384_scalar_montgomery_domain_field_element = [u32; 12]; + +/* The type fiat_p384_scalar_non_montgomery_domain_field_element is a field element NOT in the Montgomery domain. */ +/* Bounds: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] */ +pub type fiat_p384_scalar_non_montgomery_domain_field_element = [u32; 12]; + + +/// The function fiat_p384_scalar_addcarryx_u32 is an addition with carry. +/// +/// Postconditions: +/// out1 = (arg1 + arg2 + arg3) mod 2^32 +/// out2 = ⌊(arg1 + arg2 + arg3) / 2^32⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffff] +/// arg3: [0x0 ~> 0xffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_p384_scalar_addcarryx_u32(out1: &mut u32, out2: &mut fiat_p384_scalar_u1, arg1: fiat_p384_scalar_u1, arg2: u32, arg3: u32) -> () { + let x1: u64 = (((arg1 as u64) + (arg2 as u64)) + (arg3 as u64)); + let x2: u32 = ((x1 & (0xffffffff as u64)) as u32); + let x3: fiat_p384_scalar_u1 = ((x1 >> 32) as fiat_p384_scalar_u1); + *out1 = x2; + *out2 = x3; +} + +/// The function fiat_p384_scalar_subborrowx_u32 is a subtraction with borrow. +/// +/// Postconditions: +/// out1 = (-arg1 + arg2 + -arg3) mod 2^32 +/// out2 = -⌊(-arg1 + arg2 + -arg3) / 2^32⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffff] +/// arg3: [0x0 ~> 0xffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_p384_scalar_subborrowx_u32(out1: &mut u32, out2: &mut fiat_p384_scalar_u1, arg1: fiat_p384_scalar_u1, arg2: u32, arg3: u32) -> () { + let x1: i64 = (((arg2 as i64) - (arg1 as i64)) - (arg3 as i64)); + let x2: fiat_p384_scalar_i1 = ((x1 >> 32) as fiat_p384_scalar_i1); + let x3: u32 = ((x1 & (0xffffffff as i64)) as u32); + *out1 = x3; + *out2 = (((0x0 as fiat_p384_scalar_i2) - (x2 as fiat_p384_scalar_i2)) as fiat_p384_scalar_u1); +} + +/// The function fiat_p384_scalar_mulx_u32 is a multiplication, returning the full double-width result. +/// +/// Postconditions: +/// out1 = (arg1 * arg2) mod 2^32 +/// out2 = ⌊arg1 * arg2 / 2^32⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0xffffffff] +/// arg2: [0x0 ~> 0xffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +/// out2: [0x0 ~> 0xffffffff] +#[inline] +pub fn fiat_p384_scalar_mulx_u32(out1: &mut u32, out2: &mut u32, arg1: u32, arg2: u32) -> () { + let x1: u64 = ((arg1 as u64) * (arg2 as u64)); + let x2: u32 = ((x1 & (0xffffffff as u64)) as u32); + let x3: u32 = ((x1 >> 32) as u32); + *out1 = x2; + *out2 = x3; +} + +/// The function fiat_p384_scalar_cmovznz_u32 is a single-word conditional move. +/// +/// Postconditions: +/// out1 = (if arg1 = 0 then arg2 else arg3) +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffff] +/// arg3: [0x0 ~> 0xffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +#[inline] +pub fn fiat_p384_scalar_cmovznz_u32(out1: &mut u32, arg1: fiat_p384_scalar_u1, arg2: u32, arg3: u32) -> () { + let x1: fiat_p384_scalar_u1 = (!(!arg1)); + let x2: u32 = ((((((0x0 as fiat_p384_scalar_i2) - (x1 as fiat_p384_scalar_i2)) as fiat_p384_scalar_i1) as i64) & (0xffffffff as i64)) as u32); + let x3: u32 = ((x2 & arg3) | ((!x2) & arg2)); + *out1 = x3; +} + +/// The function fiat_p384_scalar_mul multiplies two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p384_scalar_mul(out1: &mut fiat_p384_scalar_montgomery_domain_field_element, arg1: &fiat_p384_scalar_montgomery_domain_field_element, arg2: &fiat_p384_scalar_montgomery_domain_field_element) -> () { + let x1: u32 = (arg1[1]); + let x2: u32 = (arg1[2]); + let x3: u32 = (arg1[3]); + let x4: u32 = (arg1[4]); + let x5: u32 = (arg1[5]); + let x6: u32 = (arg1[6]); + let x7: u32 = (arg1[7]); + let x8: u32 = (arg1[8]); + let x9: u32 = (arg1[9]); + let x10: u32 = (arg1[10]); + let x11: u32 = (arg1[11]); + let x12: u32 = (arg1[0]); + let mut x13: u32 = 0; + let mut x14: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x13, &mut x14, x12, (arg2[11])); + let mut x15: u32 = 0; + let mut x16: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x15, &mut x16, x12, (arg2[10])); + let mut x17: u32 = 0; + let mut x18: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x17, &mut x18, x12, (arg2[9])); + let mut x19: u32 = 0; + let mut x20: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x19, &mut x20, x12, (arg2[8])); + let mut x21: u32 = 0; + let mut x22: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x21, &mut x22, x12, (arg2[7])); + let mut x23: u32 = 0; + let mut x24: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x23, &mut x24, x12, (arg2[6])); + let mut x25: u32 = 0; + let mut x26: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x25, &mut x26, x12, (arg2[5])); + let mut x27: u32 = 0; + let mut x28: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x27, &mut x28, x12, (arg2[4])); + let mut x29: u32 = 0; + let mut x30: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x29, &mut x30, x12, (arg2[3])); + let mut x31: u32 = 0; + let mut x32: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x31, &mut x32, x12, (arg2[2])); + let mut x33: u32 = 0; + let mut x34: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x33, &mut x34, x12, (arg2[1])); + let mut x35: u32 = 0; + let mut x36: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x35, &mut x36, x12, (arg2[0])); + let mut x37: u32 = 0; + let mut x38: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x37, &mut x38, 0x0, x36, x33); + let mut x39: u32 = 0; + let mut x40: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x39, &mut x40, x38, x34, x31); + let mut x41: u32 = 0; + let mut x42: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x41, &mut x42, x40, x32, x29); + let mut x43: u32 = 0; + let mut x44: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x43, &mut x44, x42, x30, x27); + let mut x45: u32 = 0; + let mut x46: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x45, &mut x46, x44, x28, x25); + let mut x47: u32 = 0; + let mut x48: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x47, &mut x48, x46, x26, x23); + let mut x49: u32 = 0; + let mut x50: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x49, &mut x50, x48, x24, x21); + let mut x51: u32 = 0; + let mut x52: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x51, &mut x52, x50, x22, x19); + let mut x53: u32 = 0; + let mut x54: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x53, &mut x54, x52, x20, x17); + let mut x55: u32 = 0; + let mut x56: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x55, &mut x56, x54, x18, x15); + let mut x57: u32 = 0; + let mut x58: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x57, &mut x58, x56, x16, x13); + let x59: u32 = ((x58 as u32) + x14); + let mut x60: u32 = 0; + let mut x61: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x60, &mut x61, x35, 0xe88fdc45); + let mut x62: u32 = 0; + let mut x63: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x62, &mut x63, x60, 0xffffffff); + let mut x64: u32 = 0; + let mut x65: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x64, &mut x65, x60, 0xffffffff); + let mut x66: u32 = 0; + let mut x67: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x66, &mut x67, x60, 0xffffffff); + let mut x68: u32 = 0; + let mut x69: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x68, &mut x69, x60, 0xffffffff); + let mut x70: u32 = 0; + let mut x71: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x70, &mut x71, x60, 0xffffffff); + let mut x72: u32 = 0; + let mut x73: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x72, &mut x73, x60, 0xffffffff); + let mut x74: u32 = 0; + let mut x75: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x74, &mut x75, x60, 0xc7634d81); + let mut x76: u32 = 0; + let mut x77: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x76, &mut x77, x60, 0xf4372ddf); + let mut x78: u32 = 0; + let mut x79: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x78, &mut x79, x60, 0x581a0db2); + let mut x80: u32 = 0; + let mut x81: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x80, &mut x81, x60, 0x48b0a77a); + let mut x82: u32 = 0; + let mut x83: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x82, &mut x83, x60, 0xecec196a); + let mut x84: u32 = 0; + let mut x85: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x84, &mut x85, x60, 0xccc52973); + let mut x86: u32 = 0; + let mut x87: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x86, &mut x87, 0x0, x85, x82); + let mut x88: u32 = 0; + let mut x89: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x88, &mut x89, x87, x83, x80); + let mut x90: u32 = 0; + let mut x91: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x90, &mut x91, x89, x81, x78); + let mut x92: u32 = 0; + let mut x93: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x92, &mut x93, x91, x79, x76); + let mut x94: u32 = 0; + let mut x95: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x94, &mut x95, x93, x77, x74); + let mut x96: u32 = 0; + let mut x97: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x96, &mut x97, x95, x75, x72); + let mut x98: u32 = 0; + let mut x99: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x98, &mut x99, x97, x73, x70); + let mut x100: u32 = 0; + let mut x101: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x100, &mut x101, x99, x71, x68); + let mut x102: u32 = 0; + let mut x103: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x102, &mut x103, x101, x69, x66); + let mut x104: u32 = 0; + let mut x105: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x104, &mut x105, x103, x67, x64); + let mut x106: u32 = 0; + let mut x107: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x106, &mut x107, x105, x65, x62); + let x108: u32 = ((x107 as u32) + x63); + let mut x109: u32 = 0; + let mut x110: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x109, &mut x110, 0x0, x35, x84); + let mut x111: u32 = 0; + let mut x112: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x111, &mut x112, x110, x37, x86); + let mut x113: u32 = 0; + let mut x114: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x113, &mut x114, x112, x39, x88); + let mut x115: u32 = 0; + let mut x116: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x115, &mut x116, x114, x41, x90); + let mut x117: u32 = 0; + let mut x118: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x117, &mut x118, x116, x43, x92); + let mut x119: u32 = 0; + let mut x120: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x119, &mut x120, x118, x45, x94); + let mut x121: u32 = 0; + let mut x122: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x121, &mut x122, x120, x47, x96); + let mut x123: u32 = 0; + let mut x124: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x123, &mut x124, x122, x49, x98); + let mut x125: u32 = 0; + let mut x126: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x125, &mut x126, x124, x51, x100); + let mut x127: u32 = 0; + let mut x128: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x127, &mut x128, x126, x53, x102); + let mut x129: u32 = 0; + let mut x130: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x129, &mut x130, x128, x55, x104); + let mut x131: u32 = 0; + let mut x132: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x131, &mut x132, x130, x57, x106); + let mut x133: u32 = 0; + let mut x134: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x133, &mut x134, x132, x59, x108); + let mut x135: u32 = 0; + let mut x136: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x135, &mut x136, x1, (arg2[11])); + let mut x137: u32 = 0; + let mut x138: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x137, &mut x138, x1, (arg2[10])); + let mut x139: u32 = 0; + let mut x140: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x139, &mut x140, x1, (arg2[9])); + let mut x141: u32 = 0; + let mut x142: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x141, &mut x142, x1, (arg2[8])); + let mut x143: u32 = 0; + let mut x144: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x143, &mut x144, x1, (arg2[7])); + let mut x145: u32 = 0; + let mut x146: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x145, &mut x146, x1, (arg2[6])); + let mut x147: u32 = 0; + let mut x148: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x147, &mut x148, x1, (arg2[5])); + let mut x149: u32 = 0; + let mut x150: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x149, &mut x150, x1, (arg2[4])); + let mut x151: u32 = 0; + let mut x152: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x151, &mut x152, x1, (arg2[3])); + let mut x153: u32 = 0; + let mut x154: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x153, &mut x154, x1, (arg2[2])); + let mut x155: u32 = 0; + let mut x156: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x155, &mut x156, x1, (arg2[1])); + let mut x157: u32 = 0; + let mut x158: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x157, &mut x158, x1, (arg2[0])); + let mut x159: u32 = 0; + let mut x160: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x159, &mut x160, 0x0, x158, x155); + let mut x161: u32 = 0; + let mut x162: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x161, &mut x162, x160, x156, x153); + let mut x163: u32 = 0; + let mut x164: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x163, &mut x164, x162, x154, x151); + let mut x165: u32 = 0; + let mut x166: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x165, &mut x166, x164, x152, x149); + let mut x167: u32 = 0; + let mut x168: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x167, &mut x168, x166, x150, x147); + let mut x169: u32 = 0; + let mut x170: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x169, &mut x170, x168, x148, x145); + let mut x171: u32 = 0; + let mut x172: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x171, &mut x172, x170, x146, x143); + let mut x173: u32 = 0; + let mut x174: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x173, &mut x174, x172, x144, x141); + let mut x175: u32 = 0; + let mut x176: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x175, &mut x176, x174, x142, x139); + let mut x177: u32 = 0; + let mut x178: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x177, &mut x178, x176, x140, x137); + let mut x179: u32 = 0; + let mut x180: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x179, &mut x180, x178, x138, x135); + let x181: u32 = ((x180 as u32) + x136); + let mut x182: u32 = 0; + let mut x183: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x182, &mut x183, 0x0, x111, x157); + let mut x184: u32 = 0; + let mut x185: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x184, &mut x185, x183, x113, x159); + let mut x186: u32 = 0; + let mut x187: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x186, &mut x187, x185, x115, x161); + let mut x188: u32 = 0; + let mut x189: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x188, &mut x189, x187, x117, x163); + let mut x190: u32 = 0; + let mut x191: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x190, &mut x191, x189, x119, x165); + let mut x192: u32 = 0; + let mut x193: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x192, &mut x193, x191, x121, x167); + let mut x194: u32 = 0; + let mut x195: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x194, &mut x195, x193, x123, x169); + let mut x196: u32 = 0; + let mut x197: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x196, &mut x197, x195, x125, x171); + let mut x198: u32 = 0; + let mut x199: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x198, &mut x199, x197, x127, x173); + let mut x200: u32 = 0; + let mut x201: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x200, &mut x201, x199, x129, x175); + let mut x202: u32 = 0; + let mut x203: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x202, &mut x203, x201, x131, x177); + let mut x204: u32 = 0; + let mut x205: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x204, &mut x205, x203, x133, x179); + let mut x206: u32 = 0; + let mut x207: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x206, &mut x207, x205, (x134 as u32), x181); + let mut x208: u32 = 0; + let mut x209: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x208, &mut x209, x182, 0xe88fdc45); + let mut x210: u32 = 0; + let mut x211: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x210, &mut x211, x208, 0xffffffff); + let mut x212: u32 = 0; + let mut x213: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x212, &mut x213, x208, 0xffffffff); + let mut x214: u32 = 0; + let mut x215: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x214, &mut x215, x208, 0xffffffff); + let mut x216: u32 = 0; + let mut x217: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x216, &mut x217, x208, 0xffffffff); + let mut x218: u32 = 0; + let mut x219: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x218, &mut x219, x208, 0xffffffff); + let mut x220: u32 = 0; + let mut x221: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x220, &mut x221, x208, 0xffffffff); + let mut x222: u32 = 0; + let mut x223: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x222, &mut x223, x208, 0xc7634d81); + let mut x224: u32 = 0; + let mut x225: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x224, &mut x225, x208, 0xf4372ddf); + let mut x226: u32 = 0; + let mut x227: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x226, &mut x227, x208, 0x581a0db2); + let mut x228: u32 = 0; + let mut x229: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x228, &mut x229, x208, 0x48b0a77a); + let mut x230: u32 = 0; + let mut x231: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x230, &mut x231, x208, 0xecec196a); + let mut x232: u32 = 0; + let mut x233: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x232, &mut x233, x208, 0xccc52973); + let mut x234: u32 = 0; + let mut x235: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x234, &mut x235, 0x0, x233, x230); + let mut x236: u32 = 0; + let mut x237: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x236, &mut x237, x235, x231, x228); + let mut x238: u32 = 0; + let mut x239: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x238, &mut x239, x237, x229, x226); + let mut x240: u32 = 0; + let mut x241: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x240, &mut x241, x239, x227, x224); + let mut x242: u32 = 0; + let mut x243: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x242, &mut x243, x241, x225, x222); + let mut x244: u32 = 0; + let mut x245: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x244, &mut x245, x243, x223, x220); + let mut x246: u32 = 0; + let mut x247: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x246, &mut x247, x245, x221, x218); + let mut x248: u32 = 0; + let mut x249: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x248, &mut x249, x247, x219, x216); + let mut x250: u32 = 0; + let mut x251: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x250, &mut x251, x249, x217, x214); + let mut x252: u32 = 0; + let mut x253: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x252, &mut x253, x251, x215, x212); + let mut x254: u32 = 0; + let mut x255: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x254, &mut x255, x253, x213, x210); + let x256: u32 = ((x255 as u32) + x211); + let mut x257: u32 = 0; + let mut x258: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x257, &mut x258, 0x0, x182, x232); + let mut x259: u32 = 0; + let mut x260: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x259, &mut x260, x258, x184, x234); + let mut x261: u32 = 0; + let mut x262: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x261, &mut x262, x260, x186, x236); + let mut x263: u32 = 0; + let mut x264: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x263, &mut x264, x262, x188, x238); + let mut x265: u32 = 0; + let mut x266: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x265, &mut x266, x264, x190, x240); + let mut x267: u32 = 0; + let mut x268: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x267, &mut x268, x266, x192, x242); + let mut x269: u32 = 0; + let mut x270: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x269, &mut x270, x268, x194, x244); + let mut x271: u32 = 0; + let mut x272: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x271, &mut x272, x270, x196, x246); + let mut x273: u32 = 0; + let mut x274: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x273, &mut x274, x272, x198, x248); + let mut x275: u32 = 0; + let mut x276: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x275, &mut x276, x274, x200, x250); + let mut x277: u32 = 0; + let mut x278: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x277, &mut x278, x276, x202, x252); + let mut x279: u32 = 0; + let mut x280: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x279, &mut x280, x278, x204, x254); + let mut x281: u32 = 0; + let mut x282: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x281, &mut x282, x280, x206, x256); + let x283: u32 = ((x282 as u32) + (x207 as u32)); + let mut x284: u32 = 0; + let mut x285: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x284, &mut x285, x2, (arg2[11])); + let mut x286: u32 = 0; + let mut x287: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x286, &mut x287, x2, (arg2[10])); + let mut x288: u32 = 0; + let mut x289: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x288, &mut x289, x2, (arg2[9])); + let mut x290: u32 = 0; + let mut x291: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x290, &mut x291, x2, (arg2[8])); + let mut x292: u32 = 0; + let mut x293: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x292, &mut x293, x2, (arg2[7])); + let mut x294: u32 = 0; + let mut x295: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x294, &mut x295, x2, (arg2[6])); + let mut x296: u32 = 0; + let mut x297: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x296, &mut x297, x2, (arg2[5])); + let mut x298: u32 = 0; + let mut x299: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x298, &mut x299, x2, (arg2[4])); + let mut x300: u32 = 0; + let mut x301: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x300, &mut x301, x2, (arg2[3])); + let mut x302: u32 = 0; + let mut x303: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x302, &mut x303, x2, (arg2[2])); + let mut x304: u32 = 0; + let mut x305: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x304, &mut x305, x2, (arg2[1])); + let mut x306: u32 = 0; + let mut x307: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x306, &mut x307, x2, (arg2[0])); + let mut x308: u32 = 0; + let mut x309: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x308, &mut x309, 0x0, x307, x304); + let mut x310: u32 = 0; + let mut x311: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x310, &mut x311, x309, x305, x302); + let mut x312: u32 = 0; + let mut x313: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x312, &mut x313, x311, x303, x300); + let mut x314: u32 = 0; + let mut x315: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x314, &mut x315, x313, x301, x298); + let mut x316: u32 = 0; + let mut x317: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x316, &mut x317, x315, x299, x296); + let mut x318: u32 = 0; + let mut x319: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x318, &mut x319, x317, x297, x294); + let mut x320: u32 = 0; + let mut x321: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x320, &mut x321, x319, x295, x292); + let mut x322: u32 = 0; + let mut x323: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x322, &mut x323, x321, x293, x290); + let mut x324: u32 = 0; + let mut x325: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x324, &mut x325, x323, x291, x288); + let mut x326: u32 = 0; + let mut x327: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x326, &mut x327, x325, x289, x286); + let mut x328: u32 = 0; + let mut x329: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x328, &mut x329, x327, x287, x284); + let x330: u32 = ((x329 as u32) + x285); + let mut x331: u32 = 0; + let mut x332: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x331, &mut x332, 0x0, x259, x306); + let mut x333: u32 = 0; + let mut x334: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x333, &mut x334, x332, x261, x308); + let mut x335: u32 = 0; + let mut x336: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x335, &mut x336, x334, x263, x310); + let mut x337: u32 = 0; + let mut x338: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x337, &mut x338, x336, x265, x312); + let mut x339: u32 = 0; + let mut x340: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x339, &mut x340, x338, x267, x314); + let mut x341: u32 = 0; + let mut x342: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x341, &mut x342, x340, x269, x316); + let mut x343: u32 = 0; + let mut x344: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x343, &mut x344, x342, x271, x318); + let mut x345: u32 = 0; + let mut x346: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x345, &mut x346, x344, x273, x320); + let mut x347: u32 = 0; + let mut x348: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x347, &mut x348, x346, x275, x322); + let mut x349: u32 = 0; + let mut x350: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x349, &mut x350, x348, x277, x324); + let mut x351: u32 = 0; + let mut x352: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x351, &mut x352, x350, x279, x326); + let mut x353: u32 = 0; + let mut x354: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x353, &mut x354, x352, x281, x328); + let mut x355: u32 = 0; + let mut x356: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x355, &mut x356, x354, x283, x330); + let mut x357: u32 = 0; + let mut x358: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x357, &mut x358, x331, 0xe88fdc45); + let mut x359: u32 = 0; + let mut x360: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x359, &mut x360, x357, 0xffffffff); + let mut x361: u32 = 0; + let mut x362: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x361, &mut x362, x357, 0xffffffff); + let mut x363: u32 = 0; + let mut x364: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x363, &mut x364, x357, 0xffffffff); + let mut x365: u32 = 0; + let mut x366: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x365, &mut x366, x357, 0xffffffff); + let mut x367: u32 = 0; + let mut x368: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x367, &mut x368, x357, 0xffffffff); + let mut x369: u32 = 0; + let mut x370: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x369, &mut x370, x357, 0xffffffff); + let mut x371: u32 = 0; + let mut x372: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x371, &mut x372, x357, 0xc7634d81); + let mut x373: u32 = 0; + let mut x374: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x373, &mut x374, x357, 0xf4372ddf); + let mut x375: u32 = 0; + let mut x376: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x375, &mut x376, x357, 0x581a0db2); + let mut x377: u32 = 0; + let mut x378: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x377, &mut x378, x357, 0x48b0a77a); + let mut x379: u32 = 0; + let mut x380: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x379, &mut x380, x357, 0xecec196a); + let mut x381: u32 = 0; + let mut x382: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x381, &mut x382, x357, 0xccc52973); + let mut x383: u32 = 0; + let mut x384: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x383, &mut x384, 0x0, x382, x379); + let mut x385: u32 = 0; + let mut x386: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x385, &mut x386, x384, x380, x377); + let mut x387: u32 = 0; + let mut x388: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x387, &mut x388, x386, x378, x375); + let mut x389: u32 = 0; + let mut x390: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x389, &mut x390, x388, x376, x373); + let mut x391: u32 = 0; + let mut x392: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x391, &mut x392, x390, x374, x371); + let mut x393: u32 = 0; + let mut x394: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x393, &mut x394, x392, x372, x369); + let mut x395: u32 = 0; + let mut x396: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x395, &mut x396, x394, x370, x367); + let mut x397: u32 = 0; + let mut x398: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x397, &mut x398, x396, x368, x365); + let mut x399: u32 = 0; + let mut x400: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x399, &mut x400, x398, x366, x363); + let mut x401: u32 = 0; + let mut x402: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x401, &mut x402, x400, x364, x361); + let mut x403: u32 = 0; + let mut x404: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x403, &mut x404, x402, x362, x359); + let x405: u32 = ((x404 as u32) + x360); + let mut x406: u32 = 0; + let mut x407: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x406, &mut x407, 0x0, x331, x381); + let mut x408: u32 = 0; + let mut x409: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x408, &mut x409, x407, x333, x383); + let mut x410: u32 = 0; + let mut x411: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x410, &mut x411, x409, x335, x385); + let mut x412: u32 = 0; + let mut x413: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x412, &mut x413, x411, x337, x387); + let mut x414: u32 = 0; + let mut x415: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x414, &mut x415, x413, x339, x389); + let mut x416: u32 = 0; + let mut x417: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x416, &mut x417, x415, x341, x391); + let mut x418: u32 = 0; + let mut x419: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x418, &mut x419, x417, x343, x393); + let mut x420: u32 = 0; + let mut x421: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x420, &mut x421, x419, x345, x395); + let mut x422: u32 = 0; + let mut x423: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x422, &mut x423, x421, x347, x397); + let mut x424: u32 = 0; + let mut x425: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x424, &mut x425, x423, x349, x399); + let mut x426: u32 = 0; + let mut x427: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x426, &mut x427, x425, x351, x401); + let mut x428: u32 = 0; + let mut x429: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x428, &mut x429, x427, x353, x403); + let mut x430: u32 = 0; + let mut x431: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x430, &mut x431, x429, x355, x405); + let x432: u32 = ((x431 as u32) + (x356 as u32)); + let mut x433: u32 = 0; + let mut x434: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x433, &mut x434, x3, (arg2[11])); + let mut x435: u32 = 0; + let mut x436: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x435, &mut x436, x3, (arg2[10])); + let mut x437: u32 = 0; + let mut x438: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x437, &mut x438, x3, (arg2[9])); + let mut x439: u32 = 0; + let mut x440: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x439, &mut x440, x3, (arg2[8])); + let mut x441: u32 = 0; + let mut x442: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x441, &mut x442, x3, (arg2[7])); + let mut x443: u32 = 0; + let mut x444: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x443, &mut x444, x3, (arg2[6])); + let mut x445: u32 = 0; + let mut x446: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x445, &mut x446, x3, (arg2[5])); + let mut x447: u32 = 0; + let mut x448: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x447, &mut x448, x3, (arg2[4])); + let mut x449: u32 = 0; + let mut x450: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x449, &mut x450, x3, (arg2[3])); + let mut x451: u32 = 0; + let mut x452: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x451, &mut x452, x3, (arg2[2])); + let mut x453: u32 = 0; + let mut x454: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x453, &mut x454, x3, (arg2[1])); + let mut x455: u32 = 0; + let mut x456: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x455, &mut x456, x3, (arg2[0])); + let mut x457: u32 = 0; + let mut x458: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x457, &mut x458, 0x0, x456, x453); + let mut x459: u32 = 0; + let mut x460: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x459, &mut x460, x458, x454, x451); + let mut x461: u32 = 0; + let mut x462: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x461, &mut x462, x460, x452, x449); + let mut x463: u32 = 0; + let mut x464: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x463, &mut x464, x462, x450, x447); + let mut x465: u32 = 0; + let mut x466: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x465, &mut x466, x464, x448, x445); + let mut x467: u32 = 0; + let mut x468: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x467, &mut x468, x466, x446, x443); + let mut x469: u32 = 0; + let mut x470: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x469, &mut x470, x468, x444, x441); + let mut x471: u32 = 0; + let mut x472: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x471, &mut x472, x470, x442, x439); + let mut x473: u32 = 0; + let mut x474: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x473, &mut x474, x472, x440, x437); + let mut x475: u32 = 0; + let mut x476: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x475, &mut x476, x474, x438, x435); + let mut x477: u32 = 0; + let mut x478: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x477, &mut x478, x476, x436, x433); + let x479: u32 = ((x478 as u32) + x434); + let mut x480: u32 = 0; + let mut x481: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x480, &mut x481, 0x0, x408, x455); + let mut x482: u32 = 0; + let mut x483: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x482, &mut x483, x481, x410, x457); + let mut x484: u32 = 0; + let mut x485: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x484, &mut x485, x483, x412, x459); + let mut x486: u32 = 0; + let mut x487: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x486, &mut x487, x485, x414, x461); + let mut x488: u32 = 0; + let mut x489: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x488, &mut x489, x487, x416, x463); + let mut x490: u32 = 0; + let mut x491: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x490, &mut x491, x489, x418, x465); + let mut x492: u32 = 0; + let mut x493: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x492, &mut x493, x491, x420, x467); + let mut x494: u32 = 0; + let mut x495: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x494, &mut x495, x493, x422, x469); + let mut x496: u32 = 0; + let mut x497: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x496, &mut x497, x495, x424, x471); + let mut x498: u32 = 0; + let mut x499: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x498, &mut x499, x497, x426, x473); + let mut x500: u32 = 0; + let mut x501: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x500, &mut x501, x499, x428, x475); + let mut x502: u32 = 0; + let mut x503: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x502, &mut x503, x501, x430, x477); + let mut x504: u32 = 0; + let mut x505: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x504, &mut x505, x503, x432, x479); + let mut x506: u32 = 0; + let mut x507: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x506, &mut x507, x480, 0xe88fdc45); + let mut x508: u32 = 0; + let mut x509: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x508, &mut x509, x506, 0xffffffff); + let mut x510: u32 = 0; + let mut x511: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x510, &mut x511, x506, 0xffffffff); + let mut x512: u32 = 0; + let mut x513: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x512, &mut x513, x506, 0xffffffff); + let mut x514: u32 = 0; + let mut x515: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x514, &mut x515, x506, 0xffffffff); + let mut x516: u32 = 0; + let mut x517: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x516, &mut x517, x506, 0xffffffff); + let mut x518: u32 = 0; + let mut x519: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x518, &mut x519, x506, 0xffffffff); + let mut x520: u32 = 0; + let mut x521: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x520, &mut x521, x506, 0xc7634d81); + let mut x522: u32 = 0; + let mut x523: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x522, &mut x523, x506, 0xf4372ddf); + let mut x524: u32 = 0; + let mut x525: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x524, &mut x525, x506, 0x581a0db2); + let mut x526: u32 = 0; + let mut x527: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x526, &mut x527, x506, 0x48b0a77a); + let mut x528: u32 = 0; + let mut x529: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x528, &mut x529, x506, 0xecec196a); + let mut x530: u32 = 0; + let mut x531: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x530, &mut x531, x506, 0xccc52973); + let mut x532: u32 = 0; + let mut x533: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x532, &mut x533, 0x0, x531, x528); + let mut x534: u32 = 0; + let mut x535: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x534, &mut x535, x533, x529, x526); + let mut x536: u32 = 0; + let mut x537: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x536, &mut x537, x535, x527, x524); + let mut x538: u32 = 0; + let mut x539: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x538, &mut x539, x537, x525, x522); + let mut x540: u32 = 0; + let mut x541: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x540, &mut x541, x539, x523, x520); + let mut x542: u32 = 0; + let mut x543: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x542, &mut x543, x541, x521, x518); + let mut x544: u32 = 0; + let mut x545: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x544, &mut x545, x543, x519, x516); + let mut x546: u32 = 0; + let mut x547: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x546, &mut x547, x545, x517, x514); + let mut x548: u32 = 0; + let mut x549: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x548, &mut x549, x547, x515, x512); + let mut x550: u32 = 0; + let mut x551: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x550, &mut x551, x549, x513, x510); + let mut x552: u32 = 0; + let mut x553: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x552, &mut x553, x551, x511, x508); + let x554: u32 = ((x553 as u32) + x509); + let mut x555: u32 = 0; + let mut x556: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x555, &mut x556, 0x0, x480, x530); + let mut x557: u32 = 0; + let mut x558: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x557, &mut x558, x556, x482, x532); + let mut x559: u32 = 0; + let mut x560: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x559, &mut x560, x558, x484, x534); + let mut x561: u32 = 0; + let mut x562: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x561, &mut x562, x560, x486, x536); + let mut x563: u32 = 0; + let mut x564: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x563, &mut x564, x562, x488, x538); + let mut x565: u32 = 0; + let mut x566: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x565, &mut x566, x564, x490, x540); + let mut x567: u32 = 0; + let mut x568: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x567, &mut x568, x566, x492, x542); + let mut x569: u32 = 0; + let mut x570: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x569, &mut x570, x568, x494, x544); + let mut x571: u32 = 0; + let mut x572: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x571, &mut x572, x570, x496, x546); + let mut x573: u32 = 0; + let mut x574: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x573, &mut x574, x572, x498, x548); + let mut x575: u32 = 0; + let mut x576: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x575, &mut x576, x574, x500, x550); + let mut x577: u32 = 0; + let mut x578: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x577, &mut x578, x576, x502, x552); + let mut x579: u32 = 0; + let mut x580: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x579, &mut x580, x578, x504, x554); + let x581: u32 = ((x580 as u32) + (x505 as u32)); + let mut x582: u32 = 0; + let mut x583: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x582, &mut x583, x4, (arg2[11])); + let mut x584: u32 = 0; + let mut x585: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x584, &mut x585, x4, (arg2[10])); + let mut x586: u32 = 0; + let mut x587: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x586, &mut x587, x4, (arg2[9])); + let mut x588: u32 = 0; + let mut x589: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x588, &mut x589, x4, (arg2[8])); + let mut x590: u32 = 0; + let mut x591: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x590, &mut x591, x4, (arg2[7])); + let mut x592: u32 = 0; + let mut x593: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x592, &mut x593, x4, (arg2[6])); + let mut x594: u32 = 0; + let mut x595: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x594, &mut x595, x4, (arg2[5])); + let mut x596: u32 = 0; + let mut x597: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x596, &mut x597, x4, (arg2[4])); + let mut x598: u32 = 0; + let mut x599: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x598, &mut x599, x4, (arg2[3])); + let mut x600: u32 = 0; + let mut x601: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x600, &mut x601, x4, (arg2[2])); + let mut x602: u32 = 0; + let mut x603: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x602, &mut x603, x4, (arg2[1])); + let mut x604: u32 = 0; + let mut x605: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x604, &mut x605, x4, (arg2[0])); + let mut x606: u32 = 0; + let mut x607: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x606, &mut x607, 0x0, x605, x602); + let mut x608: u32 = 0; + let mut x609: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x608, &mut x609, x607, x603, x600); + let mut x610: u32 = 0; + let mut x611: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x610, &mut x611, x609, x601, x598); + let mut x612: u32 = 0; + let mut x613: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x612, &mut x613, x611, x599, x596); + let mut x614: u32 = 0; + let mut x615: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x614, &mut x615, x613, x597, x594); + let mut x616: u32 = 0; + let mut x617: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x616, &mut x617, x615, x595, x592); + let mut x618: u32 = 0; + let mut x619: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x618, &mut x619, x617, x593, x590); + let mut x620: u32 = 0; + let mut x621: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x620, &mut x621, x619, x591, x588); + let mut x622: u32 = 0; + let mut x623: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x622, &mut x623, x621, x589, x586); + let mut x624: u32 = 0; + let mut x625: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x624, &mut x625, x623, x587, x584); + let mut x626: u32 = 0; + let mut x627: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x626, &mut x627, x625, x585, x582); + let x628: u32 = ((x627 as u32) + x583); + let mut x629: u32 = 0; + let mut x630: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x629, &mut x630, 0x0, x557, x604); + let mut x631: u32 = 0; + let mut x632: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x631, &mut x632, x630, x559, x606); + let mut x633: u32 = 0; + let mut x634: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x633, &mut x634, x632, x561, x608); + let mut x635: u32 = 0; + let mut x636: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x635, &mut x636, x634, x563, x610); + let mut x637: u32 = 0; + let mut x638: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x637, &mut x638, x636, x565, x612); + let mut x639: u32 = 0; + let mut x640: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x639, &mut x640, x638, x567, x614); + let mut x641: u32 = 0; + let mut x642: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x641, &mut x642, x640, x569, x616); + let mut x643: u32 = 0; + let mut x644: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x643, &mut x644, x642, x571, x618); + let mut x645: u32 = 0; + let mut x646: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x645, &mut x646, x644, x573, x620); + let mut x647: u32 = 0; + let mut x648: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x647, &mut x648, x646, x575, x622); + let mut x649: u32 = 0; + let mut x650: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x649, &mut x650, x648, x577, x624); + let mut x651: u32 = 0; + let mut x652: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x651, &mut x652, x650, x579, x626); + let mut x653: u32 = 0; + let mut x654: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x653, &mut x654, x652, x581, x628); + let mut x655: u32 = 0; + let mut x656: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x655, &mut x656, x629, 0xe88fdc45); + let mut x657: u32 = 0; + let mut x658: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x657, &mut x658, x655, 0xffffffff); + let mut x659: u32 = 0; + let mut x660: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x659, &mut x660, x655, 0xffffffff); + let mut x661: u32 = 0; + let mut x662: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x661, &mut x662, x655, 0xffffffff); + let mut x663: u32 = 0; + let mut x664: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x663, &mut x664, x655, 0xffffffff); + let mut x665: u32 = 0; + let mut x666: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x665, &mut x666, x655, 0xffffffff); + let mut x667: u32 = 0; + let mut x668: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x667, &mut x668, x655, 0xffffffff); + let mut x669: u32 = 0; + let mut x670: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x669, &mut x670, x655, 0xc7634d81); + let mut x671: u32 = 0; + let mut x672: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x671, &mut x672, x655, 0xf4372ddf); + let mut x673: u32 = 0; + let mut x674: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x673, &mut x674, x655, 0x581a0db2); + let mut x675: u32 = 0; + let mut x676: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x675, &mut x676, x655, 0x48b0a77a); + let mut x677: u32 = 0; + let mut x678: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x677, &mut x678, x655, 0xecec196a); + let mut x679: u32 = 0; + let mut x680: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x679, &mut x680, x655, 0xccc52973); + let mut x681: u32 = 0; + let mut x682: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x681, &mut x682, 0x0, x680, x677); + let mut x683: u32 = 0; + let mut x684: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x683, &mut x684, x682, x678, x675); + let mut x685: u32 = 0; + let mut x686: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x685, &mut x686, x684, x676, x673); + let mut x687: u32 = 0; + let mut x688: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x687, &mut x688, x686, x674, x671); + let mut x689: u32 = 0; + let mut x690: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x689, &mut x690, x688, x672, x669); + let mut x691: u32 = 0; + let mut x692: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x691, &mut x692, x690, x670, x667); + let mut x693: u32 = 0; + let mut x694: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x693, &mut x694, x692, x668, x665); + let mut x695: u32 = 0; + let mut x696: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x695, &mut x696, x694, x666, x663); + let mut x697: u32 = 0; + let mut x698: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x697, &mut x698, x696, x664, x661); + let mut x699: u32 = 0; + let mut x700: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x699, &mut x700, x698, x662, x659); + let mut x701: u32 = 0; + let mut x702: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x701, &mut x702, x700, x660, x657); + let x703: u32 = ((x702 as u32) + x658); + let mut x704: u32 = 0; + let mut x705: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x704, &mut x705, 0x0, x629, x679); + let mut x706: u32 = 0; + let mut x707: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x706, &mut x707, x705, x631, x681); + let mut x708: u32 = 0; + let mut x709: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x708, &mut x709, x707, x633, x683); + let mut x710: u32 = 0; + let mut x711: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x710, &mut x711, x709, x635, x685); + let mut x712: u32 = 0; + let mut x713: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x712, &mut x713, x711, x637, x687); + let mut x714: u32 = 0; + let mut x715: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x714, &mut x715, x713, x639, x689); + let mut x716: u32 = 0; + let mut x717: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x716, &mut x717, x715, x641, x691); + let mut x718: u32 = 0; + let mut x719: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x718, &mut x719, x717, x643, x693); + let mut x720: u32 = 0; + let mut x721: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x720, &mut x721, x719, x645, x695); + let mut x722: u32 = 0; + let mut x723: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x722, &mut x723, x721, x647, x697); + let mut x724: u32 = 0; + let mut x725: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x724, &mut x725, x723, x649, x699); + let mut x726: u32 = 0; + let mut x727: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x726, &mut x727, x725, x651, x701); + let mut x728: u32 = 0; + let mut x729: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x728, &mut x729, x727, x653, x703); + let x730: u32 = ((x729 as u32) + (x654 as u32)); + let mut x731: u32 = 0; + let mut x732: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x731, &mut x732, x5, (arg2[11])); + let mut x733: u32 = 0; + let mut x734: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x733, &mut x734, x5, (arg2[10])); + let mut x735: u32 = 0; + let mut x736: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x735, &mut x736, x5, (arg2[9])); + let mut x737: u32 = 0; + let mut x738: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x737, &mut x738, x5, (arg2[8])); + let mut x739: u32 = 0; + let mut x740: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x739, &mut x740, x5, (arg2[7])); + let mut x741: u32 = 0; + let mut x742: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x741, &mut x742, x5, (arg2[6])); + let mut x743: u32 = 0; + let mut x744: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x743, &mut x744, x5, (arg2[5])); + let mut x745: u32 = 0; + let mut x746: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x745, &mut x746, x5, (arg2[4])); + let mut x747: u32 = 0; + let mut x748: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x747, &mut x748, x5, (arg2[3])); + let mut x749: u32 = 0; + let mut x750: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x749, &mut x750, x5, (arg2[2])); + let mut x751: u32 = 0; + let mut x752: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x751, &mut x752, x5, (arg2[1])); + let mut x753: u32 = 0; + let mut x754: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x753, &mut x754, x5, (arg2[0])); + let mut x755: u32 = 0; + let mut x756: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x755, &mut x756, 0x0, x754, x751); + let mut x757: u32 = 0; + let mut x758: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x757, &mut x758, x756, x752, x749); + let mut x759: u32 = 0; + let mut x760: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x759, &mut x760, x758, x750, x747); + let mut x761: u32 = 0; + let mut x762: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x761, &mut x762, x760, x748, x745); + let mut x763: u32 = 0; + let mut x764: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x763, &mut x764, x762, x746, x743); + let mut x765: u32 = 0; + let mut x766: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x765, &mut x766, x764, x744, x741); + let mut x767: u32 = 0; + let mut x768: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x767, &mut x768, x766, x742, x739); + let mut x769: u32 = 0; + let mut x770: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x769, &mut x770, x768, x740, x737); + let mut x771: u32 = 0; + let mut x772: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x771, &mut x772, x770, x738, x735); + let mut x773: u32 = 0; + let mut x774: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x773, &mut x774, x772, x736, x733); + let mut x775: u32 = 0; + let mut x776: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x775, &mut x776, x774, x734, x731); + let x777: u32 = ((x776 as u32) + x732); + let mut x778: u32 = 0; + let mut x779: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x778, &mut x779, 0x0, x706, x753); + let mut x780: u32 = 0; + let mut x781: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x780, &mut x781, x779, x708, x755); + let mut x782: u32 = 0; + let mut x783: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x782, &mut x783, x781, x710, x757); + let mut x784: u32 = 0; + let mut x785: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x784, &mut x785, x783, x712, x759); + let mut x786: u32 = 0; + let mut x787: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x786, &mut x787, x785, x714, x761); + let mut x788: u32 = 0; + let mut x789: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x788, &mut x789, x787, x716, x763); + let mut x790: u32 = 0; + let mut x791: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x790, &mut x791, x789, x718, x765); + let mut x792: u32 = 0; + let mut x793: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x792, &mut x793, x791, x720, x767); + let mut x794: u32 = 0; + let mut x795: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x794, &mut x795, x793, x722, x769); + let mut x796: u32 = 0; + let mut x797: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x796, &mut x797, x795, x724, x771); + let mut x798: u32 = 0; + let mut x799: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x798, &mut x799, x797, x726, x773); + let mut x800: u32 = 0; + let mut x801: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x800, &mut x801, x799, x728, x775); + let mut x802: u32 = 0; + let mut x803: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x802, &mut x803, x801, x730, x777); + let mut x804: u32 = 0; + let mut x805: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x804, &mut x805, x778, 0xe88fdc45); + let mut x806: u32 = 0; + let mut x807: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x806, &mut x807, x804, 0xffffffff); + let mut x808: u32 = 0; + let mut x809: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x808, &mut x809, x804, 0xffffffff); + let mut x810: u32 = 0; + let mut x811: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x810, &mut x811, x804, 0xffffffff); + let mut x812: u32 = 0; + let mut x813: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x812, &mut x813, x804, 0xffffffff); + let mut x814: u32 = 0; + let mut x815: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x814, &mut x815, x804, 0xffffffff); + let mut x816: u32 = 0; + let mut x817: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x816, &mut x817, x804, 0xffffffff); + let mut x818: u32 = 0; + let mut x819: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x818, &mut x819, x804, 0xc7634d81); + let mut x820: u32 = 0; + let mut x821: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x820, &mut x821, x804, 0xf4372ddf); + let mut x822: u32 = 0; + let mut x823: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x822, &mut x823, x804, 0x581a0db2); + let mut x824: u32 = 0; + let mut x825: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x824, &mut x825, x804, 0x48b0a77a); + let mut x826: u32 = 0; + let mut x827: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x826, &mut x827, x804, 0xecec196a); + let mut x828: u32 = 0; + let mut x829: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x828, &mut x829, x804, 0xccc52973); + let mut x830: u32 = 0; + let mut x831: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x830, &mut x831, 0x0, x829, x826); + let mut x832: u32 = 0; + let mut x833: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x832, &mut x833, x831, x827, x824); + let mut x834: u32 = 0; + let mut x835: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x834, &mut x835, x833, x825, x822); + let mut x836: u32 = 0; + let mut x837: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x836, &mut x837, x835, x823, x820); + let mut x838: u32 = 0; + let mut x839: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x838, &mut x839, x837, x821, x818); + let mut x840: u32 = 0; + let mut x841: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x840, &mut x841, x839, x819, x816); + let mut x842: u32 = 0; + let mut x843: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x842, &mut x843, x841, x817, x814); + let mut x844: u32 = 0; + let mut x845: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x844, &mut x845, x843, x815, x812); + let mut x846: u32 = 0; + let mut x847: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x846, &mut x847, x845, x813, x810); + let mut x848: u32 = 0; + let mut x849: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x848, &mut x849, x847, x811, x808); + let mut x850: u32 = 0; + let mut x851: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x850, &mut x851, x849, x809, x806); + let x852: u32 = ((x851 as u32) + x807); + let mut x853: u32 = 0; + let mut x854: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x853, &mut x854, 0x0, x778, x828); + let mut x855: u32 = 0; + let mut x856: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x855, &mut x856, x854, x780, x830); + let mut x857: u32 = 0; + let mut x858: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x857, &mut x858, x856, x782, x832); + let mut x859: u32 = 0; + let mut x860: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x859, &mut x860, x858, x784, x834); + let mut x861: u32 = 0; + let mut x862: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x861, &mut x862, x860, x786, x836); + let mut x863: u32 = 0; + let mut x864: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x863, &mut x864, x862, x788, x838); + let mut x865: u32 = 0; + let mut x866: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x865, &mut x866, x864, x790, x840); + let mut x867: u32 = 0; + let mut x868: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x867, &mut x868, x866, x792, x842); + let mut x869: u32 = 0; + let mut x870: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x869, &mut x870, x868, x794, x844); + let mut x871: u32 = 0; + let mut x872: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x871, &mut x872, x870, x796, x846); + let mut x873: u32 = 0; + let mut x874: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x873, &mut x874, x872, x798, x848); + let mut x875: u32 = 0; + let mut x876: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x875, &mut x876, x874, x800, x850); + let mut x877: u32 = 0; + let mut x878: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x877, &mut x878, x876, x802, x852); + let x879: u32 = ((x878 as u32) + (x803 as u32)); + let mut x880: u32 = 0; + let mut x881: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x880, &mut x881, x6, (arg2[11])); + let mut x882: u32 = 0; + let mut x883: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x882, &mut x883, x6, (arg2[10])); + let mut x884: u32 = 0; + let mut x885: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x884, &mut x885, x6, (arg2[9])); + let mut x886: u32 = 0; + let mut x887: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x886, &mut x887, x6, (arg2[8])); + let mut x888: u32 = 0; + let mut x889: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x888, &mut x889, x6, (arg2[7])); + let mut x890: u32 = 0; + let mut x891: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x890, &mut x891, x6, (arg2[6])); + let mut x892: u32 = 0; + let mut x893: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x892, &mut x893, x6, (arg2[5])); + let mut x894: u32 = 0; + let mut x895: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x894, &mut x895, x6, (arg2[4])); + let mut x896: u32 = 0; + let mut x897: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x896, &mut x897, x6, (arg2[3])); + let mut x898: u32 = 0; + let mut x899: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x898, &mut x899, x6, (arg2[2])); + let mut x900: u32 = 0; + let mut x901: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x900, &mut x901, x6, (arg2[1])); + let mut x902: u32 = 0; + let mut x903: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x902, &mut x903, x6, (arg2[0])); + let mut x904: u32 = 0; + let mut x905: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x904, &mut x905, 0x0, x903, x900); + let mut x906: u32 = 0; + let mut x907: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x906, &mut x907, x905, x901, x898); + let mut x908: u32 = 0; + let mut x909: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x908, &mut x909, x907, x899, x896); + let mut x910: u32 = 0; + let mut x911: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x910, &mut x911, x909, x897, x894); + let mut x912: u32 = 0; + let mut x913: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x912, &mut x913, x911, x895, x892); + let mut x914: u32 = 0; + let mut x915: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x914, &mut x915, x913, x893, x890); + let mut x916: u32 = 0; + let mut x917: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x916, &mut x917, x915, x891, x888); + let mut x918: u32 = 0; + let mut x919: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x918, &mut x919, x917, x889, x886); + let mut x920: u32 = 0; + let mut x921: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x920, &mut x921, x919, x887, x884); + let mut x922: u32 = 0; + let mut x923: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x922, &mut x923, x921, x885, x882); + let mut x924: u32 = 0; + let mut x925: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x924, &mut x925, x923, x883, x880); + let x926: u32 = ((x925 as u32) + x881); + let mut x927: u32 = 0; + let mut x928: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x927, &mut x928, 0x0, x855, x902); + let mut x929: u32 = 0; + let mut x930: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x929, &mut x930, x928, x857, x904); + let mut x931: u32 = 0; + let mut x932: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x931, &mut x932, x930, x859, x906); + let mut x933: u32 = 0; + let mut x934: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x933, &mut x934, x932, x861, x908); + let mut x935: u32 = 0; + let mut x936: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x935, &mut x936, x934, x863, x910); + let mut x937: u32 = 0; + let mut x938: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x937, &mut x938, x936, x865, x912); + let mut x939: u32 = 0; + let mut x940: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x939, &mut x940, x938, x867, x914); + let mut x941: u32 = 0; + let mut x942: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x941, &mut x942, x940, x869, x916); + let mut x943: u32 = 0; + let mut x944: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x943, &mut x944, x942, x871, x918); + let mut x945: u32 = 0; + let mut x946: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x945, &mut x946, x944, x873, x920); + let mut x947: u32 = 0; + let mut x948: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x947, &mut x948, x946, x875, x922); + let mut x949: u32 = 0; + let mut x950: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x949, &mut x950, x948, x877, x924); + let mut x951: u32 = 0; + let mut x952: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x951, &mut x952, x950, x879, x926); + let mut x953: u32 = 0; + let mut x954: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x953, &mut x954, x927, 0xe88fdc45); + let mut x955: u32 = 0; + let mut x956: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x955, &mut x956, x953, 0xffffffff); + let mut x957: u32 = 0; + let mut x958: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x957, &mut x958, x953, 0xffffffff); + let mut x959: u32 = 0; + let mut x960: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x959, &mut x960, x953, 0xffffffff); + let mut x961: u32 = 0; + let mut x962: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x961, &mut x962, x953, 0xffffffff); + let mut x963: u32 = 0; + let mut x964: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x963, &mut x964, x953, 0xffffffff); + let mut x965: u32 = 0; + let mut x966: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x965, &mut x966, x953, 0xffffffff); + let mut x967: u32 = 0; + let mut x968: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x967, &mut x968, x953, 0xc7634d81); + let mut x969: u32 = 0; + let mut x970: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x969, &mut x970, x953, 0xf4372ddf); + let mut x971: u32 = 0; + let mut x972: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x971, &mut x972, x953, 0x581a0db2); + let mut x973: u32 = 0; + let mut x974: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x973, &mut x974, x953, 0x48b0a77a); + let mut x975: u32 = 0; + let mut x976: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x975, &mut x976, x953, 0xecec196a); + let mut x977: u32 = 0; + let mut x978: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x977, &mut x978, x953, 0xccc52973); + let mut x979: u32 = 0; + let mut x980: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x979, &mut x980, 0x0, x978, x975); + let mut x981: u32 = 0; + let mut x982: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x981, &mut x982, x980, x976, x973); + let mut x983: u32 = 0; + let mut x984: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x983, &mut x984, x982, x974, x971); + let mut x985: u32 = 0; + let mut x986: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x985, &mut x986, x984, x972, x969); + let mut x987: u32 = 0; + let mut x988: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x987, &mut x988, x986, x970, x967); + let mut x989: u32 = 0; + let mut x990: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x989, &mut x990, x988, x968, x965); + let mut x991: u32 = 0; + let mut x992: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x991, &mut x992, x990, x966, x963); + let mut x993: u32 = 0; + let mut x994: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x993, &mut x994, x992, x964, x961); + let mut x995: u32 = 0; + let mut x996: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x995, &mut x996, x994, x962, x959); + let mut x997: u32 = 0; + let mut x998: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x997, &mut x998, x996, x960, x957); + let mut x999: u32 = 0; + let mut x1000: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x999, &mut x1000, x998, x958, x955); + let x1001: u32 = ((x1000 as u32) + x956); + let mut x1002: u32 = 0; + let mut x1003: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1002, &mut x1003, 0x0, x927, x977); + let mut x1004: u32 = 0; + let mut x1005: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1004, &mut x1005, x1003, x929, x979); + let mut x1006: u32 = 0; + let mut x1007: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1006, &mut x1007, x1005, x931, x981); + let mut x1008: u32 = 0; + let mut x1009: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1008, &mut x1009, x1007, x933, x983); + let mut x1010: u32 = 0; + let mut x1011: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1010, &mut x1011, x1009, x935, x985); + let mut x1012: u32 = 0; + let mut x1013: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1012, &mut x1013, x1011, x937, x987); + let mut x1014: u32 = 0; + let mut x1015: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1014, &mut x1015, x1013, x939, x989); + let mut x1016: u32 = 0; + let mut x1017: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1016, &mut x1017, x1015, x941, x991); + let mut x1018: u32 = 0; + let mut x1019: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1018, &mut x1019, x1017, x943, x993); + let mut x1020: u32 = 0; + let mut x1021: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1020, &mut x1021, x1019, x945, x995); + let mut x1022: u32 = 0; + let mut x1023: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1022, &mut x1023, x1021, x947, x997); + let mut x1024: u32 = 0; + let mut x1025: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1024, &mut x1025, x1023, x949, x999); + let mut x1026: u32 = 0; + let mut x1027: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1026, &mut x1027, x1025, x951, x1001); + let x1028: u32 = ((x1027 as u32) + (x952 as u32)); + let mut x1029: u32 = 0; + let mut x1030: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1029, &mut x1030, x7, (arg2[11])); + let mut x1031: u32 = 0; + let mut x1032: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1031, &mut x1032, x7, (arg2[10])); + let mut x1033: u32 = 0; + let mut x1034: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1033, &mut x1034, x7, (arg2[9])); + let mut x1035: u32 = 0; + let mut x1036: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1035, &mut x1036, x7, (arg2[8])); + let mut x1037: u32 = 0; + let mut x1038: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1037, &mut x1038, x7, (arg2[7])); + let mut x1039: u32 = 0; + let mut x1040: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1039, &mut x1040, x7, (arg2[6])); + let mut x1041: u32 = 0; + let mut x1042: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1041, &mut x1042, x7, (arg2[5])); + let mut x1043: u32 = 0; + let mut x1044: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1043, &mut x1044, x7, (arg2[4])); + let mut x1045: u32 = 0; + let mut x1046: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1045, &mut x1046, x7, (arg2[3])); + let mut x1047: u32 = 0; + let mut x1048: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1047, &mut x1048, x7, (arg2[2])); + let mut x1049: u32 = 0; + let mut x1050: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1049, &mut x1050, x7, (arg2[1])); + let mut x1051: u32 = 0; + let mut x1052: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1051, &mut x1052, x7, (arg2[0])); + let mut x1053: u32 = 0; + let mut x1054: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1053, &mut x1054, 0x0, x1052, x1049); + let mut x1055: u32 = 0; + let mut x1056: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1055, &mut x1056, x1054, x1050, x1047); + let mut x1057: u32 = 0; + let mut x1058: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1057, &mut x1058, x1056, x1048, x1045); + let mut x1059: u32 = 0; + let mut x1060: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1059, &mut x1060, x1058, x1046, x1043); + let mut x1061: u32 = 0; + let mut x1062: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1061, &mut x1062, x1060, x1044, x1041); + let mut x1063: u32 = 0; + let mut x1064: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1063, &mut x1064, x1062, x1042, x1039); + let mut x1065: u32 = 0; + let mut x1066: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1065, &mut x1066, x1064, x1040, x1037); + let mut x1067: u32 = 0; + let mut x1068: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1067, &mut x1068, x1066, x1038, x1035); + let mut x1069: u32 = 0; + let mut x1070: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1069, &mut x1070, x1068, x1036, x1033); + let mut x1071: u32 = 0; + let mut x1072: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1071, &mut x1072, x1070, x1034, x1031); + let mut x1073: u32 = 0; + let mut x1074: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1073, &mut x1074, x1072, x1032, x1029); + let x1075: u32 = ((x1074 as u32) + x1030); + let mut x1076: u32 = 0; + let mut x1077: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1076, &mut x1077, 0x0, x1004, x1051); + let mut x1078: u32 = 0; + let mut x1079: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1078, &mut x1079, x1077, x1006, x1053); + let mut x1080: u32 = 0; + let mut x1081: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1080, &mut x1081, x1079, x1008, x1055); + let mut x1082: u32 = 0; + let mut x1083: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1082, &mut x1083, x1081, x1010, x1057); + let mut x1084: u32 = 0; + let mut x1085: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1084, &mut x1085, x1083, x1012, x1059); + let mut x1086: u32 = 0; + let mut x1087: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1086, &mut x1087, x1085, x1014, x1061); + let mut x1088: u32 = 0; + let mut x1089: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1088, &mut x1089, x1087, x1016, x1063); + let mut x1090: u32 = 0; + let mut x1091: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1090, &mut x1091, x1089, x1018, x1065); + let mut x1092: u32 = 0; + let mut x1093: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1092, &mut x1093, x1091, x1020, x1067); + let mut x1094: u32 = 0; + let mut x1095: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1094, &mut x1095, x1093, x1022, x1069); + let mut x1096: u32 = 0; + let mut x1097: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1096, &mut x1097, x1095, x1024, x1071); + let mut x1098: u32 = 0; + let mut x1099: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1098, &mut x1099, x1097, x1026, x1073); + let mut x1100: u32 = 0; + let mut x1101: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1100, &mut x1101, x1099, x1028, x1075); + let mut x1102: u32 = 0; + let mut x1103: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1102, &mut x1103, x1076, 0xe88fdc45); + let mut x1104: u32 = 0; + let mut x1105: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1104, &mut x1105, x1102, 0xffffffff); + let mut x1106: u32 = 0; + let mut x1107: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1106, &mut x1107, x1102, 0xffffffff); + let mut x1108: u32 = 0; + let mut x1109: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1108, &mut x1109, x1102, 0xffffffff); + let mut x1110: u32 = 0; + let mut x1111: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1110, &mut x1111, x1102, 0xffffffff); + let mut x1112: u32 = 0; + let mut x1113: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1112, &mut x1113, x1102, 0xffffffff); + let mut x1114: u32 = 0; + let mut x1115: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1114, &mut x1115, x1102, 0xffffffff); + let mut x1116: u32 = 0; + let mut x1117: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1116, &mut x1117, x1102, 0xc7634d81); + let mut x1118: u32 = 0; + let mut x1119: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1118, &mut x1119, x1102, 0xf4372ddf); + let mut x1120: u32 = 0; + let mut x1121: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1120, &mut x1121, x1102, 0x581a0db2); + let mut x1122: u32 = 0; + let mut x1123: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1122, &mut x1123, x1102, 0x48b0a77a); + let mut x1124: u32 = 0; + let mut x1125: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1124, &mut x1125, x1102, 0xecec196a); + let mut x1126: u32 = 0; + let mut x1127: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1126, &mut x1127, x1102, 0xccc52973); + let mut x1128: u32 = 0; + let mut x1129: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1128, &mut x1129, 0x0, x1127, x1124); + let mut x1130: u32 = 0; + let mut x1131: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1130, &mut x1131, x1129, x1125, x1122); + let mut x1132: u32 = 0; + let mut x1133: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1132, &mut x1133, x1131, x1123, x1120); + let mut x1134: u32 = 0; + let mut x1135: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1134, &mut x1135, x1133, x1121, x1118); + let mut x1136: u32 = 0; + let mut x1137: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1136, &mut x1137, x1135, x1119, x1116); + let mut x1138: u32 = 0; + let mut x1139: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1138, &mut x1139, x1137, x1117, x1114); + let mut x1140: u32 = 0; + let mut x1141: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1140, &mut x1141, x1139, x1115, x1112); + let mut x1142: u32 = 0; + let mut x1143: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1142, &mut x1143, x1141, x1113, x1110); + let mut x1144: u32 = 0; + let mut x1145: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1144, &mut x1145, x1143, x1111, x1108); + let mut x1146: u32 = 0; + let mut x1147: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1146, &mut x1147, x1145, x1109, x1106); + let mut x1148: u32 = 0; + let mut x1149: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1148, &mut x1149, x1147, x1107, x1104); + let x1150: u32 = ((x1149 as u32) + x1105); + let mut x1151: u32 = 0; + let mut x1152: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1151, &mut x1152, 0x0, x1076, x1126); + let mut x1153: u32 = 0; + let mut x1154: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1153, &mut x1154, x1152, x1078, x1128); + let mut x1155: u32 = 0; + let mut x1156: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1155, &mut x1156, x1154, x1080, x1130); + let mut x1157: u32 = 0; + let mut x1158: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1157, &mut x1158, x1156, x1082, x1132); + let mut x1159: u32 = 0; + let mut x1160: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1159, &mut x1160, x1158, x1084, x1134); + let mut x1161: u32 = 0; + let mut x1162: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1161, &mut x1162, x1160, x1086, x1136); + let mut x1163: u32 = 0; + let mut x1164: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1163, &mut x1164, x1162, x1088, x1138); + let mut x1165: u32 = 0; + let mut x1166: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1165, &mut x1166, x1164, x1090, x1140); + let mut x1167: u32 = 0; + let mut x1168: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1167, &mut x1168, x1166, x1092, x1142); + let mut x1169: u32 = 0; + let mut x1170: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1169, &mut x1170, x1168, x1094, x1144); + let mut x1171: u32 = 0; + let mut x1172: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1171, &mut x1172, x1170, x1096, x1146); + let mut x1173: u32 = 0; + let mut x1174: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1173, &mut x1174, x1172, x1098, x1148); + let mut x1175: u32 = 0; + let mut x1176: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1175, &mut x1176, x1174, x1100, x1150); + let x1177: u32 = ((x1176 as u32) + (x1101 as u32)); + let mut x1178: u32 = 0; + let mut x1179: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1178, &mut x1179, x8, (arg2[11])); + let mut x1180: u32 = 0; + let mut x1181: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1180, &mut x1181, x8, (arg2[10])); + let mut x1182: u32 = 0; + let mut x1183: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1182, &mut x1183, x8, (arg2[9])); + let mut x1184: u32 = 0; + let mut x1185: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1184, &mut x1185, x8, (arg2[8])); + let mut x1186: u32 = 0; + let mut x1187: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1186, &mut x1187, x8, (arg2[7])); + let mut x1188: u32 = 0; + let mut x1189: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1188, &mut x1189, x8, (arg2[6])); + let mut x1190: u32 = 0; + let mut x1191: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1190, &mut x1191, x8, (arg2[5])); + let mut x1192: u32 = 0; + let mut x1193: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1192, &mut x1193, x8, (arg2[4])); + let mut x1194: u32 = 0; + let mut x1195: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1194, &mut x1195, x8, (arg2[3])); + let mut x1196: u32 = 0; + let mut x1197: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1196, &mut x1197, x8, (arg2[2])); + let mut x1198: u32 = 0; + let mut x1199: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1198, &mut x1199, x8, (arg2[1])); + let mut x1200: u32 = 0; + let mut x1201: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1200, &mut x1201, x8, (arg2[0])); + let mut x1202: u32 = 0; + let mut x1203: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1202, &mut x1203, 0x0, x1201, x1198); + let mut x1204: u32 = 0; + let mut x1205: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1204, &mut x1205, x1203, x1199, x1196); + let mut x1206: u32 = 0; + let mut x1207: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1206, &mut x1207, x1205, x1197, x1194); + let mut x1208: u32 = 0; + let mut x1209: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1208, &mut x1209, x1207, x1195, x1192); + let mut x1210: u32 = 0; + let mut x1211: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1210, &mut x1211, x1209, x1193, x1190); + let mut x1212: u32 = 0; + let mut x1213: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1212, &mut x1213, x1211, x1191, x1188); + let mut x1214: u32 = 0; + let mut x1215: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1214, &mut x1215, x1213, x1189, x1186); + let mut x1216: u32 = 0; + let mut x1217: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1216, &mut x1217, x1215, x1187, x1184); + let mut x1218: u32 = 0; + let mut x1219: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1218, &mut x1219, x1217, x1185, x1182); + let mut x1220: u32 = 0; + let mut x1221: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1220, &mut x1221, x1219, x1183, x1180); + let mut x1222: u32 = 0; + let mut x1223: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1222, &mut x1223, x1221, x1181, x1178); + let x1224: u32 = ((x1223 as u32) + x1179); + let mut x1225: u32 = 0; + let mut x1226: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1225, &mut x1226, 0x0, x1153, x1200); + let mut x1227: u32 = 0; + let mut x1228: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1227, &mut x1228, x1226, x1155, x1202); + let mut x1229: u32 = 0; + let mut x1230: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1229, &mut x1230, x1228, x1157, x1204); + let mut x1231: u32 = 0; + let mut x1232: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1231, &mut x1232, x1230, x1159, x1206); + let mut x1233: u32 = 0; + let mut x1234: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1233, &mut x1234, x1232, x1161, x1208); + let mut x1235: u32 = 0; + let mut x1236: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1235, &mut x1236, x1234, x1163, x1210); + let mut x1237: u32 = 0; + let mut x1238: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1237, &mut x1238, x1236, x1165, x1212); + let mut x1239: u32 = 0; + let mut x1240: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1239, &mut x1240, x1238, x1167, x1214); + let mut x1241: u32 = 0; + let mut x1242: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1241, &mut x1242, x1240, x1169, x1216); + let mut x1243: u32 = 0; + let mut x1244: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1243, &mut x1244, x1242, x1171, x1218); + let mut x1245: u32 = 0; + let mut x1246: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1245, &mut x1246, x1244, x1173, x1220); + let mut x1247: u32 = 0; + let mut x1248: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1247, &mut x1248, x1246, x1175, x1222); + let mut x1249: u32 = 0; + let mut x1250: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1249, &mut x1250, x1248, x1177, x1224); + let mut x1251: u32 = 0; + let mut x1252: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1251, &mut x1252, x1225, 0xe88fdc45); + let mut x1253: u32 = 0; + let mut x1254: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1253, &mut x1254, x1251, 0xffffffff); + let mut x1255: u32 = 0; + let mut x1256: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1255, &mut x1256, x1251, 0xffffffff); + let mut x1257: u32 = 0; + let mut x1258: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1257, &mut x1258, x1251, 0xffffffff); + let mut x1259: u32 = 0; + let mut x1260: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1259, &mut x1260, x1251, 0xffffffff); + let mut x1261: u32 = 0; + let mut x1262: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1261, &mut x1262, x1251, 0xffffffff); + let mut x1263: u32 = 0; + let mut x1264: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1263, &mut x1264, x1251, 0xffffffff); + let mut x1265: u32 = 0; + let mut x1266: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1265, &mut x1266, x1251, 0xc7634d81); + let mut x1267: u32 = 0; + let mut x1268: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1267, &mut x1268, x1251, 0xf4372ddf); + let mut x1269: u32 = 0; + let mut x1270: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1269, &mut x1270, x1251, 0x581a0db2); + let mut x1271: u32 = 0; + let mut x1272: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1271, &mut x1272, x1251, 0x48b0a77a); + let mut x1273: u32 = 0; + let mut x1274: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1273, &mut x1274, x1251, 0xecec196a); + let mut x1275: u32 = 0; + let mut x1276: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1275, &mut x1276, x1251, 0xccc52973); + let mut x1277: u32 = 0; + let mut x1278: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1277, &mut x1278, 0x0, x1276, x1273); + let mut x1279: u32 = 0; + let mut x1280: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1279, &mut x1280, x1278, x1274, x1271); + let mut x1281: u32 = 0; + let mut x1282: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1281, &mut x1282, x1280, x1272, x1269); + let mut x1283: u32 = 0; + let mut x1284: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1283, &mut x1284, x1282, x1270, x1267); + let mut x1285: u32 = 0; + let mut x1286: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1285, &mut x1286, x1284, x1268, x1265); + let mut x1287: u32 = 0; + let mut x1288: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1287, &mut x1288, x1286, x1266, x1263); + let mut x1289: u32 = 0; + let mut x1290: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1289, &mut x1290, x1288, x1264, x1261); + let mut x1291: u32 = 0; + let mut x1292: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1291, &mut x1292, x1290, x1262, x1259); + let mut x1293: u32 = 0; + let mut x1294: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1293, &mut x1294, x1292, x1260, x1257); + let mut x1295: u32 = 0; + let mut x1296: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1295, &mut x1296, x1294, x1258, x1255); + let mut x1297: u32 = 0; + let mut x1298: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1297, &mut x1298, x1296, x1256, x1253); + let x1299: u32 = ((x1298 as u32) + x1254); + let mut x1300: u32 = 0; + let mut x1301: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1300, &mut x1301, 0x0, x1225, x1275); + let mut x1302: u32 = 0; + let mut x1303: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1302, &mut x1303, x1301, x1227, x1277); + let mut x1304: u32 = 0; + let mut x1305: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1304, &mut x1305, x1303, x1229, x1279); + let mut x1306: u32 = 0; + let mut x1307: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1306, &mut x1307, x1305, x1231, x1281); + let mut x1308: u32 = 0; + let mut x1309: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1308, &mut x1309, x1307, x1233, x1283); + let mut x1310: u32 = 0; + let mut x1311: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1310, &mut x1311, x1309, x1235, x1285); + let mut x1312: u32 = 0; + let mut x1313: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1312, &mut x1313, x1311, x1237, x1287); + let mut x1314: u32 = 0; + let mut x1315: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1314, &mut x1315, x1313, x1239, x1289); + let mut x1316: u32 = 0; + let mut x1317: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1316, &mut x1317, x1315, x1241, x1291); + let mut x1318: u32 = 0; + let mut x1319: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1318, &mut x1319, x1317, x1243, x1293); + let mut x1320: u32 = 0; + let mut x1321: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1320, &mut x1321, x1319, x1245, x1295); + let mut x1322: u32 = 0; + let mut x1323: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1322, &mut x1323, x1321, x1247, x1297); + let mut x1324: u32 = 0; + let mut x1325: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1324, &mut x1325, x1323, x1249, x1299); + let x1326: u32 = ((x1325 as u32) + (x1250 as u32)); + let mut x1327: u32 = 0; + let mut x1328: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1327, &mut x1328, x9, (arg2[11])); + let mut x1329: u32 = 0; + let mut x1330: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1329, &mut x1330, x9, (arg2[10])); + let mut x1331: u32 = 0; + let mut x1332: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1331, &mut x1332, x9, (arg2[9])); + let mut x1333: u32 = 0; + let mut x1334: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1333, &mut x1334, x9, (arg2[8])); + let mut x1335: u32 = 0; + let mut x1336: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1335, &mut x1336, x9, (arg2[7])); + let mut x1337: u32 = 0; + let mut x1338: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1337, &mut x1338, x9, (arg2[6])); + let mut x1339: u32 = 0; + let mut x1340: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1339, &mut x1340, x9, (arg2[5])); + let mut x1341: u32 = 0; + let mut x1342: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1341, &mut x1342, x9, (arg2[4])); + let mut x1343: u32 = 0; + let mut x1344: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1343, &mut x1344, x9, (arg2[3])); + let mut x1345: u32 = 0; + let mut x1346: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1345, &mut x1346, x9, (arg2[2])); + let mut x1347: u32 = 0; + let mut x1348: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1347, &mut x1348, x9, (arg2[1])); + let mut x1349: u32 = 0; + let mut x1350: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1349, &mut x1350, x9, (arg2[0])); + let mut x1351: u32 = 0; + let mut x1352: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1351, &mut x1352, 0x0, x1350, x1347); + let mut x1353: u32 = 0; + let mut x1354: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1353, &mut x1354, x1352, x1348, x1345); + let mut x1355: u32 = 0; + let mut x1356: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1355, &mut x1356, x1354, x1346, x1343); + let mut x1357: u32 = 0; + let mut x1358: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1357, &mut x1358, x1356, x1344, x1341); + let mut x1359: u32 = 0; + let mut x1360: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1359, &mut x1360, x1358, x1342, x1339); + let mut x1361: u32 = 0; + let mut x1362: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1361, &mut x1362, x1360, x1340, x1337); + let mut x1363: u32 = 0; + let mut x1364: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1363, &mut x1364, x1362, x1338, x1335); + let mut x1365: u32 = 0; + let mut x1366: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1365, &mut x1366, x1364, x1336, x1333); + let mut x1367: u32 = 0; + let mut x1368: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1367, &mut x1368, x1366, x1334, x1331); + let mut x1369: u32 = 0; + let mut x1370: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1369, &mut x1370, x1368, x1332, x1329); + let mut x1371: u32 = 0; + let mut x1372: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1371, &mut x1372, x1370, x1330, x1327); + let x1373: u32 = ((x1372 as u32) + x1328); + let mut x1374: u32 = 0; + let mut x1375: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1374, &mut x1375, 0x0, x1302, x1349); + let mut x1376: u32 = 0; + let mut x1377: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1376, &mut x1377, x1375, x1304, x1351); + let mut x1378: u32 = 0; + let mut x1379: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1378, &mut x1379, x1377, x1306, x1353); + let mut x1380: u32 = 0; + let mut x1381: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1380, &mut x1381, x1379, x1308, x1355); + let mut x1382: u32 = 0; + let mut x1383: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1382, &mut x1383, x1381, x1310, x1357); + let mut x1384: u32 = 0; + let mut x1385: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1384, &mut x1385, x1383, x1312, x1359); + let mut x1386: u32 = 0; + let mut x1387: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1386, &mut x1387, x1385, x1314, x1361); + let mut x1388: u32 = 0; + let mut x1389: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1388, &mut x1389, x1387, x1316, x1363); + let mut x1390: u32 = 0; + let mut x1391: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1390, &mut x1391, x1389, x1318, x1365); + let mut x1392: u32 = 0; + let mut x1393: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1392, &mut x1393, x1391, x1320, x1367); + let mut x1394: u32 = 0; + let mut x1395: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1394, &mut x1395, x1393, x1322, x1369); + let mut x1396: u32 = 0; + let mut x1397: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1396, &mut x1397, x1395, x1324, x1371); + let mut x1398: u32 = 0; + let mut x1399: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1398, &mut x1399, x1397, x1326, x1373); + let mut x1400: u32 = 0; + let mut x1401: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1400, &mut x1401, x1374, 0xe88fdc45); + let mut x1402: u32 = 0; + let mut x1403: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1402, &mut x1403, x1400, 0xffffffff); + let mut x1404: u32 = 0; + let mut x1405: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1404, &mut x1405, x1400, 0xffffffff); + let mut x1406: u32 = 0; + let mut x1407: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1406, &mut x1407, x1400, 0xffffffff); + let mut x1408: u32 = 0; + let mut x1409: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1408, &mut x1409, x1400, 0xffffffff); + let mut x1410: u32 = 0; + let mut x1411: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1410, &mut x1411, x1400, 0xffffffff); + let mut x1412: u32 = 0; + let mut x1413: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1412, &mut x1413, x1400, 0xffffffff); + let mut x1414: u32 = 0; + let mut x1415: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1414, &mut x1415, x1400, 0xc7634d81); + let mut x1416: u32 = 0; + let mut x1417: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1416, &mut x1417, x1400, 0xf4372ddf); + let mut x1418: u32 = 0; + let mut x1419: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1418, &mut x1419, x1400, 0x581a0db2); + let mut x1420: u32 = 0; + let mut x1421: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1420, &mut x1421, x1400, 0x48b0a77a); + let mut x1422: u32 = 0; + let mut x1423: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1422, &mut x1423, x1400, 0xecec196a); + let mut x1424: u32 = 0; + let mut x1425: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1424, &mut x1425, x1400, 0xccc52973); + let mut x1426: u32 = 0; + let mut x1427: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1426, &mut x1427, 0x0, x1425, x1422); + let mut x1428: u32 = 0; + let mut x1429: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1428, &mut x1429, x1427, x1423, x1420); + let mut x1430: u32 = 0; + let mut x1431: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1430, &mut x1431, x1429, x1421, x1418); + let mut x1432: u32 = 0; + let mut x1433: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1432, &mut x1433, x1431, x1419, x1416); + let mut x1434: u32 = 0; + let mut x1435: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1434, &mut x1435, x1433, x1417, x1414); + let mut x1436: u32 = 0; + let mut x1437: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1436, &mut x1437, x1435, x1415, x1412); + let mut x1438: u32 = 0; + let mut x1439: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1438, &mut x1439, x1437, x1413, x1410); + let mut x1440: u32 = 0; + let mut x1441: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1440, &mut x1441, x1439, x1411, x1408); + let mut x1442: u32 = 0; + let mut x1443: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1442, &mut x1443, x1441, x1409, x1406); + let mut x1444: u32 = 0; + let mut x1445: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1444, &mut x1445, x1443, x1407, x1404); + let mut x1446: u32 = 0; + let mut x1447: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1446, &mut x1447, x1445, x1405, x1402); + let x1448: u32 = ((x1447 as u32) + x1403); + let mut x1449: u32 = 0; + let mut x1450: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1449, &mut x1450, 0x0, x1374, x1424); + let mut x1451: u32 = 0; + let mut x1452: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1451, &mut x1452, x1450, x1376, x1426); + let mut x1453: u32 = 0; + let mut x1454: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1453, &mut x1454, x1452, x1378, x1428); + let mut x1455: u32 = 0; + let mut x1456: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1455, &mut x1456, x1454, x1380, x1430); + let mut x1457: u32 = 0; + let mut x1458: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1457, &mut x1458, x1456, x1382, x1432); + let mut x1459: u32 = 0; + let mut x1460: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1459, &mut x1460, x1458, x1384, x1434); + let mut x1461: u32 = 0; + let mut x1462: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1461, &mut x1462, x1460, x1386, x1436); + let mut x1463: u32 = 0; + let mut x1464: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1463, &mut x1464, x1462, x1388, x1438); + let mut x1465: u32 = 0; + let mut x1466: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1465, &mut x1466, x1464, x1390, x1440); + let mut x1467: u32 = 0; + let mut x1468: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1467, &mut x1468, x1466, x1392, x1442); + let mut x1469: u32 = 0; + let mut x1470: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1469, &mut x1470, x1468, x1394, x1444); + let mut x1471: u32 = 0; + let mut x1472: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1471, &mut x1472, x1470, x1396, x1446); + let mut x1473: u32 = 0; + let mut x1474: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1473, &mut x1474, x1472, x1398, x1448); + let x1475: u32 = ((x1474 as u32) + (x1399 as u32)); + let mut x1476: u32 = 0; + let mut x1477: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1476, &mut x1477, x10, (arg2[11])); + let mut x1478: u32 = 0; + let mut x1479: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1478, &mut x1479, x10, (arg2[10])); + let mut x1480: u32 = 0; + let mut x1481: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1480, &mut x1481, x10, (arg2[9])); + let mut x1482: u32 = 0; + let mut x1483: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1482, &mut x1483, x10, (arg2[8])); + let mut x1484: u32 = 0; + let mut x1485: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1484, &mut x1485, x10, (arg2[7])); + let mut x1486: u32 = 0; + let mut x1487: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1486, &mut x1487, x10, (arg2[6])); + let mut x1488: u32 = 0; + let mut x1489: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1488, &mut x1489, x10, (arg2[5])); + let mut x1490: u32 = 0; + let mut x1491: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1490, &mut x1491, x10, (arg2[4])); + let mut x1492: u32 = 0; + let mut x1493: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1492, &mut x1493, x10, (arg2[3])); + let mut x1494: u32 = 0; + let mut x1495: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1494, &mut x1495, x10, (arg2[2])); + let mut x1496: u32 = 0; + let mut x1497: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1496, &mut x1497, x10, (arg2[1])); + let mut x1498: u32 = 0; + let mut x1499: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1498, &mut x1499, x10, (arg2[0])); + let mut x1500: u32 = 0; + let mut x1501: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1500, &mut x1501, 0x0, x1499, x1496); + let mut x1502: u32 = 0; + let mut x1503: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1502, &mut x1503, x1501, x1497, x1494); + let mut x1504: u32 = 0; + let mut x1505: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1504, &mut x1505, x1503, x1495, x1492); + let mut x1506: u32 = 0; + let mut x1507: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1506, &mut x1507, x1505, x1493, x1490); + let mut x1508: u32 = 0; + let mut x1509: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1508, &mut x1509, x1507, x1491, x1488); + let mut x1510: u32 = 0; + let mut x1511: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1510, &mut x1511, x1509, x1489, x1486); + let mut x1512: u32 = 0; + let mut x1513: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1512, &mut x1513, x1511, x1487, x1484); + let mut x1514: u32 = 0; + let mut x1515: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1514, &mut x1515, x1513, x1485, x1482); + let mut x1516: u32 = 0; + let mut x1517: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1516, &mut x1517, x1515, x1483, x1480); + let mut x1518: u32 = 0; + let mut x1519: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1518, &mut x1519, x1517, x1481, x1478); + let mut x1520: u32 = 0; + let mut x1521: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1520, &mut x1521, x1519, x1479, x1476); + let x1522: u32 = ((x1521 as u32) + x1477); + let mut x1523: u32 = 0; + let mut x1524: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1523, &mut x1524, 0x0, x1451, x1498); + let mut x1525: u32 = 0; + let mut x1526: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1525, &mut x1526, x1524, x1453, x1500); + let mut x1527: u32 = 0; + let mut x1528: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1527, &mut x1528, x1526, x1455, x1502); + let mut x1529: u32 = 0; + let mut x1530: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1529, &mut x1530, x1528, x1457, x1504); + let mut x1531: u32 = 0; + let mut x1532: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1531, &mut x1532, x1530, x1459, x1506); + let mut x1533: u32 = 0; + let mut x1534: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1533, &mut x1534, x1532, x1461, x1508); + let mut x1535: u32 = 0; + let mut x1536: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1535, &mut x1536, x1534, x1463, x1510); + let mut x1537: u32 = 0; + let mut x1538: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1537, &mut x1538, x1536, x1465, x1512); + let mut x1539: u32 = 0; + let mut x1540: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1539, &mut x1540, x1538, x1467, x1514); + let mut x1541: u32 = 0; + let mut x1542: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1541, &mut x1542, x1540, x1469, x1516); + let mut x1543: u32 = 0; + let mut x1544: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1543, &mut x1544, x1542, x1471, x1518); + let mut x1545: u32 = 0; + let mut x1546: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1545, &mut x1546, x1544, x1473, x1520); + let mut x1547: u32 = 0; + let mut x1548: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1547, &mut x1548, x1546, x1475, x1522); + let mut x1549: u32 = 0; + let mut x1550: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1549, &mut x1550, x1523, 0xe88fdc45); + let mut x1551: u32 = 0; + let mut x1552: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1551, &mut x1552, x1549, 0xffffffff); + let mut x1553: u32 = 0; + let mut x1554: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1553, &mut x1554, x1549, 0xffffffff); + let mut x1555: u32 = 0; + let mut x1556: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1555, &mut x1556, x1549, 0xffffffff); + let mut x1557: u32 = 0; + let mut x1558: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1557, &mut x1558, x1549, 0xffffffff); + let mut x1559: u32 = 0; + let mut x1560: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1559, &mut x1560, x1549, 0xffffffff); + let mut x1561: u32 = 0; + let mut x1562: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1561, &mut x1562, x1549, 0xffffffff); + let mut x1563: u32 = 0; + let mut x1564: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1563, &mut x1564, x1549, 0xc7634d81); + let mut x1565: u32 = 0; + let mut x1566: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1565, &mut x1566, x1549, 0xf4372ddf); + let mut x1567: u32 = 0; + let mut x1568: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1567, &mut x1568, x1549, 0x581a0db2); + let mut x1569: u32 = 0; + let mut x1570: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1569, &mut x1570, x1549, 0x48b0a77a); + let mut x1571: u32 = 0; + let mut x1572: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1571, &mut x1572, x1549, 0xecec196a); + let mut x1573: u32 = 0; + let mut x1574: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1573, &mut x1574, x1549, 0xccc52973); + let mut x1575: u32 = 0; + let mut x1576: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1575, &mut x1576, 0x0, x1574, x1571); + let mut x1577: u32 = 0; + let mut x1578: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1577, &mut x1578, x1576, x1572, x1569); + let mut x1579: u32 = 0; + let mut x1580: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1579, &mut x1580, x1578, x1570, x1567); + let mut x1581: u32 = 0; + let mut x1582: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1581, &mut x1582, x1580, x1568, x1565); + let mut x1583: u32 = 0; + let mut x1584: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1583, &mut x1584, x1582, x1566, x1563); + let mut x1585: u32 = 0; + let mut x1586: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1585, &mut x1586, x1584, x1564, x1561); + let mut x1587: u32 = 0; + let mut x1588: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1587, &mut x1588, x1586, x1562, x1559); + let mut x1589: u32 = 0; + let mut x1590: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1589, &mut x1590, x1588, x1560, x1557); + let mut x1591: u32 = 0; + let mut x1592: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1591, &mut x1592, x1590, x1558, x1555); + let mut x1593: u32 = 0; + let mut x1594: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1593, &mut x1594, x1592, x1556, x1553); + let mut x1595: u32 = 0; + let mut x1596: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1595, &mut x1596, x1594, x1554, x1551); + let x1597: u32 = ((x1596 as u32) + x1552); + let mut x1598: u32 = 0; + let mut x1599: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1598, &mut x1599, 0x0, x1523, x1573); + let mut x1600: u32 = 0; + let mut x1601: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1600, &mut x1601, x1599, x1525, x1575); + let mut x1602: u32 = 0; + let mut x1603: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1602, &mut x1603, x1601, x1527, x1577); + let mut x1604: u32 = 0; + let mut x1605: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1604, &mut x1605, x1603, x1529, x1579); + let mut x1606: u32 = 0; + let mut x1607: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1606, &mut x1607, x1605, x1531, x1581); + let mut x1608: u32 = 0; + let mut x1609: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1608, &mut x1609, x1607, x1533, x1583); + let mut x1610: u32 = 0; + let mut x1611: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1610, &mut x1611, x1609, x1535, x1585); + let mut x1612: u32 = 0; + let mut x1613: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1612, &mut x1613, x1611, x1537, x1587); + let mut x1614: u32 = 0; + let mut x1615: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1614, &mut x1615, x1613, x1539, x1589); + let mut x1616: u32 = 0; + let mut x1617: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1616, &mut x1617, x1615, x1541, x1591); + let mut x1618: u32 = 0; + let mut x1619: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1618, &mut x1619, x1617, x1543, x1593); + let mut x1620: u32 = 0; + let mut x1621: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1620, &mut x1621, x1619, x1545, x1595); + let mut x1622: u32 = 0; + let mut x1623: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1622, &mut x1623, x1621, x1547, x1597); + let x1624: u32 = ((x1623 as u32) + (x1548 as u32)); + let mut x1625: u32 = 0; + let mut x1626: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1625, &mut x1626, x11, (arg2[11])); + let mut x1627: u32 = 0; + let mut x1628: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1627, &mut x1628, x11, (arg2[10])); + let mut x1629: u32 = 0; + let mut x1630: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1629, &mut x1630, x11, (arg2[9])); + let mut x1631: u32 = 0; + let mut x1632: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1631, &mut x1632, x11, (arg2[8])); + let mut x1633: u32 = 0; + let mut x1634: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1633, &mut x1634, x11, (arg2[7])); + let mut x1635: u32 = 0; + let mut x1636: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1635, &mut x1636, x11, (arg2[6])); + let mut x1637: u32 = 0; + let mut x1638: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1637, &mut x1638, x11, (arg2[5])); + let mut x1639: u32 = 0; + let mut x1640: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1639, &mut x1640, x11, (arg2[4])); + let mut x1641: u32 = 0; + let mut x1642: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1641, &mut x1642, x11, (arg2[3])); + let mut x1643: u32 = 0; + let mut x1644: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1643, &mut x1644, x11, (arg2[2])); + let mut x1645: u32 = 0; + let mut x1646: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1645, &mut x1646, x11, (arg2[1])); + let mut x1647: u32 = 0; + let mut x1648: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1647, &mut x1648, x11, (arg2[0])); + let mut x1649: u32 = 0; + let mut x1650: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1649, &mut x1650, 0x0, x1648, x1645); + let mut x1651: u32 = 0; + let mut x1652: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1651, &mut x1652, x1650, x1646, x1643); + let mut x1653: u32 = 0; + let mut x1654: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1653, &mut x1654, x1652, x1644, x1641); + let mut x1655: u32 = 0; + let mut x1656: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1655, &mut x1656, x1654, x1642, x1639); + let mut x1657: u32 = 0; + let mut x1658: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1657, &mut x1658, x1656, x1640, x1637); + let mut x1659: u32 = 0; + let mut x1660: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1659, &mut x1660, x1658, x1638, x1635); + let mut x1661: u32 = 0; + let mut x1662: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1661, &mut x1662, x1660, x1636, x1633); + let mut x1663: u32 = 0; + let mut x1664: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1663, &mut x1664, x1662, x1634, x1631); + let mut x1665: u32 = 0; + let mut x1666: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1665, &mut x1666, x1664, x1632, x1629); + let mut x1667: u32 = 0; + let mut x1668: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1667, &mut x1668, x1666, x1630, x1627); + let mut x1669: u32 = 0; + let mut x1670: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1669, &mut x1670, x1668, x1628, x1625); + let x1671: u32 = ((x1670 as u32) + x1626); + let mut x1672: u32 = 0; + let mut x1673: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1672, &mut x1673, 0x0, x1600, x1647); + let mut x1674: u32 = 0; + let mut x1675: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1674, &mut x1675, x1673, x1602, x1649); + let mut x1676: u32 = 0; + let mut x1677: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1676, &mut x1677, x1675, x1604, x1651); + let mut x1678: u32 = 0; + let mut x1679: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1678, &mut x1679, x1677, x1606, x1653); + let mut x1680: u32 = 0; + let mut x1681: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1680, &mut x1681, x1679, x1608, x1655); + let mut x1682: u32 = 0; + let mut x1683: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1682, &mut x1683, x1681, x1610, x1657); + let mut x1684: u32 = 0; + let mut x1685: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1684, &mut x1685, x1683, x1612, x1659); + let mut x1686: u32 = 0; + let mut x1687: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1686, &mut x1687, x1685, x1614, x1661); + let mut x1688: u32 = 0; + let mut x1689: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1688, &mut x1689, x1687, x1616, x1663); + let mut x1690: u32 = 0; + let mut x1691: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1690, &mut x1691, x1689, x1618, x1665); + let mut x1692: u32 = 0; + let mut x1693: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1692, &mut x1693, x1691, x1620, x1667); + let mut x1694: u32 = 0; + let mut x1695: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1694, &mut x1695, x1693, x1622, x1669); + let mut x1696: u32 = 0; + let mut x1697: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1696, &mut x1697, x1695, x1624, x1671); + let mut x1698: u32 = 0; + let mut x1699: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1698, &mut x1699, x1672, 0xe88fdc45); + let mut x1700: u32 = 0; + let mut x1701: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1700, &mut x1701, x1698, 0xffffffff); + let mut x1702: u32 = 0; + let mut x1703: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1702, &mut x1703, x1698, 0xffffffff); + let mut x1704: u32 = 0; + let mut x1705: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1704, &mut x1705, x1698, 0xffffffff); + let mut x1706: u32 = 0; + let mut x1707: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1706, &mut x1707, x1698, 0xffffffff); + let mut x1708: u32 = 0; + let mut x1709: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1708, &mut x1709, x1698, 0xffffffff); + let mut x1710: u32 = 0; + let mut x1711: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1710, &mut x1711, x1698, 0xffffffff); + let mut x1712: u32 = 0; + let mut x1713: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1712, &mut x1713, x1698, 0xc7634d81); + let mut x1714: u32 = 0; + let mut x1715: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1714, &mut x1715, x1698, 0xf4372ddf); + let mut x1716: u32 = 0; + let mut x1717: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1716, &mut x1717, x1698, 0x581a0db2); + let mut x1718: u32 = 0; + let mut x1719: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1718, &mut x1719, x1698, 0x48b0a77a); + let mut x1720: u32 = 0; + let mut x1721: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1720, &mut x1721, x1698, 0xecec196a); + let mut x1722: u32 = 0; + let mut x1723: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1722, &mut x1723, x1698, 0xccc52973); + let mut x1724: u32 = 0; + let mut x1725: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1724, &mut x1725, 0x0, x1723, x1720); + let mut x1726: u32 = 0; + let mut x1727: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1726, &mut x1727, x1725, x1721, x1718); + let mut x1728: u32 = 0; + let mut x1729: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1728, &mut x1729, x1727, x1719, x1716); + let mut x1730: u32 = 0; + let mut x1731: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1730, &mut x1731, x1729, x1717, x1714); + let mut x1732: u32 = 0; + let mut x1733: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1732, &mut x1733, x1731, x1715, x1712); + let mut x1734: u32 = 0; + let mut x1735: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1734, &mut x1735, x1733, x1713, x1710); + let mut x1736: u32 = 0; + let mut x1737: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1736, &mut x1737, x1735, x1711, x1708); + let mut x1738: u32 = 0; + let mut x1739: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1738, &mut x1739, x1737, x1709, x1706); + let mut x1740: u32 = 0; + let mut x1741: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1740, &mut x1741, x1739, x1707, x1704); + let mut x1742: u32 = 0; + let mut x1743: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1742, &mut x1743, x1741, x1705, x1702); + let mut x1744: u32 = 0; + let mut x1745: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1744, &mut x1745, x1743, x1703, x1700); + let x1746: u32 = ((x1745 as u32) + x1701); + let mut x1747: u32 = 0; + let mut x1748: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1747, &mut x1748, 0x0, x1672, x1722); + let mut x1749: u32 = 0; + let mut x1750: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1749, &mut x1750, x1748, x1674, x1724); + let mut x1751: u32 = 0; + let mut x1752: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1751, &mut x1752, x1750, x1676, x1726); + let mut x1753: u32 = 0; + let mut x1754: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1753, &mut x1754, x1752, x1678, x1728); + let mut x1755: u32 = 0; + let mut x1756: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1755, &mut x1756, x1754, x1680, x1730); + let mut x1757: u32 = 0; + let mut x1758: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1757, &mut x1758, x1756, x1682, x1732); + let mut x1759: u32 = 0; + let mut x1760: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1759, &mut x1760, x1758, x1684, x1734); + let mut x1761: u32 = 0; + let mut x1762: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1761, &mut x1762, x1760, x1686, x1736); + let mut x1763: u32 = 0; + let mut x1764: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1763, &mut x1764, x1762, x1688, x1738); + let mut x1765: u32 = 0; + let mut x1766: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1765, &mut x1766, x1764, x1690, x1740); + let mut x1767: u32 = 0; + let mut x1768: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1767, &mut x1768, x1766, x1692, x1742); + let mut x1769: u32 = 0; + let mut x1770: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1769, &mut x1770, x1768, x1694, x1744); + let mut x1771: u32 = 0; + let mut x1772: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1771, &mut x1772, x1770, x1696, x1746); + let x1773: u32 = ((x1772 as u32) + (x1697 as u32)); + let mut x1774: u32 = 0; + let mut x1775: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1774, &mut x1775, 0x0, x1749, 0xccc52973); + let mut x1776: u32 = 0; + let mut x1777: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1776, &mut x1777, x1775, x1751, 0xecec196a); + let mut x1778: u32 = 0; + let mut x1779: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1778, &mut x1779, x1777, x1753, 0x48b0a77a); + let mut x1780: u32 = 0; + let mut x1781: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1780, &mut x1781, x1779, x1755, 0x581a0db2); + let mut x1782: u32 = 0; + let mut x1783: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1782, &mut x1783, x1781, x1757, 0xf4372ddf); + let mut x1784: u32 = 0; + let mut x1785: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1784, &mut x1785, x1783, x1759, 0xc7634d81); + let mut x1786: u32 = 0; + let mut x1787: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1786, &mut x1787, x1785, x1761, 0xffffffff); + let mut x1788: u32 = 0; + let mut x1789: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1788, &mut x1789, x1787, x1763, 0xffffffff); + let mut x1790: u32 = 0; + let mut x1791: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1790, &mut x1791, x1789, x1765, 0xffffffff); + let mut x1792: u32 = 0; + let mut x1793: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1792, &mut x1793, x1791, x1767, 0xffffffff); + let mut x1794: u32 = 0; + let mut x1795: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1794, &mut x1795, x1793, x1769, 0xffffffff); + let mut x1796: u32 = 0; + let mut x1797: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1796, &mut x1797, x1795, x1771, 0xffffffff); + let mut x1798: u32 = 0; + let mut x1799: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1798, &mut x1799, x1797, x1773, (0x0 as u32)); + let mut x1800: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x1800, x1799, x1774, x1749); + let mut x1801: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x1801, x1799, x1776, x1751); + let mut x1802: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x1802, x1799, x1778, x1753); + let mut x1803: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x1803, x1799, x1780, x1755); + let mut x1804: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x1804, x1799, x1782, x1757); + let mut x1805: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x1805, x1799, x1784, x1759); + let mut x1806: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x1806, x1799, x1786, x1761); + let mut x1807: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x1807, x1799, x1788, x1763); + let mut x1808: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x1808, x1799, x1790, x1765); + let mut x1809: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x1809, x1799, x1792, x1767); + let mut x1810: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x1810, x1799, x1794, x1769); + let mut x1811: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x1811, x1799, x1796, x1771); + out1[0] = x1800; + out1[1] = x1801; + out1[2] = x1802; + out1[3] = x1803; + out1[4] = x1804; + out1[5] = x1805; + out1[6] = x1806; + out1[7] = x1807; + out1[8] = x1808; + out1[9] = x1809; + out1[10] = x1810; + out1[11] = x1811; +} + +/// The function fiat_p384_scalar_square squares a field element in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg1)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p384_scalar_square(out1: &mut fiat_p384_scalar_montgomery_domain_field_element, arg1: &fiat_p384_scalar_montgomery_domain_field_element) -> () { + let x1: u32 = (arg1[1]); + let x2: u32 = (arg1[2]); + let x3: u32 = (arg1[3]); + let x4: u32 = (arg1[4]); + let x5: u32 = (arg1[5]); + let x6: u32 = (arg1[6]); + let x7: u32 = (arg1[7]); + let x8: u32 = (arg1[8]); + let x9: u32 = (arg1[9]); + let x10: u32 = (arg1[10]); + let x11: u32 = (arg1[11]); + let x12: u32 = (arg1[0]); + let mut x13: u32 = 0; + let mut x14: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x13, &mut x14, x12, (arg1[11])); + let mut x15: u32 = 0; + let mut x16: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x15, &mut x16, x12, (arg1[10])); + let mut x17: u32 = 0; + let mut x18: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x17, &mut x18, x12, (arg1[9])); + let mut x19: u32 = 0; + let mut x20: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x19, &mut x20, x12, (arg1[8])); + let mut x21: u32 = 0; + let mut x22: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x21, &mut x22, x12, (arg1[7])); + let mut x23: u32 = 0; + let mut x24: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x23, &mut x24, x12, (arg1[6])); + let mut x25: u32 = 0; + let mut x26: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x25, &mut x26, x12, (arg1[5])); + let mut x27: u32 = 0; + let mut x28: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x27, &mut x28, x12, (arg1[4])); + let mut x29: u32 = 0; + let mut x30: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x29, &mut x30, x12, (arg1[3])); + let mut x31: u32 = 0; + let mut x32: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x31, &mut x32, x12, (arg1[2])); + let mut x33: u32 = 0; + let mut x34: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x33, &mut x34, x12, (arg1[1])); + let mut x35: u32 = 0; + let mut x36: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x35, &mut x36, x12, (arg1[0])); + let mut x37: u32 = 0; + let mut x38: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x37, &mut x38, 0x0, x36, x33); + let mut x39: u32 = 0; + let mut x40: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x39, &mut x40, x38, x34, x31); + let mut x41: u32 = 0; + let mut x42: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x41, &mut x42, x40, x32, x29); + let mut x43: u32 = 0; + let mut x44: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x43, &mut x44, x42, x30, x27); + let mut x45: u32 = 0; + let mut x46: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x45, &mut x46, x44, x28, x25); + let mut x47: u32 = 0; + let mut x48: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x47, &mut x48, x46, x26, x23); + let mut x49: u32 = 0; + let mut x50: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x49, &mut x50, x48, x24, x21); + let mut x51: u32 = 0; + let mut x52: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x51, &mut x52, x50, x22, x19); + let mut x53: u32 = 0; + let mut x54: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x53, &mut x54, x52, x20, x17); + let mut x55: u32 = 0; + let mut x56: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x55, &mut x56, x54, x18, x15); + let mut x57: u32 = 0; + let mut x58: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x57, &mut x58, x56, x16, x13); + let x59: u32 = ((x58 as u32) + x14); + let mut x60: u32 = 0; + let mut x61: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x60, &mut x61, x35, 0xe88fdc45); + let mut x62: u32 = 0; + let mut x63: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x62, &mut x63, x60, 0xffffffff); + let mut x64: u32 = 0; + let mut x65: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x64, &mut x65, x60, 0xffffffff); + let mut x66: u32 = 0; + let mut x67: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x66, &mut x67, x60, 0xffffffff); + let mut x68: u32 = 0; + let mut x69: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x68, &mut x69, x60, 0xffffffff); + let mut x70: u32 = 0; + let mut x71: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x70, &mut x71, x60, 0xffffffff); + let mut x72: u32 = 0; + let mut x73: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x72, &mut x73, x60, 0xffffffff); + let mut x74: u32 = 0; + let mut x75: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x74, &mut x75, x60, 0xc7634d81); + let mut x76: u32 = 0; + let mut x77: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x76, &mut x77, x60, 0xf4372ddf); + let mut x78: u32 = 0; + let mut x79: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x78, &mut x79, x60, 0x581a0db2); + let mut x80: u32 = 0; + let mut x81: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x80, &mut x81, x60, 0x48b0a77a); + let mut x82: u32 = 0; + let mut x83: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x82, &mut x83, x60, 0xecec196a); + let mut x84: u32 = 0; + let mut x85: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x84, &mut x85, x60, 0xccc52973); + let mut x86: u32 = 0; + let mut x87: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x86, &mut x87, 0x0, x85, x82); + let mut x88: u32 = 0; + let mut x89: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x88, &mut x89, x87, x83, x80); + let mut x90: u32 = 0; + let mut x91: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x90, &mut x91, x89, x81, x78); + let mut x92: u32 = 0; + let mut x93: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x92, &mut x93, x91, x79, x76); + let mut x94: u32 = 0; + let mut x95: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x94, &mut x95, x93, x77, x74); + let mut x96: u32 = 0; + let mut x97: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x96, &mut x97, x95, x75, x72); + let mut x98: u32 = 0; + let mut x99: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x98, &mut x99, x97, x73, x70); + let mut x100: u32 = 0; + let mut x101: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x100, &mut x101, x99, x71, x68); + let mut x102: u32 = 0; + let mut x103: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x102, &mut x103, x101, x69, x66); + let mut x104: u32 = 0; + let mut x105: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x104, &mut x105, x103, x67, x64); + let mut x106: u32 = 0; + let mut x107: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x106, &mut x107, x105, x65, x62); + let x108: u32 = ((x107 as u32) + x63); + let mut x109: u32 = 0; + let mut x110: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x109, &mut x110, 0x0, x35, x84); + let mut x111: u32 = 0; + let mut x112: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x111, &mut x112, x110, x37, x86); + let mut x113: u32 = 0; + let mut x114: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x113, &mut x114, x112, x39, x88); + let mut x115: u32 = 0; + let mut x116: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x115, &mut x116, x114, x41, x90); + let mut x117: u32 = 0; + let mut x118: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x117, &mut x118, x116, x43, x92); + let mut x119: u32 = 0; + let mut x120: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x119, &mut x120, x118, x45, x94); + let mut x121: u32 = 0; + let mut x122: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x121, &mut x122, x120, x47, x96); + let mut x123: u32 = 0; + let mut x124: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x123, &mut x124, x122, x49, x98); + let mut x125: u32 = 0; + let mut x126: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x125, &mut x126, x124, x51, x100); + let mut x127: u32 = 0; + let mut x128: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x127, &mut x128, x126, x53, x102); + let mut x129: u32 = 0; + let mut x130: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x129, &mut x130, x128, x55, x104); + let mut x131: u32 = 0; + let mut x132: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x131, &mut x132, x130, x57, x106); + let mut x133: u32 = 0; + let mut x134: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x133, &mut x134, x132, x59, x108); + let mut x135: u32 = 0; + let mut x136: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x135, &mut x136, x1, (arg1[11])); + let mut x137: u32 = 0; + let mut x138: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x137, &mut x138, x1, (arg1[10])); + let mut x139: u32 = 0; + let mut x140: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x139, &mut x140, x1, (arg1[9])); + let mut x141: u32 = 0; + let mut x142: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x141, &mut x142, x1, (arg1[8])); + let mut x143: u32 = 0; + let mut x144: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x143, &mut x144, x1, (arg1[7])); + let mut x145: u32 = 0; + let mut x146: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x145, &mut x146, x1, (arg1[6])); + let mut x147: u32 = 0; + let mut x148: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x147, &mut x148, x1, (arg1[5])); + let mut x149: u32 = 0; + let mut x150: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x149, &mut x150, x1, (arg1[4])); + let mut x151: u32 = 0; + let mut x152: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x151, &mut x152, x1, (arg1[3])); + let mut x153: u32 = 0; + let mut x154: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x153, &mut x154, x1, (arg1[2])); + let mut x155: u32 = 0; + let mut x156: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x155, &mut x156, x1, (arg1[1])); + let mut x157: u32 = 0; + let mut x158: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x157, &mut x158, x1, (arg1[0])); + let mut x159: u32 = 0; + let mut x160: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x159, &mut x160, 0x0, x158, x155); + let mut x161: u32 = 0; + let mut x162: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x161, &mut x162, x160, x156, x153); + let mut x163: u32 = 0; + let mut x164: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x163, &mut x164, x162, x154, x151); + let mut x165: u32 = 0; + let mut x166: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x165, &mut x166, x164, x152, x149); + let mut x167: u32 = 0; + let mut x168: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x167, &mut x168, x166, x150, x147); + let mut x169: u32 = 0; + let mut x170: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x169, &mut x170, x168, x148, x145); + let mut x171: u32 = 0; + let mut x172: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x171, &mut x172, x170, x146, x143); + let mut x173: u32 = 0; + let mut x174: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x173, &mut x174, x172, x144, x141); + let mut x175: u32 = 0; + let mut x176: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x175, &mut x176, x174, x142, x139); + let mut x177: u32 = 0; + let mut x178: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x177, &mut x178, x176, x140, x137); + let mut x179: u32 = 0; + let mut x180: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x179, &mut x180, x178, x138, x135); + let x181: u32 = ((x180 as u32) + x136); + let mut x182: u32 = 0; + let mut x183: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x182, &mut x183, 0x0, x111, x157); + let mut x184: u32 = 0; + let mut x185: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x184, &mut x185, x183, x113, x159); + let mut x186: u32 = 0; + let mut x187: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x186, &mut x187, x185, x115, x161); + let mut x188: u32 = 0; + let mut x189: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x188, &mut x189, x187, x117, x163); + let mut x190: u32 = 0; + let mut x191: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x190, &mut x191, x189, x119, x165); + let mut x192: u32 = 0; + let mut x193: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x192, &mut x193, x191, x121, x167); + let mut x194: u32 = 0; + let mut x195: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x194, &mut x195, x193, x123, x169); + let mut x196: u32 = 0; + let mut x197: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x196, &mut x197, x195, x125, x171); + let mut x198: u32 = 0; + let mut x199: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x198, &mut x199, x197, x127, x173); + let mut x200: u32 = 0; + let mut x201: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x200, &mut x201, x199, x129, x175); + let mut x202: u32 = 0; + let mut x203: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x202, &mut x203, x201, x131, x177); + let mut x204: u32 = 0; + let mut x205: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x204, &mut x205, x203, x133, x179); + let mut x206: u32 = 0; + let mut x207: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x206, &mut x207, x205, (x134 as u32), x181); + let mut x208: u32 = 0; + let mut x209: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x208, &mut x209, x182, 0xe88fdc45); + let mut x210: u32 = 0; + let mut x211: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x210, &mut x211, x208, 0xffffffff); + let mut x212: u32 = 0; + let mut x213: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x212, &mut x213, x208, 0xffffffff); + let mut x214: u32 = 0; + let mut x215: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x214, &mut x215, x208, 0xffffffff); + let mut x216: u32 = 0; + let mut x217: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x216, &mut x217, x208, 0xffffffff); + let mut x218: u32 = 0; + let mut x219: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x218, &mut x219, x208, 0xffffffff); + let mut x220: u32 = 0; + let mut x221: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x220, &mut x221, x208, 0xffffffff); + let mut x222: u32 = 0; + let mut x223: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x222, &mut x223, x208, 0xc7634d81); + let mut x224: u32 = 0; + let mut x225: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x224, &mut x225, x208, 0xf4372ddf); + let mut x226: u32 = 0; + let mut x227: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x226, &mut x227, x208, 0x581a0db2); + let mut x228: u32 = 0; + let mut x229: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x228, &mut x229, x208, 0x48b0a77a); + let mut x230: u32 = 0; + let mut x231: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x230, &mut x231, x208, 0xecec196a); + let mut x232: u32 = 0; + let mut x233: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x232, &mut x233, x208, 0xccc52973); + let mut x234: u32 = 0; + let mut x235: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x234, &mut x235, 0x0, x233, x230); + let mut x236: u32 = 0; + let mut x237: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x236, &mut x237, x235, x231, x228); + let mut x238: u32 = 0; + let mut x239: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x238, &mut x239, x237, x229, x226); + let mut x240: u32 = 0; + let mut x241: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x240, &mut x241, x239, x227, x224); + let mut x242: u32 = 0; + let mut x243: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x242, &mut x243, x241, x225, x222); + let mut x244: u32 = 0; + let mut x245: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x244, &mut x245, x243, x223, x220); + let mut x246: u32 = 0; + let mut x247: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x246, &mut x247, x245, x221, x218); + let mut x248: u32 = 0; + let mut x249: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x248, &mut x249, x247, x219, x216); + let mut x250: u32 = 0; + let mut x251: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x250, &mut x251, x249, x217, x214); + let mut x252: u32 = 0; + let mut x253: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x252, &mut x253, x251, x215, x212); + let mut x254: u32 = 0; + let mut x255: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x254, &mut x255, x253, x213, x210); + let x256: u32 = ((x255 as u32) + x211); + let mut x257: u32 = 0; + let mut x258: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x257, &mut x258, 0x0, x182, x232); + let mut x259: u32 = 0; + let mut x260: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x259, &mut x260, x258, x184, x234); + let mut x261: u32 = 0; + let mut x262: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x261, &mut x262, x260, x186, x236); + let mut x263: u32 = 0; + let mut x264: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x263, &mut x264, x262, x188, x238); + let mut x265: u32 = 0; + let mut x266: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x265, &mut x266, x264, x190, x240); + let mut x267: u32 = 0; + let mut x268: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x267, &mut x268, x266, x192, x242); + let mut x269: u32 = 0; + let mut x270: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x269, &mut x270, x268, x194, x244); + let mut x271: u32 = 0; + let mut x272: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x271, &mut x272, x270, x196, x246); + let mut x273: u32 = 0; + let mut x274: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x273, &mut x274, x272, x198, x248); + let mut x275: u32 = 0; + let mut x276: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x275, &mut x276, x274, x200, x250); + let mut x277: u32 = 0; + let mut x278: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x277, &mut x278, x276, x202, x252); + let mut x279: u32 = 0; + let mut x280: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x279, &mut x280, x278, x204, x254); + let mut x281: u32 = 0; + let mut x282: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x281, &mut x282, x280, x206, x256); + let x283: u32 = ((x282 as u32) + (x207 as u32)); + let mut x284: u32 = 0; + let mut x285: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x284, &mut x285, x2, (arg1[11])); + let mut x286: u32 = 0; + let mut x287: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x286, &mut x287, x2, (arg1[10])); + let mut x288: u32 = 0; + let mut x289: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x288, &mut x289, x2, (arg1[9])); + let mut x290: u32 = 0; + let mut x291: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x290, &mut x291, x2, (arg1[8])); + let mut x292: u32 = 0; + let mut x293: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x292, &mut x293, x2, (arg1[7])); + let mut x294: u32 = 0; + let mut x295: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x294, &mut x295, x2, (arg1[6])); + let mut x296: u32 = 0; + let mut x297: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x296, &mut x297, x2, (arg1[5])); + let mut x298: u32 = 0; + let mut x299: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x298, &mut x299, x2, (arg1[4])); + let mut x300: u32 = 0; + let mut x301: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x300, &mut x301, x2, (arg1[3])); + let mut x302: u32 = 0; + let mut x303: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x302, &mut x303, x2, (arg1[2])); + let mut x304: u32 = 0; + let mut x305: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x304, &mut x305, x2, (arg1[1])); + let mut x306: u32 = 0; + let mut x307: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x306, &mut x307, x2, (arg1[0])); + let mut x308: u32 = 0; + let mut x309: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x308, &mut x309, 0x0, x307, x304); + let mut x310: u32 = 0; + let mut x311: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x310, &mut x311, x309, x305, x302); + let mut x312: u32 = 0; + let mut x313: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x312, &mut x313, x311, x303, x300); + let mut x314: u32 = 0; + let mut x315: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x314, &mut x315, x313, x301, x298); + let mut x316: u32 = 0; + let mut x317: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x316, &mut x317, x315, x299, x296); + let mut x318: u32 = 0; + let mut x319: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x318, &mut x319, x317, x297, x294); + let mut x320: u32 = 0; + let mut x321: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x320, &mut x321, x319, x295, x292); + let mut x322: u32 = 0; + let mut x323: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x322, &mut x323, x321, x293, x290); + let mut x324: u32 = 0; + let mut x325: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x324, &mut x325, x323, x291, x288); + let mut x326: u32 = 0; + let mut x327: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x326, &mut x327, x325, x289, x286); + let mut x328: u32 = 0; + let mut x329: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x328, &mut x329, x327, x287, x284); + let x330: u32 = ((x329 as u32) + x285); + let mut x331: u32 = 0; + let mut x332: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x331, &mut x332, 0x0, x259, x306); + let mut x333: u32 = 0; + let mut x334: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x333, &mut x334, x332, x261, x308); + let mut x335: u32 = 0; + let mut x336: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x335, &mut x336, x334, x263, x310); + let mut x337: u32 = 0; + let mut x338: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x337, &mut x338, x336, x265, x312); + let mut x339: u32 = 0; + let mut x340: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x339, &mut x340, x338, x267, x314); + let mut x341: u32 = 0; + let mut x342: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x341, &mut x342, x340, x269, x316); + let mut x343: u32 = 0; + let mut x344: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x343, &mut x344, x342, x271, x318); + let mut x345: u32 = 0; + let mut x346: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x345, &mut x346, x344, x273, x320); + let mut x347: u32 = 0; + let mut x348: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x347, &mut x348, x346, x275, x322); + let mut x349: u32 = 0; + let mut x350: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x349, &mut x350, x348, x277, x324); + let mut x351: u32 = 0; + let mut x352: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x351, &mut x352, x350, x279, x326); + let mut x353: u32 = 0; + let mut x354: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x353, &mut x354, x352, x281, x328); + let mut x355: u32 = 0; + let mut x356: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x355, &mut x356, x354, x283, x330); + let mut x357: u32 = 0; + let mut x358: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x357, &mut x358, x331, 0xe88fdc45); + let mut x359: u32 = 0; + let mut x360: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x359, &mut x360, x357, 0xffffffff); + let mut x361: u32 = 0; + let mut x362: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x361, &mut x362, x357, 0xffffffff); + let mut x363: u32 = 0; + let mut x364: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x363, &mut x364, x357, 0xffffffff); + let mut x365: u32 = 0; + let mut x366: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x365, &mut x366, x357, 0xffffffff); + let mut x367: u32 = 0; + let mut x368: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x367, &mut x368, x357, 0xffffffff); + let mut x369: u32 = 0; + let mut x370: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x369, &mut x370, x357, 0xffffffff); + let mut x371: u32 = 0; + let mut x372: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x371, &mut x372, x357, 0xc7634d81); + let mut x373: u32 = 0; + let mut x374: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x373, &mut x374, x357, 0xf4372ddf); + let mut x375: u32 = 0; + let mut x376: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x375, &mut x376, x357, 0x581a0db2); + let mut x377: u32 = 0; + let mut x378: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x377, &mut x378, x357, 0x48b0a77a); + let mut x379: u32 = 0; + let mut x380: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x379, &mut x380, x357, 0xecec196a); + let mut x381: u32 = 0; + let mut x382: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x381, &mut x382, x357, 0xccc52973); + let mut x383: u32 = 0; + let mut x384: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x383, &mut x384, 0x0, x382, x379); + let mut x385: u32 = 0; + let mut x386: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x385, &mut x386, x384, x380, x377); + let mut x387: u32 = 0; + let mut x388: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x387, &mut x388, x386, x378, x375); + let mut x389: u32 = 0; + let mut x390: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x389, &mut x390, x388, x376, x373); + let mut x391: u32 = 0; + let mut x392: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x391, &mut x392, x390, x374, x371); + let mut x393: u32 = 0; + let mut x394: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x393, &mut x394, x392, x372, x369); + let mut x395: u32 = 0; + let mut x396: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x395, &mut x396, x394, x370, x367); + let mut x397: u32 = 0; + let mut x398: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x397, &mut x398, x396, x368, x365); + let mut x399: u32 = 0; + let mut x400: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x399, &mut x400, x398, x366, x363); + let mut x401: u32 = 0; + let mut x402: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x401, &mut x402, x400, x364, x361); + let mut x403: u32 = 0; + let mut x404: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x403, &mut x404, x402, x362, x359); + let x405: u32 = ((x404 as u32) + x360); + let mut x406: u32 = 0; + let mut x407: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x406, &mut x407, 0x0, x331, x381); + let mut x408: u32 = 0; + let mut x409: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x408, &mut x409, x407, x333, x383); + let mut x410: u32 = 0; + let mut x411: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x410, &mut x411, x409, x335, x385); + let mut x412: u32 = 0; + let mut x413: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x412, &mut x413, x411, x337, x387); + let mut x414: u32 = 0; + let mut x415: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x414, &mut x415, x413, x339, x389); + let mut x416: u32 = 0; + let mut x417: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x416, &mut x417, x415, x341, x391); + let mut x418: u32 = 0; + let mut x419: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x418, &mut x419, x417, x343, x393); + let mut x420: u32 = 0; + let mut x421: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x420, &mut x421, x419, x345, x395); + let mut x422: u32 = 0; + let mut x423: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x422, &mut x423, x421, x347, x397); + let mut x424: u32 = 0; + let mut x425: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x424, &mut x425, x423, x349, x399); + let mut x426: u32 = 0; + let mut x427: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x426, &mut x427, x425, x351, x401); + let mut x428: u32 = 0; + let mut x429: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x428, &mut x429, x427, x353, x403); + let mut x430: u32 = 0; + let mut x431: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x430, &mut x431, x429, x355, x405); + let x432: u32 = ((x431 as u32) + (x356 as u32)); + let mut x433: u32 = 0; + let mut x434: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x433, &mut x434, x3, (arg1[11])); + let mut x435: u32 = 0; + let mut x436: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x435, &mut x436, x3, (arg1[10])); + let mut x437: u32 = 0; + let mut x438: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x437, &mut x438, x3, (arg1[9])); + let mut x439: u32 = 0; + let mut x440: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x439, &mut x440, x3, (arg1[8])); + let mut x441: u32 = 0; + let mut x442: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x441, &mut x442, x3, (arg1[7])); + let mut x443: u32 = 0; + let mut x444: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x443, &mut x444, x3, (arg1[6])); + let mut x445: u32 = 0; + let mut x446: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x445, &mut x446, x3, (arg1[5])); + let mut x447: u32 = 0; + let mut x448: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x447, &mut x448, x3, (arg1[4])); + let mut x449: u32 = 0; + let mut x450: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x449, &mut x450, x3, (arg1[3])); + let mut x451: u32 = 0; + let mut x452: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x451, &mut x452, x3, (arg1[2])); + let mut x453: u32 = 0; + let mut x454: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x453, &mut x454, x3, (arg1[1])); + let mut x455: u32 = 0; + let mut x456: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x455, &mut x456, x3, (arg1[0])); + let mut x457: u32 = 0; + let mut x458: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x457, &mut x458, 0x0, x456, x453); + let mut x459: u32 = 0; + let mut x460: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x459, &mut x460, x458, x454, x451); + let mut x461: u32 = 0; + let mut x462: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x461, &mut x462, x460, x452, x449); + let mut x463: u32 = 0; + let mut x464: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x463, &mut x464, x462, x450, x447); + let mut x465: u32 = 0; + let mut x466: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x465, &mut x466, x464, x448, x445); + let mut x467: u32 = 0; + let mut x468: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x467, &mut x468, x466, x446, x443); + let mut x469: u32 = 0; + let mut x470: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x469, &mut x470, x468, x444, x441); + let mut x471: u32 = 0; + let mut x472: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x471, &mut x472, x470, x442, x439); + let mut x473: u32 = 0; + let mut x474: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x473, &mut x474, x472, x440, x437); + let mut x475: u32 = 0; + let mut x476: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x475, &mut x476, x474, x438, x435); + let mut x477: u32 = 0; + let mut x478: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x477, &mut x478, x476, x436, x433); + let x479: u32 = ((x478 as u32) + x434); + let mut x480: u32 = 0; + let mut x481: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x480, &mut x481, 0x0, x408, x455); + let mut x482: u32 = 0; + let mut x483: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x482, &mut x483, x481, x410, x457); + let mut x484: u32 = 0; + let mut x485: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x484, &mut x485, x483, x412, x459); + let mut x486: u32 = 0; + let mut x487: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x486, &mut x487, x485, x414, x461); + let mut x488: u32 = 0; + let mut x489: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x488, &mut x489, x487, x416, x463); + let mut x490: u32 = 0; + let mut x491: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x490, &mut x491, x489, x418, x465); + let mut x492: u32 = 0; + let mut x493: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x492, &mut x493, x491, x420, x467); + let mut x494: u32 = 0; + let mut x495: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x494, &mut x495, x493, x422, x469); + let mut x496: u32 = 0; + let mut x497: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x496, &mut x497, x495, x424, x471); + let mut x498: u32 = 0; + let mut x499: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x498, &mut x499, x497, x426, x473); + let mut x500: u32 = 0; + let mut x501: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x500, &mut x501, x499, x428, x475); + let mut x502: u32 = 0; + let mut x503: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x502, &mut x503, x501, x430, x477); + let mut x504: u32 = 0; + let mut x505: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x504, &mut x505, x503, x432, x479); + let mut x506: u32 = 0; + let mut x507: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x506, &mut x507, x480, 0xe88fdc45); + let mut x508: u32 = 0; + let mut x509: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x508, &mut x509, x506, 0xffffffff); + let mut x510: u32 = 0; + let mut x511: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x510, &mut x511, x506, 0xffffffff); + let mut x512: u32 = 0; + let mut x513: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x512, &mut x513, x506, 0xffffffff); + let mut x514: u32 = 0; + let mut x515: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x514, &mut x515, x506, 0xffffffff); + let mut x516: u32 = 0; + let mut x517: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x516, &mut x517, x506, 0xffffffff); + let mut x518: u32 = 0; + let mut x519: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x518, &mut x519, x506, 0xffffffff); + let mut x520: u32 = 0; + let mut x521: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x520, &mut x521, x506, 0xc7634d81); + let mut x522: u32 = 0; + let mut x523: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x522, &mut x523, x506, 0xf4372ddf); + let mut x524: u32 = 0; + let mut x525: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x524, &mut x525, x506, 0x581a0db2); + let mut x526: u32 = 0; + let mut x527: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x526, &mut x527, x506, 0x48b0a77a); + let mut x528: u32 = 0; + let mut x529: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x528, &mut x529, x506, 0xecec196a); + let mut x530: u32 = 0; + let mut x531: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x530, &mut x531, x506, 0xccc52973); + let mut x532: u32 = 0; + let mut x533: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x532, &mut x533, 0x0, x531, x528); + let mut x534: u32 = 0; + let mut x535: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x534, &mut x535, x533, x529, x526); + let mut x536: u32 = 0; + let mut x537: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x536, &mut x537, x535, x527, x524); + let mut x538: u32 = 0; + let mut x539: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x538, &mut x539, x537, x525, x522); + let mut x540: u32 = 0; + let mut x541: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x540, &mut x541, x539, x523, x520); + let mut x542: u32 = 0; + let mut x543: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x542, &mut x543, x541, x521, x518); + let mut x544: u32 = 0; + let mut x545: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x544, &mut x545, x543, x519, x516); + let mut x546: u32 = 0; + let mut x547: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x546, &mut x547, x545, x517, x514); + let mut x548: u32 = 0; + let mut x549: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x548, &mut x549, x547, x515, x512); + let mut x550: u32 = 0; + let mut x551: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x550, &mut x551, x549, x513, x510); + let mut x552: u32 = 0; + let mut x553: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x552, &mut x553, x551, x511, x508); + let x554: u32 = ((x553 as u32) + x509); + let mut x555: u32 = 0; + let mut x556: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x555, &mut x556, 0x0, x480, x530); + let mut x557: u32 = 0; + let mut x558: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x557, &mut x558, x556, x482, x532); + let mut x559: u32 = 0; + let mut x560: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x559, &mut x560, x558, x484, x534); + let mut x561: u32 = 0; + let mut x562: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x561, &mut x562, x560, x486, x536); + let mut x563: u32 = 0; + let mut x564: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x563, &mut x564, x562, x488, x538); + let mut x565: u32 = 0; + let mut x566: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x565, &mut x566, x564, x490, x540); + let mut x567: u32 = 0; + let mut x568: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x567, &mut x568, x566, x492, x542); + let mut x569: u32 = 0; + let mut x570: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x569, &mut x570, x568, x494, x544); + let mut x571: u32 = 0; + let mut x572: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x571, &mut x572, x570, x496, x546); + let mut x573: u32 = 0; + let mut x574: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x573, &mut x574, x572, x498, x548); + let mut x575: u32 = 0; + let mut x576: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x575, &mut x576, x574, x500, x550); + let mut x577: u32 = 0; + let mut x578: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x577, &mut x578, x576, x502, x552); + let mut x579: u32 = 0; + let mut x580: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x579, &mut x580, x578, x504, x554); + let x581: u32 = ((x580 as u32) + (x505 as u32)); + let mut x582: u32 = 0; + let mut x583: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x582, &mut x583, x4, (arg1[11])); + let mut x584: u32 = 0; + let mut x585: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x584, &mut x585, x4, (arg1[10])); + let mut x586: u32 = 0; + let mut x587: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x586, &mut x587, x4, (arg1[9])); + let mut x588: u32 = 0; + let mut x589: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x588, &mut x589, x4, (arg1[8])); + let mut x590: u32 = 0; + let mut x591: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x590, &mut x591, x4, (arg1[7])); + let mut x592: u32 = 0; + let mut x593: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x592, &mut x593, x4, (arg1[6])); + let mut x594: u32 = 0; + let mut x595: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x594, &mut x595, x4, (arg1[5])); + let mut x596: u32 = 0; + let mut x597: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x596, &mut x597, x4, (arg1[4])); + let mut x598: u32 = 0; + let mut x599: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x598, &mut x599, x4, (arg1[3])); + let mut x600: u32 = 0; + let mut x601: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x600, &mut x601, x4, (arg1[2])); + let mut x602: u32 = 0; + let mut x603: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x602, &mut x603, x4, (arg1[1])); + let mut x604: u32 = 0; + let mut x605: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x604, &mut x605, x4, (arg1[0])); + let mut x606: u32 = 0; + let mut x607: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x606, &mut x607, 0x0, x605, x602); + let mut x608: u32 = 0; + let mut x609: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x608, &mut x609, x607, x603, x600); + let mut x610: u32 = 0; + let mut x611: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x610, &mut x611, x609, x601, x598); + let mut x612: u32 = 0; + let mut x613: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x612, &mut x613, x611, x599, x596); + let mut x614: u32 = 0; + let mut x615: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x614, &mut x615, x613, x597, x594); + let mut x616: u32 = 0; + let mut x617: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x616, &mut x617, x615, x595, x592); + let mut x618: u32 = 0; + let mut x619: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x618, &mut x619, x617, x593, x590); + let mut x620: u32 = 0; + let mut x621: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x620, &mut x621, x619, x591, x588); + let mut x622: u32 = 0; + let mut x623: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x622, &mut x623, x621, x589, x586); + let mut x624: u32 = 0; + let mut x625: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x624, &mut x625, x623, x587, x584); + let mut x626: u32 = 0; + let mut x627: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x626, &mut x627, x625, x585, x582); + let x628: u32 = ((x627 as u32) + x583); + let mut x629: u32 = 0; + let mut x630: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x629, &mut x630, 0x0, x557, x604); + let mut x631: u32 = 0; + let mut x632: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x631, &mut x632, x630, x559, x606); + let mut x633: u32 = 0; + let mut x634: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x633, &mut x634, x632, x561, x608); + let mut x635: u32 = 0; + let mut x636: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x635, &mut x636, x634, x563, x610); + let mut x637: u32 = 0; + let mut x638: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x637, &mut x638, x636, x565, x612); + let mut x639: u32 = 0; + let mut x640: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x639, &mut x640, x638, x567, x614); + let mut x641: u32 = 0; + let mut x642: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x641, &mut x642, x640, x569, x616); + let mut x643: u32 = 0; + let mut x644: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x643, &mut x644, x642, x571, x618); + let mut x645: u32 = 0; + let mut x646: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x645, &mut x646, x644, x573, x620); + let mut x647: u32 = 0; + let mut x648: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x647, &mut x648, x646, x575, x622); + let mut x649: u32 = 0; + let mut x650: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x649, &mut x650, x648, x577, x624); + let mut x651: u32 = 0; + let mut x652: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x651, &mut x652, x650, x579, x626); + let mut x653: u32 = 0; + let mut x654: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x653, &mut x654, x652, x581, x628); + let mut x655: u32 = 0; + let mut x656: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x655, &mut x656, x629, 0xe88fdc45); + let mut x657: u32 = 0; + let mut x658: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x657, &mut x658, x655, 0xffffffff); + let mut x659: u32 = 0; + let mut x660: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x659, &mut x660, x655, 0xffffffff); + let mut x661: u32 = 0; + let mut x662: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x661, &mut x662, x655, 0xffffffff); + let mut x663: u32 = 0; + let mut x664: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x663, &mut x664, x655, 0xffffffff); + let mut x665: u32 = 0; + let mut x666: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x665, &mut x666, x655, 0xffffffff); + let mut x667: u32 = 0; + let mut x668: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x667, &mut x668, x655, 0xffffffff); + let mut x669: u32 = 0; + let mut x670: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x669, &mut x670, x655, 0xc7634d81); + let mut x671: u32 = 0; + let mut x672: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x671, &mut x672, x655, 0xf4372ddf); + let mut x673: u32 = 0; + let mut x674: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x673, &mut x674, x655, 0x581a0db2); + let mut x675: u32 = 0; + let mut x676: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x675, &mut x676, x655, 0x48b0a77a); + let mut x677: u32 = 0; + let mut x678: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x677, &mut x678, x655, 0xecec196a); + let mut x679: u32 = 0; + let mut x680: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x679, &mut x680, x655, 0xccc52973); + let mut x681: u32 = 0; + let mut x682: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x681, &mut x682, 0x0, x680, x677); + let mut x683: u32 = 0; + let mut x684: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x683, &mut x684, x682, x678, x675); + let mut x685: u32 = 0; + let mut x686: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x685, &mut x686, x684, x676, x673); + let mut x687: u32 = 0; + let mut x688: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x687, &mut x688, x686, x674, x671); + let mut x689: u32 = 0; + let mut x690: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x689, &mut x690, x688, x672, x669); + let mut x691: u32 = 0; + let mut x692: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x691, &mut x692, x690, x670, x667); + let mut x693: u32 = 0; + let mut x694: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x693, &mut x694, x692, x668, x665); + let mut x695: u32 = 0; + let mut x696: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x695, &mut x696, x694, x666, x663); + let mut x697: u32 = 0; + let mut x698: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x697, &mut x698, x696, x664, x661); + let mut x699: u32 = 0; + let mut x700: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x699, &mut x700, x698, x662, x659); + let mut x701: u32 = 0; + let mut x702: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x701, &mut x702, x700, x660, x657); + let x703: u32 = ((x702 as u32) + x658); + let mut x704: u32 = 0; + let mut x705: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x704, &mut x705, 0x0, x629, x679); + let mut x706: u32 = 0; + let mut x707: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x706, &mut x707, x705, x631, x681); + let mut x708: u32 = 0; + let mut x709: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x708, &mut x709, x707, x633, x683); + let mut x710: u32 = 0; + let mut x711: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x710, &mut x711, x709, x635, x685); + let mut x712: u32 = 0; + let mut x713: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x712, &mut x713, x711, x637, x687); + let mut x714: u32 = 0; + let mut x715: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x714, &mut x715, x713, x639, x689); + let mut x716: u32 = 0; + let mut x717: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x716, &mut x717, x715, x641, x691); + let mut x718: u32 = 0; + let mut x719: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x718, &mut x719, x717, x643, x693); + let mut x720: u32 = 0; + let mut x721: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x720, &mut x721, x719, x645, x695); + let mut x722: u32 = 0; + let mut x723: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x722, &mut x723, x721, x647, x697); + let mut x724: u32 = 0; + let mut x725: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x724, &mut x725, x723, x649, x699); + let mut x726: u32 = 0; + let mut x727: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x726, &mut x727, x725, x651, x701); + let mut x728: u32 = 0; + let mut x729: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x728, &mut x729, x727, x653, x703); + let x730: u32 = ((x729 as u32) + (x654 as u32)); + let mut x731: u32 = 0; + let mut x732: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x731, &mut x732, x5, (arg1[11])); + let mut x733: u32 = 0; + let mut x734: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x733, &mut x734, x5, (arg1[10])); + let mut x735: u32 = 0; + let mut x736: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x735, &mut x736, x5, (arg1[9])); + let mut x737: u32 = 0; + let mut x738: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x737, &mut x738, x5, (arg1[8])); + let mut x739: u32 = 0; + let mut x740: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x739, &mut x740, x5, (arg1[7])); + let mut x741: u32 = 0; + let mut x742: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x741, &mut x742, x5, (arg1[6])); + let mut x743: u32 = 0; + let mut x744: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x743, &mut x744, x5, (arg1[5])); + let mut x745: u32 = 0; + let mut x746: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x745, &mut x746, x5, (arg1[4])); + let mut x747: u32 = 0; + let mut x748: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x747, &mut x748, x5, (arg1[3])); + let mut x749: u32 = 0; + let mut x750: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x749, &mut x750, x5, (arg1[2])); + let mut x751: u32 = 0; + let mut x752: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x751, &mut x752, x5, (arg1[1])); + let mut x753: u32 = 0; + let mut x754: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x753, &mut x754, x5, (arg1[0])); + let mut x755: u32 = 0; + let mut x756: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x755, &mut x756, 0x0, x754, x751); + let mut x757: u32 = 0; + let mut x758: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x757, &mut x758, x756, x752, x749); + let mut x759: u32 = 0; + let mut x760: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x759, &mut x760, x758, x750, x747); + let mut x761: u32 = 0; + let mut x762: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x761, &mut x762, x760, x748, x745); + let mut x763: u32 = 0; + let mut x764: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x763, &mut x764, x762, x746, x743); + let mut x765: u32 = 0; + let mut x766: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x765, &mut x766, x764, x744, x741); + let mut x767: u32 = 0; + let mut x768: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x767, &mut x768, x766, x742, x739); + let mut x769: u32 = 0; + let mut x770: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x769, &mut x770, x768, x740, x737); + let mut x771: u32 = 0; + let mut x772: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x771, &mut x772, x770, x738, x735); + let mut x773: u32 = 0; + let mut x774: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x773, &mut x774, x772, x736, x733); + let mut x775: u32 = 0; + let mut x776: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x775, &mut x776, x774, x734, x731); + let x777: u32 = ((x776 as u32) + x732); + let mut x778: u32 = 0; + let mut x779: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x778, &mut x779, 0x0, x706, x753); + let mut x780: u32 = 0; + let mut x781: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x780, &mut x781, x779, x708, x755); + let mut x782: u32 = 0; + let mut x783: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x782, &mut x783, x781, x710, x757); + let mut x784: u32 = 0; + let mut x785: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x784, &mut x785, x783, x712, x759); + let mut x786: u32 = 0; + let mut x787: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x786, &mut x787, x785, x714, x761); + let mut x788: u32 = 0; + let mut x789: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x788, &mut x789, x787, x716, x763); + let mut x790: u32 = 0; + let mut x791: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x790, &mut x791, x789, x718, x765); + let mut x792: u32 = 0; + let mut x793: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x792, &mut x793, x791, x720, x767); + let mut x794: u32 = 0; + let mut x795: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x794, &mut x795, x793, x722, x769); + let mut x796: u32 = 0; + let mut x797: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x796, &mut x797, x795, x724, x771); + let mut x798: u32 = 0; + let mut x799: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x798, &mut x799, x797, x726, x773); + let mut x800: u32 = 0; + let mut x801: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x800, &mut x801, x799, x728, x775); + let mut x802: u32 = 0; + let mut x803: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x802, &mut x803, x801, x730, x777); + let mut x804: u32 = 0; + let mut x805: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x804, &mut x805, x778, 0xe88fdc45); + let mut x806: u32 = 0; + let mut x807: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x806, &mut x807, x804, 0xffffffff); + let mut x808: u32 = 0; + let mut x809: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x808, &mut x809, x804, 0xffffffff); + let mut x810: u32 = 0; + let mut x811: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x810, &mut x811, x804, 0xffffffff); + let mut x812: u32 = 0; + let mut x813: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x812, &mut x813, x804, 0xffffffff); + let mut x814: u32 = 0; + let mut x815: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x814, &mut x815, x804, 0xffffffff); + let mut x816: u32 = 0; + let mut x817: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x816, &mut x817, x804, 0xffffffff); + let mut x818: u32 = 0; + let mut x819: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x818, &mut x819, x804, 0xc7634d81); + let mut x820: u32 = 0; + let mut x821: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x820, &mut x821, x804, 0xf4372ddf); + let mut x822: u32 = 0; + let mut x823: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x822, &mut x823, x804, 0x581a0db2); + let mut x824: u32 = 0; + let mut x825: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x824, &mut x825, x804, 0x48b0a77a); + let mut x826: u32 = 0; + let mut x827: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x826, &mut x827, x804, 0xecec196a); + let mut x828: u32 = 0; + let mut x829: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x828, &mut x829, x804, 0xccc52973); + let mut x830: u32 = 0; + let mut x831: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x830, &mut x831, 0x0, x829, x826); + let mut x832: u32 = 0; + let mut x833: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x832, &mut x833, x831, x827, x824); + let mut x834: u32 = 0; + let mut x835: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x834, &mut x835, x833, x825, x822); + let mut x836: u32 = 0; + let mut x837: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x836, &mut x837, x835, x823, x820); + let mut x838: u32 = 0; + let mut x839: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x838, &mut x839, x837, x821, x818); + let mut x840: u32 = 0; + let mut x841: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x840, &mut x841, x839, x819, x816); + let mut x842: u32 = 0; + let mut x843: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x842, &mut x843, x841, x817, x814); + let mut x844: u32 = 0; + let mut x845: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x844, &mut x845, x843, x815, x812); + let mut x846: u32 = 0; + let mut x847: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x846, &mut x847, x845, x813, x810); + let mut x848: u32 = 0; + let mut x849: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x848, &mut x849, x847, x811, x808); + let mut x850: u32 = 0; + let mut x851: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x850, &mut x851, x849, x809, x806); + let x852: u32 = ((x851 as u32) + x807); + let mut x853: u32 = 0; + let mut x854: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x853, &mut x854, 0x0, x778, x828); + let mut x855: u32 = 0; + let mut x856: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x855, &mut x856, x854, x780, x830); + let mut x857: u32 = 0; + let mut x858: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x857, &mut x858, x856, x782, x832); + let mut x859: u32 = 0; + let mut x860: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x859, &mut x860, x858, x784, x834); + let mut x861: u32 = 0; + let mut x862: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x861, &mut x862, x860, x786, x836); + let mut x863: u32 = 0; + let mut x864: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x863, &mut x864, x862, x788, x838); + let mut x865: u32 = 0; + let mut x866: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x865, &mut x866, x864, x790, x840); + let mut x867: u32 = 0; + let mut x868: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x867, &mut x868, x866, x792, x842); + let mut x869: u32 = 0; + let mut x870: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x869, &mut x870, x868, x794, x844); + let mut x871: u32 = 0; + let mut x872: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x871, &mut x872, x870, x796, x846); + let mut x873: u32 = 0; + let mut x874: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x873, &mut x874, x872, x798, x848); + let mut x875: u32 = 0; + let mut x876: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x875, &mut x876, x874, x800, x850); + let mut x877: u32 = 0; + let mut x878: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x877, &mut x878, x876, x802, x852); + let x879: u32 = ((x878 as u32) + (x803 as u32)); + let mut x880: u32 = 0; + let mut x881: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x880, &mut x881, x6, (arg1[11])); + let mut x882: u32 = 0; + let mut x883: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x882, &mut x883, x6, (arg1[10])); + let mut x884: u32 = 0; + let mut x885: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x884, &mut x885, x6, (arg1[9])); + let mut x886: u32 = 0; + let mut x887: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x886, &mut x887, x6, (arg1[8])); + let mut x888: u32 = 0; + let mut x889: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x888, &mut x889, x6, (arg1[7])); + let mut x890: u32 = 0; + let mut x891: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x890, &mut x891, x6, (arg1[6])); + let mut x892: u32 = 0; + let mut x893: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x892, &mut x893, x6, (arg1[5])); + let mut x894: u32 = 0; + let mut x895: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x894, &mut x895, x6, (arg1[4])); + let mut x896: u32 = 0; + let mut x897: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x896, &mut x897, x6, (arg1[3])); + let mut x898: u32 = 0; + let mut x899: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x898, &mut x899, x6, (arg1[2])); + let mut x900: u32 = 0; + let mut x901: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x900, &mut x901, x6, (arg1[1])); + let mut x902: u32 = 0; + let mut x903: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x902, &mut x903, x6, (arg1[0])); + let mut x904: u32 = 0; + let mut x905: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x904, &mut x905, 0x0, x903, x900); + let mut x906: u32 = 0; + let mut x907: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x906, &mut x907, x905, x901, x898); + let mut x908: u32 = 0; + let mut x909: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x908, &mut x909, x907, x899, x896); + let mut x910: u32 = 0; + let mut x911: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x910, &mut x911, x909, x897, x894); + let mut x912: u32 = 0; + let mut x913: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x912, &mut x913, x911, x895, x892); + let mut x914: u32 = 0; + let mut x915: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x914, &mut x915, x913, x893, x890); + let mut x916: u32 = 0; + let mut x917: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x916, &mut x917, x915, x891, x888); + let mut x918: u32 = 0; + let mut x919: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x918, &mut x919, x917, x889, x886); + let mut x920: u32 = 0; + let mut x921: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x920, &mut x921, x919, x887, x884); + let mut x922: u32 = 0; + let mut x923: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x922, &mut x923, x921, x885, x882); + let mut x924: u32 = 0; + let mut x925: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x924, &mut x925, x923, x883, x880); + let x926: u32 = ((x925 as u32) + x881); + let mut x927: u32 = 0; + let mut x928: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x927, &mut x928, 0x0, x855, x902); + let mut x929: u32 = 0; + let mut x930: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x929, &mut x930, x928, x857, x904); + let mut x931: u32 = 0; + let mut x932: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x931, &mut x932, x930, x859, x906); + let mut x933: u32 = 0; + let mut x934: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x933, &mut x934, x932, x861, x908); + let mut x935: u32 = 0; + let mut x936: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x935, &mut x936, x934, x863, x910); + let mut x937: u32 = 0; + let mut x938: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x937, &mut x938, x936, x865, x912); + let mut x939: u32 = 0; + let mut x940: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x939, &mut x940, x938, x867, x914); + let mut x941: u32 = 0; + let mut x942: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x941, &mut x942, x940, x869, x916); + let mut x943: u32 = 0; + let mut x944: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x943, &mut x944, x942, x871, x918); + let mut x945: u32 = 0; + let mut x946: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x945, &mut x946, x944, x873, x920); + let mut x947: u32 = 0; + let mut x948: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x947, &mut x948, x946, x875, x922); + let mut x949: u32 = 0; + let mut x950: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x949, &mut x950, x948, x877, x924); + let mut x951: u32 = 0; + let mut x952: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x951, &mut x952, x950, x879, x926); + let mut x953: u32 = 0; + let mut x954: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x953, &mut x954, x927, 0xe88fdc45); + let mut x955: u32 = 0; + let mut x956: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x955, &mut x956, x953, 0xffffffff); + let mut x957: u32 = 0; + let mut x958: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x957, &mut x958, x953, 0xffffffff); + let mut x959: u32 = 0; + let mut x960: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x959, &mut x960, x953, 0xffffffff); + let mut x961: u32 = 0; + let mut x962: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x961, &mut x962, x953, 0xffffffff); + let mut x963: u32 = 0; + let mut x964: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x963, &mut x964, x953, 0xffffffff); + let mut x965: u32 = 0; + let mut x966: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x965, &mut x966, x953, 0xffffffff); + let mut x967: u32 = 0; + let mut x968: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x967, &mut x968, x953, 0xc7634d81); + let mut x969: u32 = 0; + let mut x970: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x969, &mut x970, x953, 0xf4372ddf); + let mut x971: u32 = 0; + let mut x972: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x971, &mut x972, x953, 0x581a0db2); + let mut x973: u32 = 0; + let mut x974: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x973, &mut x974, x953, 0x48b0a77a); + let mut x975: u32 = 0; + let mut x976: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x975, &mut x976, x953, 0xecec196a); + let mut x977: u32 = 0; + let mut x978: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x977, &mut x978, x953, 0xccc52973); + let mut x979: u32 = 0; + let mut x980: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x979, &mut x980, 0x0, x978, x975); + let mut x981: u32 = 0; + let mut x982: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x981, &mut x982, x980, x976, x973); + let mut x983: u32 = 0; + let mut x984: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x983, &mut x984, x982, x974, x971); + let mut x985: u32 = 0; + let mut x986: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x985, &mut x986, x984, x972, x969); + let mut x987: u32 = 0; + let mut x988: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x987, &mut x988, x986, x970, x967); + let mut x989: u32 = 0; + let mut x990: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x989, &mut x990, x988, x968, x965); + let mut x991: u32 = 0; + let mut x992: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x991, &mut x992, x990, x966, x963); + let mut x993: u32 = 0; + let mut x994: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x993, &mut x994, x992, x964, x961); + let mut x995: u32 = 0; + let mut x996: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x995, &mut x996, x994, x962, x959); + let mut x997: u32 = 0; + let mut x998: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x997, &mut x998, x996, x960, x957); + let mut x999: u32 = 0; + let mut x1000: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x999, &mut x1000, x998, x958, x955); + let x1001: u32 = ((x1000 as u32) + x956); + let mut x1002: u32 = 0; + let mut x1003: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1002, &mut x1003, 0x0, x927, x977); + let mut x1004: u32 = 0; + let mut x1005: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1004, &mut x1005, x1003, x929, x979); + let mut x1006: u32 = 0; + let mut x1007: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1006, &mut x1007, x1005, x931, x981); + let mut x1008: u32 = 0; + let mut x1009: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1008, &mut x1009, x1007, x933, x983); + let mut x1010: u32 = 0; + let mut x1011: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1010, &mut x1011, x1009, x935, x985); + let mut x1012: u32 = 0; + let mut x1013: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1012, &mut x1013, x1011, x937, x987); + let mut x1014: u32 = 0; + let mut x1015: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1014, &mut x1015, x1013, x939, x989); + let mut x1016: u32 = 0; + let mut x1017: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1016, &mut x1017, x1015, x941, x991); + let mut x1018: u32 = 0; + let mut x1019: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1018, &mut x1019, x1017, x943, x993); + let mut x1020: u32 = 0; + let mut x1021: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1020, &mut x1021, x1019, x945, x995); + let mut x1022: u32 = 0; + let mut x1023: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1022, &mut x1023, x1021, x947, x997); + let mut x1024: u32 = 0; + let mut x1025: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1024, &mut x1025, x1023, x949, x999); + let mut x1026: u32 = 0; + let mut x1027: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1026, &mut x1027, x1025, x951, x1001); + let x1028: u32 = ((x1027 as u32) + (x952 as u32)); + let mut x1029: u32 = 0; + let mut x1030: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1029, &mut x1030, x7, (arg1[11])); + let mut x1031: u32 = 0; + let mut x1032: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1031, &mut x1032, x7, (arg1[10])); + let mut x1033: u32 = 0; + let mut x1034: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1033, &mut x1034, x7, (arg1[9])); + let mut x1035: u32 = 0; + let mut x1036: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1035, &mut x1036, x7, (arg1[8])); + let mut x1037: u32 = 0; + let mut x1038: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1037, &mut x1038, x7, (arg1[7])); + let mut x1039: u32 = 0; + let mut x1040: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1039, &mut x1040, x7, (arg1[6])); + let mut x1041: u32 = 0; + let mut x1042: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1041, &mut x1042, x7, (arg1[5])); + let mut x1043: u32 = 0; + let mut x1044: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1043, &mut x1044, x7, (arg1[4])); + let mut x1045: u32 = 0; + let mut x1046: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1045, &mut x1046, x7, (arg1[3])); + let mut x1047: u32 = 0; + let mut x1048: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1047, &mut x1048, x7, (arg1[2])); + let mut x1049: u32 = 0; + let mut x1050: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1049, &mut x1050, x7, (arg1[1])); + let mut x1051: u32 = 0; + let mut x1052: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1051, &mut x1052, x7, (arg1[0])); + let mut x1053: u32 = 0; + let mut x1054: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1053, &mut x1054, 0x0, x1052, x1049); + let mut x1055: u32 = 0; + let mut x1056: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1055, &mut x1056, x1054, x1050, x1047); + let mut x1057: u32 = 0; + let mut x1058: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1057, &mut x1058, x1056, x1048, x1045); + let mut x1059: u32 = 0; + let mut x1060: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1059, &mut x1060, x1058, x1046, x1043); + let mut x1061: u32 = 0; + let mut x1062: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1061, &mut x1062, x1060, x1044, x1041); + let mut x1063: u32 = 0; + let mut x1064: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1063, &mut x1064, x1062, x1042, x1039); + let mut x1065: u32 = 0; + let mut x1066: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1065, &mut x1066, x1064, x1040, x1037); + let mut x1067: u32 = 0; + let mut x1068: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1067, &mut x1068, x1066, x1038, x1035); + let mut x1069: u32 = 0; + let mut x1070: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1069, &mut x1070, x1068, x1036, x1033); + let mut x1071: u32 = 0; + let mut x1072: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1071, &mut x1072, x1070, x1034, x1031); + let mut x1073: u32 = 0; + let mut x1074: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1073, &mut x1074, x1072, x1032, x1029); + let x1075: u32 = ((x1074 as u32) + x1030); + let mut x1076: u32 = 0; + let mut x1077: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1076, &mut x1077, 0x0, x1004, x1051); + let mut x1078: u32 = 0; + let mut x1079: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1078, &mut x1079, x1077, x1006, x1053); + let mut x1080: u32 = 0; + let mut x1081: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1080, &mut x1081, x1079, x1008, x1055); + let mut x1082: u32 = 0; + let mut x1083: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1082, &mut x1083, x1081, x1010, x1057); + let mut x1084: u32 = 0; + let mut x1085: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1084, &mut x1085, x1083, x1012, x1059); + let mut x1086: u32 = 0; + let mut x1087: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1086, &mut x1087, x1085, x1014, x1061); + let mut x1088: u32 = 0; + let mut x1089: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1088, &mut x1089, x1087, x1016, x1063); + let mut x1090: u32 = 0; + let mut x1091: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1090, &mut x1091, x1089, x1018, x1065); + let mut x1092: u32 = 0; + let mut x1093: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1092, &mut x1093, x1091, x1020, x1067); + let mut x1094: u32 = 0; + let mut x1095: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1094, &mut x1095, x1093, x1022, x1069); + let mut x1096: u32 = 0; + let mut x1097: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1096, &mut x1097, x1095, x1024, x1071); + let mut x1098: u32 = 0; + let mut x1099: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1098, &mut x1099, x1097, x1026, x1073); + let mut x1100: u32 = 0; + let mut x1101: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1100, &mut x1101, x1099, x1028, x1075); + let mut x1102: u32 = 0; + let mut x1103: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1102, &mut x1103, x1076, 0xe88fdc45); + let mut x1104: u32 = 0; + let mut x1105: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1104, &mut x1105, x1102, 0xffffffff); + let mut x1106: u32 = 0; + let mut x1107: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1106, &mut x1107, x1102, 0xffffffff); + let mut x1108: u32 = 0; + let mut x1109: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1108, &mut x1109, x1102, 0xffffffff); + let mut x1110: u32 = 0; + let mut x1111: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1110, &mut x1111, x1102, 0xffffffff); + let mut x1112: u32 = 0; + let mut x1113: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1112, &mut x1113, x1102, 0xffffffff); + let mut x1114: u32 = 0; + let mut x1115: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1114, &mut x1115, x1102, 0xffffffff); + let mut x1116: u32 = 0; + let mut x1117: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1116, &mut x1117, x1102, 0xc7634d81); + let mut x1118: u32 = 0; + let mut x1119: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1118, &mut x1119, x1102, 0xf4372ddf); + let mut x1120: u32 = 0; + let mut x1121: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1120, &mut x1121, x1102, 0x581a0db2); + let mut x1122: u32 = 0; + let mut x1123: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1122, &mut x1123, x1102, 0x48b0a77a); + let mut x1124: u32 = 0; + let mut x1125: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1124, &mut x1125, x1102, 0xecec196a); + let mut x1126: u32 = 0; + let mut x1127: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1126, &mut x1127, x1102, 0xccc52973); + let mut x1128: u32 = 0; + let mut x1129: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1128, &mut x1129, 0x0, x1127, x1124); + let mut x1130: u32 = 0; + let mut x1131: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1130, &mut x1131, x1129, x1125, x1122); + let mut x1132: u32 = 0; + let mut x1133: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1132, &mut x1133, x1131, x1123, x1120); + let mut x1134: u32 = 0; + let mut x1135: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1134, &mut x1135, x1133, x1121, x1118); + let mut x1136: u32 = 0; + let mut x1137: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1136, &mut x1137, x1135, x1119, x1116); + let mut x1138: u32 = 0; + let mut x1139: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1138, &mut x1139, x1137, x1117, x1114); + let mut x1140: u32 = 0; + let mut x1141: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1140, &mut x1141, x1139, x1115, x1112); + let mut x1142: u32 = 0; + let mut x1143: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1142, &mut x1143, x1141, x1113, x1110); + let mut x1144: u32 = 0; + let mut x1145: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1144, &mut x1145, x1143, x1111, x1108); + let mut x1146: u32 = 0; + let mut x1147: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1146, &mut x1147, x1145, x1109, x1106); + let mut x1148: u32 = 0; + let mut x1149: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1148, &mut x1149, x1147, x1107, x1104); + let x1150: u32 = ((x1149 as u32) + x1105); + let mut x1151: u32 = 0; + let mut x1152: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1151, &mut x1152, 0x0, x1076, x1126); + let mut x1153: u32 = 0; + let mut x1154: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1153, &mut x1154, x1152, x1078, x1128); + let mut x1155: u32 = 0; + let mut x1156: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1155, &mut x1156, x1154, x1080, x1130); + let mut x1157: u32 = 0; + let mut x1158: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1157, &mut x1158, x1156, x1082, x1132); + let mut x1159: u32 = 0; + let mut x1160: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1159, &mut x1160, x1158, x1084, x1134); + let mut x1161: u32 = 0; + let mut x1162: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1161, &mut x1162, x1160, x1086, x1136); + let mut x1163: u32 = 0; + let mut x1164: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1163, &mut x1164, x1162, x1088, x1138); + let mut x1165: u32 = 0; + let mut x1166: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1165, &mut x1166, x1164, x1090, x1140); + let mut x1167: u32 = 0; + let mut x1168: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1167, &mut x1168, x1166, x1092, x1142); + let mut x1169: u32 = 0; + let mut x1170: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1169, &mut x1170, x1168, x1094, x1144); + let mut x1171: u32 = 0; + let mut x1172: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1171, &mut x1172, x1170, x1096, x1146); + let mut x1173: u32 = 0; + let mut x1174: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1173, &mut x1174, x1172, x1098, x1148); + let mut x1175: u32 = 0; + let mut x1176: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1175, &mut x1176, x1174, x1100, x1150); + let x1177: u32 = ((x1176 as u32) + (x1101 as u32)); + let mut x1178: u32 = 0; + let mut x1179: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1178, &mut x1179, x8, (arg1[11])); + let mut x1180: u32 = 0; + let mut x1181: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1180, &mut x1181, x8, (arg1[10])); + let mut x1182: u32 = 0; + let mut x1183: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1182, &mut x1183, x8, (arg1[9])); + let mut x1184: u32 = 0; + let mut x1185: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1184, &mut x1185, x8, (arg1[8])); + let mut x1186: u32 = 0; + let mut x1187: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1186, &mut x1187, x8, (arg1[7])); + let mut x1188: u32 = 0; + let mut x1189: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1188, &mut x1189, x8, (arg1[6])); + let mut x1190: u32 = 0; + let mut x1191: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1190, &mut x1191, x8, (arg1[5])); + let mut x1192: u32 = 0; + let mut x1193: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1192, &mut x1193, x8, (arg1[4])); + let mut x1194: u32 = 0; + let mut x1195: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1194, &mut x1195, x8, (arg1[3])); + let mut x1196: u32 = 0; + let mut x1197: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1196, &mut x1197, x8, (arg1[2])); + let mut x1198: u32 = 0; + let mut x1199: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1198, &mut x1199, x8, (arg1[1])); + let mut x1200: u32 = 0; + let mut x1201: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1200, &mut x1201, x8, (arg1[0])); + let mut x1202: u32 = 0; + let mut x1203: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1202, &mut x1203, 0x0, x1201, x1198); + let mut x1204: u32 = 0; + let mut x1205: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1204, &mut x1205, x1203, x1199, x1196); + let mut x1206: u32 = 0; + let mut x1207: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1206, &mut x1207, x1205, x1197, x1194); + let mut x1208: u32 = 0; + let mut x1209: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1208, &mut x1209, x1207, x1195, x1192); + let mut x1210: u32 = 0; + let mut x1211: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1210, &mut x1211, x1209, x1193, x1190); + let mut x1212: u32 = 0; + let mut x1213: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1212, &mut x1213, x1211, x1191, x1188); + let mut x1214: u32 = 0; + let mut x1215: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1214, &mut x1215, x1213, x1189, x1186); + let mut x1216: u32 = 0; + let mut x1217: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1216, &mut x1217, x1215, x1187, x1184); + let mut x1218: u32 = 0; + let mut x1219: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1218, &mut x1219, x1217, x1185, x1182); + let mut x1220: u32 = 0; + let mut x1221: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1220, &mut x1221, x1219, x1183, x1180); + let mut x1222: u32 = 0; + let mut x1223: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1222, &mut x1223, x1221, x1181, x1178); + let x1224: u32 = ((x1223 as u32) + x1179); + let mut x1225: u32 = 0; + let mut x1226: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1225, &mut x1226, 0x0, x1153, x1200); + let mut x1227: u32 = 0; + let mut x1228: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1227, &mut x1228, x1226, x1155, x1202); + let mut x1229: u32 = 0; + let mut x1230: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1229, &mut x1230, x1228, x1157, x1204); + let mut x1231: u32 = 0; + let mut x1232: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1231, &mut x1232, x1230, x1159, x1206); + let mut x1233: u32 = 0; + let mut x1234: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1233, &mut x1234, x1232, x1161, x1208); + let mut x1235: u32 = 0; + let mut x1236: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1235, &mut x1236, x1234, x1163, x1210); + let mut x1237: u32 = 0; + let mut x1238: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1237, &mut x1238, x1236, x1165, x1212); + let mut x1239: u32 = 0; + let mut x1240: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1239, &mut x1240, x1238, x1167, x1214); + let mut x1241: u32 = 0; + let mut x1242: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1241, &mut x1242, x1240, x1169, x1216); + let mut x1243: u32 = 0; + let mut x1244: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1243, &mut x1244, x1242, x1171, x1218); + let mut x1245: u32 = 0; + let mut x1246: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1245, &mut x1246, x1244, x1173, x1220); + let mut x1247: u32 = 0; + let mut x1248: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1247, &mut x1248, x1246, x1175, x1222); + let mut x1249: u32 = 0; + let mut x1250: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1249, &mut x1250, x1248, x1177, x1224); + let mut x1251: u32 = 0; + let mut x1252: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1251, &mut x1252, x1225, 0xe88fdc45); + let mut x1253: u32 = 0; + let mut x1254: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1253, &mut x1254, x1251, 0xffffffff); + let mut x1255: u32 = 0; + let mut x1256: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1255, &mut x1256, x1251, 0xffffffff); + let mut x1257: u32 = 0; + let mut x1258: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1257, &mut x1258, x1251, 0xffffffff); + let mut x1259: u32 = 0; + let mut x1260: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1259, &mut x1260, x1251, 0xffffffff); + let mut x1261: u32 = 0; + let mut x1262: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1261, &mut x1262, x1251, 0xffffffff); + let mut x1263: u32 = 0; + let mut x1264: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1263, &mut x1264, x1251, 0xffffffff); + let mut x1265: u32 = 0; + let mut x1266: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1265, &mut x1266, x1251, 0xc7634d81); + let mut x1267: u32 = 0; + let mut x1268: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1267, &mut x1268, x1251, 0xf4372ddf); + let mut x1269: u32 = 0; + let mut x1270: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1269, &mut x1270, x1251, 0x581a0db2); + let mut x1271: u32 = 0; + let mut x1272: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1271, &mut x1272, x1251, 0x48b0a77a); + let mut x1273: u32 = 0; + let mut x1274: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1273, &mut x1274, x1251, 0xecec196a); + let mut x1275: u32 = 0; + let mut x1276: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1275, &mut x1276, x1251, 0xccc52973); + let mut x1277: u32 = 0; + let mut x1278: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1277, &mut x1278, 0x0, x1276, x1273); + let mut x1279: u32 = 0; + let mut x1280: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1279, &mut x1280, x1278, x1274, x1271); + let mut x1281: u32 = 0; + let mut x1282: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1281, &mut x1282, x1280, x1272, x1269); + let mut x1283: u32 = 0; + let mut x1284: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1283, &mut x1284, x1282, x1270, x1267); + let mut x1285: u32 = 0; + let mut x1286: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1285, &mut x1286, x1284, x1268, x1265); + let mut x1287: u32 = 0; + let mut x1288: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1287, &mut x1288, x1286, x1266, x1263); + let mut x1289: u32 = 0; + let mut x1290: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1289, &mut x1290, x1288, x1264, x1261); + let mut x1291: u32 = 0; + let mut x1292: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1291, &mut x1292, x1290, x1262, x1259); + let mut x1293: u32 = 0; + let mut x1294: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1293, &mut x1294, x1292, x1260, x1257); + let mut x1295: u32 = 0; + let mut x1296: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1295, &mut x1296, x1294, x1258, x1255); + let mut x1297: u32 = 0; + let mut x1298: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1297, &mut x1298, x1296, x1256, x1253); + let x1299: u32 = ((x1298 as u32) + x1254); + let mut x1300: u32 = 0; + let mut x1301: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1300, &mut x1301, 0x0, x1225, x1275); + let mut x1302: u32 = 0; + let mut x1303: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1302, &mut x1303, x1301, x1227, x1277); + let mut x1304: u32 = 0; + let mut x1305: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1304, &mut x1305, x1303, x1229, x1279); + let mut x1306: u32 = 0; + let mut x1307: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1306, &mut x1307, x1305, x1231, x1281); + let mut x1308: u32 = 0; + let mut x1309: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1308, &mut x1309, x1307, x1233, x1283); + let mut x1310: u32 = 0; + let mut x1311: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1310, &mut x1311, x1309, x1235, x1285); + let mut x1312: u32 = 0; + let mut x1313: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1312, &mut x1313, x1311, x1237, x1287); + let mut x1314: u32 = 0; + let mut x1315: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1314, &mut x1315, x1313, x1239, x1289); + let mut x1316: u32 = 0; + let mut x1317: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1316, &mut x1317, x1315, x1241, x1291); + let mut x1318: u32 = 0; + let mut x1319: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1318, &mut x1319, x1317, x1243, x1293); + let mut x1320: u32 = 0; + let mut x1321: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1320, &mut x1321, x1319, x1245, x1295); + let mut x1322: u32 = 0; + let mut x1323: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1322, &mut x1323, x1321, x1247, x1297); + let mut x1324: u32 = 0; + let mut x1325: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1324, &mut x1325, x1323, x1249, x1299); + let x1326: u32 = ((x1325 as u32) + (x1250 as u32)); + let mut x1327: u32 = 0; + let mut x1328: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1327, &mut x1328, x9, (arg1[11])); + let mut x1329: u32 = 0; + let mut x1330: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1329, &mut x1330, x9, (arg1[10])); + let mut x1331: u32 = 0; + let mut x1332: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1331, &mut x1332, x9, (arg1[9])); + let mut x1333: u32 = 0; + let mut x1334: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1333, &mut x1334, x9, (arg1[8])); + let mut x1335: u32 = 0; + let mut x1336: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1335, &mut x1336, x9, (arg1[7])); + let mut x1337: u32 = 0; + let mut x1338: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1337, &mut x1338, x9, (arg1[6])); + let mut x1339: u32 = 0; + let mut x1340: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1339, &mut x1340, x9, (arg1[5])); + let mut x1341: u32 = 0; + let mut x1342: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1341, &mut x1342, x9, (arg1[4])); + let mut x1343: u32 = 0; + let mut x1344: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1343, &mut x1344, x9, (arg1[3])); + let mut x1345: u32 = 0; + let mut x1346: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1345, &mut x1346, x9, (arg1[2])); + let mut x1347: u32 = 0; + let mut x1348: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1347, &mut x1348, x9, (arg1[1])); + let mut x1349: u32 = 0; + let mut x1350: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1349, &mut x1350, x9, (arg1[0])); + let mut x1351: u32 = 0; + let mut x1352: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1351, &mut x1352, 0x0, x1350, x1347); + let mut x1353: u32 = 0; + let mut x1354: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1353, &mut x1354, x1352, x1348, x1345); + let mut x1355: u32 = 0; + let mut x1356: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1355, &mut x1356, x1354, x1346, x1343); + let mut x1357: u32 = 0; + let mut x1358: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1357, &mut x1358, x1356, x1344, x1341); + let mut x1359: u32 = 0; + let mut x1360: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1359, &mut x1360, x1358, x1342, x1339); + let mut x1361: u32 = 0; + let mut x1362: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1361, &mut x1362, x1360, x1340, x1337); + let mut x1363: u32 = 0; + let mut x1364: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1363, &mut x1364, x1362, x1338, x1335); + let mut x1365: u32 = 0; + let mut x1366: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1365, &mut x1366, x1364, x1336, x1333); + let mut x1367: u32 = 0; + let mut x1368: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1367, &mut x1368, x1366, x1334, x1331); + let mut x1369: u32 = 0; + let mut x1370: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1369, &mut x1370, x1368, x1332, x1329); + let mut x1371: u32 = 0; + let mut x1372: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1371, &mut x1372, x1370, x1330, x1327); + let x1373: u32 = ((x1372 as u32) + x1328); + let mut x1374: u32 = 0; + let mut x1375: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1374, &mut x1375, 0x0, x1302, x1349); + let mut x1376: u32 = 0; + let mut x1377: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1376, &mut x1377, x1375, x1304, x1351); + let mut x1378: u32 = 0; + let mut x1379: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1378, &mut x1379, x1377, x1306, x1353); + let mut x1380: u32 = 0; + let mut x1381: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1380, &mut x1381, x1379, x1308, x1355); + let mut x1382: u32 = 0; + let mut x1383: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1382, &mut x1383, x1381, x1310, x1357); + let mut x1384: u32 = 0; + let mut x1385: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1384, &mut x1385, x1383, x1312, x1359); + let mut x1386: u32 = 0; + let mut x1387: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1386, &mut x1387, x1385, x1314, x1361); + let mut x1388: u32 = 0; + let mut x1389: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1388, &mut x1389, x1387, x1316, x1363); + let mut x1390: u32 = 0; + let mut x1391: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1390, &mut x1391, x1389, x1318, x1365); + let mut x1392: u32 = 0; + let mut x1393: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1392, &mut x1393, x1391, x1320, x1367); + let mut x1394: u32 = 0; + let mut x1395: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1394, &mut x1395, x1393, x1322, x1369); + let mut x1396: u32 = 0; + let mut x1397: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1396, &mut x1397, x1395, x1324, x1371); + let mut x1398: u32 = 0; + let mut x1399: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1398, &mut x1399, x1397, x1326, x1373); + let mut x1400: u32 = 0; + let mut x1401: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1400, &mut x1401, x1374, 0xe88fdc45); + let mut x1402: u32 = 0; + let mut x1403: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1402, &mut x1403, x1400, 0xffffffff); + let mut x1404: u32 = 0; + let mut x1405: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1404, &mut x1405, x1400, 0xffffffff); + let mut x1406: u32 = 0; + let mut x1407: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1406, &mut x1407, x1400, 0xffffffff); + let mut x1408: u32 = 0; + let mut x1409: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1408, &mut x1409, x1400, 0xffffffff); + let mut x1410: u32 = 0; + let mut x1411: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1410, &mut x1411, x1400, 0xffffffff); + let mut x1412: u32 = 0; + let mut x1413: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1412, &mut x1413, x1400, 0xffffffff); + let mut x1414: u32 = 0; + let mut x1415: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1414, &mut x1415, x1400, 0xc7634d81); + let mut x1416: u32 = 0; + let mut x1417: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1416, &mut x1417, x1400, 0xf4372ddf); + let mut x1418: u32 = 0; + let mut x1419: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1418, &mut x1419, x1400, 0x581a0db2); + let mut x1420: u32 = 0; + let mut x1421: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1420, &mut x1421, x1400, 0x48b0a77a); + let mut x1422: u32 = 0; + let mut x1423: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1422, &mut x1423, x1400, 0xecec196a); + let mut x1424: u32 = 0; + let mut x1425: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1424, &mut x1425, x1400, 0xccc52973); + let mut x1426: u32 = 0; + let mut x1427: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1426, &mut x1427, 0x0, x1425, x1422); + let mut x1428: u32 = 0; + let mut x1429: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1428, &mut x1429, x1427, x1423, x1420); + let mut x1430: u32 = 0; + let mut x1431: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1430, &mut x1431, x1429, x1421, x1418); + let mut x1432: u32 = 0; + let mut x1433: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1432, &mut x1433, x1431, x1419, x1416); + let mut x1434: u32 = 0; + let mut x1435: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1434, &mut x1435, x1433, x1417, x1414); + let mut x1436: u32 = 0; + let mut x1437: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1436, &mut x1437, x1435, x1415, x1412); + let mut x1438: u32 = 0; + let mut x1439: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1438, &mut x1439, x1437, x1413, x1410); + let mut x1440: u32 = 0; + let mut x1441: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1440, &mut x1441, x1439, x1411, x1408); + let mut x1442: u32 = 0; + let mut x1443: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1442, &mut x1443, x1441, x1409, x1406); + let mut x1444: u32 = 0; + let mut x1445: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1444, &mut x1445, x1443, x1407, x1404); + let mut x1446: u32 = 0; + let mut x1447: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1446, &mut x1447, x1445, x1405, x1402); + let x1448: u32 = ((x1447 as u32) + x1403); + let mut x1449: u32 = 0; + let mut x1450: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1449, &mut x1450, 0x0, x1374, x1424); + let mut x1451: u32 = 0; + let mut x1452: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1451, &mut x1452, x1450, x1376, x1426); + let mut x1453: u32 = 0; + let mut x1454: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1453, &mut x1454, x1452, x1378, x1428); + let mut x1455: u32 = 0; + let mut x1456: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1455, &mut x1456, x1454, x1380, x1430); + let mut x1457: u32 = 0; + let mut x1458: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1457, &mut x1458, x1456, x1382, x1432); + let mut x1459: u32 = 0; + let mut x1460: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1459, &mut x1460, x1458, x1384, x1434); + let mut x1461: u32 = 0; + let mut x1462: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1461, &mut x1462, x1460, x1386, x1436); + let mut x1463: u32 = 0; + let mut x1464: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1463, &mut x1464, x1462, x1388, x1438); + let mut x1465: u32 = 0; + let mut x1466: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1465, &mut x1466, x1464, x1390, x1440); + let mut x1467: u32 = 0; + let mut x1468: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1467, &mut x1468, x1466, x1392, x1442); + let mut x1469: u32 = 0; + let mut x1470: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1469, &mut x1470, x1468, x1394, x1444); + let mut x1471: u32 = 0; + let mut x1472: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1471, &mut x1472, x1470, x1396, x1446); + let mut x1473: u32 = 0; + let mut x1474: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1473, &mut x1474, x1472, x1398, x1448); + let x1475: u32 = ((x1474 as u32) + (x1399 as u32)); + let mut x1476: u32 = 0; + let mut x1477: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1476, &mut x1477, x10, (arg1[11])); + let mut x1478: u32 = 0; + let mut x1479: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1478, &mut x1479, x10, (arg1[10])); + let mut x1480: u32 = 0; + let mut x1481: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1480, &mut x1481, x10, (arg1[9])); + let mut x1482: u32 = 0; + let mut x1483: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1482, &mut x1483, x10, (arg1[8])); + let mut x1484: u32 = 0; + let mut x1485: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1484, &mut x1485, x10, (arg1[7])); + let mut x1486: u32 = 0; + let mut x1487: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1486, &mut x1487, x10, (arg1[6])); + let mut x1488: u32 = 0; + let mut x1489: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1488, &mut x1489, x10, (arg1[5])); + let mut x1490: u32 = 0; + let mut x1491: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1490, &mut x1491, x10, (arg1[4])); + let mut x1492: u32 = 0; + let mut x1493: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1492, &mut x1493, x10, (arg1[3])); + let mut x1494: u32 = 0; + let mut x1495: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1494, &mut x1495, x10, (arg1[2])); + let mut x1496: u32 = 0; + let mut x1497: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1496, &mut x1497, x10, (arg1[1])); + let mut x1498: u32 = 0; + let mut x1499: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1498, &mut x1499, x10, (arg1[0])); + let mut x1500: u32 = 0; + let mut x1501: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1500, &mut x1501, 0x0, x1499, x1496); + let mut x1502: u32 = 0; + let mut x1503: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1502, &mut x1503, x1501, x1497, x1494); + let mut x1504: u32 = 0; + let mut x1505: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1504, &mut x1505, x1503, x1495, x1492); + let mut x1506: u32 = 0; + let mut x1507: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1506, &mut x1507, x1505, x1493, x1490); + let mut x1508: u32 = 0; + let mut x1509: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1508, &mut x1509, x1507, x1491, x1488); + let mut x1510: u32 = 0; + let mut x1511: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1510, &mut x1511, x1509, x1489, x1486); + let mut x1512: u32 = 0; + let mut x1513: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1512, &mut x1513, x1511, x1487, x1484); + let mut x1514: u32 = 0; + let mut x1515: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1514, &mut x1515, x1513, x1485, x1482); + let mut x1516: u32 = 0; + let mut x1517: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1516, &mut x1517, x1515, x1483, x1480); + let mut x1518: u32 = 0; + let mut x1519: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1518, &mut x1519, x1517, x1481, x1478); + let mut x1520: u32 = 0; + let mut x1521: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1520, &mut x1521, x1519, x1479, x1476); + let x1522: u32 = ((x1521 as u32) + x1477); + let mut x1523: u32 = 0; + let mut x1524: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1523, &mut x1524, 0x0, x1451, x1498); + let mut x1525: u32 = 0; + let mut x1526: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1525, &mut x1526, x1524, x1453, x1500); + let mut x1527: u32 = 0; + let mut x1528: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1527, &mut x1528, x1526, x1455, x1502); + let mut x1529: u32 = 0; + let mut x1530: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1529, &mut x1530, x1528, x1457, x1504); + let mut x1531: u32 = 0; + let mut x1532: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1531, &mut x1532, x1530, x1459, x1506); + let mut x1533: u32 = 0; + let mut x1534: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1533, &mut x1534, x1532, x1461, x1508); + let mut x1535: u32 = 0; + let mut x1536: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1535, &mut x1536, x1534, x1463, x1510); + let mut x1537: u32 = 0; + let mut x1538: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1537, &mut x1538, x1536, x1465, x1512); + let mut x1539: u32 = 0; + let mut x1540: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1539, &mut x1540, x1538, x1467, x1514); + let mut x1541: u32 = 0; + let mut x1542: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1541, &mut x1542, x1540, x1469, x1516); + let mut x1543: u32 = 0; + let mut x1544: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1543, &mut x1544, x1542, x1471, x1518); + let mut x1545: u32 = 0; + let mut x1546: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1545, &mut x1546, x1544, x1473, x1520); + let mut x1547: u32 = 0; + let mut x1548: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1547, &mut x1548, x1546, x1475, x1522); + let mut x1549: u32 = 0; + let mut x1550: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1549, &mut x1550, x1523, 0xe88fdc45); + let mut x1551: u32 = 0; + let mut x1552: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1551, &mut x1552, x1549, 0xffffffff); + let mut x1553: u32 = 0; + let mut x1554: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1553, &mut x1554, x1549, 0xffffffff); + let mut x1555: u32 = 0; + let mut x1556: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1555, &mut x1556, x1549, 0xffffffff); + let mut x1557: u32 = 0; + let mut x1558: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1557, &mut x1558, x1549, 0xffffffff); + let mut x1559: u32 = 0; + let mut x1560: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1559, &mut x1560, x1549, 0xffffffff); + let mut x1561: u32 = 0; + let mut x1562: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1561, &mut x1562, x1549, 0xffffffff); + let mut x1563: u32 = 0; + let mut x1564: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1563, &mut x1564, x1549, 0xc7634d81); + let mut x1565: u32 = 0; + let mut x1566: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1565, &mut x1566, x1549, 0xf4372ddf); + let mut x1567: u32 = 0; + let mut x1568: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1567, &mut x1568, x1549, 0x581a0db2); + let mut x1569: u32 = 0; + let mut x1570: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1569, &mut x1570, x1549, 0x48b0a77a); + let mut x1571: u32 = 0; + let mut x1572: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1571, &mut x1572, x1549, 0xecec196a); + let mut x1573: u32 = 0; + let mut x1574: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1573, &mut x1574, x1549, 0xccc52973); + let mut x1575: u32 = 0; + let mut x1576: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1575, &mut x1576, 0x0, x1574, x1571); + let mut x1577: u32 = 0; + let mut x1578: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1577, &mut x1578, x1576, x1572, x1569); + let mut x1579: u32 = 0; + let mut x1580: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1579, &mut x1580, x1578, x1570, x1567); + let mut x1581: u32 = 0; + let mut x1582: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1581, &mut x1582, x1580, x1568, x1565); + let mut x1583: u32 = 0; + let mut x1584: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1583, &mut x1584, x1582, x1566, x1563); + let mut x1585: u32 = 0; + let mut x1586: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1585, &mut x1586, x1584, x1564, x1561); + let mut x1587: u32 = 0; + let mut x1588: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1587, &mut x1588, x1586, x1562, x1559); + let mut x1589: u32 = 0; + let mut x1590: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1589, &mut x1590, x1588, x1560, x1557); + let mut x1591: u32 = 0; + let mut x1592: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1591, &mut x1592, x1590, x1558, x1555); + let mut x1593: u32 = 0; + let mut x1594: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1593, &mut x1594, x1592, x1556, x1553); + let mut x1595: u32 = 0; + let mut x1596: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1595, &mut x1596, x1594, x1554, x1551); + let x1597: u32 = ((x1596 as u32) + x1552); + let mut x1598: u32 = 0; + let mut x1599: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1598, &mut x1599, 0x0, x1523, x1573); + let mut x1600: u32 = 0; + let mut x1601: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1600, &mut x1601, x1599, x1525, x1575); + let mut x1602: u32 = 0; + let mut x1603: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1602, &mut x1603, x1601, x1527, x1577); + let mut x1604: u32 = 0; + let mut x1605: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1604, &mut x1605, x1603, x1529, x1579); + let mut x1606: u32 = 0; + let mut x1607: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1606, &mut x1607, x1605, x1531, x1581); + let mut x1608: u32 = 0; + let mut x1609: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1608, &mut x1609, x1607, x1533, x1583); + let mut x1610: u32 = 0; + let mut x1611: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1610, &mut x1611, x1609, x1535, x1585); + let mut x1612: u32 = 0; + let mut x1613: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1612, &mut x1613, x1611, x1537, x1587); + let mut x1614: u32 = 0; + let mut x1615: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1614, &mut x1615, x1613, x1539, x1589); + let mut x1616: u32 = 0; + let mut x1617: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1616, &mut x1617, x1615, x1541, x1591); + let mut x1618: u32 = 0; + let mut x1619: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1618, &mut x1619, x1617, x1543, x1593); + let mut x1620: u32 = 0; + let mut x1621: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1620, &mut x1621, x1619, x1545, x1595); + let mut x1622: u32 = 0; + let mut x1623: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1622, &mut x1623, x1621, x1547, x1597); + let x1624: u32 = ((x1623 as u32) + (x1548 as u32)); + let mut x1625: u32 = 0; + let mut x1626: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1625, &mut x1626, x11, (arg1[11])); + let mut x1627: u32 = 0; + let mut x1628: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1627, &mut x1628, x11, (arg1[10])); + let mut x1629: u32 = 0; + let mut x1630: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1629, &mut x1630, x11, (arg1[9])); + let mut x1631: u32 = 0; + let mut x1632: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1631, &mut x1632, x11, (arg1[8])); + let mut x1633: u32 = 0; + let mut x1634: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1633, &mut x1634, x11, (arg1[7])); + let mut x1635: u32 = 0; + let mut x1636: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1635, &mut x1636, x11, (arg1[6])); + let mut x1637: u32 = 0; + let mut x1638: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1637, &mut x1638, x11, (arg1[5])); + let mut x1639: u32 = 0; + let mut x1640: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1639, &mut x1640, x11, (arg1[4])); + let mut x1641: u32 = 0; + let mut x1642: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1641, &mut x1642, x11, (arg1[3])); + let mut x1643: u32 = 0; + let mut x1644: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1643, &mut x1644, x11, (arg1[2])); + let mut x1645: u32 = 0; + let mut x1646: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1645, &mut x1646, x11, (arg1[1])); + let mut x1647: u32 = 0; + let mut x1648: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1647, &mut x1648, x11, (arg1[0])); + let mut x1649: u32 = 0; + let mut x1650: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1649, &mut x1650, 0x0, x1648, x1645); + let mut x1651: u32 = 0; + let mut x1652: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1651, &mut x1652, x1650, x1646, x1643); + let mut x1653: u32 = 0; + let mut x1654: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1653, &mut x1654, x1652, x1644, x1641); + let mut x1655: u32 = 0; + let mut x1656: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1655, &mut x1656, x1654, x1642, x1639); + let mut x1657: u32 = 0; + let mut x1658: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1657, &mut x1658, x1656, x1640, x1637); + let mut x1659: u32 = 0; + let mut x1660: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1659, &mut x1660, x1658, x1638, x1635); + let mut x1661: u32 = 0; + let mut x1662: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1661, &mut x1662, x1660, x1636, x1633); + let mut x1663: u32 = 0; + let mut x1664: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1663, &mut x1664, x1662, x1634, x1631); + let mut x1665: u32 = 0; + let mut x1666: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1665, &mut x1666, x1664, x1632, x1629); + let mut x1667: u32 = 0; + let mut x1668: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1667, &mut x1668, x1666, x1630, x1627); + let mut x1669: u32 = 0; + let mut x1670: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1669, &mut x1670, x1668, x1628, x1625); + let x1671: u32 = ((x1670 as u32) + x1626); + let mut x1672: u32 = 0; + let mut x1673: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1672, &mut x1673, 0x0, x1600, x1647); + let mut x1674: u32 = 0; + let mut x1675: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1674, &mut x1675, x1673, x1602, x1649); + let mut x1676: u32 = 0; + let mut x1677: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1676, &mut x1677, x1675, x1604, x1651); + let mut x1678: u32 = 0; + let mut x1679: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1678, &mut x1679, x1677, x1606, x1653); + let mut x1680: u32 = 0; + let mut x1681: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1680, &mut x1681, x1679, x1608, x1655); + let mut x1682: u32 = 0; + let mut x1683: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1682, &mut x1683, x1681, x1610, x1657); + let mut x1684: u32 = 0; + let mut x1685: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1684, &mut x1685, x1683, x1612, x1659); + let mut x1686: u32 = 0; + let mut x1687: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1686, &mut x1687, x1685, x1614, x1661); + let mut x1688: u32 = 0; + let mut x1689: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1688, &mut x1689, x1687, x1616, x1663); + let mut x1690: u32 = 0; + let mut x1691: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1690, &mut x1691, x1689, x1618, x1665); + let mut x1692: u32 = 0; + let mut x1693: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1692, &mut x1693, x1691, x1620, x1667); + let mut x1694: u32 = 0; + let mut x1695: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1694, &mut x1695, x1693, x1622, x1669); + let mut x1696: u32 = 0; + let mut x1697: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1696, &mut x1697, x1695, x1624, x1671); + let mut x1698: u32 = 0; + let mut x1699: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1698, &mut x1699, x1672, 0xe88fdc45); + let mut x1700: u32 = 0; + let mut x1701: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1700, &mut x1701, x1698, 0xffffffff); + let mut x1702: u32 = 0; + let mut x1703: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1702, &mut x1703, x1698, 0xffffffff); + let mut x1704: u32 = 0; + let mut x1705: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1704, &mut x1705, x1698, 0xffffffff); + let mut x1706: u32 = 0; + let mut x1707: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1706, &mut x1707, x1698, 0xffffffff); + let mut x1708: u32 = 0; + let mut x1709: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1708, &mut x1709, x1698, 0xffffffff); + let mut x1710: u32 = 0; + let mut x1711: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1710, &mut x1711, x1698, 0xffffffff); + let mut x1712: u32 = 0; + let mut x1713: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1712, &mut x1713, x1698, 0xc7634d81); + let mut x1714: u32 = 0; + let mut x1715: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1714, &mut x1715, x1698, 0xf4372ddf); + let mut x1716: u32 = 0; + let mut x1717: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1716, &mut x1717, x1698, 0x581a0db2); + let mut x1718: u32 = 0; + let mut x1719: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1718, &mut x1719, x1698, 0x48b0a77a); + let mut x1720: u32 = 0; + let mut x1721: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1720, &mut x1721, x1698, 0xecec196a); + let mut x1722: u32 = 0; + let mut x1723: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1722, &mut x1723, x1698, 0xccc52973); + let mut x1724: u32 = 0; + let mut x1725: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1724, &mut x1725, 0x0, x1723, x1720); + let mut x1726: u32 = 0; + let mut x1727: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1726, &mut x1727, x1725, x1721, x1718); + let mut x1728: u32 = 0; + let mut x1729: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1728, &mut x1729, x1727, x1719, x1716); + let mut x1730: u32 = 0; + let mut x1731: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1730, &mut x1731, x1729, x1717, x1714); + let mut x1732: u32 = 0; + let mut x1733: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1732, &mut x1733, x1731, x1715, x1712); + let mut x1734: u32 = 0; + let mut x1735: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1734, &mut x1735, x1733, x1713, x1710); + let mut x1736: u32 = 0; + let mut x1737: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1736, &mut x1737, x1735, x1711, x1708); + let mut x1738: u32 = 0; + let mut x1739: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1738, &mut x1739, x1737, x1709, x1706); + let mut x1740: u32 = 0; + let mut x1741: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1740, &mut x1741, x1739, x1707, x1704); + let mut x1742: u32 = 0; + let mut x1743: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1742, &mut x1743, x1741, x1705, x1702); + let mut x1744: u32 = 0; + let mut x1745: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1744, &mut x1745, x1743, x1703, x1700); + let x1746: u32 = ((x1745 as u32) + x1701); + let mut x1747: u32 = 0; + let mut x1748: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1747, &mut x1748, 0x0, x1672, x1722); + let mut x1749: u32 = 0; + let mut x1750: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1749, &mut x1750, x1748, x1674, x1724); + let mut x1751: u32 = 0; + let mut x1752: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1751, &mut x1752, x1750, x1676, x1726); + let mut x1753: u32 = 0; + let mut x1754: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1753, &mut x1754, x1752, x1678, x1728); + let mut x1755: u32 = 0; + let mut x1756: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1755, &mut x1756, x1754, x1680, x1730); + let mut x1757: u32 = 0; + let mut x1758: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1757, &mut x1758, x1756, x1682, x1732); + let mut x1759: u32 = 0; + let mut x1760: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1759, &mut x1760, x1758, x1684, x1734); + let mut x1761: u32 = 0; + let mut x1762: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1761, &mut x1762, x1760, x1686, x1736); + let mut x1763: u32 = 0; + let mut x1764: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1763, &mut x1764, x1762, x1688, x1738); + let mut x1765: u32 = 0; + let mut x1766: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1765, &mut x1766, x1764, x1690, x1740); + let mut x1767: u32 = 0; + let mut x1768: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1767, &mut x1768, x1766, x1692, x1742); + let mut x1769: u32 = 0; + let mut x1770: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1769, &mut x1770, x1768, x1694, x1744); + let mut x1771: u32 = 0; + let mut x1772: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1771, &mut x1772, x1770, x1696, x1746); + let x1773: u32 = ((x1772 as u32) + (x1697 as u32)); + let mut x1774: u32 = 0; + let mut x1775: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1774, &mut x1775, 0x0, x1749, 0xccc52973); + let mut x1776: u32 = 0; + let mut x1777: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1776, &mut x1777, x1775, x1751, 0xecec196a); + let mut x1778: u32 = 0; + let mut x1779: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1778, &mut x1779, x1777, x1753, 0x48b0a77a); + let mut x1780: u32 = 0; + let mut x1781: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1780, &mut x1781, x1779, x1755, 0x581a0db2); + let mut x1782: u32 = 0; + let mut x1783: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1782, &mut x1783, x1781, x1757, 0xf4372ddf); + let mut x1784: u32 = 0; + let mut x1785: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1784, &mut x1785, x1783, x1759, 0xc7634d81); + let mut x1786: u32 = 0; + let mut x1787: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1786, &mut x1787, x1785, x1761, 0xffffffff); + let mut x1788: u32 = 0; + let mut x1789: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1788, &mut x1789, x1787, x1763, 0xffffffff); + let mut x1790: u32 = 0; + let mut x1791: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1790, &mut x1791, x1789, x1765, 0xffffffff); + let mut x1792: u32 = 0; + let mut x1793: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1792, &mut x1793, x1791, x1767, 0xffffffff); + let mut x1794: u32 = 0; + let mut x1795: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1794, &mut x1795, x1793, x1769, 0xffffffff); + let mut x1796: u32 = 0; + let mut x1797: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1796, &mut x1797, x1795, x1771, 0xffffffff); + let mut x1798: u32 = 0; + let mut x1799: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1798, &mut x1799, x1797, x1773, (0x0 as u32)); + let mut x1800: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x1800, x1799, x1774, x1749); + let mut x1801: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x1801, x1799, x1776, x1751); + let mut x1802: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x1802, x1799, x1778, x1753); + let mut x1803: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x1803, x1799, x1780, x1755); + let mut x1804: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x1804, x1799, x1782, x1757); + let mut x1805: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x1805, x1799, x1784, x1759); + let mut x1806: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x1806, x1799, x1786, x1761); + let mut x1807: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x1807, x1799, x1788, x1763); + let mut x1808: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x1808, x1799, x1790, x1765); + let mut x1809: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x1809, x1799, x1792, x1767); + let mut x1810: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x1810, x1799, x1794, x1769); + let mut x1811: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x1811, x1799, x1796, x1771); + out1[0] = x1800; + out1[1] = x1801; + out1[2] = x1802; + out1[3] = x1803; + out1[4] = x1804; + out1[5] = x1805; + out1[6] = x1806; + out1[7] = x1807; + out1[8] = x1808; + out1[9] = x1809; + out1[10] = x1810; + out1[11] = x1811; +} + +/// The function fiat_p384_scalar_add adds two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) + eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p384_scalar_add(out1: &mut fiat_p384_scalar_montgomery_domain_field_element, arg1: &fiat_p384_scalar_montgomery_domain_field_element, arg2: &fiat_p384_scalar_montgomery_domain_field_element) -> () { + let mut x1: u32 = 0; + let mut x2: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1, &mut x2, 0x0, (arg1[0]), (arg2[0])); + let mut x3: u32 = 0; + let mut x4: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x3, &mut x4, x2, (arg1[1]), (arg2[1])); + let mut x5: u32 = 0; + let mut x6: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x5, &mut x6, x4, (arg1[2]), (arg2[2])); + let mut x7: u32 = 0; + let mut x8: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x7, &mut x8, x6, (arg1[3]), (arg2[3])); + let mut x9: u32 = 0; + let mut x10: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x9, &mut x10, x8, (arg1[4]), (arg2[4])); + let mut x11: u32 = 0; + let mut x12: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x11, &mut x12, x10, (arg1[5]), (arg2[5])); + let mut x13: u32 = 0; + let mut x14: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x13, &mut x14, x12, (arg1[6]), (arg2[6])); + let mut x15: u32 = 0; + let mut x16: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x15, &mut x16, x14, (arg1[7]), (arg2[7])); + let mut x17: u32 = 0; + let mut x18: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x17, &mut x18, x16, (arg1[8]), (arg2[8])); + let mut x19: u32 = 0; + let mut x20: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x19, &mut x20, x18, (arg1[9]), (arg2[9])); + let mut x21: u32 = 0; + let mut x22: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x21, &mut x22, x20, (arg1[10]), (arg2[10])); + let mut x23: u32 = 0; + let mut x24: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x23, &mut x24, x22, (arg1[11]), (arg2[11])); + let mut x25: u32 = 0; + let mut x26: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x25, &mut x26, 0x0, x1, 0xccc52973); + let mut x27: u32 = 0; + let mut x28: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x27, &mut x28, x26, x3, 0xecec196a); + let mut x29: u32 = 0; + let mut x30: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x29, &mut x30, x28, x5, 0x48b0a77a); + let mut x31: u32 = 0; + let mut x32: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x31, &mut x32, x30, x7, 0x581a0db2); + let mut x33: u32 = 0; + let mut x34: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x33, &mut x34, x32, x9, 0xf4372ddf); + let mut x35: u32 = 0; + let mut x36: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x35, &mut x36, x34, x11, 0xc7634d81); + let mut x37: u32 = 0; + let mut x38: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x37, &mut x38, x36, x13, 0xffffffff); + let mut x39: u32 = 0; + let mut x40: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x39, &mut x40, x38, x15, 0xffffffff); + let mut x41: u32 = 0; + let mut x42: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x41, &mut x42, x40, x17, 0xffffffff); + let mut x43: u32 = 0; + let mut x44: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x43, &mut x44, x42, x19, 0xffffffff); + let mut x45: u32 = 0; + let mut x46: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x45, &mut x46, x44, x21, 0xffffffff); + let mut x47: u32 = 0; + let mut x48: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x47, &mut x48, x46, x23, 0xffffffff); + let mut x49: u32 = 0; + let mut x50: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x49, &mut x50, x48, (x24 as u32), (0x0 as u32)); + let mut x51: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x51, x50, x25, x1); + let mut x52: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x52, x50, x27, x3); + let mut x53: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x53, x50, x29, x5); + let mut x54: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x54, x50, x31, x7); + let mut x55: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x55, x50, x33, x9); + let mut x56: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x56, x50, x35, x11); + let mut x57: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x57, x50, x37, x13); + let mut x58: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x58, x50, x39, x15); + let mut x59: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x59, x50, x41, x17); + let mut x60: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x60, x50, x43, x19); + let mut x61: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x61, x50, x45, x21); + let mut x62: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x62, x50, x47, x23); + out1[0] = x51; + out1[1] = x52; + out1[2] = x53; + out1[3] = x54; + out1[4] = x55; + out1[5] = x56; + out1[6] = x57; + out1[7] = x58; + out1[8] = x59; + out1[9] = x60; + out1[10] = x61; + out1[11] = x62; +} + +/// The function fiat_p384_scalar_sub subtracts two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) - eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p384_scalar_sub(out1: &mut fiat_p384_scalar_montgomery_domain_field_element, arg1: &fiat_p384_scalar_montgomery_domain_field_element, arg2: &fiat_p384_scalar_montgomery_domain_field_element) -> () { + let mut x1: u32 = 0; + let mut x2: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1, &mut x2, 0x0, (arg1[0]), (arg2[0])); + let mut x3: u32 = 0; + let mut x4: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x3, &mut x4, x2, (arg1[1]), (arg2[1])); + let mut x5: u32 = 0; + let mut x6: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x5, &mut x6, x4, (arg1[2]), (arg2[2])); + let mut x7: u32 = 0; + let mut x8: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x7, &mut x8, x6, (arg1[3]), (arg2[3])); + let mut x9: u32 = 0; + let mut x10: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x9, &mut x10, x8, (arg1[4]), (arg2[4])); + let mut x11: u32 = 0; + let mut x12: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x11, &mut x12, x10, (arg1[5]), (arg2[5])); + let mut x13: u32 = 0; + let mut x14: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x13, &mut x14, x12, (arg1[6]), (arg2[6])); + let mut x15: u32 = 0; + let mut x16: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x15, &mut x16, x14, (arg1[7]), (arg2[7])); + let mut x17: u32 = 0; + let mut x18: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x17, &mut x18, x16, (arg1[8]), (arg2[8])); + let mut x19: u32 = 0; + let mut x20: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x19, &mut x20, x18, (arg1[9]), (arg2[9])); + let mut x21: u32 = 0; + let mut x22: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x21, &mut x22, x20, (arg1[10]), (arg2[10])); + let mut x23: u32 = 0; + let mut x24: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x23, &mut x24, x22, (arg1[11]), (arg2[11])); + let mut x25: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x25, x24, (0x0 as u32), 0xffffffff); + let mut x26: u32 = 0; + let mut x27: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x26, &mut x27, 0x0, x1, (x25 & 0xccc52973)); + let mut x28: u32 = 0; + let mut x29: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x28, &mut x29, x27, x3, (x25 & 0xecec196a)); + let mut x30: u32 = 0; + let mut x31: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x30, &mut x31, x29, x5, (x25 & 0x48b0a77a)); + let mut x32: u32 = 0; + let mut x33: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x32, &mut x33, x31, x7, (x25 & 0x581a0db2)); + let mut x34: u32 = 0; + let mut x35: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x34, &mut x35, x33, x9, (x25 & 0xf4372ddf)); + let mut x36: u32 = 0; + let mut x37: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x36, &mut x37, x35, x11, (x25 & 0xc7634d81)); + let mut x38: u32 = 0; + let mut x39: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x38, &mut x39, x37, x13, x25); + let mut x40: u32 = 0; + let mut x41: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x40, &mut x41, x39, x15, x25); + let mut x42: u32 = 0; + let mut x43: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x42, &mut x43, x41, x17, x25); + let mut x44: u32 = 0; + let mut x45: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x44, &mut x45, x43, x19, x25); + let mut x46: u32 = 0; + let mut x47: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x46, &mut x47, x45, x21, x25); + let mut x48: u32 = 0; + let mut x49: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x48, &mut x49, x47, x23, x25); + out1[0] = x26; + out1[1] = x28; + out1[2] = x30; + out1[3] = x32; + out1[4] = x34; + out1[5] = x36; + out1[6] = x38; + out1[7] = x40; + out1[8] = x42; + out1[9] = x44; + out1[10] = x46; + out1[11] = x48; +} + +/// The function fiat_p384_scalar_opp negates a field element in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = -eval (from_montgomery arg1) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p384_scalar_opp(out1: &mut fiat_p384_scalar_montgomery_domain_field_element, arg1: &fiat_p384_scalar_montgomery_domain_field_element) -> () { + let mut x1: u32 = 0; + let mut x2: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1, &mut x2, 0x0, (0x0 as u32), (arg1[0])); + let mut x3: u32 = 0; + let mut x4: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x3, &mut x4, x2, (0x0 as u32), (arg1[1])); + let mut x5: u32 = 0; + let mut x6: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x5, &mut x6, x4, (0x0 as u32), (arg1[2])); + let mut x7: u32 = 0; + let mut x8: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x7, &mut x8, x6, (0x0 as u32), (arg1[3])); + let mut x9: u32 = 0; + let mut x10: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x9, &mut x10, x8, (0x0 as u32), (arg1[4])); + let mut x11: u32 = 0; + let mut x12: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x11, &mut x12, x10, (0x0 as u32), (arg1[5])); + let mut x13: u32 = 0; + let mut x14: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x13, &mut x14, x12, (0x0 as u32), (arg1[6])); + let mut x15: u32 = 0; + let mut x16: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x15, &mut x16, x14, (0x0 as u32), (arg1[7])); + let mut x17: u32 = 0; + let mut x18: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x17, &mut x18, x16, (0x0 as u32), (arg1[8])); + let mut x19: u32 = 0; + let mut x20: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x19, &mut x20, x18, (0x0 as u32), (arg1[9])); + let mut x21: u32 = 0; + let mut x22: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x21, &mut x22, x20, (0x0 as u32), (arg1[10])); + let mut x23: u32 = 0; + let mut x24: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x23, &mut x24, x22, (0x0 as u32), (arg1[11])); + let mut x25: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x25, x24, (0x0 as u32), 0xffffffff); + let mut x26: u32 = 0; + let mut x27: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x26, &mut x27, 0x0, x1, (x25 & 0xccc52973)); + let mut x28: u32 = 0; + let mut x29: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x28, &mut x29, x27, x3, (x25 & 0xecec196a)); + let mut x30: u32 = 0; + let mut x31: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x30, &mut x31, x29, x5, (x25 & 0x48b0a77a)); + let mut x32: u32 = 0; + let mut x33: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x32, &mut x33, x31, x7, (x25 & 0x581a0db2)); + let mut x34: u32 = 0; + let mut x35: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x34, &mut x35, x33, x9, (x25 & 0xf4372ddf)); + let mut x36: u32 = 0; + let mut x37: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x36, &mut x37, x35, x11, (x25 & 0xc7634d81)); + let mut x38: u32 = 0; + let mut x39: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x38, &mut x39, x37, x13, x25); + let mut x40: u32 = 0; + let mut x41: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x40, &mut x41, x39, x15, x25); + let mut x42: u32 = 0; + let mut x43: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x42, &mut x43, x41, x17, x25); + let mut x44: u32 = 0; + let mut x45: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x44, &mut x45, x43, x19, x25); + let mut x46: u32 = 0; + let mut x47: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x46, &mut x47, x45, x21, x25); + let mut x48: u32 = 0; + let mut x49: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x48, &mut x49, x47, x23, x25); + out1[0] = x26; + out1[1] = x28; + out1[2] = x30; + out1[3] = x32; + out1[4] = x34; + out1[5] = x36; + out1[6] = x38; + out1[7] = x40; + out1[8] = x42; + out1[9] = x44; + out1[10] = x46; + out1[11] = x48; +} + +/// The function fiat_p384_scalar_from_montgomery translates a field element out of the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval out1 mod m = (eval arg1 * ((2^32)⁻¹ mod m)^12) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p384_scalar_from_montgomery(out1: &mut fiat_p384_scalar_non_montgomery_domain_field_element, arg1: &fiat_p384_scalar_montgomery_domain_field_element) -> () { + let x1: u32 = (arg1[0]); + let mut x2: u32 = 0; + let mut x3: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x2, &mut x3, x1, 0xe88fdc45); + let mut x4: u32 = 0; + let mut x5: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x4, &mut x5, x2, 0xffffffff); + let mut x6: u32 = 0; + let mut x7: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x6, &mut x7, x2, 0xffffffff); + let mut x8: u32 = 0; + let mut x9: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x8, &mut x9, x2, 0xffffffff); + let mut x10: u32 = 0; + let mut x11: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x10, &mut x11, x2, 0xffffffff); + let mut x12: u32 = 0; + let mut x13: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x12, &mut x13, x2, 0xffffffff); + let mut x14: u32 = 0; + let mut x15: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x14, &mut x15, x2, 0xffffffff); + let mut x16: u32 = 0; + let mut x17: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x16, &mut x17, x2, 0xc7634d81); + let mut x18: u32 = 0; + let mut x19: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x18, &mut x19, x2, 0xf4372ddf); + let mut x20: u32 = 0; + let mut x21: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x20, &mut x21, x2, 0x581a0db2); + let mut x22: u32 = 0; + let mut x23: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x22, &mut x23, x2, 0x48b0a77a); + let mut x24: u32 = 0; + let mut x25: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x24, &mut x25, x2, 0xecec196a); + let mut x26: u32 = 0; + let mut x27: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x26, &mut x27, x2, 0xccc52973); + let mut x28: u32 = 0; + let mut x29: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x28, &mut x29, 0x0, x27, x24); + let mut x30: u32 = 0; + let mut x31: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x30, &mut x31, x29, x25, x22); + let mut x32: u32 = 0; + let mut x33: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x32, &mut x33, x31, x23, x20); + let mut x34: u32 = 0; + let mut x35: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x34, &mut x35, x33, x21, x18); + let mut x36: u32 = 0; + let mut x37: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x36, &mut x37, x35, x19, x16); + let mut x38: u32 = 0; + let mut x39: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x38, &mut x39, x37, x17, x14); + let mut x40: u32 = 0; + let mut x41: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x40, &mut x41, x39, x15, x12); + let mut x42: u32 = 0; + let mut x43: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x42, &mut x43, x41, x13, x10); + let mut x44: u32 = 0; + let mut x45: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x44, &mut x45, x43, x11, x8); + let mut x46: u32 = 0; + let mut x47: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x46, &mut x47, x45, x9, x6); + let mut x48: u32 = 0; + let mut x49: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x48, &mut x49, x47, x7, x4); + let mut x50: u32 = 0; + let mut x51: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x50, &mut x51, 0x0, x1, x26); + let mut x52: u32 = 0; + let mut x53: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x52, &mut x53, x51, (0x0 as u32), x28); + let mut x54: u32 = 0; + let mut x55: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x54, &mut x55, x53, (0x0 as u32), x30); + let mut x56: u32 = 0; + let mut x57: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x56, &mut x57, x55, (0x0 as u32), x32); + let mut x58: u32 = 0; + let mut x59: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x58, &mut x59, x57, (0x0 as u32), x34); + let mut x60: u32 = 0; + let mut x61: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x60, &mut x61, x59, (0x0 as u32), x36); + let mut x62: u32 = 0; + let mut x63: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x62, &mut x63, x61, (0x0 as u32), x38); + let mut x64: u32 = 0; + let mut x65: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x64, &mut x65, x63, (0x0 as u32), x40); + let mut x66: u32 = 0; + let mut x67: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x66, &mut x67, x65, (0x0 as u32), x42); + let mut x68: u32 = 0; + let mut x69: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x68, &mut x69, x67, (0x0 as u32), x44); + let mut x70: u32 = 0; + let mut x71: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x70, &mut x71, x69, (0x0 as u32), x46); + let mut x72: u32 = 0; + let mut x73: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x72, &mut x73, x71, (0x0 as u32), x48); + let mut x74: u32 = 0; + let mut x75: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x74, &mut x75, x73, (0x0 as u32), ((x49 as u32) + x5)); + let mut x76: u32 = 0; + let mut x77: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x76, &mut x77, 0x0, x52, (arg1[1])); + let mut x78: u32 = 0; + let mut x79: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x78, &mut x79, x77, x54, (0x0 as u32)); + let mut x80: u32 = 0; + let mut x81: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x80, &mut x81, x79, x56, (0x0 as u32)); + let mut x82: u32 = 0; + let mut x83: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x82, &mut x83, x81, x58, (0x0 as u32)); + let mut x84: u32 = 0; + let mut x85: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x84, &mut x85, x83, x60, (0x0 as u32)); + let mut x86: u32 = 0; + let mut x87: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x86, &mut x87, x85, x62, (0x0 as u32)); + let mut x88: u32 = 0; + let mut x89: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x88, &mut x89, x87, x64, (0x0 as u32)); + let mut x90: u32 = 0; + let mut x91: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x90, &mut x91, x89, x66, (0x0 as u32)); + let mut x92: u32 = 0; + let mut x93: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x92, &mut x93, x91, x68, (0x0 as u32)); + let mut x94: u32 = 0; + let mut x95: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x94, &mut x95, x93, x70, (0x0 as u32)); + let mut x96: u32 = 0; + let mut x97: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x96, &mut x97, x95, x72, (0x0 as u32)); + let mut x98: u32 = 0; + let mut x99: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x98, &mut x99, x97, x74, (0x0 as u32)); + let mut x100: u32 = 0; + let mut x101: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x100, &mut x101, x76, 0xe88fdc45); + let mut x102: u32 = 0; + let mut x103: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x102, &mut x103, x100, 0xffffffff); + let mut x104: u32 = 0; + let mut x105: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x104, &mut x105, x100, 0xffffffff); + let mut x106: u32 = 0; + let mut x107: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x106, &mut x107, x100, 0xffffffff); + let mut x108: u32 = 0; + let mut x109: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x108, &mut x109, x100, 0xffffffff); + let mut x110: u32 = 0; + let mut x111: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x110, &mut x111, x100, 0xffffffff); + let mut x112: u32 = 0; + let mut x113: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x112, &mut x113, x100, 0xffffffff); + let mut x114: u32 = 0; + let mut x115: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x114, &mut x115, x100, 0xc7634d81); + let mut x116: u32 = 0; + let mut x117: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x116, &mut x117, x100, 0xf4372ddf); + let mut x118: u32 = 0; + let mut x119: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x118, &mut x119, x100, 0x581a0db2); + let mut x120: u32 = 0; + let mut x121: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x120, &mut x121, x100, 0x48b0a77a); + let mut x122: u32 = 0; + let mut x123: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x122, &mut x123, x100, 0xecec196a); + let mut x124: u32 = 0; + let mut x125: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x124, &mut x125, x100, 0xccc52973); + let mut x126: u32 = 0; + let mut x127: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x126, &mut x127, 0x0, x125, x122); + let mut x128: u32 = 0; + let mut x129: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x128, &mut x129, x127, x123, x120); + let mut x130: u32 = 0; + let mut x131: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x130, &mut x131, x129, x121, x118); + let mut x132: u32 = 0; + let mut x133: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x132, &mut x133, x131, x119, x116); + let mut x134: u32 = 0; + let mut x135: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x134, &mut x135, x133, x117, x114); + let mut x136: u32 = 0; + let mut x137: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x136, &mut x137, x135, x115, x112); + let mut x138: u32 = 0; + let mut x139: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x138, &mut x139, x137, x113, x110); + let mut x140: u32 = 0; + let mut x141: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x140, &mut x141, x139, x111, x108); + let mut x142: u32 = 0; + let mut x143: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x142, &mut x143, x141, x109, x106); + let mut x144: u32 = 0; + let mut x145: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x144, &mut x145, x143, x107, x104); + let mut x146: u32 = 0; + let mut x147: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x146, &mut x147, x145, x105, x102); + let mut x148: u32 = 0; + let mut x149: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x148, &mut x149, 0x0, x76, x124); + let mut x150: u32 = 0; + let mut x151: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x150, &mut x151, x149, x78, x126); + let mut x152: u32 = 0; + let mut x153: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x152, &mut x153, x151, x80, x128); + let mut x154: u32 = 0; + let mut x155: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x154, &mut x155, x153, x82, x130); + let mut x156: u32 = 0; + let mut x157: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x156, &mut x157, x155, x84, x132); + let mut x158: u32 = 0; + let mut x159: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x158, &mut x159, x157, x86, x134); + let mut x160: u32 = 0; + let mut x161: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x160, &mut x161, x159, x88, x136); + let mut x162: u32 = 0; + let mut x163: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x162, &mut x163, x161, x90, x138); + let mut x164: u32 = 0; + let mut x165: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x164, &mut x165, x163, x92, x140); + let mut x166: u32 = 0; + let mut x167: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x166, &mut x167, x165, x94, x142); + let mut x168: u32 = 0; + let mut x169: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x168, &mut x169, x167, x96, x144); + let mut x170: u32 = 0; + let mut x171: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x170, &mut x171, x169, x98, x146); + let mut x172: u32 = 0; + let mut x173: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x172, &mut x173, x171, ((x99 as u32) + (x75 as u32)), ((x147 as u32) + x103)); + let mut x174: u32 = 0; + let mut x175: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x174, &mut x175, 0x0, x150, (arg1[2])); + let mut x176: u32 = 0; + let mut x177: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x176, &mut x177, x175, x152, (0x0 as u32)); + let mut x178: u32 = 0; + let mut x179: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x178, &mut x179, x177, x154, (0x0 as u32)); + let mut x180: u32 = 0; + let mut x181: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x180, &mut x181, x179, x156, (0x0 as u32)); + let mut x182: u32 = 0; + let mut x183: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x182, &mut x183, x181, x158, (0x0 as u32)); + let mut x184: u32 = 0; + let mut x185: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x184, &mut x185, x183, x160, (0x0 as u32)); + let mut x186: u32 = 0; + let mut x187: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x186, &mut x187, x185, x162, (0x0 as u32)); + let mut x188: u32 = 0; + let mut x189: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x188, &mut x189, x187, x164, (0x0 as u32)); + let mut x190: u32 = 0; + let mut x191: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x190, &mut x191, x189, x166, (0x0 as u32)); + let mut x192: u32 = 0; + let mut x193: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x192, &mut x193, x191, x168, (0x0 as u32)); + let mut x194: u32 = 0; + let mut x195: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x194, &mut x195, x193, x170, (0x0 as u32)); + let mut x196: u32 = 0; + let mut x197: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x196, &mut x197, x195, x172, (0x0 as u32)); + let mut x198: u32 = 0; + let mut x199: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x198, &mut x199, x174, 0xe88fdc45); + let mut x200: u32 = 0; + let mut x201: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x200, &mut x201, x198, 0xffffffff); + let mut x202: u32 = 0; + let mut x203: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x202, &mut x203, x198, 0xffffffff); + let mut x204: u32 = 0; + let mut x205: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x204, &mut x205, x198, 0xffffffff); + let mut x206: u32 = 0; + let mut x207: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x206, &mut x207, x198, 0xffffffff); + let mut x208: u32 = 0; + let mut x209: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x208, &mut x209, x198, 0xffffffff); + let mut x210: u32 = 0; + let mut x211: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x210, &mut x211, x198, 0xffffffff); + let mut x212: u32 = 0; + let mut x213: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x212, &mut x213, x198, 0xc7634d81); + let mut x214: u32 = 0; + let mut x215: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x214, &mut x215, x198, 0xf4372ddf); + let mut x216: u32 = 0; + let mut x217: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x216, &mut x217, x198, 0x581a0db2); + let mut x218: u32 = 0; + let mut x219: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x218, &mut x219, x198, 0x48b0a77a); + let mut x220: u32 = 0; + let mut x221: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x220, &mut x221, x198, 0xecec196a); + let mut x222: u32 = 0; + let mut x223: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x222, &mut x223, x198, 0xccc52973); + let mut x224: u32 = 0; + let mut x225: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x224, &mut x225, 0x0, x223, x220); + let mut x226: u32 = 0; + let mut x227: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x226, &mut x227, x225, x221, x218); + let mut x228: u32 = 0; + let mut x229: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x228, &mut x229, x227, x219, x216); + let mut x230: u32 = 0; + let mut x231: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x230, &mut x231, x229, x217, x214); + let mut x232: u32 = 0; + let mut x233: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x232, &mut x233, x231, x215, x212); + let mut x234: u32 = 0; + let mut x235: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x234, &mut x235, x233, x213, x210); + let mut x236: u32 = 0; + let mut x237: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x236, &mut x237, x235, x211, x208); + let mut x238: u32 = 0; + let mut x239: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x238, &mut x239, x237, x209, x206); + let mut x240: u32 = 0; + let mut x241: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x240, &mut x241, x239, x207, x204); + let mut x242: u32 = 0; + let mut x243: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x242, &mut x243, x241, x205, x202); + let mut x244: u32 = 0; + let mut x245: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x244, &mut x245, x243, x203, x200); + let mut x246: u32 = 0; + let mut x247: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x246, &mut x247, 0x0, x174, x222); + let mut x248: u32 = 0; + let mut x249: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x248, &mut x249, x247, x176, x224); + let mut x250: u32 = 0; + let mut x251: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x250, &mut x251, x249, x178, x226); + let mut x252: u32 = 0; + let mut x253: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x252, &mut x253, x251, x180, x228); + let mut x254: u32 = 0; + let mut x255: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x254, &mut x255, x253, x182, x230); + let mut x256: u32 = 0; + let mut x257: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x256, &mut x257, x255, x184, x232); + let mut x258: u32 = 0; + let mut x259: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x258, &mut x259, x257, x186, x234); + let mut x260: u32 = 0; + let mut x261: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x260, &mut x261, x259, x188, x236); + let mut x262: u32 = 0; + let mut x263: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x262, &mut x263, x261, x190, x238); + let mut x264: u32 = 0; + let mut x265: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x264, &mut x265, x263, x192, x240); + let mut x266: u32 = 0; + let mut x267: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x266, &mut x267, x265, x194, x242); + let mut x268: u32 = 0; + let mut x269: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x268, &mut x269, x267, x196, x244); + let mut x270: u32 = 0; + let mut x271: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x270, &mut x271, x269, ((x197 as u32) + (x173 as u32)), ((x245 as u32) + x201)); + let mut x272: u32 = 0; + let mut x273: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x272, &mut x273, 0x0, x248, (arg1[3])); + let mut x274: u32 = 0; + let mut x275: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x274, &mut x275, x273, x250, (0x0 as u32)); + let mut x276: u32 = 0; + let mut x277: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x276, &mut x277, x275, x252, (0x0 as u32)); + let mut x278: u32 = 0; + let mut x279: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x278, &mut x279, x277, x254, (0x0 as u32)); + let mut x280: u32 = 0; + let mut x281: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x280, &mut x281, x279, x256, (0x0 as u32)); + let mut x282: u32 = 0; + let mut x283: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x282, &mut x283, x281, x258, (0x0 as u32)); + let mut x284: u32 = 0; + let mut x285: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x284, &mut x285, x283, x260, (0x0 as u32)); + let mut x286: u32 = 0; + let mut x287: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x286, &mut x287, x285, x262, (0x0 as u32)); + let mut x288: u32 = 0; + let mut x289: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x288, &mut x289, x287, x264, (0x0 as u32)); + let mut x290: u32 = 0; + let mut x291: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x290, &mut x291, x289, x266, (0x0 as u32)); + let mut x292: u32 = 0; + let mut x293: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x292, &mut x293, x291, x268, (0x0 as u32)); + let mut x294: u32 = 0; + let mut x295: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x294, &mut x295, x293, x270, (0x0 as u32)); + let mut x296: u32 = 0; + let mut x297: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x296, &mut x297, x272, 0xe88fdc45); + let mut x298: u32 = 0; + let mut x299: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x298, &mut x299, x296, 0xffffffff); + let mut x300: u32 = 0; + let mut x301: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x300, &mut x301, x296, 0xffffffff); + let mut x302: u32 = 0; + let mut x303: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x302, &mut x303, x296, 0xffffffff); + let mut x304: u32 = 0; + let mut x305: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x304, &mut x305, x296, 0xffffffff); + let mut x306: u32 = 0; + let mut x307: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x306, &mut x307, x296, 0xffffffff); + let mut x308: u32 = 0; + let mut x309: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x308, &mut x309, x296, 0xffffffff); + let mut x310: u32 = 0; + let mut x311: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x310, &mut x311, x296, 0xc7634d81); + let mut x312: u32 = 0; + let mut x313: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x312, &mut x313, x296, 0xf4372ddf); + let mut x314: u32 = 0; + let mut x315: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x314, &mut x315, x296, 0x581a0db2); + let mut x316: u32 = 0; + let mut x317: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x316, &mut x317, x296, 0x48b0a77a); + let mut x318: u32 = 0; + let mut x319: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x318, &mut x319, x296, 0xecec196a); + let mut x320: u32 = 0; + let mut x321: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x320, &mut x321, x296, 0xccc52973); + let mut x322: u32 = 0; + let mut x323: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x322, &mut x323, 0x0, x321, x318); + let mut x324: u32 = 0; + let mut x325: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x324, &mut x325, x323, x319, x316); + let mut x326: u32 = 0; + let mut x327: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x326, &mut x327, x325, x317, x314); + let mut x328: u32 = 0; + let mut x329: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x328, &mut x329, x327, x315, x312); + let mut x330: u32 = 0; + let mut x331: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x330, &mut x331, x329, x313, x310); + let mut x332: u32 = 0; + let mut x333: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x332, &mut x333, x331, x311, x308); + let mut x334: u32 = 0; + let mut x335: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x334, &mut x335, x333, x309, x306); + let mut x336: u32 = 0; + let mut x337: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x336, &mut x337, x335, x307, x304); + let mut x338: u32 = 0; + let mut x339: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x338, &mut x339, x337, x305, x302); + let mut x340: u32 = 0; + let mut x341: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x340, &mut x341, x339, x303, x300); + let mut x342: u32 = 0; + let mut x343: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x342, &mut x343, x341, x301, x298); + let mut x344: u32 = 0; + let mut x345: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x344, &mut x345, 0x0, x272, x320); + let mut x346: u32 = 0; + let mut x347: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x346, &mut x347, x345, x274, x322); + let mut x348: u32 = 0; + let mut x349: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x348, &mut x349, x347, x276, x324); + let mut x350: u32 = 0; + let mut x351: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x350, &mut x351, x349, x278, x326); + let mut x352: u32 = 0; + let mut x353: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x352, &mut x353, x351, x280, x328); + let mut x354: u32 = 0; + let mut x355: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x354, &mut x355, x353, x282, x330); + let mut x356: u32 = 0; + let mut x357: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x356, &mut x357, x355, x284, x332); + let mut x358: u32 = 0; + let mut x359: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x358, &mut x359, x357, x286, x334); + let mut x360: u32 = 0; + let mut x361: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x360, &mut x361, x359, x288, x336); + let mut x362: u32 = 0; + let mut x363: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x362, &mut x363, x361, x290, x338); + let mut x364: u32 = 0; + let mut x365: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x364, &mut x365, x363, x292, x340); + let mut x366: u32 = 0; + let mut x367: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x366, &mut x367, x365, x294, x342); + let mut x368: u32 = 0; + let mut x369: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x368, &mut x369, x367, ((x295 as u32) + (x271 as u32)), ((x343 as u32) + x299)); + let mut x370: u32 = 0; + let mut x371: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x370, &mut x371, 0x0, x346, (arg1[4])); + let mut x372: u32 = 0; + let mut x373: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x372, &mut x373, x371, x348, (0x0 as u32)); + let mut x374: u32 = 0; + let mut x375: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x374, &mut x375, x373, x350, (0x0 as u32)); + let mut x376: u32 = 0; + let mut x377: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x376, &mut x377, x375, x352, (0x0 as u32)); + let mut x378: u32 = 0; + let mut x379: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x378, &mut x379, x377, x354, (0x0 as u32)); + let mut x380: u32 = 0; + let mut x381: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x380, &mut x381, x379, x356, (0x0 as u32)); + let mut x382: u32 = 0; + let mut x383: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x382, &mut x383, x381, x358, (0x0 as u32)); + let mut x384: u32 = 0; + let mut x385: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x384, &mut x385, x383, x360, (0x0 as u32)); + let mut x386: u32 = 0; + let mut x387: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x386, &mut x387, x385, x362, (0x0 as u32)); + let mut x388: u32 = 0; + let mut x389: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x388, &mut x389, x387, x364, (0x0 as u32)); + let mut x390: u32 = 0; + let mut x391: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x390, &mut x391, x389, x366, (0x0 as u32)); + let mut x392: u32 = 0; + let mut x393: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x392, &mut x393, x391, x368, (0x0 as u32)); + let mut x394: u32 = 0; + let mut x395: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x394, &mut x395, x370, 0xe88fdc45); + let mut x396: u32 = 0; + let mut x397: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x396, &mut x397, x394, 0xffffffff); + let mut x398: u32 = 0; + let mut x399: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x398, &mut x399, x394, 0xffffffff); + let mut x400: u32 = 0; + let mut x401: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x400, &mut x401, x394, 0xffffffff); + let mut x402: u32 = 0; + let mut x403: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x402, &mut x403, x394, 0xffffffff); + let mut x404: u32 = 0; + let mut x405: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x404, &mut x405, x394, 0xffffffff); + let mut x406: u32 = 0; + let mut x407: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x406, &mut x407, x394, 0xffffffff); + let mut x408: u32 = 0; + let mut x409: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x408, &mut x409, x394, 0xc7634d81); + let mut x410: u32 = 0; + let mut x411: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x410, &mut x411, x394, 0xf4372ddf); + let mut x412: u32 = 0; + let mut x413: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x412, &mut x413, x394, 0x581a0db2); + let mut x414: u32 = 0; + let mut x415: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x414, &mut x415, x394, 0x48b0a77a); + let mut x416: u32 = 0; + let mut x417: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x416, &mut x417, x394, 0xecec196a); + let mut x418: u32 = 0; + let mut x419: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x418, &mut x419, x394, 0xccc52973); + let mut x420: u32 = 0; + let mut x421: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x420, &mut x421, 0x0, x419, x416); + let mut x422: u32 = 0; + let mut x423: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x422, &mut x423, x421, x417, x414); + let mut x424: u32 = 0; + let mut x425: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x424, &mut x425, x423, x415, x412); + let mut x426: u32 = 0; + let mut x427: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x426, &mut x427, x425, x413, x410); + let mut x428: u32 = 0; + let mut x429: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x428, &mut x429, x427, x411, x408); + let mut x430: u32 = 0; + let mut x431: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x430, &mut x431, x429, x409, x406); + let mut x432: u32 = 0; + let mut x433: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x432, &mut x433, x431, x407, x404); + let mut x434: u32 = 0; + let mut x435: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x434, &mut x435, x433, x405, x402); + let mut x436: u32 = 0; + let mut x437: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x436, &mut x437, x435, x403, x400); + let mut x438: u32 = 0; + let mut x439: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x438, &mut x439, x437, x401, x398); + let mut x440: u32 = 0; + let mut x441: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x440, &mut x441, x439, x399, x396); + let mut x442: u32 = 0; + let mut x443: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x442, &mut x443, 0x0, x370, x418); + let mut x444: u32 = 0; + let mut x445: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x444, &mut x445, x443, x372, x420); + let mut x446: u32 = 0; + let mut x447: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x446, &mut x447, x445, x374, x422); + let mut x448: u32 = 0; + let mut x449: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x448, &mut x449, x447, x376, x424); + let mut x450: u32 = 0; + let mut x451: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x450, &mut x451, x449, x378, x426); + let mut x452: u32 = 0; + let mut x453: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x452, &mut x453, x451, x380, x428); + let mut x454: u32 = 0; + let mut x455: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x454, &mut x455, x453, x382, x430); + let mut x456: u32 = 0; + let mut x457: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x456, &mut x457, x455, x384, x432); + let mut x458: u32 = 0; + let mut x459: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x458, &mut x459, x457, x386, x434); + let mut x460: u32 = 0; + let mut x461: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x460, &mut x461, x459, x388, x436); + let mut x462: u32 = 0; + let mut x463: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x462, &mut x463, x461, x390, x438); + let mut x464: u32 = 0; + let mut x465: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x464, &mut x465, x463, x392, x440); + let mut x466: u32 = 0; + let mut x467: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x466, &mut x467, x465, ((x393 as u32) + (x369 as u32)), ((x441 as u32) + x397)); + let mut x468: u32 = 0; + let mut x469: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x468, &mut x469, 0x0, x444, (arg1[5])); + let mut x470: u32 = 0; + let mut x471: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x470, &mut x471, x469, x446, (0x0 as u32)); + let mut x472: u32 = 0; + let mut x473: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x472, &mut x473, x471, x448, (0x0 as u32)); + let mut x474: u32 = 0; + let mut x475: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x474, &mut x475, x473, x450, (0x0 as u32)); + let mut x476: u32 = 0; + let mut x477: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x476, &mut x477, x475, x452, (0x0 as u32)); + let mut x478: u32 = 0; + let mut x479: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x478, &mut x479, x477, x454, (0x0 as u32)); + let mut x480: u32 = 0; + let mut x481: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x480, &mut x481, x479, x456, (0x0 as u32)); + let mut x482: u32 = 0; + let mut x483: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x482, &mut x483, x481, x458, (0x0 as u32)); + let mut x484: u32 = 0; + let mut x485: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x484, &mut x485, x483, x460, (0x0 as u32)); + let mut x486: u32 = 0; + let mut x487: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x486, &mut x487, x485, x462, (0x0 as u32)); + let mut x488: u32 = 0; + let mut x489: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x488, &mut x489, x487, x464, (0x0 as u32)); + let mut x490: u32 = 0; + let mut x491: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x490, &mut x491, x489, x466, (0x0 as u32)); + let mut x492: u32 = 0; + let mut x493: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x492, &mut x493, x468, 0xe88fdc45); + let mut x494: u32 = 0; + let mut x495: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x494, &mut x495, x492, 0xffffffff); + let mut x496: u32 = 0; + let mut x497: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x496, &mut x497, x492, 0xffffffff); + let mut x498: u32 = 0; + let mut x499: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x498, &mut x499, x492, 0xffffffff); + let mut x500: u32 = 0; + let mut x501: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x500, &mut x501, x492, 0xffffffff); + let mut x502: u32 = 0; + let mut x503: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x502, &mut x503, x492, 0xffffffff); + let mut x504: u32 = 0; + let mut x505: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x504, &mut x505, x492, 0xffffffff); + let mut x506: u32 = 0; + let mut x507: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x506, &mut x507, x492, 0xc7634d81); + let mut x508: u32 = 0; + let mut x509: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x508, &mut x509, x492, 0xf4372ddf); + let mut x510: u32 = 0; + let mut x511: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x510, &mut x511, x492, 0x581a0db2); + let mut x512: u32 = 0; + let mut x513: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x512, &mut x513, x492, 0x48b0a77a); + let mut x514: u32 = 0; + let mut x515: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x514, &mut x515, x492, 0xecec196a); + let mut x516: u32 = 0; + let mut x517: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x516, &mut x517, x492, 0xccc52973); + let mut x518: u32 = 0; + let mut x519: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x518, &mut x519, 0x0, x517, x514); + let mut x520: u32 = 0; + let mut x521: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x520, &mut x521, x519, x515, x512); + let mut x522: u32 = 0; + let mut x523: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x522, &mut x523, x521, x513, x510); + let mut x524: u32 = 0; + let mut x525: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x524, &mut x525, x523, x511, x508); + let mut x526: u32 = 0; + let mut x527: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x526, &mut x527, x525, x509, x506); + let mut x528: u32 = 0; + let mut x529: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x528, &mut x529, x527, x507, x504); + let mut x530: u32 = 0; + let mut x531: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x530, &mut x531, x529, x505, x502); + let mut x532: u32 = 0; + let mut x533: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x532, &mut x533, x531, x503, x500); + let mut x534: u32 = 0; + let mut x535: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x534, &mut x535, x533, x501, x498); + let mut x536: u32 = 0; + let mut x537: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x536, &mut x537, x535, x499, x496); + let mut x538: u32 = 0; + let mut x539: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x538, &mut x539, x537, x497, x494); + let mut x540: u32 = 0; + let mut x541: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x540, &mut x541, 0x0, x468, x516); + let mut x542: u32 = 0; + let mut x543: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x542, &mut x543, x541, x470, x518); + let mut x544: u32 = 0; + let mut x545: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x544, &mut x545, x543, x472, x520); + let mut x546: u32 = 0; + let mut x547: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x546, &mut x547, x545, x474, x522); + let mut x548: u32 = 0; + let mut x549: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x548, &mut x549, x547, x476, x524); + let mut x550: u32 = 0; + let mut x551: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x550, &mut x551, x549, x478, x526); + let mut x552: u32 = 0; + let mut x553: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x552, &mut x553, x551, x480, x528); + let mut x554: u32 = 0; + let mut x555: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x554, &mut x555, x553, x482, x530); + let mut x556: u32 = 0; + let mut x557: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x556, &mut x557, x555, x484, x532); + let mut x558: u32 = 0; + let mut x559: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x558, &mut x559, x557, x486, x534); + let mut x560: u32 = 0; + let mut x561: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x560, &mut x561, x559, x488, x536); + let mut x562: u32 = 0; + let mut x563: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x562, &mut x563, x561, x490, x538); + let mut x564: u32 = 0; + let mut x565: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x564, &mut x565, x563, ((x491 as u32) + (x467 as u32)), ((x539 as u32) + x495)); + let mut x566: u32 = 0; + let mut x567: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x566, &mut x567, 0x0, x542, (arg1[6])); + let mut x568: u32 = 0; + let mut x569: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x568, &mut x569, x567, x544, (0x0 as u32)); + let mut x570: u32 = 0; + let mut x571: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x570, &mut x571, x569, x546, (0x0 as u32)); + let mut x572: u32 = 0; + let mut x573: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x572, &mut x573, x571, x548, (0x0 as u32)); + let mut x574: u32 = 0; + let mut x575: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x574, &mut x575, x573, x550, (0x0 as u32)); + let mut x576: u32 = 0; + let mut x577: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x576, &mut x577, x575, x552, (0x0 as u32)); + let mut x578: u32 = 0; + let mut x579: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x578, &mut x579, x577, x554, (0x0 as u32)); + let mut x580: u32 = 0; + let mut x581: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x580, &mut x581, x579, x556, (0x0 as u32)); + let mut x582: u32 = 0; + let mut x583: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x582, &mut x583, x581, x558, (0x0 as u32)); + let mut x584: u32 = 0; + let mut x585: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x584, &mut x585, x583, x560, (0x0 as u32)); + let mut x586: u32 = 0; + let mut x587: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x586, &mut x587, x585, x562, (0x0 as u32)); + let mut x588: u32 = 0; + let mut x589: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x588, &mut x589, x587, x564, (0x0 as u32)); + let mut x590: u32 = 0; + let mut x591: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x590, &mut x591, x566, 0xe88fdc45); + let mut x592: u32 = 0; + let mut x593: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x592, &mut x593, x590, 0xffffffff); + let mut x594: u32 = 0; + let mut x595: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x594, &mut x595, x590, 0xffffffff); + let mut x596: u32 = 0; + let mut x597: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x596, &mut x597, x590, 0xffffffff); + let mut x598: u32 = 0; + let mut x599: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x598, &mut x599, x590, 0xffffffff); + let mut x600: u32 = 0; + let mut x601: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x600, &mut x601, x590, 0xffffffff); + let mut x602: u32 = 0; + let mut x603: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x602, &mut x603, x590, 0xffffffff); + let mut x604: u32 = 0; + let mut x605: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x604, &mut x605, x590, 0xc7634d81); + let mut x606: u32 = 0; + let mut x607: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x606, &mut x607, x590, 0xf4372ddf); + let mut x608: u32 = 0; + let mut x609: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x608, &mut x609, x590, 0x581a0db2); + let mut x610: u32 = 0; + let mut x611: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x610, &mut x611, x590, 0x48b0a77a); + let mut x612: u32 = 0; + let mut x613: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x612, &mut x613, x590, 0xecec196a); + let mut x614: u32 = 0; + let mut x615: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x614, &mut x615, x590, 0xccc52973); + let mut x616: u32 = 0; + let mut x617: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x616, &mut x617, 0x0, x615, x612); + let mut x618: u32 = 0; + let mut x619: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x618, &mut x619, x617, x613, x610); + let mut x620: u32 = 0; + let mut x621: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x620, &mut x621, x619, x611, x608); + let mut x622: u32 = 0; + let mut x623: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x622, &mut x623, x621, x609, x606); + let mut x624: u32 = 0; + let mut x625: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x624, &mut x625, x623, x607, x604); + let mut x626: u32 = 0; + let mut x627: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x626, &mut x627, x625, x605, x602); + let mut x628: u32 = 0; + let mut x629: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x628, &mut x629, x627, x603, x600); + let mut x630: u32 = 0; + let mut x631: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x630, &mut x631, x629, x601, x598); + let mut x632: u32 = 0; + let mut x633: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x632, &mut x633, x631, x599, x596); + let mut x634: u32 = 0; + let mut x635: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x634, &mut x635, x633, x597, x594); + let mut x636: u32 = 0; + let mut x637: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x636, &mut x637, x635, x595, x592); + let mut x638: u32 = 0; + let mut x639: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x638, &mut x639, 0x0, x566, x614); + let mut x640: u32 = 0; + let mut x641: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x640, &mut x641, x639, x568, x616); + let mut x642: u32 = 0; + let mut x643: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x642, &mut x643, x641, x570, x618); + let mut x644: u32 = 0; + let mut x645: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x644, &mut x645, x643, x572, x620); + let mut x646: u32 = 0; + let mut x647: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x646, &mut x647, x645, x574, x622); + let mut x648: u32 = 0; + let mut x649: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x648, &mut x649, x647, x576, x624); + let mut x650: u32 = 0; + let mut x651: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x650, &mut x651, x649, x578, x626); + let mut x652: u32 = 0; + let mut x653: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x652, &mut x653, x651, x580, x628); + let mut x654: u32 = 0; + let mut x655: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x654, &mut x655, x653, x582, x630); + let mut x656: u32 = 0; + let mut x657: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x656, &mut x657, x655, x584, x632); + let mut x658: u32 = 0; + let mut x659: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x658, &mut x659, x657, x586, x634); + let mut x660: u32 = 0; + let mut x661: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x660, &mut x661, x659, x588, x636); + let mut x662: u32 = 0; + let mut x663: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x662, &mut x663, x661, ((x589 as u32) + (x565 as u32)), ((x637 as u32) + x593)); + let mut x664: u32 = 0; + let mut x665: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x664, &mut x665, 0x0, x640, (arg1[7])); + let mut x666: u32 = 0; + let mut x667: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x666, &mut x667, x665, x642, (0x0 as u32)); + let mut x668: u32 = 0; + let mut x669: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x668, &mut x669, x667, x644, (0x0 as u32)); + let mut x670: u32 = 0; + let mut x671: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x670, &mut x671, x669, x646, (0x0 as u32)); + let mut x672: u32 = 0; + let mut x673: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x672, &mut x673, x671, x648, (0x0 as u32)); + let mut x674: u32 = 0; + let mut x675: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x674, &mut x675, x673, x650, (0x0 as u32)); + let mut x676: u32 = 0; + let mut x677: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x676, &mut x677, x675, x652, (0x0 as u32)); + let mut x678: u32 = 0; + let mut x679: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x678, &mut x679, x677, x654, (0x0 as u32)); + let mut x680: u32 = 0; + let mut x681: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x680, &mut x681, x679, x656, (0x0 as u32)); + let mut x682: u32 = 0; + let mut x683: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x682, &mut x683, x681, x658, (0x0 as u32)); + let mut x684: u32 = 0; + let mut x685: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x684, &mut x685, x683, x660, (0x0 as u32)); + let mut x686: u32 = 0; + let mut x687: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x686, &mut x687, x685, x662, (0x0 as u32)); + let mut x688: u32 = 0; + let mut x689: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x688, &mut x689, x664, 0xe88fdc45); + let mut x690: u32 = 0; + let mut x691: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x690, &mut x691, x688, 0xffffffff); + let mut x692: u32 = 0; + let mut x693: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x692, &mut x693, x688, 0xffffffff); + let mut x694: u32 = 0; + let mut x695: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x694, &mut x695, x688, 0xffffffff); + let mut x696: u32 = 0; + let mut x697: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x696, &mut x697, x688, 0xffffffff); + let mut x698: u32 = 0; + let mut x699: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x698, &mut x699, x688, 0xffffffff); + let mut x700: u32 = 0; + let mut x701: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x700, &mut x701, x688, 0xffffffff); + let mut x702: u32 = 0; + let mut x703: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x702, &mut x703, x688, 0xc7634d81); + let mut x704: u32 = 0; + let mut x705: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x704, &mut x705, x688, 0xf4372ddf); + let mut x706: u32 = 0; + let mut x707: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x706, &mut x707, x688, 0x581a0db2); + let mut x708: u32 = 0; + let mut x709: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x708, &mut x709, x688, 0x48b0a77a); + let mut x710: u32 = 0; + let mut x711: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x710, &mut x711, x688, 0xecec196a); + let mut x712: u32 = 0; + let mut x713: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x712, &mut x713, x688, 0xccc52973); + let mut x714: u32 = 0; + let mut x715: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x714, &mut x715, 0x0, x713, x710); + let mut x716: u32 = 0; + let mut x717: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x716, &mut x717, x715, x711, x708); + let mut x718: u32 = 0; + let mut x719: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x718, &mut x719, x717, x709, x706); + let mut x720: u32 = 0; + let mut x721: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x720, &mut x721, x719, x707, x704); + let mut x722: u32 = 0; + let mut x723: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x722, &mut x723, x721, x705, x702); + let mut x724: u32 = 0; + let mut x725: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x724, &mut x725, x723, x703, x700); + let mut x726: u32 = 0; + let mut x727: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x726, &mut x727, x725, x701, x698); + let mut x728: u32 = 0; + let mut x729: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x728, &mut x729, x727, x699, x696); + let mut x730: u32 = 0; + let mut x731: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x730, &mut x731, x729, x697, x694); + let mut x732: u32 = 0; + let mut x733: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x732, &mut x733, x731, x695, x692); + let mut x734: u32 = 0; + let mut x735: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x734, &mut x735, x733, x693, x690); + let mut x736: u32 = 0; + let mut x737: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x736, &mut x737, 0x0, x664, x712); + let mut x738: u32 = 0; + let mut x739: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x738, &mut x739, x737, x666, x714); + let mut x740: u32 = 0; + let mut x741: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x740, &mut x741, x739, x668, x716); + let mut x742: u32 = 0; + let mut x743: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x742, &mut x743, x741, x670, x718); + let mut x744: u32 = 0; + let mut x745: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x744, &mut x745, x743, x672, x720); + let mut x746: u32 = 0; + let mut x747: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x746, &mut x747, x745, x674, x722); + let mut x748: u32 = 0; + let mut x749: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x748, &mut x749, x747, x676, x724); + let mut x750: u32 = 0; + let mut x751: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x750, &mut x751, x749, x678, x726); + let mut x752: u32 = 0; + let mut x753: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x752, &mut x753, x751, x680, x728); + let mut x754: u32 = 0; + let mut x755: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x754, &mut x755, x753, x682, x730); + let mut x756: u32 = 0; + let mut x757: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x756, &mut x757, x755, x684, x732); + let mut x758: u32 = 0; + let mut x759: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x758, &mut x759, x757, x686, x734); + let mut x760: u32 = 0; + let mut x761: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x760, &mut x761, x759, ((x687 as u32) + (x663 as u32)), ((x735 as u32) + x691)); + let mut x762: u32 = 0; + let mut x763: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x762, &mut x763, 0x0, x738, (arg1[8])); + let mut x764: u32 = 0; + let mut x765: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x764, &mut x765, x763, x740, (0x0 as u32)); + let mut x766: u32 = 0; + let mut x767: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x766, &mut x767, x765, x742, (0x0 as u32)); + let mut x768: u32 = 0; + let mut x769: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x768, &mut x769, x767, x744, (0x0 as u32)); + let mut x770: u32 = 0; + let mut x771: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x770, &mut x771, x769, x746, (0x0 as u32)); + let mut x772: u32 = 0; + let mut x773: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x772, &mut x773, x771, x748, (0x0 as u32)); + let mut x774: u32 = 0; + let mut x775: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x774, &mut x775, x773, x750, (0x0 as u32)); + let mut x776: u32 = 0; + let mut x777: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x776, &mut x777, x775, x752, (0x0 as u32)); + let mut x778: u32 = 0; + let mut x779: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x778, &mut x779, x777, x754, (0x0 as u32)); + let mut x780: u32 = 0; + let mut x781: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x780, &mut x781, x779, x756, (0x0 as u32)); + let mut x782: u32 = 0; + let mut x783: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x782, &mut x783, x781, x758, (0x0 as u32)); + let mut x784: u32 = 0; + let mut x785: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x784, &mut x785, x783, x760, (0x0 as u32)); + let mut x786: u32 = 0; + let mut x787: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x786, &mut x787, x762, 0xe88fdc45); + let mut x788: u32 = 0; + let mut x789: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x788, &mut x789, x786, 0xffffffff); + let mut x790: u32 = 0; + let mut x791: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x790, &mut x791, x786, 0xffffffff); + let mut x792: u32 = 0; + let mut x793: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x792, &mut x793, x786, 0xffffffff); + let mut x794: u32 = 0; + let mut x795: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x794, &mut x795, x786, 0xffffffff); + let mut x796: u32 = 0; + let mut x797: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x796, &mut x797, x786, 0xffffffff); + let mut x798: u32 = 0; + let mut x799: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x798, &mut x799, x786, 0xffffffff); + let mut x800: u32 = 0; + let mut x801: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x800, &mut x801, x786, 0xc7634d81); + let mut x802: u32 = 0; + let mut x803: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x802, &mut x803, x786, 0xf4372ddf); + let mut x804: u32 = 0; + let mut x805: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x804, &mut x805, x786, 0x581a0db2); + let mut x806: u32 = 0; + let mut x807: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x806, &mut x807, x786, 0x48b0a77a); + let mut x808: u32 = 0; + let mut x809: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x808, &mut x809, x786, 0xecec196a); + let mut x810: u32 = 0; + let mut x811: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x810, &mut x811, x786, 0xccc52973); + let mut x812: u32 = 0; + let mut x813: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x812, &mut x813, 0x0, x811, x808); + let mut x814: u32 = 0; + let mut x815: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x814, &mut x815, x813, x809, x806); + let mut x816: u32 = 0; + let mut x817: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x816, &mut x817, x815, x807, x804); + let mut x818: u32 = 0; + let mut x819: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x818, &mut x819, x817, x805, x802); + let mut x820: u32 = 0; + let mut x821: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x820, &mut x821, x819, x803, x800); + let mut x822: u32 = 0; + let mut x823: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x822, &mut x823, x821, x801, x798); + let mut x824: u32 = 0; + let mut x825: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x824, &mut x825, x823, x799, x796); + let mut x826: u32 = 0; + let mut x827: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x826, &mut x827, x825, x797, x794); + let mut x828: u32 = 0; + let mut x829: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x828, &mut x829, x827, x795, x792); + let mut x830: u32 = 0; + let mut x831: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x830, &mut x831, x829, x793, x790); + let mut x832: u32 = 0; + let mut x833: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x832, &mut x833, x831, x791, x788); + let mut x834: u32 = 0; + let mut x835: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x834, &mut x835, 0x0, x762, x810); + let mut x836: u32 = 0; + let mut x837: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x836, &mut x837, x835, x764, x812); + let mut x838: u32 = 0; + let mut x839: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x838, &mut x839, x837, x766, x814); + let mut x840: u32 = 0; + let mut x841: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x840, &mut x841, x839, x768, x816); + let mut x842: u32 = 0; + let mut x843: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x842, &mut x843, x841, x770, x818); + let mut x844: u32 = 0; + let mut x845: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x844, &mut x845, x843, x772, x820); + let mut x846: u32 = 0; + let mut x847: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x846, &mut x847, x845, x774, x822); + let mut x848: u32 = 0; + let mut x849: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x848, &mut x849, x847, x776, x824); + let mut x850: u32 = 0; + let mut x851: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x850, &mut x851, x849, x778, x826); + let mut x852: u32 = 0; + let mut x853: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x852, &mut x853, x851, x780, x828); + let mut x854: u32 = 0; + let mut x855: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x854, &mut x855, x853, x782, x830); + let mut x856: u32 = 0; + let mut x857: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x856, &mut x857, x855, x784, x832); + let mut x858: u32 = 0; + let mut x859: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x858, &mut x859, x857, ((x785 as u32) + (x761 as u32)), ((x833 as u32) + x789)); + let mut x860: u32 = 0; + let mut x861: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x860, &mut x861, 0x0, x836, (arg1[9])); + let mut x862: u32 = 0; + let mut x863: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x862, &mut x863, x861, x838, (0x0 as u32)); + let mut x864: u32 = 0; + let mut x865: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x864, &mut x865, x863, x840, (0x0 as u32)); + let mut x866: u32 = 0; + let mut x867: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x866, &mut x867, x865, x842, (0x0 as u32)); + let mut x868: u32 = 0; + let mut x869: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x868, &mut x869, x867, x844, (0x0 as u32)); + let mut x870: u32 = 0; + let mut x871: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x870, &mut x871, x869, x846, (0x0 as u32)); + let mut x872: u32 = 0; + let mut x873: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x872, &mut x873, x871, x848, (0x0 as u32)); + let mut x874: u32 = 0; + let mut x875: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x874, &mut x875, x873, x850, (0x0 as u32)); + let mut x876: u32 = 0; + let mut x877: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x876, &mut x877, x875, x852, (0x0 as u32)); + let mut x878: u32 = 0; + let mut x879: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x878, &mut x879, x877, x854, (0x0 as u32)); + let mut x880: u32 = 0; + let mut x881: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x880, &mut x881, x879, x856, (0x0 as u32)); + let mut x882: u32 = 0; + let mut x883: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x882, &mut x883, x881, x858, (0x0 as u32)); + let mut x884: u32 = 0; + let mut x885: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x884, &mut x885, x860, 0xe88fdc45); + let mut x886: u32 = 0; + let mut x887: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x886, &mut x887, x884, 0xffffffff); + let mut x888: u32 = 0; + let mut x889: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x888, &mut x889, x884, 0xffffffff); + let mut x890: u32 = 0; + let mut x891: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x890, &mut x891, x884, 0xffffffff); + let mut x892: u32 = 0; + let mut x893: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x892, &mut x893, x884, 0xffffffff); + let mut x894: u32 = 0; + let mut x895: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x894, &mut x895, x884, 0xffffffff); + let mut x896: u32 = 0; + let mut x897: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x896, &mut x897, x884, 0xffffffff); + let mut x898: u32 = 0; + let mut x899: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x898, &mut x899, x884, 0xc7634d81); + let mut x900: u32 = 0; + let mut x901: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x900, &mut x901, x884, 0xf4372ddf); + let mut x902: u32 = 0; + let mut x903: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x902, &mut x903, x884, 0x581a0db2); + let mut x904: u32 = 0; + let mut x905: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x904, &mut x905, x884, 0x48b0a77a); + let mut x906: u32 = 0; + let mut x907: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x906, &mut x907, x884, 0xecec196a); + let mut x908: u32 = 0; + let mut x909: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x908, &mut x909, x884, 0xccc52973); + let mut x910: u32 = 0; + let mut x911: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x910, &mut x911, 0x0, x909, x906); + let mut x912: u32 = 0; + let mut x913: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x912, &mut x913, x911, x907, x904); + let mut x914: u32 = 0; + let mut x915: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x914, &mut x915, x913, x905, x902); + let mut x916: u32 = 0; + let mut x917: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x916, &mut x917, x915, x903, x900); + let mut x918: u32 = 0; + let mut x919: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x918, &mut x919, x917, x901, x898); + let mut x920: u32 = 0; + let mut x921: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x920, &mut x921, x919, x899, x896); + let mut x922: u32 = 0; + let mut x923: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x922, &mut x923, x921, x897, x894); + let mut x924: u32 = 0; + let mut x925: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x924, &mut x925, x923, x895, x892); + let mut x926: u32 = 0; + let mut x927: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x926, &mut x927, x925, x893, x890); + let mut x928: u32 = 0; + let mut x929: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x928, &mut x929, x927, x891, x888); + let mut x930: u32 = 0; + let mut x931: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x930, &mut x931, x929, x889, x886); + let mut x932: u32 = 0; + let mut x933: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x932, &mut x933, 0x0, x860, x908); + let mut x934: u32 = 0; + let mut x935: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x934, &mut x935, x933, x862, x910); + let mut x936: u32 = 0; + let mut x937: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x936, &mut x937, x935, x864, x912); + let mut x938: u32 = 0; + let mut x939: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x938, &mut x939, x937, x866, x914); + let mut x940: u32 = 0; + let mut x941: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x940, &mut x941, x939, x868, x916); + let mut x942: u32 = 0; + let mut x943: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x942, &mut x943, x941, x870, x918); + let mut x944: u32 = 0; + let mut x945: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x944, &mut x945, x943, x872, x920); + let mut x946: u32 = 0; + let mut x947: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x946, &mut x947, x945, x874, x922); + let mut x948: u32 = 0; + let mut x949: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x948, &mut x949, x947, x876, x924); + let mut x950: u32 = 0; + let mut x951: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x950, &mut x951, x949, x878, x926); + let mut x952: u32 = 0; + let mut x953: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x952, &mut x953, x951, x880, x928); + let mut x954: u32 = 0; + let mut x955: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x954, &mut x955, x953, x882, x930); + let mut x956: u32 = 0; + let mut x957: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x956, &mut x957, x955, ((x883 as u32) + (x859 as u32)), ((x931 as u32) + x887)); + let mut x958: u32 = 0; + let mut x959: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x958, &mut x959, 0x0, x934, (arg1[10])); + let mut x960: u32 = 0; + let mut x961: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x960, &mut x961, x959, x936, (0x0 as u32)); + let mut x962: u32 = 0; + let mut x963: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x962, &mut x963, x961, x938, (0x0 as u32)); + let mut x964: u32 = 0; + let mut x965: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x964, &mut x965, x963, x940, (0x0 as u32)); + let mut x966: u32 = 0; + let mut x967: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x966, &mut x967, x965, x942, (0x0 as u32)); + let mut x968: u32 = 0; + let mut x969: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x968, &mut x969, x967, x944, (0x0 as u32)); + let mut x970: u32 = 0; + let mut x971: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x970, &mut x971, x969, x946, (0x0 as u32)); + let mut x972: u32 = 0; + let mut x973: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x972, &mut x973, x971, x948, (0x0 as u32)); + let mut x974: u32 = 0; + let mut x975: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x974, &mut x975, x973, x950, (0x0 as u32)); + let mut x976: u32 = 0; + let mut x977: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x976, &mut x977, x975, x952, (0x0 as u32)); + let mut x978: u32 = 0; + let mut x979: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x978, &mut x979, x977, x954, (0x0 as u32)); + let mut x980: u32 = 0; + let mut x981: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x980, &mut x981, x979, x956, (0x0 as u32)); + let mut x982: u32 = 0; + let mut x983: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x982, &mut x983, x958, 0xe88fdc45); + let mut x984: u32 = 0; + let mut x985: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x984, &mut x985, x982, 0xffffffff); + let mut x986: u32 = 0; + let mut x987: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x986, &mut x987, x982, 0xffffffff); + let mut x988: u32 = 0; + let mut x989: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x988, &mut x989, x982, 0xffffffff); + let mut x990: u32 = 0; + let mut x991: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x990, &mut x991, x982, 0xffffffff); + let mut x992: u32 = 0; + let mut x993: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x992, &mut x993, x982, 0xffffffff); + let mut x994: u32 = 0; + let mut x995: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x994, &mut x995, x982, 0xffffffff); + let mut x996: u32 = 0; + let mut x997: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x996, &mut x997, x982, 0xc7634d81); + let mut x998: u32 = 0; + let mut x999: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x998, &mut x999, x982, 0xf4372ddf); + let mut x1000: u32 = 0; + let mut x1001: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1000, &mut x1001, x982, 0x581a0db2); + let mut x1002: u32 = 0; + let mut x1003: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1002, &mut x1003, x982, 0x48b0a77a); + let mut x1004: u32 = 0; + let mut x1005: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1004, &mut x1005, x982, 0xecec196a); + let mut x1006: u32 = 0; + let mut x1007: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1006, &mut x1007, x982, 0xccc52973); + let mut x1008: u32 = 0; + let mut x1009: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1008, &mut x1009, 0x0, x1007, x1004); + let mut x1010: u32 = 0; + let mut x1011: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1010, &mut x1011, x1009, x1005, x1002); + let mut x1012: u32 = 0; + let mut x1013: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1012, &mut x1013, x1011, x1003, x1000); + let mut x1014: u32 = 0; + let mut x1015: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1014, &mut x1015, x1013, x1001, x998); + let mut x1016: u32 = 0; + let mut x1017: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1016, &mut x1017, x1015, x999, x996); + let mut x1018: u32 = 0; + let mut x1019: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1018, &mut x1019, x1017, x997, x994); + let mut x1020: u32 = 0; + let mut x1021: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1020, &mut x1021, x1019, x995, x992); + let mut x1022: u32 = 0; + let mut x1023: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1022, &mut x1023, x1021, x993, x990); + let mut x1024: u32 = 0; + let mut x1025: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1024, &mut x1025, x1023, x991, x988); + let mut x1026: u32 = 0; + let mut x1027: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1026, &mut x1027, x1025, x989, x986); + let mut x1028: u32 = 0; + let mut x1029: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1028, &mut x1029, x1027, x987, x984); + let mut x1030: u32 = 0; + let mut x1031: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1030, &mut x1031, 0x0, x958, x1006); + let mut x1032: u32 = 0; + let mut x1033: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1032, &mut x1033, x1031, x960, x1008); + let mut x1034: u32 = 0; + let mut x1035: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1034, &mut x1035, x1033, x962, x1010); + let mut x1036: u32 = 0; + let mut x1037: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1036, &mut x1037, x1035, x964, x1012); + let mut x1038: u32 = 0; + let mut x1039: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1038, &mut x1039, x1037, x966, x1014); + let mut x1040: u32 = 0; + let mut x1041: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1040, &mut x1041, x1039, x968, x1016); + let mut x1042: u32 = 0; + let mut x1043: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1042, &mut x1043, x1041, x970, x1018); + let mut x1044: u32 = 0; + let mut x1045: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1044, &mut x1045, x1043, x972, x1020); + let mut x1046: u32 = 0; + let mut x1047: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1046, &mut x1047, x1045, x974, x1022); + let mut x1048: u32 = 0; + let mut x1049: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1048, &mut x1049, x1047, x976, x1024); + let mut x1050: u32 = 0; + let mut x1051: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1050, &mut x1051, x1049, x978, x1026); + let mut x1052: u32 = 0; + let mut x1053: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1052, &mut x1053, x1051, x980, x1028); + let mut x1054: u32 = 0; + let mut x1055: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1054, &mut x1055, x1053, ((x981 as u32) + (x957 as u32)), ((x1029 as u32) + x985)); + let mut x1056: u32 = 0; + let mut x1057: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1056, &mut x1057, 0x0, x1032, (arg1[11])); + let mut x1058: u32 = 0; + let mut x1059: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1058, &mut x1059, x1057, x1034, (0x0 as u32)); + let mut x1060: u32 = 0; + let mut x1061: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1060, &mut x1061, x1059, x1036, (0x0 as u32)); + let mut x1062: u32 = 0; + let mut x1063: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1062, &mut x1063, x1061, x1038, (0x0 as u32)); + let mut x1064: u32 = 0; + let mut x1065: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1064, &mut x1065, x1063, x1040, (0x0 as u32)); + let mut x1066: u32 = 0; + let mut x1067: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1066, &mut x1067, x1065, x1042, (0x0 as u32)); + let mut x1068: u32 = 0; + let mut x1069: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1068, &mut x1069, x1067, x1044, (0x0 as u32)); + let mut x1070: u32 = 0; + let mut x1071: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1070, &mut x1071, x1069, x1046, (0x0 as u32)); + let mut x1072: u32 = 0; + let mut x1073: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1072, &mut x1073, x1071, x1048, (0x0 as u32)); + let mut x1074: u32 = 0; + let mut x1075: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1074, &mut x1075, x1073, x1050, (0x0 as u32)); + let mut x1076: u32 = 0; + let mut x1077: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1076, &mut x1077, x1075, x1052, (0x0 as u32)); + let mut x1078: u32 = 0; + let mut x1079: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1078, &mut x1079, x1077, x1054, (0x0 as u32)); + let mut x1080: u32 = 0; + let mut x1081: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1080, &mut x1081, x1056, 0xe88fdc45); + let mut x1082: u32 = 0; + let mut x1083: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1082, &mut x1083, x1080, 0xffffffff); + let mut x1084: u32 = 0; + let mut x1085: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1084, &mut x1085, x1080, 0xffffffff); + let mut x1086: u32 = 0; + let mut x1087: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1086, &mut x1087, x1080, 0xffffffff); + let mut x1088: u32 = 0; + let mut x1089: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1088, &mut x1089, x1080, 0xffffffff); + let mut x1090: u32 = 0; + let mut x1091: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1090, &mut x1091, x1080, 0xffffffff); + let mut x1092: u32 = 0; + let mut x1093: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1092, &mut x1093, x1080, 0xffffffff); + let mut x1094: u32 = 0; + let mut x1095: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1094, &mut x1095, x1080, 0xc7634d81); + let mut x1096: u32 = 0; + let mut x1097: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1096, &mut x1097, x1080, 0xf4372ddf); + let mut x1098: u32 = 0; + let mut x1099: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1098, &mut x1099, x1080, 0x581a0db2); + let mut x1100: u32 = 0; + let mut x1101: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1100, &mut x1101, x1080, 0x48b0a77a); + let mut x1102: u32 = 0; + let mut x1103: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1102, &mut x1103, x1080, 0xecec196a); + let mut x1104: u32 = 0; + let mut x1105: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1104, &mut x1105, x1080, 0xccc52973); + let mut x1106: u32 = 0; + let mut x1107: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1106, &mut x1107, 0x0, x1105, x1102); + let mut x1108: u32 = 0; + let mut x1109: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1108, &mut x1109, x1107, x1103, x1100); + let mut x1110: u32 = 0; + let mut x1111: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1110, &mut x1111, x1109, x1101, x1098); + let mut x1112: u32 = 0; + let mut x1113: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1112, &mut x1113, x1111, x1099, x1096); + let mut x1114: u32 = 0; + let mut x1115: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1114, &mut x1115, x1113, x1097, x1094); + let mut x1116: u32 = 0; + let mut x1117: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1116, &mut x1117, x1115, x1095, x1092); + let mut x1118: u32 = 0; + let mut x1119: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1118, &mut x1119, x1117, x1093, x1090); + let mut x1120: u32 = 0; + let mut x1121: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1120, &mut x1121, x1119, x1091, x1088); + let mut x1122: u32 = 0; + let mut x1123: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1122, &mut x1123, x1121, x1089, x1086); + let mut x1124: u32 = 0; + let mut x1125: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1124, &mut x1125, x1123, x1087, x1084); + let mut x1126: u32 = 0; + let mut x1127: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1126, &mut x1127, x1125, x1085, x1082); + let mut x1128: u32 = 0; + let mut x1129: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1128, &mut x1129, 0x0, x1056, x1104); + let mut x1130: u32 = 0; + let mut x1131: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1130, &mut x1131, x1129, x1058, x1106); + let mut x1132: u32 = 0; + let mut x1133: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1132, &mut x1133, x1131, x1060, x1108); + let mut x1134: u32 = 0; + let mut x1135: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1134, &mut x1135, x1133, x1062, x1110); + let mut x1136: u32 = 0; + let mut x1137: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1136, &mut x1137, x1135, x1064, x1112); + let mut x1138: u32 = 0; + let mut x1139: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1138, &mut x1139, x1137, x1066, x1114); + let mut x1140: u32 = 0; + let mut x1141: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1140, &mut x1141, x1139, x1068, x1116); + let mut x1142: u32 = 0; + let mut x1143: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1142, &mut x1143, x1141, x1070, x1118); + let mut x1144: u32 = 0; + let mut x1145: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1144, &mut x1145, x1143, x1072, x1120); + let mut x1146: u32 = 0; + let mut x1147: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1146, &mut x1147, x1145, x1074, x1122); + let mut x1148: u32 = 0; + let mut x1149: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1148, &mut x1149, x1147, x1076, x1124); + let mut x1150: u32 = 0; + let mut x1151: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1150, &mut x1151, x1149, x1078, x1126); + let mut x1152: u32 = 0; + let mut x1153: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1152, &mut x1153, x1151, ((x1079 as u32) + (x1055 as u32)), ((x1127 as u32) + x1083)); + let mut x1154: u32 = 0; + let mut x1155: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1154, &mut x1155, 0x0, x1130, 0xccc52973); + let mut x1156: u32 = 0; + let mut x1157: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1156, &mut x1157, x1155, x1132, 0xecec196a); + let mut x1158: u32 = 0; + let mut x1159: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1158, &mut x1159, x1157, x1134, 0x48b0a77a); + let mut x1160: u32 = 0; + let mut x1161: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1160, &mut x1161, x1159, x1136, 0x581a0db2); + let mut x1162: u32 = 0; + let mut x1163: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1162, &mut x1163, x1161, x1138, 0xf4372ddf); + let mut x1164: u32 = 0; + let mut x1165: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1164, &mut x1165, x1163, x1140, 0xc7634d81); + let mut x1166: u32 = 0; + let mut x1167: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1166, &mut x1167, x1165, x1142, 0xffffffff); + let mut x1168: u32 = 0; + let mut x1169: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1168, &mut x1169, x1167, x1144, 0xffffffff); + let mut x1170: u32 = 0; + let mut x1171: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1170, &mut x1171, x1169, x1146, 0xffffffff); + let mut x1172: u32 = 0; + let mut x1173: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1172, &mut x1173, x1171, x1148, 0xffffffff); + let mut x1174: u32 = 0; + let mut x1175: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1174, &mut x1175, x1173, x1150, 0xffffffff); + let mut x1176: u32 = 0; + let mut x1177: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1176, &mut x1177, x1175, x1152, 0xffffffff); + let mut x1178: u32 = 0; + let mut x1179: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1178, &mut x1179, x1177, (x1153 as u32), (0x0 as u32)); + let mut x1180: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x1180, x1179, x1154, x1130); + let mut x1181: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x1181, x1179, x1156, x1132); + let mut x1182: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x1182, x1179, x1158, x1134); + let mut x1183: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x1183, x1179, x1160, x1136); + let mut x1184: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x1184, x1179, x1162, x1138); + let mut x1185: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x1185, x1179, x1164, x1140); + let mut x1186: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x1186, x1179, x1166, x1142); + let mut x1187: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x1187, x1179, x1168, x1144); + let mut x1188: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x1188, x1179, x1170, x1146); + let mut x1189: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x1189, x1179, x1172, x1148); + let mut x1190: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x1190, x1179, x1174, x1150); + let mut x1191: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x1191, x1179, x1176, x1152); + out1[0] = x1180; + out1[1] = x1181; + out1[2] = x1182; + out1[3] = x1183; + out1[4] = x1184; + out1[5] = x1185; + out1[6] = x1186; + out1[7] = x1187; + out1[8] = x1188; + out1[9] = x1189; + out1[10] = x1190; + out1[11] = x1191; +} + +/// The function fiat_p384_scalar_to_montgomery translates a field element into the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = eval arg1 mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p384_scalar_to_montgomery(out1: &mut fiat_p384_scalar_montgomery_domain_field_element, arg1: &fiat_p384_scalar_non_montgomery_domain_field_element) -> () { + let x1: u32 = (arg1[1]); + let x2: u32 = (arg1[2]); + let x3: u32 = (arg1[3]); + let x4: u32 = (arg1[4]); + let x5: u32 = (arg1[5]); + let x6: u32 = (arg1[6]); + let x7: u32 = (arg1[7]); + let x8: u32 = (arg1[8]); + let x9: u32 = (arg1[9]); + let x10: u32 = (arg1[10]); + let x11: u32 = (arg1[11]); + let x12: u32 = (arg1[0]); + let mut x13: u32 = 0; + let mut x14: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x13, &mut x14, x12, 0xc84ee01); + let mut x15: u32 = 0; + let mut x16: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x15, &mut x16, x12, 0x2b39bf21); + let mut x17: u32 = 0; + let mut x18: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x17, &mut x18, x12, 0x3fb05b7a); + let mut x19: u32 = 0; + let mut x20: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x19, &mut x20, x12, 0x28266895); + let mut x21: u32 = 0; + let mut x22: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x21, &mut x22, x12, 0xd40d4917); + let mut x23: u32 = 0; + let mut x24: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x23, &mut x24, x12, 0x4aab1cc5); + let mut x25: u32 = 0; + let mut x26: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x25, &mut x26, x12, 0xbc3e483a); + let mut x27: u32 = 0; + let mut x28: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x27, &mut x28, x12, 0xfcb82947); + let mut x29: u32 = 0; + let mut x30: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x29, &mut x30, x12, 0xff3d81e5); + let mut x31: u32 = 0; + let mut x32: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x31, &mut x32, x12, 0xdf1aa419); + let mut x33: u32 = 0; + let mut x34: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x33, &mut x34, x12, 0x2d319b24); + let mut x35: u32 = 0; + let mut x36: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x35, &mut x36, x12, 0x19b409a9); + let mut x37: u32 = 0; + let mut x38: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x37, &mut x38, 0x0, x36, x33); + let mut x39: u32 = 0; + let mut x40: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x39, &mut x40, x38, x34, x31); + let mut x41: u32 = 0; + let mut x42: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x41, &mut x42, x40, x32, x29); + let mut x43: u32 = 0; + let mut x44: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x43, &mut x44, x42, x30, x27); + let mut x45: u32 = 0; + let mut x46: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x45, &mut x46, x44, x28, x25); + let mut x47: u32 = 0; + let mut x48: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x47, &mut x48, x46, x26, x23); + let mut x49: u32 = 0; + let mut x50: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x49, &mut x50, x48, x24, x21); + let mut x51: u32 = 0; + let mut x52: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x51, &mut x52, x50, x22, x19); + let mut x53: u32 = 0; + let mut x54: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x53, &mut x54, x52, x20, x17); + let mut x55: u32 = 0; + let mut x56: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x55, &mut x56, x54, x18, x15); + let mut x57: u32 = 0; + let mut x58: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x57, &mut x58, x56, x16, x13); + let mut x59: u32 = 0; + let mut x60: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x59, &mut x60, x35, 0xe88fdc45); + let mut x61: u32 = 0; + let mut x62: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x61, &mut x62, x59, 0xffffffff); + let mut x63: u32 = 0; + let mut x64: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x63, &mut x64, x59, 0xffffffff); + let mut x65: u32 = 0; + let mut x66: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x65, &mut x66, x59, 0xffffffff); + let mut x67: u32 = 0; + let mut x68: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x67, &mut x68, x59, 0xffffffff); + let mut x69: u32 = 0; + let mut x70: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x69, &mut x70, x59, 0xffffffff); + let mut x71: u32 = 0; + let mut x72: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x71, &mut x72, x59, 0xffffffff); + let mut x73: u32 = 0; + let mut x74: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x73, &mut x74, x59, 0xc7634d81); + let mut x75: u32 = 0; + let mut x76: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x75, &mut x76, x59, 0xf4372ddf); + let mut x77: u32 = 0; + let mut x78: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x77, &mut x78, x59, 0x581a0db2); + let mut x79: u32 = 0; + let mut x80: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x79, &mut x80, x59, 0x48b0a77a); + let mut x81: u32 = 0; + let mut x82: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x81, &mut x82, x59, 0xecec196a); + let mut x83: u32 = 0; + let mut x84: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x83, &mut x84, x59, 0xccc52973); + let mut x85: u32 = 0; + let mut x86: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x85, &mut x86, 0x0, x84, x81); + let mut x87: u32 = 0; + let mut x88: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x87, &mut x88, x86, x82, x79); + let mut x89: u32 = 0; + let mut x90: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x89, &mut x90, x88, x80, x77); + let mut x91: u32 = 0; + let mut x92: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x91, &mut x92, x90, x78, x75); + let mut x93: u32 = 0; + let mut x94: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x93, &mut x94, x92, x76, x73); + let mut x95: u32 = 0; + let mut x96: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x95, &mut x96, x94, x74, x71); + let mut x97: u32 = 0; + let mut x98: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x97, &mut x98, x96, x72, x69); + let mut x99: u32 = 0; + let mut x100: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x99, &mut x100, x98, x70, x67); + let mut x101: u32 = 0; + let mut x102: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x101, &mut x102, x100, x68, x65); + let mut x103: u32 = 0; + let mut x104: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x103, &mut x104, x102, x66, x63); + let mut x105: u32 = 0; + let mut x106: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x105, &mut x106, x104, x64, x61); + let mut x107: u32 = 0; + let mut x108: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x107, &mut x108, 0x0, x35, x83); + let mut x109: u32 = 0; + let mut x110: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x109, &mut x110, x108, x37, x85); + let mut x111: u32 = 0; + let mut x112: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x111, &mut x112, x110, x39, x87); + let mut x113: u32 = 0; + let mut x114: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x113, &mut x114, x112, x41, x89); + let mut x115: u32 = 0; + let mut x116: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x115, &mut x116, x114, x43, x91); + let mut x117: u32 = 0; + let mut x118: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x117, &mut x118, x116, x45, x93); + let mut x119: u32 = 0; + let mut x120: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x119, &mut x120, x118, x47, x95); + let mut x121: u32 = 0; + let mut x122: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x121, &mut x122, x120, x49, x97); + let mut x123: u32 = 0; + let mut x124: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x123, &mut x124, x122, x51, x99); + let mut x125: u32 = 0; + let mut x126: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x125, &mut x126, x124, x53, x101); + let mut x127: u32 = 0; + let mut x128: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x127, &mut x128, x126, x55, x103); + let mut x129: u32 = 0; + let mut x130: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x129, &mut x130, x128, x57, x105); + let mut x131: u32 = 0; + let mut x132: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x131, &mut x132, x130, ((x58 as u32) + x14), ((x106 as u32) + x62)); + let mut x133: u32 = 0; + let mut x134: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x133, &mut x134, x1, 0xc84ee01); + let mut x135: u32 = 0; + let mut x136: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x135, &mut x136, x1, 0x2b39bf21); + let mut x137: u32 = 0; + let mut x138: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x137, &mut x138, x1, 0x3fb05b7a); + let mut x139: u32 = 0; + let mut x140: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x139, &mut x140, x1, 0x28266895); + let mut x141: u32 = 0; + let mut x142: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x141, &mut x142, x1, 0xd40d4917); + let mut x143: u32 = 0; + let mut x144: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x143, &mut x144, x1, 0x4aab1cc5); + let mut x145: u32 = 0; + let mut x146: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x145, &mut x146, x1, 0xbc3e483a); + let mut x147: u32 = 0; + let mut x148: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x147, &mut x148, x1, 0xfcb82947); + let mut x149: u32 = 0; + let mut x150: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x149, &mut x150, x1, 0xff3d81e5); + let mut x151: u32 = 0; + let mut x152: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x151, &mut x152, x1, 0xdf1aa419); + let mut x153: u32 = 0; + let mut x154: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x153, &mut x154, x1, 0x2d319b24); + let mut x155: u32 = 0; + let mut x156: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x155, &mut x156, x1, 0x19b409a9); + let mut x157: u32 = 0; + let mut x158: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x157, &mut x158, 0x0, x156, x153); + let mut x159: u32 = 0; + let mut x160: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x159, &mut x160, x158, x154, x151); + let mut x161: u32 = 0; + let mut x162: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x161, &mut x162, x160, x152, x149); + let mut x163: u32 = 0; + let mut x164: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x163, &mut x164, x162, x150, x147); + let mut x165: u32 = 0; + let mut x166: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x165, &mut x166, x164, x148, x145); + let mut x167: u32 = 0; + let mut x168: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x167, &mut x168, x166, x146, x143); + let mut x169: u32 = 0; + let mut x170: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x169, &mut x170, x168, x144, x141); + let mut x171: u32 = 0; + let mut x172: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x171, &mut x172, x170, x142, x139); + let mut x173: u32 = 0; + let mut x174: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x173, &mut x174, x172, x140, x137); + let mut x175: u32 = 0; + let mut x176: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x175, &mut x176, x174, x138, x135); + let mut x177: u32 = 0; + let mut x178: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x177, &mut x178, x176, x136, x133); + let mut x179: u32 = 0; + let mut x180: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x179, &mut x180, 0x0, x109, x155); + let mut x181: u32 = 0; + let mut x182: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x181, &mut x182, x180, x111, x157); + let mut x183: u32 = 0; + let mut x184: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x183, &mut x184, x182, x113, x159); + let mut x185: u32 = 0; + let mut x186: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x185, &mut x186, x184, x115, x161); + let mut x187: u32 = 0; + let mut x188: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x187, &mut x188, x186, x117, x163); + let mut x189: u32 = 0; + let mut x190: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x189, &mut x190, x188, x119, x165); + let mut x191: u32 = 0; + let mut x192: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x191, &mut x192, x190, x121, x167); + let mut x193: u32 = 0; + let mut x194: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x193, &mut x194, x192, x123, x169); + let mut x195: u32 = 0; + let mut x196: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x195, &mut x196, x194, x125, x171); + let mut x197: u32 = 0; + let mut x198: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x197, &mut x198, x196, x127, x173); + let mut x199: u32 = 0; + let mut x200: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x199, &mut x200, x198, x129, x175); + let mut x201: u32 = 0; + let mut x202: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x201, &mut x202, x200, x131, x177); + let mut x203: u32 = 0; + let mut x204: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x203, &mut x204, x179, 0xe88fdc45); + let mut x205: u32 = 0; + let mut x206: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x205, &mut x206, x203, 0xffffffff); + let mut x207: u32 = 0; + let mut x208: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x207, &mut x208, x203, 0xffffffff); + let mut x209: u32 = 0; + let mut x210: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x209, &mut x210, x203, 0xffffffff); + let mut x211: u32 = 0; + let mut x212: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x211, &mut x212, x203, 0xffffffff); + let mut x213: u32 = 0; + let mut x214: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x213, &mut x214, x203, 0xffffffff); + let mut x215: u32 = 0; + let mut x216: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x215, &mut x216, x203, 0xffffffff); + let mut x217: u32 = 0; + let mut x218: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x217, &mut x218, x203, 0xc7634d81); + let mut x219: u32 = 0; + let mut x220: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x219, &mut x220, x203, 0xf4372ddf); + let mut x221: u32 = 0; + let mut x222: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x221, &mut x222, x203, 0x581a0db2); + let mut x223: u32 = 0; + let mut x224: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x223, &mut x224, x203, 0x48b0a77a); + let mut x225: u32 = 0; + let mut x226: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x225, &mut x226, x203, 0xecec196a); + let mut x227: u32 = 0; + let mut x228: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x227, &mut x228, x203, 0xccc52973); + let mut x229: u32 = 0; + let mut x230: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x229, &mut x230, 0x0, x228, x225); + let mut x231: u32 = 0; + let mut x232: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x231, &mut x232, x230, x226, x223); + let mut x233: u32 = 0; + let mut x234: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x233, &mut x234, x232, x224, x221); + let mut x235: u32 = 0; + let mut x236: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x235, &mut x236, x234, x222, x219); + let mut x237: u32 = 0; + let mut x238: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x237, &mut x238, x236, x220, x217); + let mut x239: u32 = 0; + let mut x240: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x239, &mut x240, x238, x218, x215); + let mut x241: u32 = 0; + let mut x242: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x241, &mut x242, x240, x216, x213); + let mut x243: u32 = 0; + let mut x244: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x243, &mut x244, x242, x214, x211); + let mut x245: u32 = 0; + let mut x246: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x245, &mut x246, x244, x212, x209); + let mut x247: u32 = 0; + let mut x248: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x247, &mut x248, x246, x210, x207); + let mut x249: u32 = 0; + let mut x250: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x249, &mut x250, x248, x208, x205); + let mut x251: u32 = 0; + let mut x252: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x251, &mut x252, 0x0, x179, x227); + let mut x253: u32 = 0; + let mut x254: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x253, &mut x254, x252, x181, x229); + let mut x255: u32 = 0; + let mut x256: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x255, &mut x256, x254, x183, x231); + let mut x257: u32 = 0; + let mut x258: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x257, &mut x258, x256, x185, x233); + let mut x259: u32 = 0; + let mut x260: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x259, &mut x260, x258, x187, x235); + let mut x261: u32 = 0; + let mut x262: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x261, &mut x262, x260, x189, x237); + let mut x263: u32 = 0; + let mut x264: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x263, &mut x264, x262, x191, x239); + let mut x265: u32 = 0; + let mut x266: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x265, &mut x266, x264, x193, x241); + let mut x267: u32 = 0; + let mut x268: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x267, &mut x268, x266, x195, x243); + let mut x269: u32 = 0; + let mut x270: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x269, &mut x270, x268, x197, x245); + let mut x271: u32 = 0; + let mut x272: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x271, &mut x272, x270, x199, x247); + let mut x273: u32 = 0; + let mut x274: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x273, &mut x274, x272, x201, x249); + let mut x275: u32 = 0; + let mut x276: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x275, &mut x276, x274, (((x202 as u32) + (x132 as u32)) + ((x178 as u32) + x134)), ((x250 as u32) + x206)); + let mut x277: u32 = 0; + let mut x278: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x277, &mut x278, x2, 0xc84ee01); + let mut x279: u32 = 0; + let mut x280: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x279, &mut x280, x2, 0x2b39bf21); + let mut x281: u32 = 0; + let mut x282: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x281, &mut x282, x2, 0x3fb05b7a); + let mut x283: u32 = 0; + let mut x284: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x283, &mut x284, x2, 0x28266895); + let mut x285: u32 = 0; + let mut x286: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x285, &mut x286, x2, 0xd40d4917); + let mut x287: u32 = 0; + let mut x288: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x287, &mut x288, x2, 0x4aab1cc5); + let mut x289: u32 = 0; + let mut x290: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x289, &mut x290, x2, 0xbc3e483a); + let mut x291: u32 = 0; + let mut x292: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x291, &mut x292, x2, 0xfcb82947); + let mut x293: u32 = 0; + let mut x294: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x293, &mut x294, x2, 0xff3d81e5); + let mut x295: u32 = 0; + let mut x296: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x295, &mut x296, x2, 0xdf1aa419); + let mut x297: u32 = 0; + let mut x298: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x297, &mut x298, x2, 0x2d319b24); + let mut x299: u32 = 0; + let mut x300: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x299, &mut x300, x2, 0x19b409a9); + let mut x301: u32 = 0; + let mut x302: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x301, &mut x302, 0x0, x300, x297); + let mut x303: u32 = 0; + let mut x304: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x303, &mut x304, x302, x298, x295); + let mut x305: u32 = 0; + let mut x306: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x305, &mut x306, x304, x296, x293); + let mut x307: u32 = 0; + let mut x308: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x307, &mut x308, x306, x294, x291); + let mut x309: u32 = 0; + let mut x310: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x309, &mut x310, x308, x292, x289); + let mut x311: u32 = 0; + let mut x312: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x311, &mut x312, x310, x290, x287); + let mut x313: u32 = 0; + let mut x314: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x313, &mut x314, x312, x288, x285); + let mut x315: u32 = 0; + let mut x316: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x315, &mut x316, x314, x286, x283); + let mut x317: u32 = 0; + let mut x318: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x317, &mut x318, x316, x284, x281); + let mut x319: u32 = 0; + let mut x320: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x319, &mut x320, x318, x282, x279); + let mut x321: u32 = 0; + let mut x322: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x321, &mut x322, x320, x280, x277); + let mut x323: u32 = 0; + let mut x324: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x323, &mut x324, 0x0, x253, x299); + let mut x325: u32 = 0; + let mut x326: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x325, &mut x326, x324, x255, x301); + let mut x327: u32 = 0; + let mut x328: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x327, &mut x328, x326, x257, x303); + let mut x329: u32 = 0; + let mut x330: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x329, &mut x330, x328, x259, x305); + let mut x331: u32 = 0; + let mut x332: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x331, &mut x332, x330, x261, x307); + let mut x333: u32 = 0; + let mut x334: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x333, &mut x334, x332, x263, x309); + let mut x335: u32 = 0; + let mut x336: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x335, &mut x336, x334, x265, x311); + let mut x337: u32 = 0; + let mut x338: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x337, &mut x338, x336, x267, x313); + let mut x339: u32 = 0; + let mut x340: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x339, &mut x340, x338, x269, x315); + let mut x341: u32 = 0; + let mut x342: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x341, &mut x342, x340, x271, x317); + let mut x343: u32 = 0; + let mut x344: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x343, &mut x344, x342, x273, x319); + let mut x345: u32 = 0; + let mut x346: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x345, &mut x346, x344, x275, x321); + let mut x347: u32 = 0; + let mut x348: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x347, &mut x348, x323, 0xe88fdc45); + let mut x349: u32 = 0; + let mut x350: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x349, &mut x350, x347, 0xffffffff); + let mut x351: u32 = 0; + let mut x352: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x351, &mut x352, x347, 0xffffffff); + let mut x353: u32 = 0; + let mut x354: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x353, &mut x354, x347, 0xffffffff); + let mut x355: u32 = 0; + let mut x356: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x355, &mut x356, x347, 0xffffffff); + let mut x357: u32 = 0; + let mut x358: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x357, &mut x358, x347, 0xffffffff); + let mut x359: u32 = 0; + let mut x360: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x359, &mut x360, x347, 0xffffffff); + let mut x361: u32 = 0; + let mut x362: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x361, &mut x362, x347, 0xc7634d81); + let mut x363: u32 = 0; + let mut x364: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x363, &mut x364, x347, 0xf4372ddf); + let mut x365: u32 = 0; + let mut x366: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x365, &mut x366, x347, 0x581a0db2); + let mut x367: u32 = 0; + let mut x368: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x367, &mut x368, x347, 0x48b0a77a); + let mut x369: u32 = 0; + let mut x370: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x369, &mut x370, x347, 0xecec196a); + let mut x371: u32 = 0; + let mut x372: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x371, &mut x372, x347, 0xccc52973); + let mut x373: u32 = 0; + let mut x374: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x373, &mut x374, 0x0, x372, x369); + let mut x375: u32 = 0; + let mut x376: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x375, &mut x376, x374, x370, x367); + let mut x377: u32 = 0; + let mut x378: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x377, &mut x378, x376, x368, x365); + let mut x379: u32 = 0; + let mut x380: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x379, &mut x380, x378, x366, x363); + let mut x381: u32 = 0; + let mut x382: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x381, &mut x382, x380, x364, x361); + let mut x383: u32 = 0; + let mut x384: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x383, &mut x384, x382, x362, x359); + let mut x385: u32 = 0; + let mut x386: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x385, &mut x386, x384, x360, x357); + let mut x387: u32 = 0; + let mut x388: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x387, &mut x388, x386, x358, x355); + let mut x389: u32 = 0; + let mut x390: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x389, &mut x390, x388, x356, x353); + let mut x391: u32 = 0; + let mut x392: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x391, &mut x392, x390, x354, x351); + let mut x393: u32 = 0; + let mut x394: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x393, &mut x394, x392, x352, x349); + let mut x395: u32 = 0; + let mut x396: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x395, &mut x396, 0x0, x323, x371); + let mut x397: u32 = 0; + let mut x398: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x397, &mut x398, x396, x325, x373); + let mut x399: u32 = 0; + let mut x400: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x399, &mut x400, x398, x327, x375); + let mut x401: u32 = 0; + let mut x402: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x401, &mut x402, x400, x329, x377); + let mut x403: u32 = 0; + let mut x404: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x403, &mut x404, x402, x331, x379); + let mut x405: u32 = 0; + let mut x406: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x405, &mut x406, x404, x333, x381); + let mut x407: u32 = 0; + let mut x408: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x407, &mut x408, x406, x335, x383); + let mut x409: u32 = 0; + let mut x410: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x409, &mut x410, x408, x337, x385); + let mut x411: u32 = 0; + let mut x412: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x411, &mut x412, x410, x339, x387); + let mut x413: u32 = 0; + let mut x414: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x413, &mut x414, x412, x341, x389); + let mut x415: u32 = 0; + let mut x416: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x415, &mut x416, x414, x343, x391); + let mut x417: u32 = 0; + let mut x418: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x417, &mut x418, x416, x345, x393); + let mut x419: u32 = 0; + let mut x420: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x419, &mut x420, x418, (((x346 as u32) + (x276 as u32)) + ((x322 as u32) + x278)), ((x394 as u32) + x350)); + let mut x421: u32 = 0; + let mut x422: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x421, &mut x422, x3, 0xc84ee01); + let mut x423: u32 = 0; + let mut x424: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x423, &mut x424, x3, 0x2b39bf21); + let mut x425: u32 = 0; + let mut x426: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x425, &mut x426, x3, 0x3fb05b7a); + let mut x427: u32 = 0; + let mut x428: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x427, &mut x428, x3, 0x28266895); + let mut x429: u32 = 0; + let mut x430: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x429, &mut x430, x3, 0xd40d4917); + let mut x431: u32 = 0; + let mut x432: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x431, &mut x432, x3, 0x4aab1cc5); + let mut x433: u32 = 0; + let mut x434: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x433, &mut x434, x3, 0xbc3e483a); + let mut x435: u32 = 0; + let mut x436: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x435, &mut x436, x3, 0xfcb82947); + let mut x437: u32 = 0; + let mut x438: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x437, &mut x438, x3, 0xff3d81e5); + let mut x439: u32 = 0; + let mut x440: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x439, &mut x440, x3, 0xdf1aa419); + let mut x441: u32 = 0; + let mut x442: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x441, &mut x442, x3, 0x2d319b24); + let mut x443: u32 = 0; + let mut x444: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x443, &mut x444, x3, 0x19b409a9); + let mut x445: u32 = 0; + let mut x446: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x445, &mut x446, 0x0, x444, x441); + let mut x447: u32 = 0; + let mut x448: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x447, &mut x448, x446, x442, x439); + let mut x449: u32 = 0; + let mut x450: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x449, &mut x450, x448, x440, x437); + let mut x451: u32 = 0; + let mut x452: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x451, &mut x452, x450, x438, x435); + let mut x453: u32 = 0; + let mut x454: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x453, &mut x454, x452, x436, x433); + let mut x455: u32 = 0; + let mut x456: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x455, &mut x456, x454, x434, x431); + let mut x457: u32 = 0; + let mut x458: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x457, &mut x458, x456, x432, x429); + let mut x459: u32 = 0; + let mut x460: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x459, &mut x460, x458, x430, x427); + let mut x461: u32 = 0; + let mut x462: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x461, &mut x462, x460, x428, x425); + let mut x463: u32 = 0; + let mut x464: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x463, &mut x464, x462, x426, x423); + let mut x465: u32 = 0; + let mut x466: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x465, &mut x466, x464, x424, x421); + let mut x467: u32 = 0; + let mut x468: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x467, &mut x468, 0x0, x397, x443); + let mut x469: u32 = 0; + let mut x470: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x469, &mut x470, x468, x399, x445); + let mut x471: u32 = 0; + let mut x472: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x471, &mut x472, x470, x401, x447); + let mut x473: u32 = 0; + let mut x474: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x473, &mut x474, x472, x403, x449); + let mut x475: u32 = 0; + let mut x476: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x475, &mut x476, x474, x405, x451); + let mut x477: u32 = 0; + let mut x478: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x477, &mut x478, x476, x407, x453); + let mut x479: u32 = 0; + let mut x480: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x479, &mut x480, x478, x409, x455); + let mut x481: u32 = 0; + let mut x482: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x481, &mut x482, x480, x411, x457); + let mut x483: u32 = 0; + let mut x484: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x483, &mut x484, x482, x413, x459); + let mut x485: u32 = 0; + let mut x486: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x485, &mut x486, x484, x415, x461); + let mut x487: u32 = 0; + let mut x488: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x487, &mut x488, x486, x417, x463); + let mut x489: u32 = 0; + let mut x490: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x489, &mut x490, x488, x419, x465); + let mut x491: u32 = 0; + let mut x492: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x491, &mut x492, x467, 0xe88fdc45); + let mut x493: u32 = 0; + let mut x494: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x493, &mut x494, x491, 0xffffffff); + let mut x495: u32 = 0; + let mut x496: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x495, &mut x496, x491, 0xffffffff); + let mut x497: u32 = 0; + let mut x498: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x497, &mut x498, x491, 0xffffffff); + let mut x499: u32 = 0; + let mut x500: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x499, &mut x500, x491, 0xffffffff); + let mut x501: u32 = 0; + let mut x502: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x501, &mut x502, x491, 0xffffffff); + let mut x503: u32 = 0; + let mut x504: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x503, &mut x504, x491, 0xffffffff); + let mut x505: u32 = 0; + let mut x506: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x505, &mut x506, x491, 0xc7634d81); + let mut x507: u32 = 0; + let mut x508: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x507, &mut x508, x491, 0xf4372ddf); + let mut x509: u32 = 0; + let mut x510: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x509, &mut x510, x491, 0x581a0db2); + let mut x511: u32 = 0; + let mut x512: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x511, &mut x512, x491, 0x48b0a77a); + let mut x513: u32 = 0; + let mut x514: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x513, &mut x514, x491, 0xecec196a); + let mut x515: u32 = 0; + let mut x516: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x515, &mut x516, x491, 0xccc52973); + let mut x517: u32 = 0; + let mut x518: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x517, &mut x518, 0x0, x516, x513); + let mut x519: u32 = 0; + let mut x520: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x519, &mut x520, x518, x514, x511); + let mut x521: u32 = 0; + let mut x522: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x521, &mut x522, x520, x512, x509); + let mut x523: u32 = 0; + let mut x524: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x523, &mut x524, x522, x510, x507); + let mut x525: u32 = 0; + let mut x526: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x525, &mut x526, x524, x508, x505); + let mut x527: u32 = 0; + let mut x528: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x527, &mut x528, x526, x506, x503); + let mut x529: u32 = 0; + let mut x530: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x529, &mut x530, x528, x504, x501); + let mut x531: u32 = 0; + let mut x532: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x531, &mut x532, x530, x502, x499); + let mut x533: u32 = 0; + let mut x534: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x533, &mut x534, x532, x500, x497); + let mut x535: u32 = 0; + let mut x536: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x535, &mut x536, x534, x498, x495); + let mut x537: u32 = 0; + let mut x538: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x537, &mut x538, x536, x496, x493); + let mut x539: u32 = 0; + let mut x540: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x539, &mut x540, 0x0, x467, x515); + let mut x541: u32 = 0; + let mut x542: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x541, &mut x542, x540, x469, x517); + let mut x543: u32 = 0; + let mut x544: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x543, &mut x544, x542, x471, x519); + let mut x545: u32 = 0; + let mut x546: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x545, &mut x546, x544, x473, x521); + let mut x547: u32 = 0; + let mut x548: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x547, &mut x548, x546, x475, x523); + let mut x549: u32 = 0; + let mut x550: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x549, &mut x550, x548, x477, x525); + let mut x551: u32 = 0; + let mut x552: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x551, &mut x552, x550, x479, x527); + let mut x553: u32 = 0; + let mut x554: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x553, &mut x554, x552, x481, x529); + let mut x555: u32 = 0; + let mut x556: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x555, &mut x556, x554, x483, x531); + let mut x557: u32 = 0; + let mut x558: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x557, &mut x558, x556, x485, x533); + let mut x559: u32 = 0; + let mut x560: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x559, &mut x560, x558, x487, x535); + let mut x561: u32 = 0; + let mut x562: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x561, &mut x562, x560, x489, x537); + let mut x563: u32 = 0; + let mut x564: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x563, &mut x564, x562, (((x490 as u32) + (x420 as u32)) + ((x466 as u32) + x422)), ((x538 as u32) + x494)); + let mut x565: u32 = 0; + let mut x566: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x565, &mut x566, x4, 0xc84ee01); + let mut x567: u32 = 0; + let mut x568: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x567, &mut x568, x4, 0x2b39bf21); + let mut x569: u32 = 0; + let mut x570: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x569, &mut x570, x4, 0x3fb05b7a); + let mut x571: u32 = 0; + let mut x572: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x571, &mut x572, x4, 0x28266895); + let mut x573: u32 = 0; + let mut x574: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x573, &mut x574, x4, 0xd40d4917); + let mut x575: u32 = 0; + let mut x576: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x575, &mut x576, x4, 0x4aab1cc5); + let mut x577: u32 = 0; + let mut x578: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x577, &mut x578, x4, 0xbc3e483a); + let mut x579: u32 = 0; + let mut x580: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x579, &mut x580, x4, 0xfcb82947); + let mut x581: u32 = 0; + let mut x582: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x581, &mut x582, x4, 0xff3d81e5); + let mut x583: u32 = 0; + let mut x584: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x583, &mut x584, x4, 0xdf1aa419); + let mut x585: u32 = 0; + let mut x586: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x585, &mut x586, x4, 0x2d319b24); + let mut x587: u32 = 0; + let mut x588: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x587, &mut x588, x4, 0x19b409a9); + let mut x589: u32 = 0; + let mut x590: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x589, &mut x590, 0x0, x588, x585); + let mut x591: u32 = 0; + let mut x592: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x591, &mut x592, x590, x586, x583); + let mut x593: u32 = 0; + let mut x594: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x593, &mut x594, x592, x584, x581); + let mut x595: u32 = 0; + let mut x596: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x595, &mut x596, x594, x582, x579); + let mut x597: u32 = 0; + let mut x598: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x597, &mut x598, x596, x580, x577); + let mut x599: u32 = 0; + let mut x600: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x599, &mut x600, x598, x578, x575); + let mut x601: u32 = 0; + let mut x602: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x601, &mut x602, x600, x576, x573); + let mut x603: u32 = 0; + let mut x604: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x603, &mut x604, x602, x574, x571); + let mut x605: u32 = 0; + let mut x606: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x605, &mut x606, x604, x572, x569); + let mut x607: u32 = 0; + let mut x608: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x607, &mut x608, x606, x570, x567); + let mut x609: u32 = 0; + let mut x610: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x609, &mut x610, x608, x568, x565); + let mut x611: u32 = 0; + let mut x612: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x611, &mut x612, 0x0, x541, x587); + let mut x613: u32 = 0; + let mut x614: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x613, &mut x614, x612, x543, x589); + let mut x615: u32 = 0; + let mut x616: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x615, &mut x616, x614, x545, x591); + let mut x617: u32 = 0; + let mut x618: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x617, &mut x618, x616, x547, x593); + let mut x619: u32 = 0; + let mut x620: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x619, &mut x620, x618, x549, x595); + let mut x621: u32 = 0; + let mut x622: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x621, &mut x622, x620, x551, x597); + let mut x623: u32 = 0; + let mut x624: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x623, &mut x624, x622, x553, x599); + let mut x625: u32 = 0; + let mut x626: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x625, &mut x626, x624, x555, x601); + let mut x627: u32 = 0; + let mut x628: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x627, &mut x628, x626, x557, x603); + let mut x629: u32 = 0; + let mut x630: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x629, &mut x630, x628, x559, x605); + let mut x631: u32 = 0; + let mut x632: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x631, &mut x632, x630, x561, x607); + let mut x633: u32 = 0; + let mut x634: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x633, &mut x634, x632, x563, x609); + let mut x635: u32 = 0; + let mut x636: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x635, &mut x636, x611, 0xe88fdc45); + let mut x637: u32 = 0; + let mut x638: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x637, &mut x638, x635, 0xffffffff); + let mut x639: u32 = 0; + let mut x640: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x639, &mut x640, x635, 0xffffffff); + let mut x641: u32 = 0; + let mut x642: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x641, &mut x642, x635, 0xffffffff); + let mut x643: u32 = 0; + let mut x644: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x643, &mut x644, x635, 0xffffffff); + let mut x645: u32 = 0; + let mut x646: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x645, &mut x646, x635, 0xffffffff); + let mut x647: u32 = 0; + let mut x648: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x647, &mut x648, x635, 0xffffffff); + let mut x649: u32 = 0; + let mut x650: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x649, &mut x650, x635, 0xc7634d81); + let mut x651: u32 = 0; + let mut x652: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x651, &mut x652, x635, 0xf4372ddf); + let mut x653: u32 = 0; + let mut x654: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x653, &mut x654, x635, 0x581a0db2); + let mut x655: u32 = 0; + let mut x656: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x655, &mut x656, x635, 0x48b0a77a); + let mut x657: u32 = 0; + let mut x658: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x657, &mut x658, x635, 0xecec196a); + let mut x659: u32 = 0; + let mut x660: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x659, &mut x660, x635, 0xccc52973); + let mut x661: u32 = 0; + let mut x662: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x661, &mut x662, 0x0, x660, x657); + let mut x663: u32 = 0; + let mut x664: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x663, &mut x664, x662, x658, x655); + let mut x665: u32 = 0; + let mut x666: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x665, &mut x666, x664, x656, x653); + let mut x667: u32 = 0; + let mut x668: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x667, &mut x668, x666, x654, x651); + let mut x669: u32 = 0; + let mut x670: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x669, &mut x670, x668, x652, x649); + let mut x671: u32 = 0; + let mut x672: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x671, &mut x672, x670, x650, x647); + let mut x673: u32 = 0; + let mut x674: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x673, &mut x674, x672, x648, x645); + let mut x675: u32 = 0; + let mut x676: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x675, &mut x676, x674, x646, x643); + let mut x677: u32 = 0; + let mut x678: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x677, &mut x678, x676, x644, x641); + let mut x679: u32 = 0; + let mut x680: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x679, &mut x680, x678, x642, x639); + let mut x681: u32 = 0; + let mut x682: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x681, &mut x682, x680, x640, x637); + let mut x683: u32 = 0; + let mut x684: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x683, &mut x684, 0x0, x611, x659); + let mut x685: u32 = 0; + let mut x686: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x685, &mut x686, x684, x613, x661); + let mut x687: u32 = 0; + let mut x688: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x687, &mut x688, x686, x615, x663); + let mut x689: u32 = 0; + let mut x690: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x689, &mut x690, x688, x617, x665); + let mut x691: u32 = 0; + let mut x692: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x691, &mut x692, x690, x619, x667); + let mut x693: u32 = 0; + let mut x694: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x693, &mut x694, x692, x621, x669); + let mut x695: u32 = 0; + let mut x696: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x695, &mut x696, x694, x623, x671); + let mut x697: u32 = 0; + let mut x698: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x697, &mut x698, x696, x625, x673); + let mut x699: u32 = 0; + let mut x700: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x699, &mut x700, x698, x627, x675); + let mut x701: u32 = 0; + let mut x702: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x701, &mut x702, x700, x629, x677); + let mut x703: u32 = 0; + let mut x704: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x703, &mut x704, x702, x631, x679); + let mut x705: u32 = 0; + let mut x706: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x705, &mut x706, x704, x633, x681); + let mut x707: u32 = 0; + let mut x708: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x707, &mut x708, x706, (((x634 as u32) + (x564 as u32)) + ((x610 as u32) + x566)), ((x682 as u32) + x638)); + let mut x709: u32 = 0; + let mut x710: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x709, &mut x710, x5, 0xc84ee01); + let mut x711: u32 = 0; + let mut x712: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x711, &mut x712, x5, 0x2b39bf21); + let mut x713: u32 = 0; + let mut x714: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x713, &mut x714, x5, 0x3fb05b7a); + let mut x715: u32 = 0; + let mut x716: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x715, &mut x716, x5, 0x28266895); + let mut x717: u32 = 0; + let mut x718: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x717, &mut x718, x5, 0xd40d4917); + let mut x719: u32 = 0; + let mut x720: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x719, &mut x720, x5, 0x4aab1cc5); + let mut x721: u32 = 0; + let mut x722: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x721, &mut x722, x5, 0xbc3e483a); + let mut x723: u32 = 0; + let mut x724: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x723, &mut x724, x5, 0xfcb82947); + let mut x725: u32 = 0; + let mut x726: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x725, &mut x726, x5, 0xff3d81e5); + let mut x727: u32 = 0; + let mut x728: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x727, &mut x728, x5, 0xdf1aa419); + let mut x729: u32 = 0; + let mut x730: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x729, &mut x730, x5, 0x2d319b24); + let mut x731: u32 = 0; + let mut x732: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x731, &mut x732, x5, 0x19b409a9); + let mut x733: u32 = 0; + let mut x734: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x733, &mut x734, 0x0, x732, x729); + let mut x735: u32 = 0; + let mut x736: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x735, &mut x736, x734, x730, x727); + let mut x737: u32 = 0; + let mut x738: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x737, &mut x738, x736, x728, x725); + let mut x739: u32 = 0; + let mut x740: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x739, &mut x740, x738, x726, x723); + let mut x741: u32 = 0; + let mut x742: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x741, &mut x742, x740, x724, x721); + let mut x743: u32 = 0; + let mut x744: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x743, &mut x744, x742, x722, x719); + let mut x745: u32 = 0; + let mut x746: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x745, &mut x746, x744, x720, x717); + let mut x747: u32 = 0; + let mut x748: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x747, &mut x748, x746, x718, x715); + let mut x749: u32 = 0; + let mut x750: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x749, &mut x750, x748, x716, x713); + let mut x751: u32 = 0; + let mut x752: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x751, &mut x752, x750, x714, x711); + let mut x753: u32 = 0; + let mut x754: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x753, &mut x754, x752, x712, x709); + let mut x755: u32 = 0; + let mut x756: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x755, &mut x756, 0x0, x685, x731); + let mut x757: u32 = 0; + let mut x758: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x757, &mut x758, x756, x687, x733); + let mut x759: u32 = 0; + let mut x760: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x759, &mut x760, x758, x689, x735); + let mut x761: u32 = 0; + let mut x762: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x761, &mut x762, x760, x691, x737); + let mut x763: u32 = 0; + let mut x764: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x763, &mut x764, x762, x693, x739); + let mut x765: u32 = 0; + let mut x766: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x765, &mut x766, x764, x695, x741); + let mut x767: u32 = 0; + let mut x768: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x767, &mut x768, x766, x697, x743); + let mut x769: u32 = 0; + let mut x770: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x769, &mut x770, x768, x699, x745); + let mut x771: u32 = 0; + let mut x772: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x771, &mut x772, x770, x701, x747); + let mut x773: u32 = 0; + let mut x774: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x773, &mut x774, x772, x703, x749); + let mut x775: u32 = 0; + let mut x776: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x775, &mut x776, x774, x705, x751); + let mut x777: u32 = 0; + let mut x778: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x777, &mut x778, x776, x707, x753); + let mut x779: u32 = 0; + let mut x780: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x779, &mut x780, x755, 0xe88fdc45); + let mut x781: u32 = 0; + let mut x782: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x781, &mut x782, x779, 0xffffffff); + let mut x783: u32 = 0; + let mut x784: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x783, &mut x784, x779, 0xffffffff); + let mut x785: u32 = 0; + let mut x786: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x785, &mut x786, x779, 0xffffffff); + let mut x787: u32 = 0; + let mut x788: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x787, &mut x788, x779, 0xffffffff); + let mut x789: u32 = 0; + let mut x790: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x789, &mut x790, x779, 0xffffffff); + let mut x791: u32 = 0; + let mut x792: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x791, &mut x792, x779, 0xffffffff); + let mut x793: u32 = 0; + let mut x794: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x793, &mut x794, x779, 0xc7634d81); + let mut x795: u32 = 0; + let mut x796: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x795, &mut x796, x779, 0xf4372ddf); + let mut x797: u32 = 0; + let mut x798: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x797, &mut x798, x779, 0x581a0db2); + let mut x799: u32 = 0; + let mut x800: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x799, &mut x800, x779, 0x48b0a77a); + let mut x801: u32 = 0; + let mut x802: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x801, &mut x802, x779, 0xecec196a); + let mut x803: u32 = 0; + let mut x804: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x803, &mut x804, x779, 0xccc52973); + let mut x805: u32 = 0; + let mut x806: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x805, &mut x806, 0x0, x804, x801); + let mut x807: u32 = 0; + let mut x808: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x807, &mut x808, x806, x802, x799); + let mut x809: u32 = 0; + let mut x810: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x809, &mut x810, x808, x800, x797); + let mut x811: u32 = 0; + let mut x812: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x811, &mut x812, x810, x798, x795); + let mut x813: u32 = 0; + let mut x814: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x813, &mut x814, x812, x796, x793); + let mut x815: u32 = 0; + let mut x816: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x815, &mut x816, x814, x794, x791); + let mut x817: u32 = 0; + let mut x818: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x817, &mut x818, x816, x792, x789); + let mut x819: u32 = 0; + let mut x820: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x819, &mut x820, x818, x790, x787); + let mut x821: u32 = 0; + let mut x822: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x821, &mut x822, x820, x788, x785); + let mut x823: u32 = 0; + let mut x824: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x823, &mut x824, x822, x786, x783); + let mut x825: u32 = 0; + let mut x826: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x825, &mut x826, x824, x784, x781); + let mut x827: u32 = 0; + let mut x828: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x827, &mut x828, 0x0, x755, x803); + let mut x829: u32 = 0; + let mut x830: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x829, &mut x830, x828, x757, x805); + let mut x831: u32 = 0; + let mut x832: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x831, &mut x832, x830, x759, x807); + let mut x833: u32 = 0; + let mut x834: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x833, &mut x834, x832, x761, x809); + let mut x835: u32 = 0; + let mut x836: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x835, &mut x836, x834, x763, x811); + let mut x837: u32 = 0; + let mut x838: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x837, &mut x838, x836, x765, x813); + let mut x839: u32 = 0; + let mut x840: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x839, &mut x840, x838, x767, x815); + let mut x841: u32 = 0; + let mut x842: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x841, &mut x842, x840, x769, x817); + let mut x843: u32 = 0; + let mut x844: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x843, &mut x844, x842, x771, x819); + let mut x845: u32 = 0; + let mut x846: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x845, &mut x846, x844, x773, x821); + let mut x847: u32 = 0; + let mut x848: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x847, &mut x848, x846, x775, x823); + let mut x849: u32 = 0; + let mut x850: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x849, &mut x850, x848, x777, x825); + let mut x851: u32 = 0; + let mut x852: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x851, &mut x852, x850, (((x778 as u32) + (x708 as u32)) + ((x754 as u32) + x710)), ((x826 as u32) + x782)); + let mut x853: u32 = 0; + let mut x854: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x853, &mut x854, x6, 0xc84ee01); + let mut x855: u32 = 0; + let mut x856: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x855, &mut x856, x6, 0x2b39bf21); + let mut x857: u32 = 0; + let mut x858: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x857, &mut x858, x6, 0x3fb05b7a); + let mut x859: u32 = 0; + let mut x860: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x859, &mut x860, x6, 0x28266895); + let mut x861: u32 = 0; + let mut x862: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x861, &mut x862, x6, 0xd40d4917); + let mut x863: u32 = 0; + let mut x864: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x863, &mut x864, x6, 0x4aab1cc5); + let mut x865: u32 = 0; + let mut x866: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x865, &mut x866, x6, 0xbc3e483a); + let mut x867: u32 = 0; + let mut x868: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x867, &mut x868, x6, 0xfcb82947); + let mut x869: u32 = 0; + let mut x870: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x869, &mut x870, x6, 0xff3d81e5); + let mut x871: u32 = 0; + let mut x872: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x871, &mut x872, x6, 0xdf1aa419); + let mut x873: u32 = 0; + let mut x874: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x873, &mut x874, x6, 0x2d319b24); + let mut x875: u32 = 0; + let mut x876: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x875, &mut x876, x6, 0x19b409a9); + let mut x877: u32 = 0; + let mut x878: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x877, &mut x878, 0x0, x876, x873); + let mut x879: u32 = 0; + let mut x880: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x879, &mut x880, x878, x874, x871); + let mut x881: u32 = 0; + let mut x882: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x881, &mut x882, x880, x872, x869); + let mut x883: u32 = 0; + let mut x884: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x883, &mut x884, x882, x870, x867); + let mut x885: u32 = 0; + let mut x886: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x885, &mut x886, x884, x868, x865); + let mut x887: u32 = 0; + let mut x888: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x887, &mut x888, x886, x866, x863); + let mut x889: u32 = 0; + let mut x890: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x889, &mut x890, x888, x864, x861); + let mut x891: u32 = 0; + let mut x892: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x891, &mut x892, x890, x862, x859); + let mut x893: u32 = 0; + let mut x894: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x893, &mut x894, x892, x860, x857); + let mut x895: u32 = 0; + let mut x896: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x895, &mut x896, x894, x858, x855); + let mut x897: u32 = 0; + let mut x898: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x897, &mut x898, x896, x856, x853); + let mut x899: u32 = 0; + let mut x900: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x899, &mut x900, 0x0, x829, x875); + let mut x901: u32 = 0; + let mut x902: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x901, &mut x902, x900, x831, x877); + let mut x903: u32 = 0; + let mut x904: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x903, &mut x904, x902, x833, x879); + let mut x905: u32 = 0; + let mut x906: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x905, &mut x906, x904, x835, x881); + let mut x907: u32 = 0; + let mut x908: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x907, &mut x908, x906, x837, x883); + let mut x909: u32 = 0; + let mut x910: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x909, &mut x910, x908, x839, x885); + let mut x911: u32 = 0; + let mut x912: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x911, &mut x912, x910, x841, x887); + let mut x913: u32 = 0; + let mut x914: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x913, &mut x914, x912, x843, x889); + let mut x915: u32 = 0; + let mut x916: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x915, &mut x916, x914, x845, x891); + let mut x917: u32 = 0; + let mut x918: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x917, &mut x918, x916, x847, x893); + let mut x919: u32 = 0; + let mut x920: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x919, &mut x920, x918, x849, x895); + let mut x921: u32 = 0; + let mut x922: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x921, &mut x922, x920, x851, x897); + let mut x923: u32 = 0; + let mut x924: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x923, &mut x924, x899, 0xe88fdc45); + let mut x925: u32 = 0; + let mut x926: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x925, &mut x926, x923, 0xffffffff); + let mut x927: u32 = 0; + let mut x928: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x927, &mut x928, x923, 0xffffffff); + let mut x929: u32 = 0; + let mut x930: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x929, &mut x930, x923, 0xffffffff); + let mut x931: u32 = 0; + let mut x932: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x931, &mut x932, x923, 0xffffffff); + let mut x933: u32 = 0; + let mut x934: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x933, &mut x934, x923, 0xffffffff); + let mut x935: u32 = 0; + let mut x936: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x935, &mut x936, x923, 0xffffffff); + let mut x937: u32 = 0; + let mut x938: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x937, &mut x938, x923, 0xc7634d81); + let mut x939: u32 = 0; + let mut x940: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x939, &mut x940, x923, 0xf4372ddf); + let mut x941: u32 = 0; + let mut x942: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x941, &mut x942, x923, 0x581a0db2); + let mut x943: u32 = 0; + let mut x944: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x943, &mut x944, x923, 0x48b0a77a); + let mut x945: u32 = 0; + let mut x946: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x945, &mut x946, x923, 0xecec196a); + let mut x947: u32 = 0; + let mut x948: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x947, &mut x948, x923, 0xccc52973); + let mut x949: u32 = 0; + let mut x950: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x949, &mut x950, 0x0, x948, x945); + let mut x951: u32 = 0; + let mut x952: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x951, &mut x952, x950, x946, x943); + let mut x953: u32 = 0; + let mut x954: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x953, &mut x954, x952, x944, x941); + let mut x955: u32 = 0; + let mut x956: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x955, &mut x956, x954, x942, x939); + let mut x957: u32 = 0; + let mut x958: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x957, &mut x958, x956, x940, x937); + let mut x959: u32 = 0; + let mut x960: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x959, &mut x960, x958, x938, x935); + let mut x961: u32 = 0; + let mut x962: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x961, &mut x962, x960, x936, x933); + let mut x963: u32 = 0; + let mut x964: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x963, &mut x964, x962, x934, x931); + let mut x965: u32 = 0; + let mut x966: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x965, &mut x966, x964, x932, x929); + let mut x967: u32 = 0; + let mut x968: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x967, &mut x968, x966, x930, x927); + let mut x969: u32 = 0; + let mut x970: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x969, &mut x970, x968, x928, x925); + let mut x971: u32 = 0; + let mut x972: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x971, &mut x972, 0x0, x899, x947); + let mut x973: u32 = 0; + let mut x974: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x973, &mut x974, x972, x901, x949); + let mut x975: u32 = 0; + let mut x976: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x975, &mut x976, x974, x903, x951); + let mut x977: u32 = 0; + let mut x978: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x977, &mut x978, x976, x905, x953); + let mut x979: u32 = 0; + let mut x980: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x979, &mut x980, x978, x907, x955); + let mut x981: u32 = 0; + let mut x982: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x981, &mut x982, x980, x909, x957); + let mut x983: u32 = 0; + let mut x984: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x983, &mut x984, x982, x911, x959); + let mut x985: u32 = 0; + let mut x986: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x985, &mut x986, x984, x913, x961); + let mut x987: u32 = 0; + let mut x988: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x987, &mut x988, x986, x915, x963); + let mut x989: u32 = 0; + let mut x990: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x989, &mut x990, x988, x917, x965); + let mut x991: u32 = 0; + let mut x992: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x991, &mut x992, x990, x919, x967); + let mut x993: u32 = 0; + let mut x994: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x993, &mut x994, x992, x921, x969); + let mut x995: u32 = 0; + let mut x996: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x995, &mut x996, x994, (((x922 as u32) + (x852 as u32)) + ((x898 as u32) + x854)), ((x970 as u32) + x926)); + let mut x997: u32 = 0; + let mut x998: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x997, &mut x998, x7, 0xc84ee01); + let mut x999: u32 = 0; + let mut x1000: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x999, &mut x1000, x7, 0x2b39bf21); + let mut x1001: u32 = 0; + let mut x1002: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1001, &mut x1002, x7, 0x3fb05b7a); + let mut x1003: u32 = 0; + let mut x1004: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1003, &mut x1004, x7, 0x28266895); + let mut x1005: u32 = 0; + let mut x1006: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1005, &mut x1006, x7, 0xd40d4917); + let mut x1007: u32 = 0; + let mut x1008: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1007, &mut x1008, x7, 0x4aab1cc5); + let mut x1009: u32 = 0; + let mut x1010: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1009, &mut x1010, x7, 0xbc3e483a); + let mut x1011: u32 = 0; + let mut x1012: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1011, &mut x1012, x7, 0xfcb82947); + let mut x1013: u32 = 0; + let mut x1014: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1013, &mut x1014, x7, 0xff3d81e5); + let mut x1015: u32 = 0; + let mut x1016: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1015, &mut x1016, x7, 0xdf1aa419); + let mut x1017: u32 = 0; + let mut x1018: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1017, &mut x1018, x7, 0x2d319b24); + let mut x1019: u32 = 0; + let mut x1020: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1019, &mut x1020, x7, 0x19b409a9); + let mut x1021: u32 = 0; + let mut x1022: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1021, &mut x1022, 0x0, x1020, x1017); + let mut x1023: u32 = 0; + let mut x1024: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1023, &mut x1024, x1022, x1018, x1015); + let mut x1025: u32 = 0; + let mut x1026: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1025, &mut x1026, x1024, x1016, x1013); + let mut x1027: u32 = 0; + let mut x1028: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1027, &mut x1028, x1026, x1014, x1011); + let mut x1029: u32 = 0; + let mut x1030: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1029, &mut x1030, x1028, x1012, x1009); + let mut x1031: u32 = 0; + let mut x1032: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1031, &mut x1032, x1030, x1010, x1007); + let mut x1033: u32 = 0; + let mut x1034: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1033, &mut x1034, x1032, x1008, x1005); + let mut x1035: u32 = 0; + let mut x1036: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1035, &mut x1036, x1034, x1006, x1003); + let mut x1037: u32 = 0; + let mut x1038: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1037, &mut x1038, x1036, x1004, x1001); + let mut x1039: u32 = 0; + let mut x1040: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1039, &mut x1040, x1038, x1002, x999); + let mut x1041: u32 = 0; + let mut x1042: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1041, &mut x1042, x1040, x1000, x997); + let mut x1043: u32 = 0; + let mut x1044: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1043, &mut x1044, 0x0, x973, x1019); + let mut x1045: u32 = 0; + let mut x1046: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1045, &mut x1046, x1044, x975, x1021); + let mut x1047: u32 = 0; + let mut x1048: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1047, &mut x1048, x1046, x977, x1023); + let mut x1049: u32 = 0; + let mut x1050: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1049, &mut x1050, x1048, x979, x1025); + let mut x1051: u32 = 0; + let mut x1052: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1051, &mut x1052, x1050, x981, x1027); + let mut x1053: u32 = 0; + let mut x1054: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1053, &mut x1054, x1052, x983, x1029); + let mut x1055: u32 = 0; + let mut x1056: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1055, &mut x1056, x1054, x985, x1031); + let mut x1057: u32 = 0; + let mut x1058: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1057, &mut x1058, x1056, x987, x1033); + let mut x1059: u32 = 0; + let mut x1060: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1059, &mut x1060, x1058, x989, x1035); + let mut x1061: u32 = 0; + let mut x1062: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1061, &mut x1062, x1060, x991, x1037); + let mut x1063: u32 = 0; + let mut x1064: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1063, &mut x1064, x1062, x993, x1039); + let mut x1065: u32 = 0; + let mut x1066: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1065, &mut x1066, x1064, x995, x1041); + let mut x1067: u32 = 0; + let mut x1068: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1067, &mut x1068, x1043, 0xe88fdc45); + let mut x1069: u32 = 0; + let mut x1070: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1069, &mut x1070, x1067, 0xffffffff); + let mut x1071: u32 = 0; + let mut x1072: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1071, &mut x1072, x1067, 0xffffffff); + let mut x1073: u32 = 0; + let mut x1074: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1073, &mut x1074, x1067, 0xffffffff); + let mut x1075: u32 = 0; + let mut x1076: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1075, &mut x1076, x1067, 0xffffffff); + let mut x1077: u32 = 0; + let mut x1078: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1077, &mut x1078, x1067, 0xffffffff); + let mut x1079: u32 = 0; + let mut x1080: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1079, &mut x1080, x1067, 0xffffffff); + let mut x1081: u32 = 0; + let mut x1082: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1081, &mut x1082, x1067, 0xc7634d81); + let mut x1083: u32 = 0; + let mut x1084: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1083, &mut x1084, x1067, 0xf4372ddf); + let mut x1085: u32 = 0; + let mut x1086: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1085, &mut x1086, x1067, 0x581a0db2); + let mut x1087: u32 = 0; + let mut x1088: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1087, &mut x1088, x1067, 0x48b0a77a); + let mut x1089: u32 = 0; + let mut x1090: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1089, &mut x1090, x1067, 0xecec196a); + let mut x1091: u32 = 0; + let mut x1092: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1091, &mut x1092, x1067, 0xccc52973); + let mut x1093: u32 = 0; + let mut x1094: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1093, &mut x1094, 0x0, x1092, x1089); + let mut x1095: u32 = 0; + let mut x1096: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1095, &mut x1096, x1094, x1090, x1087); + let mut x1097: u32 = 0; + let mut x1098: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1097, &mut x1098, x1096, x1088, x1085); + let mut x1099: u32 = 0; + let mut x1100: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1099, &mut x1100, x1098, x1086, x1083); + let mut x1101: u32 = 0; + let mut x1102: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1101, &mut x1102, x1100, x1084, x1081); + let mut x1103: u32 = 0; + let mut x1104: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1103, &mut x1104, x1102, x1082, x1079); + let mut x1105: u32 = 0; + let mut x1106: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1105, &mut x1106, x1104, x1080, x1077); + let mut x1107: u32 = 0; + let mut x1108: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1107, &mut x1108, x1106, x1078, x1075); + let mut x1109: u32 = 0; + let mut x1110: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1109, &mut x1110, x1108, x1076, x1073); + let mut x1111: u32 = 0; + let mut x1112: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1111, &mut x1112, x1110, x1074, x1071); + let mut x1113: u32 = 0; + let mut x1114: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1113, &mut x1114, x1112, x1072, x1069); + let mut x1115: u32 = 0; + let mut x1116: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1115, &mut x1116, 0x0, x1043, x1091); + let mut x1117: u32 = 0; + let mut x1118: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1117, &mut x1118, x1116, x1045, x1093); + let mut x1119: u32 = 0; + let mut x1120: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1119, &mut x1120, x1118, x1047, x1095); + let mut x1121: u32 = 0; + let mut x1122: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1121, &mut x1122, x1120, x1049, x1097); + let mut x1123: u32 = 0; + let mut x1124: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1123, &mut x1124, x1122, x1051, x1099); + let mut x1125: u32 = 0; + let mut x1126: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1125, &mut x1126, x1124, x1053, x1101); + let mut x1127: u32 = 0; + let mut x1128: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1127, &mut x1128, x1126, x1055, x1103); + let mut x1129: u32 = 0; + let mut x1130: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1129, &mut x1130, x1128, x1057, x1105); + let mut x1131: u32 = 0; + let mut x1132: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1131, &mut x1132, x1130, x1059, x1107); + let mut x1133: u32 = 0; + let mut x1134: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1133, &mut x1134, x1132, x1061, x1109); + let mut x1135: u32 = 0; + let mut x1136: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1135, &mut x1136, x1134, x1063, x1111); + let mut x1137: u32 = 0; + let mut x1138: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1137, &mut x1138, x1136, x1065, x1113); + let mut x1139: u32 = 0; + let mut x1140: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1139, &mut x1140, x1138, (((x1066 as u32) + (x996 as u32)) + ((x1042 as u32) + x998)), ((x1114 as u32) + x1070)); + let mut x1141: u32 = 0; + let mut x1142: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1141, &mut x1142, x8, 0xc84ee01); + let mut x1143: u32 = 0; + let mut x1144: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1143, &mut x1144, x8, 0x2b39bf21); + let mut x1145: u32 = 0; + let mut x1146: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1145, &mut x1146, x8, 0x3fb05b7a); + let mut x1147: u32 = 0; + let mut x1148: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1147, &mut x1148, x8, 0x28266895); + let mut x1149: u32 = 0; + let mut x1150: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1149, &mut x1150, x8, 0xd40d4917); + let mut x1151: u32 = 0; + let mut x1152: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1151, &mut x1152, x8, 0x4aab1cc5); + let mut x1153: u32 = 0; + let mut x1154: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1153, &mut x1154, x8, 0xbc3e483a); + let mut x1155: u32 = 0; + let mut x1156: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1155, &mut x1156, x8, 0xfcb82947); + let mut x1157: u32 = 0; + let mut x1158: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1157, &mut x1158, x8, 0xff3d81e5); + let mut x1159: u32 = 0; + let mut x1160: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1159, &mut x1160, x8, 0xdf1aa419); + let mut x1161: u32 = 0; + let mut x1162: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1161, &mut x1162, x8, 0x2d319b24); + let mut x1163: u32 = 0; + let mut x1164: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1163, &mut x1164, x8, 0x19b409a9); + let mut x1165: u32 = 0; + let mut x1166: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1165, &mut x1166, 0x0, x1164, x1161); + let mut x1167: u32 = 0; + let mut x1168: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1167, &mut x1168, x1166, x1162, x1159); + let mut x1169: u32 = 0; + let mut x1170: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1169, &mut x1170, x1168, x1160, x1157); + let mut x1171: u32 = 0; + let mut x1172: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1171, &mut x1172, x1170, x1158, x1155); + let mut x1173: u32 = 0; + let mut x1174: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1173, &mut x1174, x1172, x1156, x1153); + let mut x1175: u32 = 0; + let mut x1176: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1175, &mut x1176, x1174, x1154, x1151); + let mut x1177: u32 = 0; + let mut x1178: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1177, &mut x1178, x1176, x1152, x1149); + let mut x1179: u32 = 0; + let mut x1180: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1179, &mut x1180, x1178, x1150, x1147); + let mut x1181: u32 = 0; + let mut x1182: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1181, &mut x1182, x1180, x1148, x1145); + let mut x1183: u32 = 0; + let mut x1184: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1183, &mut x1184, x1182, x1146, x1143); + let mut x1185: u32 = 0; + let mut x1186: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1185, &mut x1186, x1184, x1144, x1141); + let mut x1187: u32 = 0; + let mut x1188: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1187, &mut x1188, 0x0, x1117, x1163); + let mut x1189: u32 = 0; + let mut x1190: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1189, &mut x1190, x1188, x1119, x1165); + let mut x1191: u32 = 0; + let mut x1192: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1191, &mut x1192, x1190, x1121, x1167); + let mut x1193: u32 = 0; + let mut x1194: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1193, &mut x1194, x1192, x1123, x1169); + let mut x1195: u32 = 0; + let mut x1196: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1195, &mut x1196, x1194, x1125, x1171); + let mut x1197: u32 = 0; + let mut x1198: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1197, &mut x1198, x1196, x1127, x1173); + let mut x1199: u32 = 0; + let mut x1200: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1199, &mut x1200, x1198, x1129, x1175); + let mut x1201: u32 = 0; + let mut x1202: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1201, &mut x1202, x1200, x1131, x1177); + let mut x1203: u32 = 0; + let mut x1204: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1203, &mut x1204, x1202, x1133, x1179); + let mut x1205: u32 = 0; + let mut x1206: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1205, &mut x1206, x1204, x1135, x1181); + let mut x1207: u32 = 0; + let mut x1208: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1207, &mut x1208, x1206, x1137, x1183); + let mut x1209: u32 = 0; + let mut x1210: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1209, &mut x1210, x1208, x1139, x1185); + let mut x1211: u32 = 0; + let mut x1212: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1211, &mut x1212, x1187, 0xe88fdc45); + let mut x1213: u32 = 0; + let mut x1214: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1213, &mut x1214, x1211, 0xffffffff); + let mut x1215: u32 = 0; + let mut x1216: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1215, &mut x1216, x1211, 0xffffffff); + let mut x1217: u32 = 0; + let mut x1218: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1217, &mut x1218, x1211, 0xffffffff); + let mut x1219: u32 = 0; + let mut x1220: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1219, &mut x1220, x1211, 0xffffffff); + let mut x1221: u32 = 0; + let mut x1222: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1221, &mut x1222, x1211, 0xffffffff); + let mut x1223: u32 = 0; + let mut x1224: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1223, &mut x1224, x1211, 0xffffffff); + let mut x1225: u32 = 0; + let mut x1226: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1225, &mut x1226, x1211, 0xc7634d81); + let mut x1227: u32 = 0; + let mut x1228: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1227, &mut x1228, x1211, 0xf4372ddf); + let mut x1229: u32 = 0; + let mut x1230: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1229, &mut x1230, x1211, 0x581a0db2); + let mut x1231: u32 = 0; + let mut x1232: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1231, &mut x1232, x1211, 0x48b0a77a); + let mut x1233: u32 = 0; + let mut x1234: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1233, &mut x1234, x1211, 0xecec196a); + let mut x1235: u32 = 0; + let mut x1236: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1235, &mut x1236, x1211, 0xccc52973); + let mut x1237: u32 = 0; + let mut x1238: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1237, &mut x1238, 0x0, x1236, x1233); + let mut x1239: u32 = 0; + let mut x1240: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1239, &mut x1240, x1238, x1234, x1231); + let mut x1241: u32 = 0; + let mut x1242: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1241, &mut x1242, x1240, x1232, x1229); + let mut x1243: u32 = 0; + let mut x1244: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1243, &mut x1244, x1242, x1230, x1227); + let mut x1245: u32 = 0; + let mut x1246: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1245, &mut x1246, x1244, x1228, x1225); + let mut x1247: u32 = 0; + let mut x1248: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1247, &mut x1248, x1246, x1226, x1223); + let mut x1249: u32 = 0; + let mut x1250: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1249, &mut x1250, x1248, x1224, x1221); + let mut x1251: u32 = 0; + let mut x1252: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1251, &mut x1252, x1250, x1222, x1219); + let mut x1253: u32 = 0; + let mut x1254: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1253, &mut x1254, x1252, x1220, x1217); + let mut x1255: u32 = 0; + let mut x1256: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1255, &mut x1256, x1254, x1218, x1215); + let mut x1257: u32 = 0; + let mut x1258: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1257, &mut x1258, x1256, x1216, x1213); + let mut x1259: u32 = 0; + let mut x1260: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1259, &mut x1260, 0x0, x1187, x1235); + let mut x1261: u32 = 0; + let mut x1262: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1261, &mut x1262, x1260, x1189, x1237); + let mut x1263: u32 = 0; + let mut x1264: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1263, &mut x1264, x1262, x1191, x1239); + let mut x1265: u32 = 0; + let mut x1266: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1265, &mut x1266, x1264, x1193, x1241); + let mut x1267: u32 = 0; + let mut x1268: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1267, &mut x1268, x1266, x1195, x1243); + let mut x1269: u32 = 0; + let mut x1270: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1269, &mut x1270, x1268, x1197, x1245); + let mut x1271: u32 = 0; + let mut x1272: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1271, &mut x1272, x1270, x1199, x1247); + let mut x1273: u32 = 0; + let mut x1274: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1273, &mut x1274, x1272, x1201, x1249); + let mut x1275: u32 = 0; + let mut x1276: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1275, &mut x1276, x1274, x1203, x1251); + let mut x1277: u32 = 0; + let mut x1278: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1277, &mut x1278, x1276, x1205, x1253); + let mut x1279: u32 = 0; + let mut x1280: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1279, &mut x1280, x1278, x1207, x1255); + let mut x1281: u32 = 0; + let mut x1282: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1281, &mut x1282, x1280, x1209, x1257); + let mut x1283: u32 = 0; + let mut x1284: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1283, &mut x1284, x1282, (((x1210 as u32) + (x1140 as u32)) + ((x1186 as u32) + x1142)), ((x1258 as u32) + x1214)); + let mut x1285: u32 = 0; + let mut x1286: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1285, &mut x1286, x9, 0xc84ee01); + let mut x1287: u32 = 0; + let mut x1288: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1287, &mut x1288, x9, 0x2b39bf21); + let mut x1289: u32 = 0; + let mut x1290: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1289, &mut x1290, x9, 0x3fb05b7a); + let mut x1291: u32 = 0; + let mut x1292: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1291, &mut x1292, x9, 0x28266895); + let mut x1293: u32 = 0; + let mut x1294: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1293, &mut x1294, x9, 0xd40d4917); + let mut x1295: u32 = 0; + let mut x1296: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1295, &mut x1296, x9, 0x4aab1cc5); + let mut x1297: u32 = 0; + let mut x1298: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1297, &mut x1298, x9, 0xbc3e483a); + let mut x1299: u32 = 0; + let mut x1300: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1299, &mut x1300, x9, 0xfcb82947); + let mut x1301: u32 = 0; + let mut x1302: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1301, &mut x1302, x9, 0xff3d81e5); + let mut x1303: u32 = 0; + let mut x1304: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1303, &mut x1304, x9, 0xdf1aa419); + let mut x1305: u32 = 0; + let mut x1306: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1305, &mut x1306, x9, 0x2d319b24); + let mut x1307: u32 = 0; + let mut x1308: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1307, &mut x1308, x9, 0x19b409a9); + let mut x1309: u32 = 0; + let mut x1310: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1309, &mut x1310, 0x0, x1308, x1305); + let mut x1311: u32 = 0; + let mut x1312: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1311, &mut x1312, x1310, x1306, x1303); + let mut x1313: u32 = 0; + let mut x1314: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1313, &mut x1314, x1312, x1304, x1301); + let mut x1315: u32 = 0; + let mut x1316: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1315, &mut x1316, x1314, x1302, x1299); + let mut x1317: u32 = 0; + let mut x1318: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1317, &mut x1318, x1316, x1300, x1297); + let mut x1319: u32 = 0; + let mut x1320: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1319, &mut x1320, x1318, x1298, x1295); + let mut x1321: u32 = 0; + let mut x1322: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1321, &mut x1322, x1320, x1296, x1293); + let mut x1323: u32 = 0; + let mut x1324: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1323, &mut x1324, x1322, x1294, x1291); + let mut x1325: u32 = 0; + let mut x1326: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1325, &mut x1326, x1324, x1292, x1289); + let mut x1327: u32 = 0; + let mut x1328: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1327, &mut x1328, x1326, x1290, x1287); + let mut x1329: u32 = 0; + let mut x1330: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1329, &mut x1330, x1328, x1288, x1285); + let mut x1331: u32 = 0; + let mut x1332: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1331, &mut x1332, 0x0, x1261, x1307); + let mut x1333: u32 = 0; + let mut x1334: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1333, &mut x1334, x1332, x1263, x1309); + let mut x1335: u32 = 0; + let mut x1336: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1335, &mut x1336, x1334, x1265, x1311); + let mut x1337: u32 = 0; + let mut x1338: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1337, &mut x1338, x1336, x1267, x1313); + let mut x1339: u32 = 0; + let mut x1340: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1339, &mut x1340, x1338, x1269, x1315); + let mut x1341: u32 = 0; + let mut x1342: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1341, &mut x1342, x1340, x1271, x1317); + let mut x1343: u32 = 0; + let mut x1344: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1343, &mut x1344, x1342, x1273, x1319); + let mut x1345: u32 = 0; + let mut x1346: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1345, &mut x1346, x1344, x1275, x1321); + let mut x1347: u32 = 0; + let mut x1348: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1347, &mut x1348, x1346, x1277, x1323); + let mut x1349: u32 = 0; + let mut x1350: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1349, &mut x1350, x1348, x1279, x1325); + let mut x1351: u32 = 0; + let mut x1352: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1351, &mut x1352, x1350, x1281, x1327); + let mut x1353: u32 = 0; + let mut x1354: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1353, &mut x1354, x1352, x1283, x1329); + let mut x1355: u32 = 0; + let mut x1356: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1355, &mut x1356, x1331, 0xe88fdc45); + let mut x1357: u32 = 0; + let mut x1358: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1357, &mut x1358, x1355, 0xffffffff); + let mut x1359: u32 = 0; + let mut x1360: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1359, &mut x1360, x1355, 0xffffffff); + let mut x1361: u32 = 0; + let mut x1362: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1361, &mut x1362, x1355, 0xffffffff); + let mut x1363: u32 = 0; + let mut x1364: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1363, &mut x1364, x1355, 0xffffffff); + let mut x1365: u32 = 0; + let mut x1366: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1365, &mut x1366, x1355, 0xffffffff); + let mut x1367: u32 = 0; + let mut x1368: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1367, &mut x1368, x1355, 0xffffffff); + let mut x1369: u32 = 0; + let mut x1370: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1369, &mut x1370, x1355, 0xc7634d81); + let mut x1371: u32 = 0; + let mut x1372: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1371, &mut x1372, x1355, 0xf4372ddf); + let mut x1373: u32 = 0; + let mut x1374: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1373, &mut x1374, x1355, 0x581a0db2); + let mut x1375: u32 = 0; + let mut x1376: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1375, &mut x1376, x1355, 0x48b0a77a); + let mut x1377: u32 = 0; + let mut x1378: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1377, &mut x1378, x1355, 0xecec196a); + let mut x1379: u32 = 0; + let mut x1380: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1379, &mut x1380, x1355, 0xccc52973); + let mut x1381: u32 = 0; + let mut x1382: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1381, &mut x1382, 0x0, x1380, x1377); + let mut x1383: u32 = 0; + let mut x1384: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1383, &mut x1384, x1382, x1378, x1375); + let mut x1385: u32 = 0; + let mut x1386: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1385, &mut x1386, x1384, x1376, x1373); + let mut x1387: u32 = 0; + let mut x1388: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1387, &mut x1388, x1386, x1374, x1371); + let mut x1389: u32 = 0; + let mut x1390: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1389, &mut x1390, x1388, x1372, x1369); + let mut x1391: u32 = 0; + let mut x1392: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1391, &mut x1392, x1390, x1370, x1367); + let mut x1393: u32 = 0; + let mut x1394: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1393, &mut x1394, x1392, x1368, x1365); + let mut x1395: u32 = 0; + let mut x1396: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1395, &mut x1396, x1394, x1366, x1363); + let mut x1397: u32 = 0; + let mut x1398: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1397, &mut x1398, x1396, x1364, x1361); + let mut x1399: u32 = 0; + let mut x1400: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1399, &mut x1400, x1398, x1362, x1359); + let mut x1401: u32 = 0; + let mut x1402: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1401, &mut x1402, x1400, x1360, x1357); + let mut x1403: u32 = 0; + let mut x1404: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1403, &mut x1404, 0x0, x1331, x1379); + let mut x1405: u32 = 0; + let mut x1406: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1405, &mut x1406, x1404, x1333, x1381); + let mut x1407: u32 = 0; + let mut x1408: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1407, &mut x1408, x1406, x1335, x1383); + let mut x1409: u32 = 0; + let mut x1410: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1409, &mut x1410, x1408, x1337, x1385); + let mut x1411: u32 = 0; + let mut x1412: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1411, &mut x1412, x1410, x1339, x1387); + let mut x1413: u32 = 0; + let mut x1414: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1413, &mut x1414, x1412, x1341, x1389); + let mut x1415: u32 = 0; + let mut x1416: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1415, &mut x1416, x1414, x1343, x1391); + let mut x1417: u32 = 0; + let mut x1418: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1417, &mut x1418, x1416, x1345, x1393); + let mut x1419: u32 = 0; + let mut x1420: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1419, &mut x1420, x1418, x1347, x1395); + let mut x1421: u32 = 0; + let mut x1422: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1421, &mut x1422, x1420, x1349, x1397); + let mut x1423: u32 = 0; + let mut x1424: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1423, &mut x1424, x1422, x1351, x1399); + let mut x1425: u32 = 0; + let mut x1426: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1425, &mut x1426, x1424, x1353, x1401); + let mut x1427: u32 = 0; + let mut x1428: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1427, &mut x1428, x1426, (((x1354 as u32) + (x1284 as u32)) + ((x1330 as u32) + x1286)), ((x1402 as u32) + x1358)); + let mut x1429: u32 = 0; + let mut x1430: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1429, &mut x1430, x10, 0xc84ee01); + let mut x1431: u32 = 0; + let mut x1432: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1431, &mut x1432, x10, 0x2b39bf21); + let mut x1433: u32 = 0; + let mut x1434: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1433, &mut x1434, x10, 0x3fb05b7a); + let mut x1435: u32 = 0; + let mut x1436: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1435, &mut x1436, x10, 0x28266895); + let mut x1437: u32 = 0; + let mut x1438: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1437, &mut x1438, x10, 0xd40d4917); + let mut x1439: u32 = 0; + let mut x1440: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1439, &mut x1440, x10, 0x4aab1cc5); + let mut x1441: u32 = 0; + let mut x1442: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1441, &mut x1442, x10, 0xbc3e483a); + let mut x1443: u32 = 0; + let mut x1444: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1443, &mut x1444, x10, 0xfcb82947); + let mut x1445: u32 = 0; + let mut x1446: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1445, &mut x1446, x10, 0xff3d81e5); + let mut x1447: u32 = 0; + let mut x1448: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1447, &mut x1448, x10, 0xdf1aa419); + let mut x1449: u32 = 0; + let mut x1450: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1449, &mut x1450, x10, 0x2d319b24); + let mut x1451: u32 = 0; + let mut x1452: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1451, &mut x1452, x10, 0x19b409a9); + let mut x1453: u32 = 0; + let mut x1454: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1453, &mut x1454, 0x0, x1452, x1449); + let mut x1455: u32 = 0; + let mut x1456: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1455, &mut x1456, x1454, x1450, x1447); + let mut x1457: u32 = 0; + let mut x1458: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1457, &mut x1458, x1456, x1448, x1445); + let mut x1459: u32 = 0; + let mut x1460: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1459, &mut x1460, x1458, x1446, x1443); + let mut x1461: u32 = 0; + let mut x1462: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1461, &mut x1462, x1460, x1444, x1441); + let mut x1463: u32 = 0; + let mut x1464: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1463, &mut x1464, x1462, x1442, x1439); + let mut x1465: u32 = 0; + let mut x1466: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1465, &mut x1466, x1464, x1440, x1437); + let mut x1467: u32 = 0; + let mut x1468: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1467, &mut x1468, x1466, x1438, x1435); + let mut x1469: u32 = 0; + let mut x1470: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1469, &mut x1470, x1468, x1436, x1433); + let mut x1471: u32 = 0; + let mut x1472: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1471, &mut x1472, x1470, x1434, x1431); + let mut x1473: u32 = 0; + let mut x1474: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1473, &mut x1474, x1472, x1432, x1429); + let mut x1475: u32 = 0; + let mut x1476: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1475, &mut x1476, 0x0, x1405, x1451); + let mut x1477: u32 = 0; + let mut x1478: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1477, &mut x1478, x1476, x1407, x1453); + let mut x1479: u32 = 0; + let mut x1480: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1479, &mut x1480, x1478, x1409, x1455); + let mut x1481: u32 = 0; + let mut x1482: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1481, &mut x1482, x1480, x1411, x1457); + let mut x1483: u32 = 0; + let mut x1484: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1483, &mut x1484, x1482, x1413, x1459); + let mut x1485: u32 = 0; + let mut x1486: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1485, &mut x1486, x1484, x1415, x1461); + let mut x1487: u32 = 0; + let mut x1488: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1487, &mut x1488, x1486, x1417, x1463); + let mut x1489: u32 = 0; + let mut x1490: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1489, &mut x1490, x1488, x1419, x1465); + let mut x1491: u32 = 0; + let mut x1492: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1491, &mut x1492, x1490, x1421, x1467); + let mut x1493: u32 = 0; + let mut x1494: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1493, &mut x1494, x1492, x1423, x1469); + let mut x1495: u32 = 0; + let mut x1496: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1495, &mut x1496, x1494, x1425, x1471); + let mut x1497: u32 = 0; + let mut x1498: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1497, &mut x1498, x1496, x1427, x1473); + let mut x1499: u32 = 0; + let mut x1500: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1499, &mut x1500, x1475, 0xe88fdc45); + let mut x1501: u32 = 0; + let mut x1502: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1501, &mut x1502, x1499, 0xffffffff); + let mut x1503: u32 = 0; + let mut x1504: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1503, &mut x1504, x1499, 0xffffffff); + let mut x1505: u32 = 0; + let mut x1506: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1505, &mut x1506, x1499, 0xffffffff); + let mut x1507: u32 = 0; + let mut x1508: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1507, &mut x1508, x1499, 0xffffffff); + let mut x1509: u32 = 0; + let mut x1510: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1509, &mut x1510, x1499, 0xffffffff); + let mut x1511: u32 = 0; + let mut x1512: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1511, &mut x1512, x1499, 0xffffffff); + let mut x1513: u32 = 0; + let mut x1514: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1513, &mut x1514, x1499, 0xc7634d81); + let mut x1515: u32 = 0; + let mut x1516: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1515, &mut x1516, x1499, 0xf4372ddf); + let mut x1517: u32 = 0; + let mut x1518: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1517, &mut x1518, x1499, 0x581a0db2); + let mut x1519: u32 = 0; + let mut x1520: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1519, &mut x1520, x1499, 0x48b0a77a); + let mut x1521: u32 = 0; + let mut x1522: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1521, &mut x1522, x1499, 0xecec196a); + let mut x1523: u32 = 0; + let mut x1524: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1523, &mut x1524, x1499, 0xccc52973); + let mut x1525: u32 = 0; + let mut x1526: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1525, &mut x1526, 0x0, x1524, x1521); + let mut x1527: u32 = 0; + let mut x1528: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1527, &mut x1528, x1526, x1522, x1519); + let mut x1529: u32 = 0; + let mut x1530: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1529, &mut x1530, x1528, x1520, x1517); + let mut x1531: u32 = 0; + let mut x1532: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1531, &mut x1532, x1530, x1518, x1515); + let mut x1533: u32 = 0; + let mut x1534: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1533, &mut x1534, x1532, x1516, x1513); + let mut x1535: u32 = 0; + let mut x1536: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1535, &mut x1536, x1534, x1514, x1511); + let mut x1537: u32 = 0; + let mut x1538: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1537, &mut x1538, x1536, x1512, x1509); + let mut x1539: u32 = 0; + let mut x1540: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1539, &mut x1540, x1538, x1510, x1507); + let mut x1541: u32 = 0; + let mut x1542: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1541, &mut x1542, x1540, x1508, x1505); + let mut x1543: u32 = 0; + let mut x1544: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1543, &mut x1544, x1542, x1506, x1503); + let mut x1545: u32 = 0; + let mut x1546: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1545, &mut x1546, x1544, x1504, x1501); + let mut x1547: u32 = 0; + let mut x1548: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1547, &mut x1548, 0x0, x1475, x1523); + let mut x1549: u32 = 0; + let mut x1550: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1549, &mut x1550, x1548, x1477, x1525); + let mut x1551: u32 = 0; + let mut x1552: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1551, &mut x1552, x1550, x1479, x1527); + let mut x1553: u32 = 0; + let mut x1554: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1553, &mut x1554, x1552, x1481, x1529); + let mut x1555: u32 = 0; + let mut x1556: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1555, &mut x1556, x1554, x1483, x1531); + let mut x1557: u32 = 0; + let mut x1558: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1557, &mut x1558, x1556, x1485, x1533); + let mut x1559: u32 = 0; + let mut x1560: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1559, &mut x1560, x1558, x1487, x1535); + let mut x1561: u32 = 0; + let mut x1562: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1561, &mut x1562, x1560, x1489, x1537); + let mut x1563: u32 = 0; + let mut x1564: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1563, &mut x1564, x1562, x1491, x1539); + let mut x1565: u32 = 0; + let mut x1566: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1565, &mut x1566, x1564, x1493, x1541); + let mut x1567: u32 = 0; + let mut x1568: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1567, &mut x1568, x1566, x1495, x1543); + let mut x1569: u32 = 0; + let mut x1570: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1569, &mut x1570, x1568, x1497, x1545); + let mut x1571: u32 = 0; + let mut x1572: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1571, &mut x1572, x1570, (((x1498 as u32) + (x1428 as u32)) + ((x1474 as u32) + x1430)), ((x1546 as u32) + x1502)); + let mut x1573: u32 = 0; + let mut x1574: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1573, &mut x1574, x11, 0xc84ee01); + let mut x1575: u32 = 0; + let mut x1576: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1575, &mut x1576, x11, 0x2b39bf21); + let mut x1577: u32 = 0; + let mut x1578: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1577, &mut x1578, x11, 0x3fb05b7a); + let mut x1579: u32 = 0; + let mut x1580: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1579, &mut x1580, x11, 0x28266895); + let mut x1581: u32 = 0; + let mut x1582: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1581, &mut x1582, x11, 0xd40d4917); + let mut x1583: u32 = 0; + let mut x1584: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1583, &mut x1584, x11, 0x4aab1cc5); + let mut x1585: u32 = 0; + let mut x1586: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1585, &mut x1586, x11, 0xbc3e483a); + let mut x1587: u32 = 0; + let mut x1588: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1587, &mut x1588, x11, 0xfcb82947); + let mut x1589: u32 = 0; + let mut x1590: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1589, &mut x1590, x11, 0xff3d81e5); + let mut x1591: u32 = 0; + let mut x1592: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1591, &mut x1592, x11, 0xdf1aa419); + let mut x1593: u32 = 0; + let mut x1594: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1593, &mut x1594, x11, 0x2d319b24); + let mut x1595: u32 = 0; + let mut x1596: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1595, &mut x1596, x11, 0x19b409a9); + let mut x1597: u32 = 0; + let mut x1598: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1597, &mut x1598, 0x0, x1596, x1593); + let mut x1599: u32 = 0; + let mut x1600: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1599, &mut x1600, x1598, x1594, x1591); + let mut x1601: u32 = 0; + let mut x1602: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1601, &mut x1602, x1600, x1592, x1589); + let mut x1603: u32 = 0; + let mut x1604: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1603, &mut x1604, x1602, x1590, x1587); + let mut x1605: u32 = 0; + let mut x1606: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1605, &mut x1606, x1604, x1588, x1585); + let mut x1607: u32 = 0; + let mut x1608: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1607, &mut x1608, x1606, x1586, x1583); + let mut x1609: u32 = 0; + let mut x1610: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1609, &mut x1610, x1608, x1584, x1581); + let mut x1611: u32 = 0; + let mut x1612: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1611, &mut x1612, x1610, x1582, x1579); + let mut x1613: u32 = 0; + let mut x1614: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1613, &mut x1614, x1612, x1580, x1577); + let mut x1615: u32 = 0; + let mut x1616: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1615, &mut x1616, x1614, x1578, x1575); + let mut x1617: u32 = 0; + let mut x1618: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1617, &mut x1618, x1616, x1576, x1573); + let mut x1619: u32 = 0; + let mut x1620: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1619, &mut x1620, 0x0, x1549, x1595); + let mut x1621: u32 = 0; + let mut x1622: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1621, &mut x1622, x1620, x1551, x1597); + let mut x1623: u32 = 0; + let mut x1624: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1623, &mut x1624, x1622, x1553, x1599); + let mut x1625: u32 = 0; + let mut x1626: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1625, &mut x1626, x1624, x1555, x1601); + let mut x1627: u32 = 0; + let mut x1628: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1627, &mut x1628, x1626, x1557, x1603); + let mut x1629: u32 = 0; + let mut x1630: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1629, &mut x1630, x1628, x1559, x1605); + let mut x1631: u32 = 0; + let mut x1632: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1631, &mut x1632, x1630, x1561, x1607); + let mut x1633: u32 = 0; + let mut x1634: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1633, &mut x1634, x1632, x1563, x1609); + let mut x1635: u32 = 0; + let mut x1636: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1635, &mut x1636, x1634, x1565, x1611); + let mut x1637: u32 = 0; + let mut x1638: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1637, &mut x1638, x1636, x1567, x1613); + let mut x1639: u32 = 0; + let mut x1640: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1639, &mut x1640, x1638, x1569, x1615); + let mut x1641: u32 = 0; + let mut x1642: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1641, &mut x1642, x1640, x1571, x1617); + let mut x1643: u32 = 0; + let mut x1644: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1643, &mut x1644, x1619, 0xe88fdc45); + let mut x1645: u32 = 0; + let mut x1646: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1645, &mut x1646, x1643, 0xffffffff); + let mut x1647: u32 = 0; + let mut x1648: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1647, &mut x1648, x1643, 0xffffffff); + let mut x1649: u32 = 0; + let mut x1650: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1649, &mut x1650, x1643, 0xffffffff); + let mut x1651: u32 = 0; + let mut x1652: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1651, &mut x1652, x1643, 0xffffffff); + let mut x1653: u32 = 0; + let mut x1654: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1653, &mut x1654, x1643, 0xffffffff); + let mut x1655: u32 = 0; + let mut x1656: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1655, &mut x1656, x1643, 0xffffffff); + let mut x1657: u32 = 0; + let mut x1658: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1657, &mut x1658, x1643, 0xc7634d81); + let mut x1659: u32 = 0; + let mut x1660: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1659, &mut x1660, x1643, 0xf4372ddf); + let mut x1661: u32 = 0; + let mut x1662: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1661, &mut x1662, x1643, 0x581a0db2); + let mut x1663: u32 = 0; + let mut x1664: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1663, &mut x1664, x1643, 0x48b0a77a); + let mut x1665: u32 = 0; + let mut x1666: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1665, &mut x1666, x1643, 0xecec196a); + let mut x1667: u32 = 0; + let mut x1668: u32 = 0; + fiat_p384_scalar_mulx_u32(&mut x1667, &mut x1668, x1643, 0xccc52973); + let mut x1669: u32 = 0; + let mut x1670: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1669, &mut x1670, 0x0, x1668, x1665); + let mut x1671: u32 = 0; + let mut x1672: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1671, &mut x1672, x1670, x1666, x1663); + let mut x1673: u32 = 0; + let mut x1674: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1673, &mut x1674, x1672, x1664, x1661); + let mut x1675: u32 = 0; + let mut x1676: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1675, &mut x1676, x1674, x1662, x1659); + let mut x1677: u32 = 0; + let mut x1678: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1677, &mut x1678, x1676, x1660, x1657); + let mut x1679: u32 = 0; + let mut x1680: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1679, &mut x1680, x1678, x1658, x1655); + let mut x1681: u32 = 0; + let mut x1682: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1681, &mut x1682, x1680, x1656, x1653); + let mut x1683: u32 = 0; + let mut x1684: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1683, &mut x1684, x1682, x1654, x1651); + let mut x1685: u32 = 0; + let mut x1686: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1685, &mut x1686, x1684, x1652, x1649); + let mut x1687: u32 = 0; + let mut x1688: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1687, &mut x1688, x1686, x1650, x1647); + let mut x1689: u32 = 0; + let mut x1690: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1689, &mut x1690, x1688, x1648, x1645); + let mut x1691: u32 = 0; + let mut x1692: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1691, &mut x1692, 0x0, x1619, x1667); + let mut x1693: u32 = 0; + let mut x1694: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1693, &mut x1694, x1692, x1621, x1669); + let mut x1695: u32 = 0; + let mut x1696: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1695, &mut x1696, x1694, x1623, x1671); + let mut x1697: u32 = 0; + let mut x1698: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1697, &mut x1698, x1696, x1625, x1673); + let mut x1699: u32 = 0; + let mut x1700: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1699, &mut x1700, x1698, x1627, x1675); + let mut x1701: u32 = 0; + let mut x1702: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1701, &mut x1702, x1700, x1629, x1677); + let mut x1703: u32 = 0; + let mut x1704: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1703, &mut x1704, x1702, x1631, x1679); + let mut x1705: u32 = 0; + let mut x1706: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1705, &mut x1706, x1704, x1633, x1681); + let mut x1707: u32 = 0; + let mut x1708: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1707, &mut x1708, x1706, x1635, x1683); + let mut x1709: u32 = 0; + let mut x1710: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1709, &mut x1710, x1708, x1637, x1685); + let mut x1711: u32 = 0; + let mut x1712: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1711, &mut x1712, x1710, x1639, x1687); + let mut x1713: u32 = 0; + let mut x1714: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1713, &mut x1714, x1712, x1641, x1689); + let mut x1715: u32 = 0; + let mut x1716: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1715, &mut x1716, x1714, (((x1642 as u32) + (x1572 as u32)) + ((x1618 as u32) + x1574)), ((x1690 as u32) + x1646)); + let mut x1717: u32 = 0; + let mut x1718: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1717, &mut x1718, 0x0, x1693, 0xccc52973); + let mut x1719: u32 = 0; + let mut x1720: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1719, &mut x1720, x1718, x1695, 0xecec196a); + let mut x1721: u32 = 0; + let mut x1722: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1721, &mut x1722, x1720, x1697, 0x48b0a77a); + let mut x1723: u32 = 0; + let mut x1724: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1723, &mut x1724, x1722, x1699, 0x581a0db2); + let mut x1725: u32 = 0; + let mut x1726: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1725, &mut x1726, x1724, x1701, 0xf4372ddf); + let mut x1727: u32 = 0; + let mut x1728: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1727, &mut x1728, x1726, x1703, 0xc7634d81); + let mut x1729: u32 = 0; + let mut x1730: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1729, &mut x1730, x1728, x1705, 0xffffffff); + let mut x1731: u32 = 0; + let mut x1732: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1731, &mut x1732, x1730, x1707, 0xffffffff); + let mut x1733: u32 = 0; + let mut x1734: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1733, &mut x1734, x1732, x1709, 0xffffffff); + let mut x1735: u32 = 0; + let mut x1736: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1735, &mut x1736, x1734, x1711, 0xffffffff); + let mut x1737: u32 = 0; + let mut x1738: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1737, &mut x1738, x1736, x1713, 0xffffffff); + let mut x1739: u32 = 0; + let mut x1740: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1739, &mut x1740, x1738, x1715, 0xffffffff); + let mut x1741: u32 = 0; + let mut x1742: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x1741, &mut x1742, x1740, (x1716 as u32), (0x0 as u32)); + let mut x1743: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x1743, x1742, x1717, x1693); + let mut x1744: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x1744, x1742, x1719, x1695); + let mut x1745: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x1745, x1742, x1721, x1697); + let mut x1746: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x1746, x1742, x1723, x1699); + let mut x1747: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x1747, x1742, x1725, x1701); + let mut x1748: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x1748, x1742, x1727, x1703); + let mut x1749: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x1749, x1742, x1729, x1705); + let mut x1750: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x1750, x1742, x1731, x1707); + let mut x1751: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x1751, x1742, x1733, x1709); + let mut x1752: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x1752, x1742, x1735, x1711); + let mut x1753: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x1753, x1742, x1737, x1713); + let mut x1754: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x1754, x1742, x1739, x1715); + out1[0] = x1743; + out1[1] = x1744; + out1[2] = x1745; + out1[3] = x1746; + out1[4] = x1747; + out1[5] = x1748; + out1[6] = x1749; + out1[7] = x1750; + out1[8] = x1751; + out1[9] = x1752; + out1[10] = x1753; + out1[11] = x1754; +} + +/// The function fiat_p384_scalar_nonzero outputs a single non-zero word if the input is non-zero and zero otherwise. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// out1 = 0 ↔ eval (from_montgomery arg1) mod m = 0 +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +#[inline] +pub fn fiat_p384_scalar_nonzero(out1: &mut u32, arg1: &[u32; 12]) -> () { + let x1: u32 = ((arg1[0]) | ((arg1[1]) | ((arg1[2]) | ((arg1[3]) | ((arg1[4]) | ((arg1[5]) | ((arg1[6]) | ((arg1[7]) | ((arg1[8]) | ((arg1[9]) | ((arg1[10]) | (arg1[11])))))))))))); + *out1 = x1; +} + +/// The function fiat_p384_scalar_selectznz is a multi-limb conditional select. +/// +/// Postconditions: +/// out1 = (if arg1 = 0 then arg2 else arg3) +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// arg3: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +#[inline] +pub fn fiat_p384_scalar_selectznz(out1: &mut [u32; 12], arg1: fiat_p384_scalar_u1, arg2: &[u32; 12], arg3: &[u32; 12]) -> () { + let mut x1: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x1, arg1, (arg2[0]), (arg3[0])); + let mut x2: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x2, arg1, (arg2[1]), (arg3[1])); + let mut x3: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x3, arg1, (arg2[2]), (arg3[2])); + let mut x4: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x4, arg1, (arg2[3]), (arg3[3])); + let mut x5: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x5, arg1, (arg2[4]), (arg3[4])); + let mut x6: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x6, arg1, (arg2[5]), (arg3[5])); + let mut x7: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x7, arg1, (arg2[6]), (arg3[6])); + let mut x8: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x8, arg1, (arg2[7]), (arg3[7])); + let mut x9: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x9, arg1, (arg2[8]), (arg3[8])); + let mut x10: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x10, arg1, (arg2[9]), (arg3[9])); + let mut x11: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x11, arg1, (arg2[10]), (arg3[10])); + let mut x12: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x12, arg1, (arg2[11]), (arg3[11])); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; + out1[3] = x4; + out1[4] = x5; + out1[5] = x6; + out1[6] = x7; + out1[7] = x8; + out1[8] = x9; + out1[9] = x10; + out1[10] = x11; + out1[11] = x12; +} + +/// The function fiat_p384_scalar_to_bytes serializes a field element NOT in the Montgomery domain to bytes in little-endian order. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..47] +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] +#[inline] +pub fn fiat_p384_scalar_to_bytes(out1: &mut [u8; 48], arg1: &[u32; 12]) -> () { + let x1: u32 = (arg1[11]); + let x2: u32 = (arg1[10]); + let x3: u32 = (arg1[9]); + let x4: u32 = (arg1[8]); + let x5: u32 = (arg1[7]); + let x6: u32 = (arg1[6]); + let x7: u32 = (arg1[5]); + let x8: u32 = (arg1[4]); + let x9: u32 = (arg1[3]); + let x10: u32 = (arg1[2]); + let x11: u32 = (arg1[1]); + let x12: u32 = (arg1[0]); + let x13: u8 = ((x12 & (0xff as u32)) as u8); + let x14: u32 = (x12 >> 8); + let x15: u8 = ((x14 & (0xff as u32)) as u8); + let x16: u32 = (x14 >> 8); + let x17: u8 = ((x16 & (0xff as u32)) as u8); + let x18: u8 = ((x16 >> 8) as u8); + let x19: u8 = ((x11 & (0xff as u32)) as u8); + let x20: u32 = (x11 >> 8); + let x21: u8 = ((x20 & (0xff as u32)) as u8); + let x22: u32 = (x20 >> 8); + let x23: u8 = ((x22 & (0xff as u32)) as u8); + let x24: u8 = ((x22 >> 8) as u8); + let x25: u8 = ((x10 & (0xff as u32)) as u8); + let x26: u32 = (x10 >> 8); + let x27: u8 = ((x26 & (0xff as u32)) as u8); + let x28: u32 = (x26 >> 8); + let x29: u8 = ((x28 & (0xff as u32)) as u8); + let x30: u8 = ((x28 >> 8) as u8); + let x31: u8 = ((x9 & (0xff as u32)) as u8); + let x32: u32 = (x9 >> 8); + let x33: u8 = ((x32 & (0xff as u32)) as u8); + let x34: u32 = (x32 >> 8); + let x35: u8 = ((x34 & (0xff as u32)) as u8); + let x36: u8 = ((x34 >> 8) as u8); + let x37: u8 = ((x8 & (0xff as u32)) as u8); + let x38: u32 = (x8 >> 8); + let x39: u8 = ((x38 & (0xff as u32)) as u8); + let x40: u32 = (x38 >> 8); + let x41: u8 = ((x40 & (0xff as u32)) as u8); + let x42: u8 = ((x40 >> 8) as u8); + let x43: u8 = ((x7 & (0xff as u32)) as u8); + let x44: u32 = (x7 >> 8); + let x45: u8 = ((x44 & (0xff as u32)) as u8); + let x46: u32 = (x44 >> 8); + let x47: u8 = ((x46 & (0xff as u32)) as u8); + let x48: u8 = ((x46 >> 8) as u8); + let x49: u8 = ((x6 & (0xff as u32)) as u8); + let x50: u32 = (x6 >> 8); + let x51: u8 = ((x50 & (0xff as u32)) as u8); + let x52: u32 = (x50 >> 8); + let x53: u8 = ((x52 & (0xff as u32)) as u8); + let x54: u8 = ((x52 >> 8) as u8); + let x55: u8 = ((x5 & (0xff as u32)) as u8); + let x56: u32 = (x5 >> 8); + let x57: u8 = ((x56 & (0xff as u32)) as u8); + let x58: u32 = (x56 >> 8); + let x59: u8 = ((x58 & (0xff as u32)) as u8); + let x60: u8 = ((x58 >> 8) as u8); + let x61: u8 = ((x4 & (0xff as u32)) as u8); + let x62: u32 = (x4 >> 8); + let x63: u8 = ((x62 & (0xff as u32)) as u8); + let x64: u32 = (x62 >> 8); + let x65: u8 = ((x64 & (0xff as u32)) as u8); + let x66: u8 = ((x64 >> 8) as u8); + let x67: u8 = ((x3 & (0xff as u32)) as u8); + let x68: u32 = (x3 >> 8); + let x69: u8 = ((x68 & (0xff as u32)) as u8); + let x70: u32 = (x68 >> 8); + let x71: u8 = ((x70 & (0xff as u32)) as u8); + let x72: u8 = ((x70 >> 8) as u8); + let x73: u8 = ((x2 & (0xff as u32)) as u8); + let x74: u32 = (x2 >> 8); + let x75: u8 = ((x74 & (0xff as u32)) as u8); + let x76: u32 = (x74 >> 8); + let x77: u8 = ((x76 & (0xff as u32)) as u8); + let x78: u8 = ((x76 >> 8) as u8); + let x79: u8 = ((x1 & (0xff as u32)) as u8); + let x80: u32 = (x1 >> 8); + let x81: u8 = ((x80 & (0xff as u32)) as u8); + let x82: u32 = (x80 >> 8); + let x83: u8 = ((x82 & (0xff as u32)) as u8); + let x84: u8 = ((x82 >> 8) as u8); + out1[0] = x13; + out1[1] = x15; + out1[2] = x17; + out1[3] = x18; + out1[4] = x19; + out1[5] = x21; + out1[6] = x23; + out1[7] = x24; + out1[8] = x25; + out1[9] = x27; + out1[10] = x29; + out1[11] = x30; + out1[12] = x31; + out1[13] = x33; + out1[14] = x35; + out1[15] = x36; + out1[16] = x37; + out1[17] = x39; + out1[18] = x41; + out1[19] = x42; + out1[20] = x43; + out1[21] = x45; + out1[22] = x47; + out1[23] = x48; + out1[24] = x49; + out1[25] = x51; + out1[26] = x53; + out1[27] = x54; + out1[28] = x55; + out1[29] = x57; + out1[30] = x59; + out1[31] = x60; + out1[32] = x61; + out1[33] = x63; + out1[34] = x65; + out1[35] = x66; + out1[36] = x67; + out1[37] = x69; + out1[38] = x71; + out1[39] = x72; + out1[40] = x73; + out1[41] = x75; + out1[42] = x77; + out1[43] = x78; + out1[44] = x79; + out1[45] = x81; + out1[46] = x83; + out1[47] = x84; +} + +/// The function fiat_p384_scalar_from_bytes deserializes a field element NOT in the Montgomery domain from bytes in little-endian order. +/// +/// Preconditions: +/// 0 ≤ bytes_eval arg1 < m +/// Postconditions: +/// eval out1 mod m = bytes_eval arg1 mod m +/// 0 ≤ eval out1 < m +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +#[inline] +pub fn fiat_p384_scalar_from_bytes(out1: &mut [u32; 12], arg1: &[u8; 48]) -> () { + let x1: u32 = (((arg1[47]) as u32) << 24); + let x2: u32 = (((arg1[46]) as u32) << 16); + let x3: u32 = (((arg1[45]) as u32) << 8); + let x4: u8 = (arg1[44]); + let x5: u32 = (((arg1[43]) as u32) << 24); + let x6: u32 = (((arg1[42]) as u32) << 16); + let x7: u32 = (((arg1[41]) as u32) << 8); + let x8: u8 = (arg1[40]); + let x9: u32 = (((arg1[39]) as u32) << 24); + let x10: u32 = (((arg1[38]) as u32) << 16); + let x11: u32 = (((arg1[37]) as u32) << 8); + let x12: u8 = (arg1[36]); + let x13: u32 = (((arg1[35]) as u32) << 24); + let x14: u32 = (((arg1[34]) as u32) << 16); + let x15: u32 = (((arg1[33]) as u32) << 8); + let x16: u8 = (arg1[32]); + let x17: u32 = (((arg1[31]) as u32) << 24); + let x18: u32 = (((arg1[30]) as u32) << 16); + let x19: u32 = (((arg1[29]) as u32) << 8); + let x20: u8 = (arg1[28]); + let x21: u32 = (((arg1[27]) as u32) << 24); + let x22: u32 = (((arg1[26]) as u32) << 16); + let x23: u32 = (((arg1[25]) as u32) << 8); + let x24: u8 = (arg1[24]); + let x25: u32 = (((arg1[23]) as u32) << 24); + let x26: u32 = (((arg1[22]) as u32) << 16); + let x27: u32 = (((arg1[21]) as u32) << 8); + let x28: u8 = (arg1[20]); + let x29: u32 = (((arg1[19]) as u32) << 24); + let x30: u32 = (((arg1[18]) as u32) << 16); + let x31: u32 = (((arg1[17]) as u32) << 8); + let x32: u8 = (arg1[16]); + let x33: u32 = (((arg1[15]) as u32) << 24); + let x34: u32 = (((arg1[14]) as u32) << 16); + let x35: u32 = (((arg1[13]) as u32) << 8); + let x36: u8 = (arg1[12]); + let x37: u32 = (((arg1[11]) as u32) << 24); + let x38: u32 = (((arg1[10]) as u32) << 16); + let x39: u32 = (((arg1[9]) as u32) << 8); + let x40: u8 = (arg1[8]); + let x41: u32 = (((arg1[7]) as u32) << 24); + let x42: u32 = (((arg1[6]) as u32) << 16); + let x43: u32 = (((arg1[5]) as u32) << 8); + let x44: u8 = (arg1[4]); + let x45: u32 = (((arg1[3]) as u32) << 24); + let x46: u32 = (((arg1[2]) as u32) << 16); + let x47: u32 = (((arg1[1]) as u32) << 8); + let x48: u8 = (arg1[0]); + let x49: u32 = (x47 + (x48 as u32)); + let x50: u32 = (x46 + x49); + let x51: u32 = (x45 + x50); + let x52: u32 = (x43 + (x44 as u32)); + let x53: u32 = (x42 + x52); + let x54: u32 = (x41 + x53); + let x55: u32 = (x39 + (x40 as u32)); + let x56: u32 = (x38 + x55); + let x57: u32 = (x37 + x56); + let x58: u32 = (x35 + (x36 as u32)); + let x59: u32 = (x34 + x58); + let x60: u32 = (x33 + x59); + let x61: u32 = (x31 + (x32 as u32)); + let x62: u32 = (x30 + x61); + let x63: u32 = (x29 + x62); + let x64: u32 = (x27 + (x28 as u32)); + let x65: u32 = (x26 + x64); + let x66: u32 = (x25 + x65); + let x67: u32 = (x23 + (x24 as u32)); + let x68: u32 = (x22 + x67); + let x69: u32 = (x21 + x68); + let x70: u32 = (x19 + (x20 as u32)); + let x71: u32 = (x18 + x70); + let x72: u32 = (x17 + x71); + let x73: u32 = (x15 + (x16 as u32)); + let x74: u32 = (x14 + x73); + let x75: u32 = (x13 + x74); + let x76: u32 = (x11 + (x12 as u32)); + let x77: u32 = (x10 + x76); + let x78: u32 = (x9 + x77); + let x79: u32 = (x7 + (x8 as u32)); + let x80: u32 = (x6 + x79); + let x81: u32 = (x5 + x80); + let x82: u32 = (x3 + (x4 as u32)); + let x83: u32 = (x2 + x82); + let x84: u32 = (x1 + x83); + out1[0] = x51; + out1[1] = x54; + out1[2] = x57; + out1[3] = x60; + out1[4] = x63; + out1[5] = x66; + out1[6] = x69; + out1[7] = x72; + out1[8] = x75; + out1[9] = x78; + out1[10] = x81; + out1[11] = x84; +} + +/// The function fiat_p384_scalar_set_one returns the field element one in the Montgomery domain. +/// +/// Postconditions: +/// eval (from_montgomery out1) mod m = 1 mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p384_scalar_set_one(out1: &mut fiat_p384_scalar_montgomery_domain_field_element) -> () { + out1[0] = 0x333ad68d; + out1[1] = 0x1313e695; + out1[2] = 0xb74f5885; + out1[3] = 0xa7e5f24d; + out1[4] = 0xbc8d220; + out1[5] = 0x389cb27e; + out1[6] = (0x0 as u32); + out1[7] = (0x0 as u32); + out1[8] = (0x0 as u32); + out1[9] = (0x0 as u32); + out1[10] = (0x0 as u32); + out1[11] = (0x0 as u32); +} + +/// The function fiat_p384_scalar_msat returns the saturated representation of the prime modulus. +/// +/// Postconditions: +/// twos_complement_eval out1 = m +/// 0 ≤ eval out1 < m +/// +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +#[inline] +pub fn fiat_p384_scalar_msat(out1: &mut [u32; 13]) -> () { + out1[0] = 0xccc52973; + out1[1] = 0xecec196a; + out1[2] = 0x48b0a77a; + out1[3] = 0x581a0db2; + out1[4] = 0xf4372ddf; + out1[5] = 0xc7634d81; + out1[6] = 0xffffffff; + out1[7] = 0xffffffff; + out1[8] = 0xffffffff; + out1[9] = 0xffffffff; + out1[10] = 0xffffffff; + out1[11] = 0xffffffff; + out1[12] = (0x0 as u32); +} + +/// The function fiat_p384_scalar_divstep computes a divstep. +/// +/// Preconditions: +/// 0 ≤ eval arg4 < m +/// 0 ≤ eval arg5 < m +/// Postconditions: +/// out1 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then 1 - arg1 else 1 + arg1) +/// twos_complement_eval out2 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then twos_complement_eval arg3 else twos_complement_eval arg2) +/// twos_complement_eval out3 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then ⌊(twos_complement_eval arg3 - twos_complement_eval arg2) / 2⌋ else ⌊(twos_complement_eval arg3 + (twos_complement_eval arg3 mod 2) * twos_complement_eval arg2) / 2⌋) +/// eval (from_montgomery out4) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (2 * eval (from_montgomery arg5)) mod m else (2 * eval (from_montgomery arg4)) mod m) +/// eval (from_montgomery out5) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (eval (from_montgomery arg4) - eval (from_montgomery arg4)) mod m else (eval (from_montgomery arg5) + (twos_complement_eval arg3 mod 2) * eval (from_montgomery arg4)) mod m) +/// 0 ≤ eval out5 < m +/// 0 ≤ eval out5 < m +/// 0 ≤ eval out2 < m +/// 0 ≤ eval out3 < m +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0xffffffff] +/// arg2: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// arg3: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// arg4: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// arg5: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +/// out2: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// out3: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// out4: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// out5: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +#[inline] +pub fn fiat_p384_scalar_divstep(out1: &mut u32, out2: &mut [u32; 13], out3: &mut [u32; 13], out4: &mut [u32; 12], out5: &mut [u32; 12], arg1: u32, arg2: &[u32; 13], arg3: &[u32; 13], arg4: &[u32; 12], arg5: &[u32; 12]) -> () { + let mut x1: u32 = 0; + let mut x2: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x1, &mut x2, 0x0, (!arg1), (0x1 as u32)); + let x3: fiat_p384_scalar_u1 = (((x1 >> 31) as fiat_p384_scalar_u1) & (((arg3[0]) & (0x1 as u32)) as fiat_p384_scalar_u1)); + let mut x4: u32 = 0; + let mut x5: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x4, &mut x5, 0x0, (!arg1), (0x1 as u32)); + let mut x6: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x6, x3, arg1, x4); + let mut x7: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x7, x3, (arg2[0]), (arg3[0])); + let mut x8: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x8, x3, (arg2[1]), (arg3[1])); + let mut x9: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x9, x3, (arg2[2]), (arg3[2])); + let mut x10: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x10, x3, (arg2[3]), (arg3[3])); + let mut x11: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x11, x3, (arg2[4]), (arg3[4])); + let mut x12: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x12, x3, (arg2[5]), (arg3[5])); + let mut x13: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x13, x3, (arg2[6]), (arg3[6])); + let mut x14: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x14, x3, (arg2[7]), (arg3[7])); + let mut x15: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x15, x3, (arg2[8]), (arg3[8])); + let mut x16: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x16, x3, (arg2[9]), (arg3[9])); + let mut x17: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x17, x3, (arg2[10]), (arg3[10])); + let mut x18: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x18, x3, (arg2[11]), (arg3[11])); + let mut x19: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x19, x3, (arg2[12]), (arg3[12])); + let mut x20: u32 = 0; + let mut x21: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x20, &mut x21, 0x0, (0x1 as u32), (!(arg2[0]))); + let mut x22: u32 = 0; + let mut x23: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x22, &mut x23, x21, (0x0 as u32), (!(arg2[1]))); + let mut x24: u32 = 0; + let mut x25: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x24, &mut x25, x23, (0x0 as u32), (!(arg2[2]))); + let mut x26: u32 = 0; + let mut x27: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x26, &mut x27, x25, (0x0 as u32), (!(arg2[3]))); + let mut x28: u32 = 0; + let mut x29: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x28, &mut x29, x27, (0x0 as u32), (!(arg2[4]))); + let mut x30: u32 = 0; + let mut x31: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x30, &mut x31, x29, (0x0 as u32), (!(arg2[5]))); + let mut x32: u32 = 0; + let mut x33: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x32, &mut x33, x31, (0x0 as u32), (!(arg2[6]))); + let mut x34: u32 = 0; + let mut x35: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x34, &mut x35, x33, (0x0 as u32), (!(arg2[7]))); + let mut x36: u32 = 0; + let mut x37: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x36, &mut x37, x35, (0x0 as u32), (!(arg2[8]))); + let mut x38: u32 = 0; + let mut x39: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x38, &mut x39, x37, (0x0 as u32), (!(arg2[9]))); + let mut x40: u32 = 0; + let mut x41: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x40, &mut x41, x39, (0x0 as u32), (!(arg2[10]))); + let mut x42: u32 = 0; + let mut x43: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x42, &mut x43, x41, (0x0 as u32), (!(arg2[11]))); + let mut x44: u32 = 0; + let mut x45: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x44, &mut x45, x43, (0x0 as u32), (!(arg2[12]))); + let mut x46: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x46, x3, (arg3[0]), x20); + let mut x47: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x47, x3, (arg3[1]), x22); + let mut x48: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x48, x3, (arg3[2]), x24); + let mut x49: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x49, x3, (arg3[3]), x26); + let mut x50: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x50, x3, (arg3[4]), x28); + let mut x51: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x51, x3, (arg3[5]), x30); + let mut x52: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x52, x3, (arg3[6]), x32); + let mut x53: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x53, x3, (arg3[7]), x34); + let mut x54: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x54, x3, (arg3[8]), x36); + let mut x55: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x55, x3, (arg3[9]), x38); + let mut x56: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x56, x3, (arg3[10]), x40); + let mut x57: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x57, x3, (arg3[11]), x42); + let mut x58: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x58, x3, (arg3[12]), x44); + let mut x59: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x59, x3, (arg4[0]), (arg5[0])); + let mut x60: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x60, x3, (arg4[1]), (arg5[1])); + let mut x61: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x61, x3, (arg4[2]), (arg5[2])); + let mut x62: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x62, x3, (arg4[3]), (arg5[3])); + let mut x63: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x63, x3, (arg4[4]), (arg5[4])); + let mut x64: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x64, x3, (arg4[5]), (arg5[5])); + let mut x65: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x65, x3, (arg4[6]), (arg5[6])); + let mut x66: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x66, x3, (arg4[7]), (arg5[7])); + let mut x67: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x67, x3, (arg4[8]), (arg5[8])); + let mut x68: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x68, x3, (arg4[9]), (arg5[9])); + let mut x69: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x69, x3, (arg4[10]), (arg5[10])); + let mut x70: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x70, x3, (arg4[11]), (arg5[11])); + let mut x71: u32 = 0; + let mut x72: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x71, &mut x72, 0x0, x59, x59); + let mut x73: u32 = 0; + let mut x74: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x73, &mut x74, x72, x60, x60); + let mut x75: u32 = 0; + let mut x76: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x75, &mut x76, x74, x61, x61); + let mut x77: u32 = 0; + let mut x78: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x77, &mut x78, x76, x62, x62); + let mut x79: u32 = 0; + let mut x80: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x79, &mut x80, x78, x63, x63); + let mut x81: u32 = 0; + let mut x82: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x81, &mut x82, x80, x64, x64); + let mut x83: u32 = 0; + let mut x84: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x83, &mut x84, x82, x65, x65); + let mut x85: u32 = 0; + let mut x86: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x85, &mut x86, x84, x66, x66); + let mut x87: u32 = 0; + let mut x88: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x87, &mut x88, x86, x67, x67); + let mut x89: u32 = 0; + let mut x90: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x89, &mut x90, x88, x68, x68); + let mut x91: u32 = 0; + let mut x92: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x91, &mut x92, x90, x69, x69); + let mut x93: u32 = 0; + let mut x94: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x93, &mut x94, x92, x70, x70); + let mut x95: u32 = 0; + let mut x96: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x95, &mut x96, 0x0, x71, 0xccc52973); + let mut x97: u32 = 0; + let mut x98: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x97, &mut x98, x96, x73, 0xecec196a); + let mut x99: u32 = 0; + let mut x100: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x99, &mut x100, x98, x75, 0x48b0a77a); + let mut x101: u32 = 0; + let mut x102: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x101, &mut x102, x100, x77, 0x581a0db2); + let mut x103: u32 = 0; + let mut x104: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x103, &mut x104, x102, x79, 0xf4372ddf); + let mut x105: u32 = 0; + let mut x106: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x105, &mut x106, x104, x81, 0xc7634d81); + let mut x107: u32 = 0; + let mut x108: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x107, &mut x108, x106, x83, 0xffffffff); + let mut x109: u32 = 0; + let mut x110: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x109, &mut x110, x108, x85, 0xffffffff); + let mut x111: u32 = 0; + let mut x112: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x111, &mut x112, x110, x87, 0xffffffff); + let mut x113: u32 = 0; + let mut x114: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x113, &mut x114, x112, x89, 0xffffffff); + let mut x115: u32 = 0; + let mut x116: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x115, &mut x116, x114, x91, 0xffffffff); + let mut x117: u32 = 0; + let mut x118: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x117, &mut x118, x116, x93, 0xffffffff); + let mut x119: u32 = 0; + let mut x120: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x119, &mut x120, x118, (x94 as u32), (0x0 as u32)); + let x121: u32 = (arg4[11]); + let x122: u32 = (arg4[10]); + let x123: u32 = (arg4[9]); + let x124: u32 = (arg4[8]); + let x125: u32 = (arg4[7]); + let x126: u32 = (arg4[6]); + let x127: u32 = (arg4[5]); + let x128: u32 = (arg4[4]); + let x129: u32 = (arg4[3]); + let x130: u32 = (arg4[2]); + let x131: u32 = (arg4[1]); + let x132: u32 = (arg4[0]); + let mut x133: u32 = 0; + let mut x134: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x133, &mut x134, 0x0, (0x0 as u32), x132); + let mut x135: u32 = 0; + let mut x136: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x135, &mut x136, x134, (0x0 as u32), x131); + let mut x137: u32 = 0; + let mut x138: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x137, &mut x138, x136, (0x0 as u32), x130); + let mut x139: u32 = 0; + let mut x140: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x139, &mut x140, x138, (0x0 as u32), x129); + let mut x141: u32 = 0; + let mut x142: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x141, &mut x142, x140, (0x0 as u32), x128); + let mut x143: u32 = 0; + let mut x144: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x143, &mut x144, x142, (0x0 as u32), x127); + let mut x145: u32 = 0; + let mut x146: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x145, &mut x146, x144, (0x0 as u32), x126); + let mut x147: u32 = 0; + let mut x148: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x147, &mut x148, x146, (0x0 as u32), x125); + let mut x149: u32 = 0; + let mut x150: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x149, &mut x150, x148, (0x0 as u32), x124); + let mut x151: u32 = 0; + let mut x152: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x151, &mut x152, x150, (0x0 as u32), x123); + let mut x153: u32 = 0; + let mut x154: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x153, &mut x154, x152, (0x0 as u32), x122); + let mut x155: u32 = 0; + let mut x156: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x155, &mut x156, x154, (0x0 as u32), x121); + let mut x157: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x157, x156, (0x0 as u32), 0xffffffff); + let mut x158: u32 = 0; + let mut x159: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x158, &mut x159, 0x0, x133, (x157 & 0xccc52973)); + let mut x160: u32 = 0; + let mut x161: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x160, &mut x161, x159, x135, (x157 & 0xecec196a)); + let mut x162: u32 = 0; + let mut x163: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x162, &mut x163, x161, x137, (x157 & 0x48b0a77a)); + let mut x164: u32 = 0; + let mut x165: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x164, &mut x165, x163, x139, (x157 & 0x581a0db2)); + let mut x166: u32 = 0; + let mut x167: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x166, &mut x167, x165, x141, (x157 & 0xf4372ddf)); + let mut x168: u32 = 0; + let mut x169: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x168, &mut x169, x167, x143, (x157 & 0xc7634d81)); + let mut x170: u32 = 0; + let mut x171: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x170, &mut x171, x169, x145, x157); + let mut x172: u32 = 0; + let mut x173: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x172, &mut x173, x171, x147, x157); + let mut x174: u32 = 0; + let mut x175: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x174, &mut x175, x173, x149, x157); + let mut x176: u32 = 0; + let mut x177: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x176, &mut x177, x175, x151, x157); + let mut x178: u32 = 0; + let mut x179: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x178, &mut x179, x177, x153, x157); + let mut x180: u32 = 0; + let mut x181: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x180, &mut x181, x179, x155, x157); + let mut x182: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x182, x3, (arg5[0]), x158); + let mut x183: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x183, x3, (arg5[1]), x160); + let mut x184: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x184, x3, (arg5[2]), x162); + let mut x185: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x185, x3, (arg5[3]), x164); + let mut x186: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x186, x3, (arg5[4]), x166); + let mut x187: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x187, x3, (arg5[5]), x168); + let mut x188: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x188, x3, (arg5[6]), x170); + let mut x189: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x189, x3, (arg5[7]), x172); + let mut x190: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x190, x3, (arg5[8]), x174); + let mut x191: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x191, x3, (arg5[9]), x176); + let mut x192: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x192, x3, (arg5[10]), x178); + let mut x193: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x193, x3, (arg5[11]), x180); + let x194: fiat_p384_scalar_u1 = ((x46 & (0x1 as u32)) as fiat_p384_scalar_u1); + let mut x195: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x195, x194, (0x0 as u32), x7); + let mut x196: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x196, x194, (0x0 as u32), x8); + let mut x197: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x197, x194, (0x0 as u32), x9); + let mut x198: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x198, x194, (0x0 as u32), x10); + let mut x199: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x199, x194, (0x0 as u32), x11); + let mut x200: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x200, x194, (0x0 as u32), x12); + let mut x201: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x201, x194, (0x0 as u32), x13); + let mut x202: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x202, x194, (0x0 as u32), x14); + let mut x203: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x203, x194, (0x0 as u32), x15); + let mut x204: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x204, x194, (0x0 as u32), x16); + let mut x205: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x205, x194, (0x0 as u32), x17); + let mut x206: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x206, x194, (0x0 as u32), x18); + let mut x207: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x207, x194, (0x0 as u32), x19); + let mut x208: u32 = 0; + let mut x209: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x208, &mut x209, 0x0, x46, x195); + let mut x210: u32 = 0; + let mut x211: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x210, &mut x211, x209, x47, x196); + let mut x212: u32 = 0; + let mut x213: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x212, &mut x213, x211, x48, x197); + let mut x214: u32 = 0; + let mut x215: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x214, &mut x215, x213, x49, x198); + let mut x216: u32 = 0; + let mut x217: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x216, &mut x217, x215, x50, x199); + let mut x218: u32 = 0; + let mut x219: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x218, &mut x219, x217, x51, x200); + let mut x220: u32 = 0; + let mut x221: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x220, &mut x221, x219, x52, x201); + let mut x222: u32 = 0; + let mut x223: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x222, &mut x223, x221, x53, x202); + let mut x224: u32 = 0; + let mut x225: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x224, &mut x225, x223, x54, x203); + let mut x226: u32 = 0; + let mut x227: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x226, &mut x227, x225, x55, x204); + let mut x228: u32 = 0; + let mut x229: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x228, &mut x229, x227, x56, x205); + let mut x230: u32 = 0; + let mut x231: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x230, &mut x231, x229, x57, x206); + let mut x232: u32 = 0; + let mut x233: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x232, &mut x233, x231, x58, x207); + let mut x234: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x234, x194, (0x0 as u32), x59); + let mut x235: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x235, x194, (0x0 as u32), x60); + let mut x236: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x236, x194, (0x0 as u32), x61); + let mut x237: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x237, x194, (0x0 as u32), x62); + let mut x238: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x238, x194, (0x0 as u32), x63); + let mut x239: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x239, x194, (0x0 as u32), x64); + let mut x240: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x240, x194, (0x0 as u32), x65); + let mut x241: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x241, x194, (0x0 as u32), x66); + let mut x242: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x242, x194, (0x0 as u32), x67); + let mut x243: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x243, x194, (0x0 as u32), x68); + let mut x244: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x244, x194, (0x0 as u32), x69); + let mut x245: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x245, x194, (0x0 as u32), x70); + let mut x246: u32 = 0; + let mut x247: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x246, &mut x247, 0x0, x182, x234); + let mut x248: u32 = 0; + let mut x249: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x248, &mut x249, x247, x183, x235); + let mut x250: u32 = 0; + let mut x251: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x250, &mut x251, x249, x184, x236); + let mut x252: u32 = 0; + let mut x253: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x252, &mut x253, x251, x185, x237); + let mut x254: u32 = 0; + let mut x255: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x254, &mut x255, x253, x186, x238); + let mut x256: u32 = 0; + let mut x257: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x256, &mut x257, x255, x187, x239); + let mut x258: u32 = 0; + let mut x259: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x258, &mut x259, x257, x188, x240); + let mut x260: u32 = 0; + let mut x261: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x260, &mut x261, x259, x189, x241); + let mut x262: u32 = 0; + let mut x263: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x262, &mut x263, x261, x190, x242); + let mut x264: u32 = 0; + let mut x265: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x264, &mut x265, x263, x191, x243); + let mut x266: u32 = 0; + let mut x267: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x266, &mut x267, x265, x192, x244); + let mut x268: u32 = 0; + let mut x269: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x268, &mut x269, x267, x193, x245); + let mut x270: u32 = 0; + let mut x271: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x270, &mut x271, 0x0, x246, 0xccc52973); + let mut x272: u32 = 0; + let mut x273: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x272, &mut x273, x271, x248, 0xecec196a); + let mut x274: u32 = 0; + let mut x275: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x274, &mut x275, x273, x250, 0x48b0a77a); + let mut x276: u32 = 0; + let mut x277: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x276, &mut x277, x275, x252, 0x581a0db2); + let mut x278: u32 = 0; + let mut x279: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x278, &mut x279, x277, x254, 0xf4372ddf); + let mut x280: u32 = 0; + let mut x281: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x280, &mut x281, x279, x256, 0xc7634d81); + let mut x282: u32 = 0; + let mut x283: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x282, &mut x283, x281, x258, 0xffffffff); + let mut x284: u32 = 0; + let mut x285: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x284, &mut x285, x283, x260, 0xffffffff); + let mut x286: u32 = 0; + let mut x287: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x286, &mut x287, x285, x262, 0xffffffff); + let mut x288: u32 = 0; + let mut x289: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x288, &mut x289, x287, x264, 0xffffffff); + let mut x290: u32 = 0; + let mut x291: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x290, &mut x291, x289, x266, 0xffffffff); + let mut x292: u32 = 0; + let mut x293: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x292, &mut x293, x291, x268, 0xffffffff); + let mut x294: u32 = 0; + let mut x295: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u32(&mut x294, &mut x295, x293, (x269 as u32), (0x0 as u32)); + let mut x296: u32 = 0; + let mut x297: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u32(&mut x296, &mut x297, 0x0, x6, (0x1 as u32)); + let x298: u32 = ((x208 >> 1) | ((x210 << 31) & 0xffffffff)); + let x299: u32 = ((x210 >> 1) | ((x212 << 31) & 0xffffffff)); + let x300: u32 = ((x212 >> 1) | ((x214 << 31) & 0xffffffff)); + let x301: u32 = ((x214 >> 1) | ((x216 << 31) & 0xffffffff)); + let x302: u32 = ((x216 >> 1) | ((x218 << 31) & 0xffffffff)); + let x303: u32 = ((x218 >> 1) | ((x220 << 31) & 0xffffffff)); + let x304: u32 = ((x220 >> 1) | ((x222 << 31) & 0xffffffff)); + let x305: u32 = ((x222 >> 1) | ((x224 << 31) & 0xffffffff)); + let x306: u32 = ((x224 >> 1) | ((x226 << 31) & 0xffffffff)); + let x307: u32 = ((x226 >> 1) | ((x228 << 31) & 0xffffffff)); + let x308: u32 = ((x228 >> 1) | ((x230 << 31) & 0xffffffff)); + let x309: u32 = ((x230 >> 1) | ((x232 << 31) & 0xffffffff)); + let x310: u32 = ((x232 & 0x80000000) | (x232 >> 1)); + let mut x311: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x311, x120, x95, x71); + let mut x312: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x312, x120, x97, x73); + let mut x313: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x313, x120, x99, x75); + let mut x314: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x314, x120, x101, x77); + let mut x315: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x315, x120, x103, x79); + let mut x316: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x316, x120, x105, x81); + let mut x317: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x317, x120, x107, x83); + let mut x318: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x318, x120, x109, x85); + let mut x319: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x319, x120, x111, x87); + let mut x320: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x320, x120, x113, x89); + let mut x321: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x321, x120, x115, x91); + let mut x322: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x322, x120, x117, x93); + let mut x323: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x323, x295, x270, x246); + let mut x324: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x324, x295, x272, x248); + let mut x325: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x325, x295, x274, x250); + let mut x326: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x326, x295, x276, x252); + let mut x327: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x327, x295, x278, x254); + let mut x328: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x328, x295, x280, x256); + let mut x329: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x329, x295, x282, x258); + let mut x330: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x330, x295, x284, x260); + let mut x331: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x331, x295, x286, x262); + let mut x332: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x332, x295, x288, x264); + let mut x333: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x333, x295, x290, x266); + let mut x334: u32 = 0; + fiat_p384_scalar_cmovznz_u32(&mut x334, x295, x292, x268); + *out1 = x296; + out2[0] = x7; + out2[1] = x8; + out2[2] = x9; + out2[3] = x10; + out2[4] = x11; + out2[5] = x12; + out2[6] = x13; + out2[7] = x14; + out2[8] = x15; + out2[9] = x16; + out2[10] = x17; + out2[11] = x18; + out2[12] = x19; + out3[0] = x298; + out3[1] = x299; + out3[2] = x300; + out3[3] = x301; + out3[4] = x302; + out3[5] = x303; + out3[6] = x304; + out3[7] = x305; + out3[8] = x306; + out3[9] = x307; + out3[10] = x308; + out3[11] = x309; + out3[12] = x310; + out4[0] = x311; + out4[1] = x312; + out4[2] = x313; + out4[3] = x314; + out4[4] = x315; + out4[5] = x316; + out4[6] = x317; + out4[7] = x318; + out4[8] = x319; + out4[9] = x320; + out4[10] = x321; + out4[11] = x322; + out5[0] = x323; + out5[1] = x324; + out5[2] = x325; + out5[3] = x326; + out5[4] = x327; + out5[5] = x328; + out5[6] = x329; + out5[7] = x330; + out5[8] = x331; + out5[9] = x332; + out5[10] = x333; + out5[11] = x334; +} + +/// The function fiat_p384_scalar_divstep_precomp returns the precomputed value for Bernstein-Yang-inversion (in montgomery form). +/// +/// Postconditions: +/// eval (from_montgomery out1) = ⌊(m - 1) / 2⌋^(if ⌊log2 m⌋ + 1 < 46 then ⌊(49 * (⌊log2 m⌋ + 1) + 80) / 17⌋ else ⌊(49 * (⌊log2 m⌋ + 1) + 57) / 17⌋) +/// 0 ≤ eval out1 < m +/// +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +#[inline] +pub fn fiat_p384_scalar_divstep_precomp(out1: &mut [u32; 12]) -> () { + out1[0] = 0xe6045b6a; + out1[1] = 0x49589ae0; + out1[2] = 0x870040ed; + out1[3] = 0x3c9a5352; + out1[4] = 0x977dc242; + out1[5] = 0xdacb097e; + out1[6] = 0xd1ecbe36; + out1[7] = 0xb5ab30a6; + out1[8] = 0x1f959973; + out1[9] = 0x97d7a108; + out1[10] = 0xd27192bc; + out1[11] = 0x2ba012f8; +} diff --git a/vendor/fiat-crypto/src/p384_scalar_64.rs b/vendor/fiat-crypto/src/p384_scalar_64.rs new file mode 100644 index 000000000..63474c239 --- /dev/null +++ b/vendor/fiat-crypto/src/p384_scalar_64.rs @@ -0,0 +1,3625 @@ +//! Autogenerated: 'src/ExtractionOCaml/word_by_word_montgomery' --lang Rust --inline p384_scalar 64 '2^384 - 1388124618062372383947042015309946732620727252194336364173' mul square add sub opp from_montgomery to_montgomery nonzero selectznz to_bytes from_bytes one msat divstep divstep_precomp +//! curve description: p384_scalar +//! machine_wordsize = 64 (from "64") +//! requested operations: mul, square, add, sub, opp, from_montgomery, to_montgomery, nonzero, selectznz, to_bytes, from_bytes, one, msat, divstep, divstep_precomp +//! m = 0xffffffffffffffffffffffffffffffffffffffffffffffffc7634d81f4372ddf581a0db248b0a77aecec196accc52973 (from "2^384 - 1388124618062372383947042015309946732620727252194336364173") +//! +//! NOTE: In addition to the bounds specified above each function, all +//! functions synthesized for this Montgomery arithmetic require the +//! input to be strictly less than the prime modulus (m), and also +//! require the input to be in the unique saturated representation. +//! All functions also ensure that these two properties are true of +//! return values. +//! +//! Computed values: +//! eval z = z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) + (z[4] << 256) + (z[5] << 0x140) +//! bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248) + (z[32] << 256) + (z[33] << 0x108) + (z[34] << 0x110) + (z[35] << 0x118) + (z[36] << 0x120) + (z[37] << 0x128) + (z[38] << 0x130) + (z[39] << 0x138) + (z[40] << 0x140) + (z[41] << 0x148) + (z[42] << 0x150) + (z[43] << 0x158) + (z[44] << 0x160) + (z[45] << 0x168) + (z[46] << 0x170) + (z[47] << 0x178) +//! twos_complement_eval z = let x1 := z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) + (z[4] << 256) + (z[5] << 0x140) in +//! if x1 & (2^384-1) < 2^383 then x1 & (2^384-1) else (x1 & (2^384-1)) - 2^384 + +#![allow(unused_parens)] +#![allow(non_camel_case_types)] + +pub type fiat_p384_scalar_u1 = u8; +pub type fiat_p384_scalar_i1 = i8; +pub type fiat_p384_scalar_u2 = u8; +pub type fiat_p384_scalar_i2 = i8; + +/* The type fiat_p384_scalar_montgomery_domain_field_element is a field element in the Montgomery domain. */ +/* Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] */ +pub type fiat_p384_scalar_montgomery_domain_field_element = [u64; 6]; + +/* The type fiat_p384_scalar_non_montgomery_domain_field_element is a field element NOT in the Montgomery domain. */ +/* Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] */ +pub type fiat_p384_scalar_non_montgomery_domain_field_element = [u64; 6]; + + +/// The function fiat_p384_scalar_addcarryx_u64 is an addition with carry. +/// +/// Postconditions: +/// out1 = (arg1 + arg2 + arg3) mod 2^64 +/// out2 = ⌊(arg1 + arg2 + arg3) / 2^64⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffffffffffff] +/// arg3: [0x0 ~> 0xffffffffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_p384_scalar_addcarryx_u64(out1: &mut u64, out2: &mut fiat_p384_scalar_u1, arg1: fiat_p384_scalar_u1, arg2: u64, arg3: u64) -> () { + let x1: u128 = (((arg1 as u128) + (arg2 as u128)) + (arg3 as u128)); + let x2: u64 = ((x1 & (0xffffffffffffffff as u128)) as u64); + let x3: fiat_p384_scalar_u1 = ((x1 >> 64) as fiat_p384_scalar_u1); + *out1 = x2; + *out2 = x3; +} + +/// The function fiat_p384_scalar_subborrowx_u64 is a subtraction with borrow. +/// +/// Postconditions: +/// out1 = (-arg1 + arg2 + -arg3) mod 2^64 +/// out2 = -⌊(-arg1 + arg2 + -arg3) / 2^64⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffffffffffff] +/// arg3: [0x0 ~> 0xffffffffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_p384_scalar_subborrowx_u64(out1: &mut u64, out2: &mut fiat_p384_scalar_u1, arg1: fiat_p384_scalar_u1, arg2: u64, arg3: u64) -> () { + let x1: i128 = (((arg2 as i128) - (arg1 as i128)) - (arg3 as i128)); + let x2: fiat_p384_scalar_i1 = ((x1 >> 64) as fiat_p384_scalar_i1); + let x3: u64 = ((x1 & (0xffffffffffffffff as i128)) as u64); + *out1 = x3; + *out2 = (((0x0 as fiat_p384_scalar_i2) - (x2 as fiat_p384_scalar_i2)) as fiat_p384_scalar_u1); +} + +/// The function fiat_p384_scalar_mulx_u64 is a multiplication, returning the full double-width result. +/// +/// Postconditions: +/// out1 = (arg1 * arg2) mod 2^64 +/// out2 = ⌊arg1 * arg2 / 2^64⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0xffffffffffffffff] +/// arg2: [0x0 ~> 0xffffffffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +/// out2: [0x0 ~> 0xffffffffffffffff] +#[inline] +pub fn fiat_p384_scalar_mulx_u64(out1: &mut u64, out2: &mut u64, arg1: u64, arg2: u64) -> () { + let x1: u128 = ((arg1 as u128) * (arg2 as u128)); + let x2: u64 = ((x1 & (0xffffffffffffffff as u128)) as u64); + let x3: u64 = ((x1 >> 64) as u64); + *out1 = x2; + *out2 = x3; +} + +/// The function fiat_p384_scalar_cmovznz_u64 is a single-word conditional move. +/// +/// Postconditions: +/// out1 = (if arg1 = 0 then arg2 else arg3) +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffffffffffff] +/// arg3: [0x0 ~> 0xffffffffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +#[inline] +pub fn fiat_p384_scalar_cmovznz_u64(out1: &mut u64, arg1: fiat_p384_scalar_u1, arg2: u64, arg3: u64) -> () { + let x1: fiat_p384_scalar_u1 = (!(!arg1)); + let x2: u64 = ((((((0x0 as fiat_p384_scalar_i2) - (x1 as fiat_p384_scalar_i2)) as fiat_p384_scalar_i1) as i128) & (0xffffffffffffffff as i128)) as u64); + let x3: u64 = ((x2 & arg3) | ((!x2) & arg2)); + *out1 = x3; +} + +/// The function fiat_p384_scalar_mul multiplies two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p384_scalar_mul(out1: &mut fiat_p384_scalar_montgomery_domain_field_element, arg1: &fiat_p384_scalar_montgomery_domain_field_element, arg2: &fiat_p384_scalar_montgomery_domain_field_element) -> () { + let x1: u64 = (arg1[1]); + let x2: u64 = (arg1[2]); + let x3: u64 = (arg1[3]); + let x4: u64 = (arg1[4]); + let x5: u64 = (arg1[5]); + let x6: u64 = (arg1[0]); + let mut x7: u64 = 0; + let mut x8: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x7, &mut x8, x6, (arg2[5])); + let mut x9: u64 = 0; + let mut x10: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x9, &mut x10, x6, (arg2[4])); + let mut x11: u64 = 0; + let mut x12: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x11, &mut x12, x6, (arg2[3])); + let mut x13: u64 = 0; + let mut x14: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x13, &mut x14, x6, (arg2[2])); + let mut x15: u64 = 0; + let mut x16: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x15, &mut x16, x6, (arg2[1])); + let mut x17: u64 = 0; + let mut x18: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x17, &mut x18, x6, (arg2[0])); + let mut x19: u64 = 0; + let mut x20: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x19, &mut x20, 0x0, x18, x15); + let mut x21: u64 = 0; + let mut x22: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x21, &mut x22, x20, x16, x13); + let mut x23: u64 = 0; + let mut x24: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x23, &mut x24, x22, x14, x11); + let mut x25: u64 = 0; + let mut x26: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x25, &mut x26, x24, x12, x9); + let mut x27: u64 = 0; + let mut x28: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x27, &mut x28, x26, x10, x7); + let x29: u64 = ((x28 as u64) + x8); + let mut x30: u64 = 0; + let mut x31: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x30, &mut x31, x17, 0x6ed46089e88fdc45); + let mut x32: u64 = 0; + let mut x33: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x32, &mut x33, x30, 0xffffffffffffffff); + let mut x34: u64 = 0; + let mut x35: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x34, &mut x35, x30, 0xffffffffffffffff); + let mut x36: u64 = 0; + let mut x37: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x36, &mut x37, x30, 0xffffffffffffffff); + let mut x38: u64 = 0; + let mut x39: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x38, &mut x39, x30, 0xc7634d81f4372ddf); + let mut x40: u64 = 0; + let mut x41: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x40, &mut x41, x30, 0x581a0db248b0a77a); + let mut x42: u64 = 0; + let mut x43: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x42, &mut x43, x30, 0xecec196accc52973); + let mut x44: u64 = 0; + let mut x45: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x44, &mut x45, 0x0, x43, x40); + let mut x46: u64 = 0; + let mut x47: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x46, &mut x47, x45, x41, x38); + let mut x48: u64 = 0; + let mut x49: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x48, &mut x49, x47, x39, x36); + let mut x50: u64 = 0; + let mut x51: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x50, &mut x51, x49, x37, x34); + let mut x52: u64 = 0; + let mut x53: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x52, &mut x53, x51, x35, x32); + let x54: u64 = ((x53 as u64) + x33); + let mut x55: u64 = 0; + let mut x56: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x55, &mut x56, 0x0, x17, x42); + let mut x57: u64 = 0; + let mut x58: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x57, &mut x58, x56, x19, x44); + let mut x59: u64 = 0; + let mut x60: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x59, &mut x60, x58, x21, x46); + let mut x61: u64 = 0; + let mut x62: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x61, &mut x62, x60, x23, x48); + let mut x63: u64 = 0; + let mut x64: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x63, &mut x64, x62, x25, x50); + let mut x65: u64 = 0; + let mut x66: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x65, &mut x66, x64, x27, x52); + let mut x67: u64 = 0; + let mut x68: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x67, &mut x68, x66, x29, x54); + let mut x69: u64 = 0; + let mut x70: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x69, &mut x70, x1, (arg2[5])); + let mut x71: u64 = 0; + let mut x72: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x71, &mut x72, x1, (arg2[4])); + let mut x73: u64 = 0; + let mut x74: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x73, &mut x74, x1, (arg2[3])); + let mut x75: u64 = 0; + let mut x76: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x75, &mut x76, x1, (arg2[2])); + let mut x77: u64 = 0; + let mut x78: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x77, &mut x78, x1, (arg2[1])); + let mut x79: u64 = 0; + let mut x80: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x79, &mut x80, x1, (arg2[0])); + let mut x81: u64 = 0; + let mut x82: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x81, &mut x82, 0x0, x80, x77); + let mut x83: u64 = 0; + let mut x84: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x83, &mut x84, x82, x78, x75); + let mut x85: u64 = 0; + let mut x86: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x85, &mut x86, x84, x76, x73); + let mut x87: u64 = 0; + let mut x88: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x87, &mut x88, x86, x74, x71); + let mut x89: u64 = 0; + let mut x90: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x89, &mut x90, x88, x72, x69); + let x91: u64 = ((x90 as u64) + x70); + let mut x92: u64 = 0; + let mut x93: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x92, &mut x93, 0x0, x57, x79); + let mut x94: u64 = 0; + let mut x95: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x94, &mut x95, x93, x59, x81); + let mut x96: u64 = 0; + let mut x97: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x96, &mut x97, x95, x61, x83); + let mut x98: u64 = 0; + let mut x99: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x98, &mut x99, x97, x63, x85); + let mut x100: u64 = 0; + let mut x101: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x100, &mut x101, x99, x65, x87); + let mut x102: u64 = 0; + let mut x103: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x102, &mut x103, x101, x67, x89); + let mut x104: u64 = 0; + let mut x105: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x104, &mut x105, x103, (x68 as u64), x91); + let mut x106: u64 = 0; + let mut x107: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x106, &mut x107, x92, 0x6ed46089e88fdc45); + let mut x108: u64 = 0; + let mut x109: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x108, &mut x109, x106, 0xffffffffffffffff); + let mut x110: u64 = 0; + let mut x111: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x110, &mut x111, x106, 0xffffffffffffffff); + let mut x112: u64 = 0; + let mut x113: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x112, &mut x113, x106, 0xffffffffffffffff); + let mut x114: u64 = 0; + let mut x115: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x114, &mut x115, x106, 0xc7634d81f4372ddf); + let mut x116: u64 = 0; + let mut x117: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x116, &mut x117, x106, 0x581a0db248b0a77a); + let mut x118: u64 = 0; + let mut x119: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x118, &mut x119, x106, 0xecec196accc52973); + let mut x120: u64 = 0; + let mut x121: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x120, &mut x121, 0x0, x119, x116); + let mut x122: u64 = 0; + let mut x123: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x122, &mut x123, x121, x117, x114); + let mut x124: u64 = 0; + let mut x125: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x124, &mut x125, x123, x115, x112); + let mut x126: u64 = 0; + let mut x127: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x126, &mut x127, x125, x113, x110); + let mut x128: u64 = 0; + let mut x129: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x128, &mut x129, x127, x111, x108); + let x130: u64 = ((x129 as u64) + x109); + let mut x131: u64 = 0; + let mut x132: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x131, &mut x132, 0x0, x92, x118); + let mut x133: u64 = 0; + let mut x134: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x133, &mut x134, x132, x94, x120); + let mut x135: u64 = 0; + let mut x136: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x135, &mut x136, x134, x96, x122); + let mut x137: u64 = 0; + let mut x138: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x137, &mut x138, x136, x98, x124); + let mut x139: u64 = 0; + let mut x140: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x139, &mut x140, x138, x100, x126); + let mut x141: u64 = 0; + let mut x142: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x141, &mut x142, x140, x102, x128); + let mut x143: u64 = 0; + let mut x144: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x143, &mut x144, x142, x104, x130); + let x145: u64 = ((x144 as u64) + (x105 as u64)); + let mut x146: u64 = 0; + let mut x147: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x146, &mut x147, x2, (arg2[5])); + let mut x148: u64 = 0; + let mut x149: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x148, &mut x149, x2, (arg2[4])); + let mut x150: u64 = 0; + let mut x151: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x150, &mut x151, x2, (arg2[3])); + let mut x152: u64 = 0; + let mut x153: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x152, &mut x153, x2, (arg2[2])); + let mut x154: u64 = 0; + let mut x155: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x154, &mut x155, x2, (arg2[1])); + let mut x156: u64 = 0; + let mut x157: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x156, &mut x157, x2, (arg2[0])); + let mut x158: u64 = 0; + let mut x159: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x158, &mut x159, 0x0, x157, x154); + let mut x160: u64 = 0; + let mut x161: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x160, &mut x161, x159, x155, x152); + let mut x162: u64 = 0; + let mut x163: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x162, &mut x163, x161, x153, x150); + let mut x164: u64 = 0; + let mut x165: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x164, &mut x165, x163, x151, x148); + let mut x166: u64 = 0; + let mut x167: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x166, &mut x167, x165, x149, x146); + let x168: u64 = ((x167 as u64) + x147); + let mut x169: u64 = 0; + let mut x170: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x169, &mut x170, 0x0, x133, x156); + let mut x171: u64 = 0; + let mut x172: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x171, &mut x172, x170, x135, x158); + let mut x173: u64 = 0; + let mut x174: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x173, &mut x174, x172, x137, x160); + let mut x175: u64 = 0; + let mut x176: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x175, &mut x176, x174, x139, x162); + let mut x177: u64 = 0; + let mut x178: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x177, &mut x178, x176, x141, x164); + let mut x179: u64 = 0; + let mut x180: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x179, &mut x180, x178, x143, x166); + let mut x181: u64 = 0; + let mut x182: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x181, &mut x182, x180, x145, x168); + let mut x183: u64 = 0; + let mut x184: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x183, &mut x184, x169, 0x6ed46089e88fdc45); + let mut x185: u64 = 0; + let mut x186: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x185, &mut x186, x183, 0xffffffffffffffff); + let mut x187: u64 = 0; + let mut x188: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x187, &mut x188, x183, 0xffffffffffffffff); + let mut x189: u64 = 0; + let mut x190: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x189, &mut x190, x183, 0xffffffffffffffff); + let mut x191: u64 = 0; + let mut x192: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x191, &mut x192, x183, 0xc7634d81f4372ddf); + let mut x193: u64 = 0; + let mut x194: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x193, &mut x194, x183, 0x581a0db248b0a77a); + let mut x195: u64 = 0; + let mut x196: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x195, &mut x196, x183, 0xecec196accc52973); + let mut x197: u64 = 0; + let mut x198: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x197, &mut x198, 0x0, x196, x193); + let mut x199: u64 = 0; + let mut x200: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x199, &mut x200, x198, x194, x191); + let mut x201: u64 = 0; + let mut x202: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x201, &mut x202, x200, x192, x189); + let mut x203: u64 = 0; + let mut x204: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x203, &mut x204, x202, x190, x187); + let mut x205: u64 = 0; + let mut x206: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x205, &mut x206, x204, x188, x185); + let x207: u64 = ((x206 as u64) + x186); + let mut x208: u64 = 0; + let mut x209: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x208, &mut x209, 0x0, x169, x195); + let mut x210: u64 = 0; + let mut x211: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x210, &mut x211, x209, x171, x197); + let mut x212: u64 = 0; + let mut x213: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x212, &mut x213, x211, x173, x199); + let mut x214: u64 = 0; + let mut x215: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x214, &mut x215, x213, x175, x201); + let mut x216: u64 = 0; + let mut x217: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x216, &mut x217, x215, x177, x203); + let mut x218: u64 = 0; + let mut x219: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x218, &mut x219, x217, x179, x205); + let mut x220: u64 = 0; + let mut x221: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x220, &mut x221, x219, x181, x207); + let x222: u64 = ((x221 as u64) + (x182 as u64)); + let mut x223: u64 = 0; + let mut x224: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x223, &mut x224, x3, (arg2[5])); + let mut x225: u64 = 0; + let mut x226: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x225, &mut x226, x3, (arg2[4])); + let mut x227: u64 = 0; + let mut x228: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x227, &mut x228, x3, (arg2[3])); + let mut x229: u64 = 0; + let mut x230: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x229, &mut x230, x3, (arg2[2])); + let mut x231: u64 = 0; + let mut x232: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x231, &mut x232, x3, (arg2[1])); + let mut x233: u64 = 0; + let mut x234: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x233, &mut x234, x3, (arg2[0])); + let mut x235: u64 = 0; + let mut x236: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x235, &mut x236, 0x0, x234, x231); + let mut x237: u64 = 0; + let mut x238: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x237, &mut x238, x236, x232, x229); + let mut x239: u64 = 0; + let mut x240: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x239, &mut x240, x238, x230, x227); + let mut x241: u64 = 0; + let mut x242: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x241, &mut x242, x240, x228, x225); + let mut x243: u64 = 0; + let mut x244: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x243, &mut x244, x242, x226, x223); + let x245: u64 = ((x244 as u64) + x224); + let mut x246: u64 = 0; + let mut x247: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x246, &mut x247, 0x0, x210, x233); + let mut x248: u64 = 0; + let mut x249: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x248, &mut x249, x247, x212, x235); + let mut x250: u64 = 0; + let mut x251: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x250, &mut x251, x249, x214, x237); + let mut x252: u64 = 0; + let mut x253: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x252, &mut x253, x251, x216, x239); + let mut x254: u64 = 0; + let mut x255: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x254, &mut x255, x253, x218, x241); + let mut x256: u64 = 0; + let mut x257: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x256, &mut x257, x255, x220, x243); + let mut x258: u64 = 0; + let mut x259: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x258, &mut x259, x257, x222, x245); + let mut x260: u64 = 0; + let mut x261: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x260, &mut x261, x246, 0x6ed46089e88fdc45); + let mut x262: u64 = 0; + let mut x263: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x262, &mut x263, x260, 0xffffffffffffffff); + let mut x264: u64 = 0; + let mut x265: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x264, &mut x265, x260, 0xffffffffffffffff); + let mut x266: u64 = 0; + let mut x267: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x266, &mut x267, x260, 0xffffffffffffffff); + let mut x268: u64 = 0; + let mut x269: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x268, &mut x269, x260, 0xc7634d81f4372ddf); + let mut x270: u64 = 0; + let mut x271: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x270, &mut x271, x260, 0x581a0db248b0a77a); + let mut x272: u64 = 0; + let mut x273: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x272, &mut x273, x260, 0xecec196accc52973); + let mut x274: u64 = 0; + let mut x275: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x274, &mut x275, 0x0, x273, x270); + let mut x276: u64 = 0; + let mut x277: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x276, &mut x277, x275, x271, x268); + let mut x278: u64 = 0; + let mut x279: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x278, &mut x279, x277, x269, x266); + let mut x280: u64 = 0; + let mut x281: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x280, &mut x281, x279, x267, x264); + let mut x282: u64 = 0; + let mut x283: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x282, &mut x283, x281, x265, x262); + let x284: u64 = ((x283 as u64) + x263); + let mut x285: u64 = 0; + let mut x286: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x285, &mut x286, 0x0, x246, x272); + let mut x287: u64 = 0; + let mut x288: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x287, &mut x288, x286, x248, x274); + let mut x289: u64 = 0; + let mut x290: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x289, &mut x290, x288, x250, x276); + let mut x291: u64 = 0; + let mut x292: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x291, &mut x292, x290, x252, x278); + let mut x293: u64 = 0; + let mut x294: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x293, &mut x294, x292, x254, x280); + let mut x295: u64 = 0; + let mut x296: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x295, &mut x296, x294, x256, x282); + let mut x297: u64 = 0; + let mut x298: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x297, &mut x298, x296, x258, x284); + let x299: u64 = ((x298 as u64) + (x259 as u64)); + let mut x300: u64 = 0; + let mut x301: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x300, &mut x301, x4, (arg2[5])); + let mut x302: u64 = 0; + let mut x303: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x302, &mut x303, x4, (arg2[4])); + let mut x304: u64 = 0; + let mut x305: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x304, &mut x305, x4, (arg2[3])); + let mut x306: u64 = 0; + let mut x307: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x306, &mut x307, x4, (arg2[2])); + let mut x308: u64 = 0; + let mut x309: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x308, &mut x309, x4, (arg2[1])); + let mut x310: u64 = 0; + let mut x311: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x310, &mut x311, x4, (arg2[0])); + let mut x312: u64 = 0; + let mut x313: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x312, &mut x313, 0x0, x311, x308); + let mut x314: u64 = 0; + let mut x315: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x314, &mut x315, x313, x309, x306); + let mut x316: u64 = 0; + let mut x317: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x316, &mut x317, x315, x307, x304); + let mut x318: u64 = 0; + let mut x319: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x318, &mut x319, x317, x305, x302); + let mut x320: u64 = 0; + let mut x321: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x320, &mut x321, x319, x303, x300); + let x322: u64 = ((x321 as u64) + x301); + let mut x323: u64 = 0; + let mut x324: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x323, &mut x324, 0x0, x287, x310); + let mut x325: u64 = 0; + let mut x326: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x325, &mut x326, x324, x289, x312); + let mut x327: u64 = 0; + let mut x328: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x327, &mut x328, x326, x291, x314); + let mut x329: u64 = 0; + let mut x330: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x329, &mut x330, x328, x293, x316); + let mut x331: u64 = 0; + let mut x332: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x331, &mut x332, x330, x295, x318); + let mut x333: u64 = 0; + let mut x334: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x333, &mut x334, x332, x297, x320); + let mut x335: u64 = 0; + let mut x336: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x335, &mut x336, x334, x299, x322); + let mut x337: u64 = 0; + let mut x338: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x337, &mut x338, x323, 0x6ed46089e88fdc45); + let mut x339: u64 = 0; + let mut x340: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x339, &mut x340, x337, 0xffffffffffffffff); + let mut x341: u64 = 0; + let mut x342: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x341, &mut x342, x337, 0xffffffffffffffff); + let mut x343: u64 = 0; + let mut x344: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x343, &mut x344, x337, 0xffffffffffffffff); + let mut x345: u64 = 0; + let mut x346: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x345, &mut x346, x337, 0xc7634d81f4372ddf); + let mut x347: u64 = 0; + let mut x348: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x347, &mut x348, x337, 0x581a0db248b0a77a); + let mut x349: u64 = 0; + let mut x350: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x349, &mut x350, x337, 0xecec196accc52973); + let mut x351: u64 = 0; + let mut x352: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x351, &mut x352, 0x0, x350, x347); + let mut x353: u64 = 0; + let mut x354: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x353, &mut x354, x352, x348, x345); + let mut x355: u64 = 0; + let mut x356: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x355, &mut x356, x354, x346, x343); + let mut x357: u64 = 0; + let mut x358: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x357, &mut x358, x356, x344, x341); + let mut x359: u64 = 0; + let mut x360: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x359, &mut x360, x358, x342, x339); + let x361: u64 = ((x360 as u64) + x340); + let mut x362: u64 = 0; + let mut x363: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x362, &mut x363, 0x0, x323, x349); + let mut x364: u64 = 0; + let mut x365: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x364, &mut x365, x363, x325, x351); + let mut x366: u64 = 0; + let mut x367: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x366, &mut x367, x365, x327, x353); + let mut x368: u64 = 0; + let mut x369: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x368, &mut x369, x367, x329, x355); + let mut x370: u64 = 0; + let mut x371: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x370, &mut x371, x369, x331, x357); + let mut x372: u64 = 0; + let mut x373: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x372, &mut x373, x371, x333, x359); + let mut x374: u64 = 0; + let mut x375: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x374, &mut x375, x373, x335, x361); + let x376: u64 = ((x375 as u64) + (x336 as u64)); + let mut x377: u64 = 0; + let mut x378: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x377, &mut x378, x5, (arg2[5])); + let mut x379: u64 = 0; + let mut x380: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x379, &mut x380, x5, (arg2[4])); + let mut x381: u64 = 0; + let mut x382: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x381, &mut x382, x5, (arg2[3])); + let mut x383: u64 = 0; + let mut x384: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x383, &mut x384, x5, (arg2[2])); + let mut x385: u64 = 0; + let mut x386: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x385, &mut x386, x5, (arg2[1])); + let mut x387: u64 = 0; + let mut x388: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x387, &mut x388, x5, (arg2[0])); + let mut x389: u64 = 0; + let mut x390: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x389, &mut x390, 0x0, x388, x385); + let mut x391: u64 = 0; + let mut x392: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x391, &mut x392, x390, x386, x383); + let mut x393: u64 = 0; + let mut x394: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x393, &mut x394, x392, x384, x381); + let mut x395: u64 = 0; + let mut x396: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x395, &mut x396, x394, x382, x379); + let mut x397: u64 = 0; + let mut x398: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x397, &mut x398, x396, x380, x377); + let x399: u64 = ((x398 as u64) + x378); + let mut x400: u64 = 0; + let mut x401: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x400, &mut x401, 0x0, x364, x387); + let mut x402: u64 = 0; + let mut x403: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x402, &mut x403, x401, x366, x389); + let mut x404: u64 = 0; + let mut x405: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x404, &mut x405, x403, x368, x391); + let mut x406: u64 = 0; + let mut x407: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x406, &mut x407, x405, x370, x393); + let mut x408: u64 = 0; + let mut x409: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x408, &mut x409, x407, x372, x395); + let mut x410: u64 = 0; + let mut x411: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x410, &mut x411, x409, x374, x397); + let mut x412: u64 = 0; + let mut x413: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x412, &mut x413, x411, x376, x399); + let mut x414: u64 = 0; + let mut x415: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x414, &mut x415, x400, 0x6ed46089e88fdc45); + let mut x416: u64 = 0; + let mut x417: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x416, &mut x417, x414, 0xffffffffffffffff); + let mut x418: u64 = 0; + let mut x419: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x418, &mut x419, x414, 0xffffffffffffffff); + let mut x420: u64 = 0; + let mut x421: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x420, &mut x421, x414, 0xffffffffffffffff); + let mut x422: u64 = 0; + let mut x423: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x422, &mut x423, x414, 0xc7634d81f4372ddf); + let mut x424: u64 = 0; + let mut x425: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x424, &mut x425, x414, 0x581a0db248b0a77a); + let mut x426: u64 = 0; + let mut x427: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x426, &mut x427, x414, 0xecec196accc52973); + let mut x428: u64 = 0; + let mut x429: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x428, &mut x429, 0x0, x427, x424); + let mut x430: u64 = 0; + let mut x431: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x430, &mut x431, x429, x425, x422); + let mut x432: u64 = 0; + let mut x433: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x432, &mut x433, x431, x423, x420); + let mut x434: u64 = 0; + let mut x435: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x434, &mut x435, x433, x421, x418); + let mut x436: u64 = 0; + let mut x437: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x436, &mut x437, x435, x419, x416); + let x438: u64 = ((x437 as u64) + x417); + let mut x439: u64 = 0; + let mut x440: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x439, &mut x440, 0x0, x400, x426); + let mut x441: u64 = 0; + let mut x442: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x441, &mut x442, x440, x402, x428); + let mut x443: u64 = 0; + let mut x444: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x443, &mut x444, x442, x404, x430); + let mut x445: u64 = 0; + let mut x446: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x445, &mut x446, x444, x406, x432); + let mut x447: u64 = 0; + let mut x448: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x447, &mut x448, x446, x408, x434); + let mut x449: u64 = 0; + let mut x450: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x449, &mut x450, x448, x410, x436); + let mut x451: u64 = 0; + let mut x452: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x451, &mut x452, x450, x412, x438); + let x453: u64 = ((x452 as u64) + (x413 as u64)); + let mut x454: u64 = 0; + let mut x455: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x454, &mut x455, 0x0, x441, 0xecec196accc52973); + let mut x456: u64 = 0; + let mut x457: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x456, &mut x457, x455, x443, 0x581a0db248b0a77a); + let mut x458: u64 = 0; + let mut x459: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x458, &mut x459, x457, x445, 0xc7634d81f4372ddf); + let mut x460: u64 = 0; + let mut x461: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x460, &mut x461, x459, x447, 0xffffffffffffffff); + let mut x462: u64 = 0; + let mut x463: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x462, &mut x463, x461, x449, 0xffffffffffffffff); + let mut x464: u64 = 0; + let mut x465: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x464, &mut x465, x463, x451, 0xffffffffffffffff); + let mut x466: u64 = 0; + let mut x467: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x466, &mut x467, x465, x453, (0x0 as u64)); + let mut x468: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x468, x467, x454, x441); + let mut x469: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x469, x467, x456, x443); + let mut x470: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x470, x467, x458, x445); + let mut x471: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x471, x467, x460, x447); + let mut x472: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x472, x467, x462, x449); + let mut x473: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x473, x467, x464, x451); + out1[0] = x468; + out1[1] = x469; + out1[2] = x470; + out1[3] = x471; + out1[4] = x472; + out1[5] = x473; +} + +/// The function fiat_p384_scalar_square squares a field element in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg1)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p384_scalar_square(out1: &mut fiat_p384_scalar_montgomery_domain_field_element, arg1: &fiat_p384_scalar_montgomery_domain_field_element) -> () { + let x1: u64 = (arg1[1]); + let x2: u64 = (arg1[2]); + let x3: u64 = (arg1[3]); + let x4: u64 = (arg1[4]); + let x5: u64 = (arg1[5]); + let x6: u64 = (arg1[0]); + let mut x7: u64 = 0; + let mut x8: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x7, &mut x8, x6, (arg1[5])); + let mut x9: u64 = 0; + let mut x10: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x9, &mut x10, x6, (arg1[4])); + let mut x11: u64 = 0; + let mut x12: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x11, &mut x12, x6, (arg1[3])); + let mut x13: u64 = 0; + let mut x14: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x13, &mut x14, x6, (arg1[2])); + let mut x15: u64 = 0; + let mut x16: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x15, &mut x16, x6, (arg1[1])); + let mut x17: u64 = 0; + let mut x18: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x17, &mut x18, x6, (arg1[0])); + let mut x19: u64 = 0; + let mut x20: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x19, &mut x20, 0x0, x18, x15); + let mut x21: u64 = 0; + let mut x22: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x21, &mut x22, x20, x16, x13); + let mut x23: u64 = 0; + let mut x24: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x23, &mut x24, x22, x14, x11); + let mut x25: u64 = 0; + let mut x26: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x25, &mut x26, x24, x12, x9); + let mut x27: u64 = 0; + let mut x28: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x27, &mut x28, x26, x10, x7); + let x29: u64 = ((x28 as u64) + x8); + let mut x30: u64 = 0; + let mut x31: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x30, &mut x31, x17, 0x6ed46089e88fdc45); + let mut x32: u64 = 0; + let mut x33: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x32, &mut x33, x30, 0xffffffffffffffff); + let mut x34: u64 = 0; + let mut x35: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x34, &mut x35, x30, 0xffffffffffffffff); + let mut x36: u64 = 0; + let mut x37: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x36, &mut x37, x30, 0xffffffffffffffff); + let mut x38: u64 = 0; + let mut x39: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x38, &mut x39, x30, 0xc7634d81f4372ddf); + let mut x40: u64 = 0; + let mut x41: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x40, &mut x41, x30, 0x581a0db248b0a77a); + let mut x42: u64 = 0; + let mut x43: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x42, &mut x43, x30, 0xecec196accc52973); + let mut x44: u64 = 0; + let mut x45: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x44, &mut x45, 0x0, x43, x40); + let mut x46: u64 = 0; + let mut x47: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x46, &mut x47, x45, x41, x38); + let mut x48: u64 = 0; + let mut x49: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x48, &mut x49, x47, x39, x36); + let mut x50: u64 = 0; + let mut x51: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x50, &mut x51, x49, x37, x34); + let mut x52: u64 = 0; + let mut x53: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x52, &mut x53, x51, x35, x32); + let x54: u64 = ((x53 as u64) + x33); + let mut x55: u64 = 0; + let mut x56: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x55, &mut x56, 0x0, x17, x42); + let mut x57: u64 = 0; + let mut x58: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x57, &mut x58, x56, x19, x44); + let mut x59: u64 = 0; + let mut x60: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x59, &mut x60, x58, x21, x46); + let mut x61: u64 = 0; + let mut x62: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x61, &mut x62, x60, x23, x48); + let mut x63: u64 = 0; + let mut x64: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x63, &mut x64, x62, x25, x50); + let mut x65: u64 = 0; + let mut x66: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x65, &mut x66, x64, x27, x52); + let mut x67: u64 = 0; + let mut x68: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x67, &mut x68, x66, x29, x54); + let mut x69: u64 = 0; + let mut x70: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x69, &mut x70, x1, (arg1[5])); + let mut x71: u64 = 0; + let mut x72: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x71, &mut x72, x1, (arg1[4])); + let mut x73: u64 = 0; + let mut x74: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x73, &mut x74, x1, (arg1[3])); + let mut x75: u64 = 0; + let mut x76: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x75, &mut x76, x1, (arg1[2])); + let mut x77: u64 = 0; + let mut x78: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x77, &mut x78, x1, (arg1[1])); + let mut x79: u64 = 0; + let mut x80: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x79, &mut x80, x1, (arg1[0])); + let mut x81: u64 = 0; + let mut x82: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x81, &mut x82, 0x0, x80, x77); + let mut x83: u64 = 0; + let mut x84: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x83, &mut x84, x82, x78, x75); + let mut x85: u64 = 0; + let mut x86: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x85, &mut x86, x84, x76, x73); + let mut x87: u64 = 0; + let mut x88: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x87, &mut x88, x86, x74, x71); + let mut x89: u64 = 0; + let mut x90: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x89, &mut x90, x88, x72, x69); + let x91: u64 = ((x90 as u64) + x70); + let mut x92: u64 = 0; + let mut x93: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x92, &mut x93, 0x0, x57, x79); + let mut x94: u64 = 0; + let mut x95: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x94, &mut x95, x93, x59, x81); + let mut x96: u64 = 0; + let mut x97: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x96, &mut x97, x95, x61, x83); + let mut x98: u64 = 0; + let mut x99: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x98, &mut x99, x97, x63, x85); + let mut x100: u64 = 0; + let mut x101: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x100, &mut x101, x99, x65, x87); + let mut x102: u64 = 0; + let mut x103: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x102, &mut x103, x101, x67, x89); + let mut x104: u64 = 0; + let mut x105: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x104, &mut x105, x103, (x68 as u64), x91); + let mut x106: u64 = 0; + let mut x107: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x106, &mut x107, x92, 0x6ed46089e88fdc45); + let mut x108: u64 = 0; + let mut x109: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x108, &mut x109, x106, 0xffffffffffffffff); + let mut x110: u64 = 0; + let mut x111: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x110, &mut x111, x106, 0xffffffffffffffff); + let mut x112: u64 = 0; + let mut x113: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x112, &mut x113, x106, 0xffffffffffffffff); + let mut x114: u64 = 0; + let mut x115: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x114, &mut x115, x106, 0xc7634d81f4372ddf); + let mut x116: u64 = 0; + let mut x117: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x116, &mut x117, x106, 0x581a0db248b0a77a); + let mut x118: u64 = 0; + let mut x119: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x118, &mut x119, x106, 0xecec196accc52973); + let mut x120: u64 = 0; + let mut x121: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x120, &mut x121, 0x0, x119, x116); + let mut x122: u64 = 0; + let mut x123: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x122, &mut x123, x121, x117, x114); + let mut x124: u64 = 0; + let mut x125: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x124, &mut x125, x123, x115, x112); + let mut x126: u64 = 0; + let mut x127: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x126, &mut x127, x125, x113, x110); + let mut x128: u64 = 0; + let mut x129: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x128, &mut x129, x127, x111, x108); + let x130: u64 = ((x129 as u64) + x109); + let mut x131: u64 = 0; + let mut x132: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x131, &mut x132, 0x0, x92, x118); + let mut x133: u64 = 0; + let mut x134: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x133, &mut x134, x132, x94, x120); + let mut x135: u64 = 0; + let mut x136: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x135, &mut x136, x134, x96, x122); + let mut x137: u64 = 0; + let mut x138: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x137, &mut x138, x136, x98, x124); + let mut x139: u64 = 0; + let mut x140: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x139, &mut x140, x138, x100, x126); + let mut x141: u64 = 0; + let mut x142: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x141, &mut x142, x140, x102, x128); + let mut x143: u64 = 0; + let mut x144: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x143, &mut x144, x142, x104, x130); + let x145: u64 = ((x144 as u64) + (x105 as u64)); + let mut x146: u64 = 0; + let mut x147: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x146, &mut x147, x2, (arg1[5])); + let mut x148: u64 = 0; + let mut x149: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x148, &mut x149, x2, (arg1[4])); + let mut x150: u64 = 0; + let mut x151: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x150, &mut x151, x2, (arg1[3])); + let mut x152: u64 = 0; + let mut x153: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x152, &mut x153, x2, (arg1[2])); + let mut x154: u64 = 0; + let mut x155: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x154, &mut x155, x2, (arg1[1])); + let mut x156: u64 = 0; + let mut x157: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x156, &mut x157, x2, (arg1[0])); + let mut x158: u64 = 0; + let mut x159: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x158, &mut x159, 0x0, x157, x154); + let mut x160: u64 = 0; + let mut x161: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x160, &mut x161, x159, x155, x152); + let mut x162: u64 = 0; + let mut x163: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x162, &mut x163, x161, x153, x150); + let mut x164: u64 = 0; + let mut x165: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x164, &mut x165, x163, x151, x148); + let mut x166: u64 = 0; + let mut x167: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x166, &mut x167, x165, x149, x146); + let x168: u64 = ((x167 as u64) + x147); + let mut x169: u64 = 0; + let mut x170: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x169, &mut x170, 0x0, x133, x156); + let mut x171: u64 = 0; + let mut x172: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x171, &mut x172, x170, x135, x158); + let mut x173: u64 = 0; + let mut x174: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x173, &mut x174, x172, x137, x160); + let mut x175: u64 = 0; + let mut x176: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x175, &mut x176, x174, x139, x162); + let mut x177: u64 = 0; + let mut x178: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x177, &mut x178, x176, x141, x164); + let mut x179: u64 = 0; + let mut x180: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x179, &mut x180, x178, x143, x166); + let mut x181: u64 = 0; + let mut x182: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x181, &mut x182, x180, x145, x168); + let mut x183: u64 = 0; + let mut x184: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x183, &mut x184, x169, 0x6ed46089e88fdc45); + let mut x185: u64 = 0; + let mut x186: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x185, &mut x186, x183, 0xffffffffffffffff); + let mut x187: u64 = 0; + let mut x188: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x187, &mut x188, x183, 0xffffffffffffffff); + let mut x189: u64 = 0; + let mut x190: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x189, &mut x190, x183, 0xffffffffffffffff); + let mut x191: u64 = 0; + let mut x192: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x191, &mut x192, x183, 0xc7634d81f4372ddf); + let mut x193: u64 = 0; + let mut x194: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x193, &mut x194, x183, 0x581a0db248b0a77a); + let mut x195: u64 = 0; + let mut x196: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x195, &mut x196, x183, 0xecec196accc52973); + let mut x197: u64 = 0; + let mut x198: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x197, &mut x198, 0x0, x196, x193); + let mut x199: u64 = 0; + let mut x200: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x199, &mut x200, x198, x194, x191); + let mut x201: u64 = 0; + let mut x202: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x201, &mut x202, x200, x192, x189); + let mut x203: u64 = 0; + let mut x204: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x203, &mut x204, x202, x190, x187); + let mut x205: u64 = 0; + let mut x206: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x205, &mut x206, x204, x188, x185); + let x207: u64 = ((x206 as u64) + x186); + let mut x208: u64 = 0; + let mut x209: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x208, &mut x209, 0x0, x169, x195); + let mut x210: u64 = 0; + let mut x211: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x210, &mut x211, x209, x171, x197); + let mut x212: u64 = 0; + let mut x213: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x212, &mut x213, x211, x173, x199); + let mut x214: u64 = 0; + let mut x215: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x214, &mut x215, x213, x175, x201); + let mut x216: u64 = 0; + let mut x217: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x216, &mut x217, x215, x177, x203); + let mut x218: u64 = 0; + let mut x219: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x218, &mut x219, x217, x179, x205); + let mut x220: u64 = 0; + let mut x221: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x220, &mut x221, x219, x181, x207); + let x222: u64 = ((x221 as u64) + (x182 as u64)); + let mut x223: u64 = 0; + let mut x224: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x223, &mut x224, x3, (arg1[5])); + let mut x225: u64 = 0; + let mut x226: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x225, &mut x226, x3, (arg1[4])); + let mut x227: u64 = 0; + let mut x228: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x227, &mut x228, x3, (arg1[3])); + let mut x229: u64 = 0; + let mut x230: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x229, &mut x230, x3, (arg1[2])); + let mut x231: u64 = 0; + let mut x232: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x231, &mut x232, x3, (arg1[1])); + let mut x233: u64 = 0; + let mut x234: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x233, &mut x234, x3, (arg1[0])); + let mut x235: u64 = 0; + let mut x236: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x235, &mut x236, 0x0, x234, x231); + let mut x237: u64 = 0; + let mut x238: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x237, &mut x238, x236, x232, x229); + let mut x239: u64 = 0; + let mut x240: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x239, &mut x240, x238, x230, x227); + let mut x241: u64 = 0; + let mut x242: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x241, &mut x242, x240, x228, x225); + let mut x243: u64 = 0; + let mut x244: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x243, &mut x244, x242, x226, x223); + let x245: u64 = ((x244 as u64) + x224); + let mut x246: u64 = 0; + let mut x247: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x246, &mut x247, 0x0, x210, x233); + let mut x248: u64 = 0; + let mut x249: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x248, &mut x249, x247, x212, x235); + let mut x250: u64 = 0; + let mut x251: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x250, &mut x251, x249, x214, x237); + let mut x252: u64 = 0; + let mut x253: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x252, &mut x253, x251, x216, x239); + let mut x254: u64 = 0; + let mut x255: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x254, &mut x255, x253, x218, x241); + let mut x256: u64 = 0; + let mut x257: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x256, &mut x257, x255, x220, x243); + let mut x258: u64 = 0; + let mut x259: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x258, &mut x259, x257, x222, x245); + let mut x260: u64 = 0; + let mut x261: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x260, &mut x261, x246, 0x6ed46089e88fdc45); + let mut x262: u64 = 0; + let mut x263: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x262, &mut x263, x260, 0xffffffffffffffff); + let mut x264: u64 = 0; + let mut x265: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x264, &mut x265, x260, 0xffffffffffffffff); + let mut x266: u64 = 0; + let mut x267: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x266, &mut x267, x260, 0xffffffffffffffff); + let mut x268: u64 = 0; + let mut x269: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x268, &mut x269, x260, 0xc7634d81f4372ddf); + let mut x270: u64 = 0; + let mut x271: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x270, &mut x271, x260, 0x581a0db248b0a77a); + let mut x272: u64 = 0; + let mut x273: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x272, &mut x273, x260, 0xecec196accc52973); + let mut x274: u64 = 0; + let mut x275: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x274, &mut x275, 0x0, x273, x270); + let mut x276: u64 = 0; + let mut x277: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x276, &mut x277, x275, x271, x268); + let mut x278: u64 = 0; + let mut x279: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x278, &mut x279, x277, x269, x266); + let mut x280: u64 = 0; + let mut x281: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x280, &mut x281, x279, x267, x264); + let mut x282: u64 = 0; + let mut x283: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x282, &mut x283, x281, x265, x262); + let x284: u64 = ((x283 as u64) + x263); + let mut x285: u64 = 0; + let mut x286: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x285, &mut x286, 0x0, x246, x272); + let mut x287: u64 = 0; + let mut x288: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x287, &mut x288, x286, x248, x274); + let mut x289: u64 = 0; + let mut x290: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x289, &mut x290, x288, x250, x276); + let mut x291: u64 = 0; + let mut x292: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x291, &mut x292, x290, x252, x278); + let mut x293: u64 = 0; + let mut x294: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x293, &mut x294, x292, x254, x280); + let mut x295: u64 = 0; + let mut x296: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x295, &mut x296, x294, x256, x282); + let mut x297: u64 = 0; + let mut x298: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x297, &mut x298, x296, x258, x284); + let x299: u64 = ((x298 as u64) + (x259 as u64)); + let mut x300: u64 = 0; + let mut x301: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x300, &mut x301, x4, (arg1[5])); + let mut x302: u64 = 0; + let mut x303: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x302, &mut x303, x4, (arg1[4])); + let mut x304: u64 = 0; + let mut x305: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x304, &mut x305, x4, (arg1[3])); + let mut x306: u64 = 0; + let mut x307: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x306, &mut x307, x4, (arg1[2])); + let mut x308: u64 = 0; + let mut x309: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x308, &mut x309, x4, (arg1[1])); + let mut x310: u64 = 0; + let mut x311: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x310, &mut x311, x4, (arg1[0])); + let mut x312: u64 = 0; + let mut x313: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x312, &mut x313, 0x0, x311, x308); + let mut x314: u64 = 0; + let mut x315: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x314, &mut x315, x313, x309, x306); + let mut x316: u64 = 0; + let mut x317: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x316, &mut x317, x315, x307, x304); + let mut x318: u64 = 0; + let mut x319: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x318, &mut x319, x317, x305, x302); + let mut x320: u64 = 0; + let mut x321: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x320, &mut x321, x319, x303, x300); + let x322: u64 = ((x321 as u64) + x301); + let mut x323: u64 = 0; + let mut x324: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x323, &mut x324, 0x0, x287, x310); + let mut x325: u64 = 0; + let mut x326: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x325, &mut x326, x324, x289, x312); + let mut x327: u64 = 0; + let mut x328: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x327, &mut x328, x326, x291, x314); + let mut x329: u64 = 0; + let mut x330: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x329, &mut x330, x328, x293, x316); + let mut x331: u64 = 0; + let mut x332: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x331, &mut x332, x330, x295, x318); + let mut x333: u64 = 0; + let mut x334: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x333, &mut x334, x332, x297, x320); + let mut x335: u64 = 0; + let mut x336: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x335, &mut x336, x334, x299, x322); + let mut x337: u64 = 0; + let mut x338: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x337, &mut x338, x323, 0x6ed46089e88fdc45); + let mut x339: u64 = 0; + let mut x340: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x339, &mut x340, x337, 0xffffffffffffffff); + let mut x341: u64 = 0; + let mut x342: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x341, &mut x342, x337, 0xffffffffffffffff); + let mut x343: u64 = 0; + let mut x344: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x343, &mut x344, x337, 0xffffffffffffffff); + let mut x345: u64 = 0; + let mut x346: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x345, &mut x346, x337, 0xc7634d81f4372ddf); + let mut x347: u64 = 0; + let mut x348: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x347, &mut x348, x337, 0x581a0db248b0a77a); + let mut x349: u64 = 0; + let mut x350: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x349, &mut x350, x337, 0xecec196accc52973); + let mut x351: u64 = 0; + let mut x352: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x351, &mut x352, 0x0, x350, x347); + let mut x353: u64 = 0; + let mut x354: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x353, &mut x354, x352, x348, x345); + let mut x355: u64 = 0; + let mut x356: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x355, &mut x356, x354, x346, x343); + let mut x357: u64 = 0; + let mut x358: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x357, &mut x358, x356, x344, x341); + let mut x359: u64 = 0; + let mut x360: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x359, &mut x360, x358, x342, x339); + let x361: u64 = ((x360 as u64) + x340); + let mut x362: u64 = 0; + let mut x363: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x362, &mut x363, 0x0, x323, x349); + let mut x364: u64 = 0; + let mut x365: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x364, &mut x365, x363, x325, x351); + let mut x366: u64 = 0; + let mut x367: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x366, &mut x367, x365, x327, x353); + let mut x368: u64 = 0; + let mut x369: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x368, &mut x369, x367, x329, x355); + let mut x370: u64 = 0; + let mut x371: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x370, &mut x371, x369, x331, x357); + let mut x372: u64 = 0; + let mut x373: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x372, &mut x373, x371, x333, x359); + let mut x374: u64 = 0; + let mut x375: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x374, &mut x375, x373, x335, x361); + let x376: u64 = ((x375 as u64) + (x336 as u64)); + let mut x377: u64 = 0; + let mut x378: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x377, &mut x378, x5, (arg1[5])); + let mut x379: u64 = 0; + let mut x380: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x379, &mut x380, x5, (arg1[4])); + let mut x381: u64 = 0; + let mut x382: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x381, &mut x382, x5, (arg1[3])); + let mut x383: u64 = 0; + let mut x384: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x383, &mut x384, x5, (arg1[2])); + let mut x385: u64 = 0; + let mut x386: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x385, &mut x386, x5, (arg1[1])); + let mut x387: u64 = 0; + let mut x388: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x387, &mut x388, x5, (arg1[0])); + let mut x389: u64 = 0; + let mut x390: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x389, &mut x390, 0x0, x388, x385); + let mut x391: u64 = 0; + let mut x392: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x391, &mut x392, x390, x386, x383); + let mut x393: u64 = 0; + let mut x394: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x393, &mut x394, x392, x384, x381); + let mut x395: u64 = 0; + let mut x396: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x395, &mut x396, x394, x382, x379); + let mut x397: u64 = 0; + let mut x398: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x397, &mut x398, x396, x380, x377); + let x399: u64 = ((x398 as u64) + x378); + let mut x400: u64 = 0; + let mut x401: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x400, &mut x401, 0x0, x364, x387); + let mut x402: u64 = 0; + let mut x403: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x402, &mut x403, x401, x366, x389); + let mut x404: u64 = 0; + let mut x405: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x404, &mut x405, x403, x368, x391); + let mut x406: u64 = 0; + let mut x407: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x406, &mut x407, x405, x370, x393); + let mut x408: u64 = 0; + let mut x409: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x408, &mut x409, x407, x372, x395); + let mut x410: u64 = 0; + let mut x411: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x410, &mut x411, x409, x374, x397); + let mut x412: u64 = 0; + let mut x413: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x412, &mut x413, x411, x376, x399); + let mut x414: u64 = 0; + let mut x415: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x414, &mut x415, x400, 0x6ed46089e88fdc45); + let mut x416: u64 = 0; + let mut x417: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x416, &mut x417, x414, 0xffffffffffffffff); + let mut x418: u64 = 0; + let mut x419: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x418, &mut x419, x414, 0xffffffffffffffff); + let mut x420: u64 = 0; + let mut x421: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x420, &mut x421, x414, 0xffffffffffffffff); + let mut x422: u64 = 0; + let mut x423: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x422, &mut x423, x414, 0xc7634d81f4372ddf); + let mut x424: u64 = 0; + let mut x425: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x424, &mut x425, x414, 0x581a0db248b0a77a); + let mut x426: u64 = 0; + let mut x427: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x426, &mut x427, x414, 0xecec196accc52973); + let mut x428: u64 = 0; + let mut x429: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x428, &mut x429, 0x0, x427, x424); + let mut x430: u64 = 0; + let mut x431: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x430, &mut x431, x429, x425, x422); + let mut x432: u64 = 0; + let mut x433: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x432, &mut x433, x431, x423, x420); + let mut x434: u64 = 0; + let mut x435: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x434, &mut x435, x433, x421, x418); + let mut x436: u64 = 0; + let mut x437: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x436, &mut x437, x435, x419, x416); + let x438: u64 = ((x437 as u64) + x417); + let mut x439: u64 = 0; + let mut x440: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x439, &mut x440, 0x0, x400, x426); + let mut x441: u64 = 0; + let mut x442: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x441, &mut x442, x440, x402, x428); + let mut x443: u64 = 0; + let mut x444: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x443, &mut x444, x442, x404, x430); + let mut x445: u64 = 0; + let mut x446: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x445, &mut x446, x444, x406, x432); + let mut x447: u64 = 0; + let mut x448: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x447, &mut x448, x446, x408, x434); + let mut x449: u64 = 0; + let mut x450: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x449, &mut x450, x448, x410, x436); + let mut x451: u64 = 0; + let mut x452: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x451, &mut x452, x450, x412, x438); + let x453: u64 = ((x452 as u64) + (x413 as u64)); + let mut x454: u64 = 0; + let mut x455: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x454, &mut x455, 0x0, x441, 0xecec196accc52973); + let mut x456: u64 = 0; + let mut x457: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x456, &mut x457, x455, x443, 0x581a0db248b0a77a); + let mut x458: u64 = 0; + let mut x459: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x458, &mut x459, x457, x445, 0xc7634d81f4372ddf); + let mut x460: u64 = 0; + let mut x461: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x460, &mut x461, x459, x447, 0xffffffffffffffff); + let mut x462: u64 = 0; + let mut x463: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x462, &mut x463, x461, x449, 0xffffffffffffffff); + let mut x464: u64 = 0; + let mut x465: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x464, &mut x465, x463, x451, 0xffffffffffffffff); + let mut x466: u64 = 0; + let mut x467: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x466, &mut x467, x465, x453, (0x0 as u64)); + let mut x468: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x468, x467, x454, x441); + let mut x469: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x469, x467, x456, x443); + let mut x470: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x470, x467, x458, x445); + let mut x471: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x471, x467, x460, x447); + let mut x472: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x472, x467, x462, x449); + let mut x473: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x473, x467, x464, x451); + out1[0] = x468; + out1[1] = x469; + out1[2] = x470; + out1[3] = x471; + out1[4] = x472; + out1[5] = x473; +} + +/// The function fiat_p384_scalar_add adds two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) + eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p384_scalar_add(out1: &mut fiat_p384_scalar_montgomery_domain_field_element, arg1: &fiat_p384_scalar_montgomery_domain_field_element, arg2: &fiat_p384_scalar_montgomery_domain_field_element) -> () { + let mut x1: u64 = 0; + let mut x2: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x1, &mut x2, 0x0, (arg1[0]), (arg2[0])); + let mut x3: u64 = 0; + let mut x4: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x3, &mut x4, x2, (arg1[1]), (arg2[1])); + let mut x5: u64 = 0; + let mut x6: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x5, &mut x6, x4, (arg1[2]), (arg2[2])); + let mut x7: u64 = 0; + let mut x8: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x7, &mut x8, x6, (arg1[3]), (arg2[3])); + let mut x9: u64 = 0; + let mut x10: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x9, &mut x10, x8, (arg1[4]), (arg2[4])); + let mut x11: u64 = 0; + let mut x12: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x11, &mut x12, x10, (arg1[5]), (arg2[5])); + let mut x13: u64 = 0; + let mut x14: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x13, &mut x14, 0x0, x1, 0xecec196accc52973); + let mut x15: u64 = 0; + let mut x16: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x15, &mut x16, x14, x3, 0x581a0db248b0a77a); + let mut x17: u64 = 0; + let mut x18: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x17, &mut x18, x16, x5, 0xc7634d81f4372ddf); + let mut x19: u64 = 0; + let mut x20: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x19, &mut x20, x18, x7, 0xffffffffffffffff); + let mut x21: u64 = 0; + let mut x22: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x21, &mut x22, x20, x9, 0xffffffffffffffff); + let mut x23: u64 = 0; + let mut x24: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x23, &mut x24, x22, x11, 0xffffffffffffffff); + let mut x25: u64 = 0; + let mut x26: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x25, &mut x26, x24, (x12 as u64), (0x0 as u64)); + let mut x27: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x27, x26, x13, x1); + let mut x28: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x28, x26, x15, x3); + let mut x29: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x29, x26, x17, x5); + let mut x30: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x30, x26, x19, x7); + let mut x31: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x31, x26, x21, x9); + let mut x32: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x32, x26, x23, x11); + out1[0] = x27; + out1[1] = x28; + out1[2] = x29; + out1[3] = x30; + out1[4] = x31; + out1[5] = x32; +} + +/// The function fiat_p384_scalar_sub subtracts two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) - eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p384_scalar_sub(out1: &mut fiat_p384_scalar_montgomery_domain_field_element, arg1: &fiat_p384_scalar_montgomery_domain_field_element, arg2: &fiat_p384_scalar_montgomery_domain_field_element) -> () { + let mut x1: u64 = 0; + let mut x2: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x1, &mut x2, 0x0, (arg1[0]), (arg2[0])); + let mut x3: u64 = 0; + let mut x4: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x3, &mut x4, x2, (arg1[1]), (arg2[1])); + let mut x5: u64 = 0; + let mut x6: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x5, &mut x6, x4, (arg1[2]), (arg2[2])); + let mut x7: u64 = 0; + let mut x8: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x7, &mut x8, x6, (arg1[3]), (arg2[3])); + let mut x9: u64 = 0; + let mut x10: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x9, &mut x10, x8, (arg1[4]), (arg2[4])); + let mut x11: u64 = 0; + let mut x12: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x11, &mut x12, x10, (arg1[5]), (arg2[5])); + let mut x13: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x13, x12, (0x0 as u64), 0xffffffffffffffff); + let mut x14: u64 = 0; + let mut x15: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x14, &mut x15, 0x0, x1, (x13 & 0xecec196accc52973)); + let mut x16: u64 = 0; + let mut x17: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x16, &mut x17, x15, x3, (x13 & 0x581a0db248b0a77a)); + let mut x18: u64 = 0; + let mut x19: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x18, &mut x19, x17, x5, (x13 & 0xc7634d81f4372ddf)); + let mut x20: u64 = 0; + let mut x21: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x20, &mut x21, x19, x7, x13); + let mut x22: u64 = 0; + let mut x23: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x22, &mut x23, x21, x9, x13); + let mut x24: u64 = 0; + let mut x25: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x24, &mut x25, x23, x11, x13); + out1[0] = x14; + out1[1] = x16; + out1[2] = x18; + out1[3] = x20; + out1[4] = x22; + out1[5] = x24; +} + +/// The function fiat_p384_scalar_opp negates a field element in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = -eval (from_montgomery arg1) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p384_scalar_opp(out1: &mut fiat_p384_scalar_montgomery_domain_field_element, arg1: &fiat_p384_scalar_montgomery_domain_field_element) -> () { + let mut x1: u64 = 0; + let mut x2: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x1, &mut x2, 0x0, (0x0 as u64), (arg1[0])); + let mut x3: u64 = 0; + let mut x4: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x3, &mut x4, x2, (0x0 as u64), (arg1[1])); + let mut x5: u64 = 0; + let mut x6: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x5, &mut x6, x4, (0x0 as u64), (arg1[2])); + let mut x7: u64 = 0; + let mut x8: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x7, &mut x8, x6, (0x0 as u64), (arg1[3])); + let mut x9: u64 = 0; + let mut x10: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x9, &mut x10, x8, (0x0 as u64), (arg1[4])); + let mut x11: u64 = 0; + let mut x12: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x11, &mut x12, x10, (0x0 as u64), (arg1[5])); + let mut x13: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x13, x12, (0x0 as u64), 0xffffffffffffffff); + let mut x14: u64 = 0; + let mut x15: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x14, &mut x15, 0x0, x1, (x13 & 0xecec196accc52973)); + let mut x16: u64 = 0; + let mut x17: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x16, &mut x17, x15, x3, (x13 & 0x581a0db248b0a77a)); + let mut x18: u64 = 0; + let mut x19: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x18, &mut x19, x17, x5, (x13 & 0xc7634d81f4372ddf)); + let mut x20: u64 = 0; + let mut x21: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x20, &mut x21, x19, x7, x13); + let mut x22: u64 = 0; + let mut x23: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x22, &mut x23, x21, x9, x13); + let mut x24: u64 = 0; + let mut x25: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x24, &mut x25, x23, x11, x13); + out1[0] = x14; + out1[1] = x16; + out1[2] = x18; + out1[3] = x20; + out1[4] = x22; + out1[5] = x24; +} + +/// The function fiat_p384_scalar_from_montgomery translates a field element out of the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval out1 mod m = (eval arg1 * ((2^64)⁻¹ mod m)^6) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p384_scalar_from_montgomery(out1: &mut fiat_p384_scalar_non_montgomery_domain_field_element, arg1: &fiat_p384_scalar_montgomery_domain_field_element) -> () { + let x1: u64 = (arg1[0]); + let mut x2: u64 = 0; + let mut x3: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x2, &mut x3, x1, 0x6ed46089e88fdc45); + let mut x4: u64 = 0; + let mut x5: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x4, &mut x5, x2, 0xffffffffffffffff); + let mut x6: u64 = 0; + let mut x7: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x6, &mut x7, x2, 0xffffffffffffffff); + let mut x8: u64 = 0; + let mut x9: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x8, &mut x9, x2, 0xffffffffffffffff); + let mut x10: u64 = 0; + let mut x11: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x10, &mut x11, x2, 0xc7634d81f4372ddf); + let mut x12: u64 = 0; + let mut x13: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x12, &mut x13, x2, 0x581a0db248b0a77a); + let mut x14: u64 = 0; + let mut x15: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x14, &mut x15, x2, 0xecec196accc52973); + let mut x16: u64 = 0; + let mut x17: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x16, &mut x17, 0x0, x15, x12); + let mut x18: u64 = 0; + let mut x19: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x18, &mut x19, x17, x13, x10); + let mut x20: u64 = 0; + let mut x21: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x20, &mut x21, x19, x11, x8); + let mut x22: u64 = 0; + let mut x23: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x22, &mut x23, x21, x9, x6); + let mut x24: u64 = 0; + let mut x25: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x24, &mut x25, x23, x7, x4); + let mut x26: u64 = 0; + let mut x27: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x26, &mut x27, 0x0, x1, x14); + let mut x28: u64 = 0; + let mut x29: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x28, &mut x29, x27, (0x0 as u64), x16); + let mut x30: u64 = 0; + let mut x31: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x30, &mut x31, x29, (0x0 as u64), x18); + let mut x32: u64 = 0; + let mut x33: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x32, &mut x33, x31, (0x0 as u64), x20); + let mut x34: u64 = 0; + let mut x35: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x34, &mut x35, x33, (0x0 as u64), x22); + let mut x36: u64 = 0; + let mut x37: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x36, &mut x37, x35, (0x0 as u64), x24); + let mut x38: u64 = 0; + let mut x39: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x38, &mut x39, x37, (0x0 as u64), ((x25 as u64) + x5)); + let mut x40: u64 = 0; + let mut x41: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x40, &mut x41, 0x0, x28, (arg1[1])); + let mut x42: u64 = 0; + let mut x43: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x42, &mut x43, x41, x30, (0x0 as u64)); + let mut x44: u64 = 0; + let mut x45: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x44, &mut x45, x43, x32, (0x0 as u64)); + let mut x46: u64 = 0; + let mut x47: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x46, &mut x47, x45, x34, (0x0 as u64)); + let mut x48: u64 = 0; + let mut x49: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x48, &mut x49, x47, x36, (0x0 as u64)); + let mut x50: u64 = 0; + let mut x51: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x50, &mut x51, x49, x38, (0x0 as u64)); + let mut x52: u64 = 0; + let mut x53: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x52, &mut x53, x40, 0x6ed46089e88fdc45); + let mut x54: u64 = 0; + let mut x55: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x54, &mut x55, x52, 0xffffffffffffffff); + let mut x56: u64 = 0; + let mut x57: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x56, &mut x57, x52, 0xffffffffffffffff); + let mut x58: u64 = 0; + let mut x59: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x58, &mut x59, x52, 0xffffffffffffffff); + let mut x60: u64 = 0; + let mut x61: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x60, &mut x61, x52, 0xc7634d81f4372ddf); + let mut x62: u64 = 0; + let mut x63: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x62, &mut x63, x52, 0x581a0db248b0a77a); + let mut x64: u64 = 0; + let mut x65: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x64, &mut x65, x52, 0xecec196accc52973); + let mut x66: u64 = 0; + let mut x67: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x66, &mut x67, 0x0, x65, x62); + let mut x68: u64 = 0; + let mut x69: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x68, &mut x69, x67, x63, x60); + let mut x70: u64 = 0; + let mut x71: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x70, &mut x71, x69, x61, x58); + let mut x72: u64 = 0; + let mut x73: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x72, &mut x73, x71, x59, x56); + let mut x74: u64 = 0; + let mut x75: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x74, &mut x75, x73, x57, x54); + let mut x76: u64 = 0; + let mut x77: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x76, &mut x77, 0x0, x40, x64); + let mut x78: u64 = 0; + let mut x79: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x78, &mut x79, x77, x42, x66); + let mut x80: u64 = 0; + let mut x81: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x80, &mut x81, x79, x44, x68); + let mut x82: u64 = 0; + let mut x83: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x82, &mut x83, x81, x46, x70); + let mut x84: u64 = 0; + let mut x85: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x84, &mut x85, x83, x48, x72); + let mut x86: u64 = 0; + let mut x87: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x86, &mut x87, x85, x50, x74); + let mut x88: u64 = 0; + let mut x89: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x88, &mut x89, x87, ((x51 as u64) + (x39 as u64)), ((x75 as u64) + x55)); + let mut x90: u64 = 0; + let mut x91: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x90, &mut x91, 0x0, x78, (arg1[2])); + let mut x92: u64 = 0; + let mut x93: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x92, &mut x93, x91, x80, (0x0 as u64)); + let mut x94: u64 = 0; + let mut x95: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x94, &mut x95, x93, x82, (0x0 as u64)); + let mut x96: u64 = 0; + let mut x97: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x96, &mut x97, x95, x84, (0x0 as u64)); + let mut x98: u64 = 0; + let mut x99: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x98, &mut x99, x97, x86, (0x0 as u64)); + let mut x100: u64 = 0; + let mut x101: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x100, &mut x101, x99, x88, (0x0 as u64)); + let mut x102: u64 = 0; + let mut x103: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x102, &mut x103, x90, 0x6ed46089e88fdc45); + let mut x104: u64 = 0; + let mut x105: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x104, &mut x105, x102, 0xffffffffffffffff); + let mut x106: u64 = 0; + let mut x107: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x106, &mut x107, x102, 0xffffffffffffffff); + let mut x108: u64 = 0; + let mut x109: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x108, &mut x109, x102, 0xffffffffffffffff); + let mut x110: u64 = 0; + let mut x111: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x110, &mut x111, x102, 0xc7634d81f4372ddf); + let mut x112: u64 = 0; + let mut x113: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x112, &mut x113, x102, 0x581a0db248b0a77a); + let mut x114: u64 = 0; + let mut x115: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x114, &mut x115, x102, 0xecec196accc52973); + let mut x116: u64 = 0; + let mut x117: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x116, &mut x117, 0x0, x115, x112); + let mut x118: u64 = 0; + let mut x119: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x118, &mut x119, x117, x113, x110); + let mut x120: u64 = 0; + let mut x121: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x120, &mut x121, x119, x111, x108); + let mut x122: u64 = 0; + let mut x123: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x122, &mut x123, x121, x109, x106); + let mut x124: u64 = 0; + let mut x125: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x124, &mut x125, x123, x107, x104); + let mut x126: u64 = 0; + let mut x127: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x126, &mut x127, 0x0, x90, x114); + let mut x128: u64 = 0; + let mut x129: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x128, &mut x129, x127, x92, x116); + let mut x130: u64 = 0; + let mut x131: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x130, &mut x131, x129, x94, x118); + let mut x132: u64 = 0; + let mut x133: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x132, &mut x133, x131, x96, x120); + let mut x134: u64 = 0; + let mut x135: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x134, &mut x135, x133, x98, x122); + let mut x136: u64 = 0; + let mut x137: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x136, &mut x137, x135, x100, x124); + let mut x138: u64 = 0; + let mut x139: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x138, &mut x139, x137, ((x101 as u64) + (x89 as u64)), ((x125 as u64) + x105)); + let mut x140: u64 = 0; + let mut x141: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x140, &mut x141, 0x0, x128, (arg1[3])); + let mut x142: u64 = 0; + let mut x143: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x142, &mut x143, x141, x130, (0x0 as u64)); + let mut x144: u64 = 0; + let mut x145: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x144, &mut x145, x143, x132, (0x0 as u64)); + let mut x146: u64 = 0; + let mut x147: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x146, &mut x147, x145, x134, (0x0 as u64)); + let mut x148: u64 = 0; + let mut x149: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x148, &mut x149, x147, x136, (0x0 as u64)); + let mut x150: u64 = 0; + let mut x151: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x150, &mut x151, x149, x138, (0x0 as u64)); + let mut x152: u64 = 0; + let mut x153: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x152, &mut x153, x140, 0x6ed46089e88fdc45); + let mut x154: u64 = 0; + let mut x155: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x154, &mut x155, x152, 0xffffffffffffffff); + let mut x156: u64 = 0; + let mut x157: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x156, &mut x157, x152, 0xffffffffffffffff); + let mut x158: u64 = 0; + let mut x159: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x158, &mut x159, x152, 0xffffffffffffffff); + let mut x160: u64 = 0; + let mut x161: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x160, &mut x161, x152, 0xc7634d81f4372ddf); + let mut x162: u64 = 0; + let mut x163: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x162, &mut x163, x152, 0x581a0db248b0a77a); + let mut x164: u64 = 0; + let mut x165: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x164, &mut x165, x152, 0xecec196accc52973); + let mut x166: u64 = 0; + let mut x167: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x166, &mut x167, 0x0, x165, x162); + let mut x168: u64 = 0; + let mut x169: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x168, &mut x169, x167, x163, x160); + let mut x170: u64 = 0; + let mut x171: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x170, &mut x171, x169, x161, x158); + let mut x172: u64 = 0; + let mut x173: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x172, &mut x173, x171, x159, x156); + let mut x174: u64 = 0; + let mut x175: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x174, &mut x175, x173, x157, x154); + let mut x176: u64 = 0; + let mut x177: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x176, &mut x177, 0x0, x140, x164); + let mut x178: u64 = 0; + let mut x179: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x178, &mut x179, x177, x142, x166); + let mut x180: u64 = 0; + let mut x181: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x180, &mut x181, x179, x144, x168); + let mut x182: u64 = 0; + let mut x183: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x182, &mut x183, x181, x146, x170); + let mut x184: u64 = 0; + let mut x185: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x184, &mut x185, x183, x148, x172); + let mut x186: u64 = 0; + let mut x187: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x186, &mut x187, x185, x150, x174); + let mut x188: u64 = 0; + let mut x189: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x188, &mut x189, x187, ((x151 as u64) + (x139 as u64)), ((x175 as u64) + x155)); + let mut x190: u64 = 0; + let mut x191: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x190, &mut x191, 0x0, x178, (arg1[4])); + let mut x192: u64 = 0; + let mut x193: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x192, &mut x193, x191, x180, (0x0 as u64)); + let mut x194: u64 = 0; + let mut x195: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x194, &mut x195, x193, x182, (0x0 as u64)); + let mut x196: u64 = 0; + let mut x197: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x196, &mut x197, x195, x184, (0x0 as u64)); + let mut x198: u64 = 0; + let mut x199: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x198, &mut x199, x197, x186, (0x0 as u64)); + let mut x200: u64 = 0; + let mut x201: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x200, &mut x201, x199, x188, (0x0 as u64)); + let mut x202: u64 = 0; + let mut x203: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x202, &mut x203, x190, 0x6ed46089e88fdc45); + let mut x204: u64 = 0; + let mut x205: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x204, &mut x205, x202, 0xffffffffffffffff); + let mut x206: u64 = 0; + let mut x207: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x206, &mut x207, x202, 0xffffffffffffffff); + let mut x208: u64 = 0; + let mut x209: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x208, &mut x209, x202, 0xffffffffffffffff); + let mut x210: u64 = 0; + let mut x211: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x210, &mut x211, x202, 0xc7634d81f4372ddf); + let mut x212: u64 = 0; + let mut x213: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x212, &mut x213, x202, 0x581a0db248b0a77a); + let mut x214: u64 = 0; + let mut x215: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x214, &mut x215, x202, 0xecec196accc52973); + let mut x216: u64 = 0; + let mut x217: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x216, &mut x217, 0x0, x215, x212); + let mut x218: u64 = 0; + let mut x219: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x218, &mut x219, x217, x213, x210); + let mut x220: u64 = 0; + let mut x221: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x220, &mut x221, x219, x211, x208); + let mut x222: u64 = 0; + let mut x223: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x222, &mut x223, x221, x209, x206); + let mut x224: u64 = 0; + let mut x225: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x224, &mut x225, x223, x207, x204); + let mut x226: u64 = 0; + let mut x227: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x226, &mut x227, 0x0, x190, x214); + let mut x228: u64 = 0; + let mut x229: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x228, &mut x229, x227, x192, x216); + let mut x230: u64 = 0; + let mut x231: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x230, &mut x231, x229, x194, x218); + let mut x232: u64 = 0; + let mut x233: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x232, &mut x233, x231, x196, x220); + let mut x234: u64 = 0; + let mut x235: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x234, &mut x235, x233, x198, x222); + let mut x236: u64 = 0; + let mut x237: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x236, &mut x237, x235, x200, x224); + let mut x238: u64 = 0; + let mut x239: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x238, &mut x239, x237, ((x201 as u64) + (x189 as u64)), ((x225 as u64) + x205)); + let mut x240: u64 = 0; + let mut x241: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x240, &mut x241, 0x0, x228, (arg1[5])); + let mut x242: u64 = 0; + let mut x243: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x242, &mut x243, x241, x230, (0x0 as u64)); + let mut x244: u64 = 0; + let mut x245: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x244, &mut x245, x243, x232, (0x0 as u64)); + let mut x246: u64 = 0; + let mut x247: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x246, &mut x247, x245, x234, (0x0 as u64)); + let mut x248: u64 = 0; + let mut x249: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x248, &mut x249, x247, x236, (0x0 as u64)); + let mut x250: u64 = 0; + let mut x251: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x250, &mut x251, x249, x238, (0x0 as u64)); + let mut x252: u64 = 0; + let mut x253: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x252, &mut x253, x240, 0x6ed46089e88fdc45); + let mut x254: u64 = 0; + let mut x255: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x254, &mut x255, x252, 0xffffffffffffffff); + let mut x256: u64 = 0; + let mut x257: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x256, &mut x257, x252, 0xffffffffffffffff); + let mut x258: u64 = 0; + let mut x259: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x258, &mut x259, x252, 0xffffffffffffffff); + let mut x260: u64 = 0; + let mut x261: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x260, &mut x261, x252, 0xc7634d81f4372ddf); + let mut x262: u64 = 0; + let mut x263: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x262, &mut x263, x252, 0x581a0db248b0a77a); + let mut x264: u64 = 0; + let mut x265: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x264, &mut x265, x252, 0xecec196accc52973); + let mut x266: u64 = 0; + let mut x267: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x266, &mut x267, 0x0, x265, x262); + let mut x268: u64 = 0; + let mut x269: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x268, &mut x269, x267, x263, x260); + let mut x270: u64 = 0; + let mut x271: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x270, &mut x271, x269, x261, x258); + let mut x272: u64 = 0; + let mut x273: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x272, &mut x273, x271, x259, x256); + let mut x274: u64 = 0; + let mut x275: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x274, &mut x275, x273, x257, x254); + let mut x276: u64 = 0; + let mut x277: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x276, &mut x277, 0x0, x240, x264); + let mut x278: u64 = 0; + let mut x279: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x278, &mut x279, x277, x242, x266); + let mut x280: u64 = 0; + let mut x281: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x280, &mut x281, x279, x244, x268); + let mut x282: u64 = 0; + let mut x283: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x282, &mut x283, x281, x246, x270); + let mut x284: u64 = 0; + let mut x285: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x284, &mut x285, x283, x248, x272); + let mut x286: u64 = 0; + let mut x287: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x286, &mut x287, x285, x250, x274); + let mut x288: u64 = 0; + let mut x289: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x288, &mut x289, x287, ((x251 as u64) + (x239 as u64)), ((x275 as u64) + x255)); + let mut x290: u64 = 0; + let mut x291: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x290, &mut x291, 0x0, x278, 0xecec196accc52973); + let mut x292: u64 = 0; + let mut x293: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x292, &mut x293, x291, x280, 0x581a0db248b0a77a); + let mut x294: u64 = 0; + let mut x295: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x294, &mut x295, x293, x282, 0xc7634d81f4372ddf); + let mut x296: u64 = 0; + let mut x297: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x296, &mut x297, x295, x284, 0xffffffffffffffff); + let mut x298: u64 = 0; + let mut x299: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x298, &mut x299, x297, x286, 0xffffffffffffffff); + let mut x300: u64 = 0; + let mut x301: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x300, &mut x301, x299, x288, 0xffffffffffffffff); + let mut x302: u64 = 0; + let mut x303: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x302, &mut x303, x301, (x289 as u64), (0x0 as u64)); + let mut x304: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x304, x303, x290, x278); + let mut x305: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x305, x303, x292, x280); + let mut x306: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x306, x303, x294, x282); + let mut x307: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x307, x303, x296, x284); + let mut x308: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x308, x303, x298, x286); + let mut x309: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x309, x303, x300, x288); + out1[0] = x304; + out1[1] = x305; + out1[2] = x306; + out1[3] = x307; + out1[4] = x308; + out1[5] = x309; +} + +/// The function fiat_p384_scalar_to_montgomery translates a field element into the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = eval arg1 mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p384_scalar_to_montgomery(out1: &mut fiat_p384_scalar_montgomery_domain_field_element, arg1: &fiat_p384_scalar_non_montgomery_domain_field_element) -> () { + let x1: u64 = (arg1[1]); + let x2: u64 = (arg1[2]); + let x3: u64 = (arg1[3]); + let x4: u64 = (arg1[4]); + let x5: u64 = (arg1[5]); + let x6: u64 = (arg1[0]); + let mut x7: u64 = 0; + let mut x8: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x7, &mut x8, x6, 0xc84ee012b39bf21); + let mut x9: u64 = 0; + let mut x10: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x9, &mut x10, x6, 0x3fb05b7a28266895); + let mut x11: u64 = 0; + let mut x12: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x11, &mut x12, x6, 0xd40d49174aab1cc5); + let mut x13: u64 = 0; + let mut x14: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x13, &mut x14, x6, 0xbc3e483afcb82947); + let mut x15: u64 = 0; + let mut x16: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x15, &mut x16, x6, 0xff3d81e5df1aa419); + let mut x17: u64 = 0; + let mut x18: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x17, &mut x18, x6, 0x2d319b2419b409a9); + let mut x19: u64 = 0; + let mut x20: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x19, &mut x20, 0x0, x18, x15); + let mut x21: u64 = 0; + let mut x22: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x21, &mut x22, x20, x16, x13); + let mut x23: u64 = 0; + let mut x24: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x23, &mut x24, x22, x14, x11); + let mut x25: u64 = 0; + let mut x26: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x25, &mut x26, x24, x12, x9); + let mut x27: u64 = 0; + let mut x28: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x27, &mut x28, x26, x10, x7); + let mut x29: u64 = 0; + let mut x30: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x29, &mut x30, x17, 0x6ed46089e88fdc45); + let mut x31: u64 = 0; + let mut x32: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x31, &mut x32, x29, 0xffffffffffffffff); + let mut x33: u64 = 0; + let mut x34: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x33, &mut x34, x29, 0xffffffffffffffff); + let mut x35: u64 = 0; + let mut x36: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x35, &mut x36, x29, 0xffffffffffffffff); + let mut x37: u64 = 0; + let mut x38: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x37, &mut x38, x29, 0xc7634d81f4372ddf); + let mut x39: u64 = 0; + let mut x40: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x39, &mut x40, x29, 0x581a0db248b0a77a); + let mut x41: u64 = 0; + let mut x42: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x41, &mut x42, x29, 0xecec196accc52973); + let mut x43: u64 = 0; + let mut x44: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x43, &mut x44, 0x0, x42, x39); + let mut x45: u64 = 0; + let mut x46: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x45, &mut x46, x44, x40, x37); + let mut x47: u64 = 0; + let mut x48: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x47, &mut x48, x46, x38, x35); + let mut x49: u64 = 0; + let mut x50: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x49, &mut x50, x48, x36, x33); + let mut x51: u64 = 0; + let mut x52: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x51, &mut x52, x50, x34, x31); + let mut x53: u64 = 0; + let mut x54: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x53, &mut x54, 0x0, x17, x41); + let mut x55: u64 = 0; + let mut x56: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x55, &mut x56, x54, x19, x43); + let mut x57: u64 = 0; + let mut x58: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x57, &mut x58, x56, x21, x45); + let mut x59: u64 = 0; + let mut x60: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x59, &mut x60, x58, x23, x47); + let mut x61: u64 = 0; + let mut x62: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x61, &mut x62, x60, x25, x49); + let mut x63: u64 = 0; + let mut x64: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x63, &mut x64, x62, x27, x51); + let mut x65: u64 = 0; + let mut x66: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x65, &mut x66, x64, ((x28 as u64) + x8), ((x52 as u64) + x32)); + let mut x67: u64 = 0; + let mut x68: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x67, &mut x68, x1, 0xc84ee012b39bf21); + let mut x69: u64 = 0; + let mut x70: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x69, &mut x70, x1, 0x3fb05b7a28266895); + let mut x71: u64 = 0; + let mut x72: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x71, &mut x72, x1, 0xd40d49174aab1cc5); + let mut x73: u64 = 0; + let mut x74: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x73, &mut x74, x1, 0xbc3e483afcb82947); + let mut x75: u64 = 0; + let mut x76: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x75, &mut x76, x1, 0xff3d81e5df1aa419); + let mut x77: u64 = 0; + let mut x78: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x77, &mut x78, x1, 0x2d319b2419b409a9); + let mut x79: u64 = 0; + let mut x80: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x79, &mut x80, 0x0, x78, x75); + let mut x81: u64 = 0; + let mut x82: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x81, &mut x82, x80, x76, x73); + let mut x83: u64 = 0; + let mut x84: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x83, &mut x84, x82, x74, x71); + let mut x85: u64 = 0; + let mut x86: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x85, &mut x86, x84, x72, x69); + let mut x87: u64 = 0; + let mut x88: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x87, &mut x88, x86, x70, x67); + let mut x89: u64 = 0; + let mut x90: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x89, &mut x90, 0x0, x55, x77); + let mut x91: u64 = 0; + let mut x92: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x91, &mut x92, x90, x57, x79); + let mut x93: u64 = 0; + let mut x94: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x93, &mut x94, x92, x59, x81); + let mut x95: u64 = 0; + let mut x96: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x95, &mut x96, x94, x61, x83); + let mut x97: u64 = 0; + let mut x98: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x97, &mut x98, x96, x63, x85); + let mut x99: u64 = 0; + let mut x100: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x99, &mut x100, x98, x65, x87); + let mut x101: u64 = 0; + let mut x102: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x101, &mut x102, x89, 0x6ed46089e88fdc45); + let mut x103: u64 = 0; + let mut x104: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x103, &mut x104, x101, 0xffffffffffffffff); + let mut x105: u64 = 0; + let mut x106: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x105, &mut x106, x101, 0xffffffffffffffff); + let mut x107: u64 = 0; + let mut x108: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x107, &mut x108, x101, 0xffffffffffffffff); + let mut x109: u64 = 0; + let mut x110: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x109, &mut x110, x101, 0xc7634d81f4372ddf); + let mut x111: u64 = 0; + let mut x112: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x111, &mut x112, x101, 0x581a0db248b0a77a); + let mut x113: u64 = 0; + let mut x114: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x113, &mut x114, x101, 0xecec196accc52973); + let mut x115: u64 = 0; + let mut x116: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x115, &mut x116, 0x0, x114, x111); + let mut x117: u64 = 0; + let mut x118: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x117, &mut x118, x116, x112, x109); + let mut x119: u64 = 0; + let mut x120: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x119, &mut x120, x118, x110, x107); + let mut x121: u64 = 0; + let mut x122: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x121, &mut x122, x120, x108, x105); + let mut x123: u64 = 0; + let mut x124: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x123, &mut x124, x122, x106, x103); + let mut x125: u64 = 0; + let mut x126: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x125, &mut x126, 0x0, x89, x113); + let mut x127: u64 = 0; + let mut x128: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x127, &mut x128, x126, x91, x115); + let mut x129: u64 = 0; + let mut x130: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x129, &mut x130, x128, x93, x117); + let mut x131: u64 = 0; + let mut x132: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x131, &mut x132, x130, x95, x119); + let mut x133: u64 = 0; + let mut x134: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x133, &mut x134, x132, x97, x121); + let mut x135: u64 = 0; + let mut x136: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x135, &mut x136, x134, x99, x123); + let mut x137: u64 = 0; + let mut x138: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x137, &mut x138, x136, (((x100 as u64) + (x66 as u64)) + ((x88 as u64) + x68)), ((x124 as u64) + x104)); + let mut x139: u64 = 0; + let mut x140: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x139, &mut x140, x2, 0xc84ee012b39bf21); + let mut x141: u64 = 0; + let mut x142: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x141, &mut x142, x2, 0x3fb05b7a28266895); + let mut x143: u64 = 0; + let mut x144: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x143, &mut x144, x2, 0xd40d49174aab1cc5); + let mut x145: u64 = 0; + let mut x146: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x145, &mut x146, x2, 0xbc3e483afcb82947); + let mut x147: u64 = 0; + let mut x148: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x147, &mut x148, x2, 0xff3d81e5df1aa419); + let mut x149: u64 = 0; + let mut x150: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x149, &mut x150, x2, 0x2d319b2419b409a9); + let mut x151: u64 = 0; + let mut x152: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x151, &mut x152, 0x0, x150, x147); + let mut x153: u64 = 0; + let mut x154: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x153, &mut x154, x152, x148, x145); + let mut x155: u64 = 0; + let mut x156: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x155, &mut x156, x154, x146, x143); + let mut x157: u64 = 0; + let mut x158: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x157, &mut x158, x156, x144, x141); + let mut x159: u64 = 0; + let mut x160: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x159, &mut x160, x158, x142, x139); + let mut x161: u64 = 0; + let mut x162: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x161, &mut x162, 0x0, x127, x149); + let mut x163: u64 = 0; + let mut x164: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x163, &mut x164, x162, x129, x151); + let mut x165: u64 = 0; + let mut x166: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x165, &mut x166, x164, x131, x153); + let mut x167: u64 = 0; + let mut x168: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x167, &mut x168, x166, x133, x155); + let mut x169: u64 = 0; + let mut x170: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x169, &mut x170, x168, x135, x157); + let mut x171: u64 = 0; + let mut x172: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x171, &mut x172, x170, x137, x159); + let mut x173: u64 = 0; + let mut x174: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x173, &mut x174, x161, 0x6ed46089e88fdc45); + let mut x175: u64 = 0; + let mut x176: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x175, &mut x176, x173, 0xffffffffffffffff); + let mut x177: u64 = 0; + let mut x178: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x177, &mut x178, x173, 0xffffffffffffffff); + let mut x179: u64 = 0; + let mut x180: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x179, &mut x180, x173, 0xffffffffffffffff); + let mut x181: u64 = 0; + let mut x182: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x181, &mut x182, x173, 0xc7634d81f4372ddf); + let mut x183: u64 = 0; + let mut x184: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x183, &mut x184, x173, 0x581a0db248b0a77a); + let mut x185: u64 = 0; + let mut x186: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x185, &mut x186, x173, 0xecec196accc52973); + let mut x187: u64 = 0; + let mut x188: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x187, &mut x188, 0x0, x186, x183); + let mut x189: u64 = 0; + let mut x190: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x189, &mut x190, x188, x184, x181); + let mut x191: u64 = 0; + let mut x192: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x191, &mut x192, x190, x182, x179); + let mut x193: u64 = 0; + let mut x194: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x193, &mut x194, x192, x180, x177); + let mut x195: u64 = 0; + let mut x196: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x195, &mut x196, x194, x178, x175); + let mut x197: u64 = 0; + let mut x198: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x197, &mut x198, 0x0, x161, x185); + let mut x199: u64 = 0; + let mut x200: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x199, &mut x200, x198, x163, x187); + let mut x201: u64 = 0; + let mut x202: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x201, &mut x202, x200, x165, x189); + let mut x203: u64 = 0; + let mut x204: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x203, &mut x204, x202, x167, x191); + let mut x205: u64 = 0; + let mut x206: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x205, &mut x206, x204, x169, x193); + let mut x207: u64 = 0; + let mut x208: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x207, &mut x208, x206, x171, x195); + let mut x209: u64 = 0; + let mut x210: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x209, &mut x210, x208, (((x172 as u64) + (x138 as u64)) + ((x160 as u64) + x140)), ((x196 as u64) + x176)); + let mut x211: u64 = 0; + let mut x212: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x211, &mut x212, x3, 0xc84ee012b39bf21); + let mut x213: u64 = 0; + let mut x214: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x213, &mut x214, x3, 0x3fb05b7a28266895); + let mut x215: u64 = 0; + let mut x216: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x215, &mut x216, x3, 0xd40d49174aab1cc5); + let mut x217: u64 = 0; + let mut x218: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x217, &mut x218, x3, 0xbc3e483afcb82947); + let mut x219: u64 = 0; + let mut x220: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x219, &mut x220, x3, 0xff3d81e5df1aa419); + let mut x221: u64 = 0; + let mut x222: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x221, &mut x222, x3, 0x2d319b2419b409a9); + let mut x223: u64 = 0; + let mut x224: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x223, &mut x224, 0x0, x222, x219); + let mut x225: u64 = 0; + let mut x226: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x225, &mut x226, x224, x220, x217); + let mut x227: u64 = 0; + let mut x228: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x227, &mut x228, x226, x218, x215); + let mut x229: u64 = 0; + let mut x230: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x229, &mut x230, x228, x216, x213); + let mut x231: u64 = 0; + let mut x232: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x231, &mut x232, x230, x214, x211); + let mut x233: u64 = 0; + let mut x234: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x233, &mut x234, 0x0, x199, x221); + let mut x235: u64 = 0; + let mut x236: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x235, &mut x236, x234, x201, x223); + let mut x237: u64 = 0; + let mut x238: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x237, &mut x238, x236, x203, x225); + let mut x239: u64 = 0; + let mut x240: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x239, &mut x240, x238, x205, x227); + let mut x241: u64 = 0; + let mut x242: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x241, &mut x242, x240, x207, x229); + let mut x243: u64 = 0; + let mut x244: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x243, &mut x244, x242, x209, x231); + let mut x245: u64 = 0; + let mut x246: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x245, &mut x246, x233, 0x6ed46089e88fdc45); + let mut x247: u64 = 0; + let mut x248: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x247, &mut x248, x245, 0xffffffffffffffff); + let mut x249: u64 = 0; + let mut x250: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x249, &mut x250, x245, 0xffffffffffffffff); + let mut x251: u64 = 0; + let mut x252: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x251, &mut x252, x245, 0xffffffffffffffff); + let mut x253: u64 = 0; + let mut x254: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x253, &mut x254, x245, 0xc7634d81f4372ddf); + let mut x255: u64 = 0; + let mut x256: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x255, &mut x256, x245, 0x581a0db248b0a77a); + let mut x257: u64 = 0; + let mut x258: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x257, &mut x258, x245, 0xecec196accc52973); + let mut x259: u64 = 0; + let mut x260: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x259, &mut x260, 0x0, x258, x255); + let mut x261: u64 = 0; + let mut x262: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x261, &mut x262, x260, x256, x253); + let mut x263: u64 = 0; + let mut x264: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x263, &mut x264, x262, x254, x251); + let mut x265: u64 = 0; + let mut x266: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x265, &mut x266, x264, x252, x249); + let mut x267: u64 = 0; + let mut x268: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x267, &mut x268, x266, x250, x247); + let mut x269: u64 = 0; + let mut x270: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x269, &mut x270, 0x0, x233, x257); + let mut x271: u64 = 0; + let mut x272: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x271, &mut x272, x270, x235, x259); + let mut x273: u64 = 0; + let mut x274: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x273, &mut x274, x272, x237, x261); + let mut x275: u64 = 0; + let mut x276: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x275, &mut x276, x274, x239, x263); + let mut x277: u64 = 0; + let mut x278: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x277, &mut x278, x276, x241, x265); + let mut x279: u64 = 0; + let mut x280: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x279, &mut x280, x278, x243, x267); + let mut x281: u64 = 0; + let mut x282: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x281, &mut x282, x280, (((x244 as u64) + (x210 as u64)) + ((x232 as u64) + x212)), ((x268 as u64) + x248)); + let mut x283: u64 = 0; + let mut x284: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x283, &mut x284, x4, 0xc84ee012b39bf21); + let mut x285: u64 = 0; + let mut x286: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x285, &mut x286, x4, 0x3fb05b7a28266895); + let mut x287: u64 = 0; + let mut x288: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x287, &mut x288, x4, 0xd40d49174aab1cc5); + let mut x289: u64 = 0; + let mut x290: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x289, &mut x290, x4, 0xbc3e483afcb82947); + let mut x291: u64 = 0; + let mut x292: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x291, &mut x292, x4, 0xff3d81e5df1aa419); + let mut x293: u64 = 0; + let mut x294: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x293, &mut x294, x4, 0x2d319b2419b409a9); + let mut x295: u64 = 0; + let mut x296: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x295, &mut x296, 0x0, x294, x291); + let mut x297: u64 = 0; + let mut x298: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x297, &mut x298, x296, x292, x289); + let mut x299: u64 = 0; + let mut x300: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x299, &mut x300, x298, x290, x287); + let mut x301: u64 = 0; + let mut x302: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x301, &mut x302, x300, x288, x285); + let mut x303: u64 = 0; + let mut x304: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x303, &mut x304, x302, x286, x283); + let mut x305: u64 = 0; + let mut x306: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x305, &mut x306, 0x0, x271, x293); + let mut x307: u64 = 0; + let mut x308: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x307, &mut x308, x306, x273, x295); + let mut x309: u64 = 0; + let mut x310: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x309, &mut x310, x308, x275, x297); + let mut x311: u64 = 0; + let mut x312: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x311, &mut x312, x310, x277, x299); + let mut x313: u64 = 0; + let mut x314: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x313, &mut x314, x312, x279, x301); + let mut x315: u64 = 0; + let mut x316: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x315, &mut x316, x314, x281, x303); + let mut x317: u64 = 0; + let mut x318: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x317, &mut x318, x305, 0x6ed46089e88fdc45); + let mut x319: u64 = 0; + let mut x320: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x319, &mut x320, x317, 0xffffffffffffffff); + let mut x321: u64 = 0; + let mut x322: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x321, &mut x322, x317, 0xffffffffffffffff); + let mut x323: u64 = 0; + let mut x324: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x323, &mut x324, x317, 0xffffffffffffffff); + let mut x325: u64 = 0; + let mut x326: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x325, &mut x326, x317, 0xc7634d81f4372ddf); + let mut x327: u64 = 0; + let mut x328: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x327, &mut x328, x317, 0x581a0db248b0a77a); + let mut x329: u64 = 0; + let mut x330: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x329, &mut x330, x317, 0xecec196accc52973); + let mut x331: u64 = 0; + let mut x332: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x331, &mut x332, 0x0, x330, x327); + let mut x333: u64 = 0; + let mut x334: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x333, &mut x334, x332, x328, x325); + let mut x335: u64 = 0; + let mut x336: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x335, &mut x336, x334, x326, x323); + let mut x337: u64 = 0; + let mut x338: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x337, &mut x338, x336, x324, x321); + let mut x339: u64 = 0; + let mut x340: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x339, &mut x340, x338, x322, x319); + let mut x341: u64 = 0; + let mut x342: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x341, &mut x342, 0x0, x305, x329); + let mut x343: u64 = 0; + let mut x344: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x343, &mut x344, x342, x307, x331); + let mut x345: u64 = 0; + let mut x346: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x345, &mut x346, x344, x309, x333); + let mut x347: u64 = 0; + let mut x348: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x347, &mut x348, x346, x311, x335); + let mut x349: u64 = 0; + let mut x350: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x349, &mut x350, x348, x313, x337); + let mut x351: u64 = 0; + let mut x352: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x351, &mut x352, x350, x315, x339); + let mut x353: u64 = 0; + let mut x354: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x353, &mut x354, x352, (((x316 as u64) + (x282 as u64)) + ((x304 as u64) + x284)), ((x340 as u64) + x320)); + let mut x355: u64 = 0; + let mut x356: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x355, &mut x356, x5, 0xc84ee012b39bf21); + let mut x357: u64 = 0; + let mut x358: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x357, &mut x358, x5, 0x3fb05b7a28266895); + let mut x359: u64 = 0; + let mut x360: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x359, &mut x360, x5, 0xd40d49174aab1cc5); + let mut x361: u64 = 0; + let mut x362: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x361, &mut x362, x5, 0xbc3e483afcb82947); + let mut x363: u64 = 0; + let mut x364: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x363, &mut x364, x5, 0xff3d81e5df1aa419); + let mut x365: u64 = 0; + let mut x366: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x365, &mut x366, x5, 0x2d319b2419b409a9); + let mut x367: u64 = 0; + let mut x368: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x367, &mut x368, 0x0, x366, x363); + let mut x369: u64 = 0; + let mut x370: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x369, &mut x370, x368, x364, x361); + let mut x371: u64 = 0; + let mut x372: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x371, &mut x372, x370, x362, x359); + let mut x373: u64 = 0; + let mut x374: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x373, &mut x374, x372, x360, x357); + let mut x375: u64 = 0; + let mut x376: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x375, &mut x376, x374, x358, x355); + let mut x377: u64 = 0; + let mut x378: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x377, &mut x378, 0x0, x343, x365); + let mut x379: u64 = 0; + let mut x380: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x379, &mut x380, x378, x345, x367); + let mut x381: u64 = 0; + let mut x382: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x381, &mut x382, x380, x347, x369); + let mut x383: u64 = 0; + let mut x384: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x383, &mut x384, x382, x349, x371); + let mut x385: u64 = 0; + let mut x386: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x385, &mut x386, x384, x351, x373); + let mut x387: u64 = 0; + let mut x388: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x387, &mut x388, x386, x353, x375); + let mut x389: u64 = 0; + let mut x390: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x389, &mut x390, x377, 0x6ed46089e88fdc45); + let mut x391: u64 = 0; + let mut x392: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x391, &mut x392, x389, 0xffffffffffffffff); + let mut x393: u64 = 0; + let mut x394: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x393, &mut x394, x389, 0xffffffffffffffff); + let mut x395: u64 = 0; + let mut x396: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x395, &mut x396, x389, 0xffffffffffffffff); + let mut x397: u64 = 0; + let mut x398: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x397, &mut x398, x389, 0xc7634d81f4372ddf); + let mut x399: u64 = 0; + let mut x400: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x399, &mut x400, x389, 0x581a0db248b0a77a); + let mut x401: u64 = 0; + let mut x402: u64 = 0; + fiat_p384_scalar_mulx_u64(&mut x401, &mut x402, x389, 0xecec196accc52973); + let mut x403: u64 = 0; + let mut x404: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x403, &mut x404, 0x0, x402, x399); + let mut x405: u64 = 0; + let mut x406: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x405, &mut x406, x404, x400, x397); + let mut x407: u64 = 0; + let mut x408: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x407, &mut x408, x406, x398, x395); + let mut x409: u64 = 0; + let mut x410: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x409, &mut x410, x408, x396, x393); + let mut x411: u64 = 0; + let mut x412: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x411, &mut x412, x410, x394, x391); + let mut x413: u64 = 0; + let mut x414: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x413, &mut x414, 0x0, x377, x401); + let mut x415: u64 = 0; + let mut x416: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x415, &mut x416, x414, x379, x403); + let mut x417: u64 = 0; + let mut x418: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x417, &mut x418, x416, x381, x405); + let mut x419: u64 = 0; + let mut x420: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x419, &mut x420, x418, x383, x407); + let mut x421: u64 = 0; + let mut x422: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x421, &mut x422, x420, x385, x409); + let mut x423: u64 = 0; + let mut x424: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x423, &mut x424, x422, x387, x411); + let mut x425: u64 = 0; + let mut x426: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x425, &mut x426, x424, (((x388 as u64) + (x354 as u64)) + ((x376 as u64) + x356)), ((x412 as u64) + x392)); + let mut x427: u64 = 0; + let mut x428: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x427, &mut x428, 0x0, x415, 0xecec196accc52973); + let mut x429: u64 = 0; + let mut x430: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x429, &mut x430, x428, x417, 0x581a0db248b0a77a); + let mut x431: u64 = 0; + let mut x432: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x431, &mut x432, x430, x419, 0xc7634d81f4372ddf); + let mut x433: u64 = 0; + let mut x434: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x433, &mut x434, x432, x421, 0xffffffffffffffff); + let mut x435: u64 = 0; + let mut x436: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x435, &mut x436, x434, x423, 0xffffffffffffffff); + let mut x437: u64 = 0; + let mut x438: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x437, &mut x438, x436, x425, 0xffffffffffffffff); + let mut x439: u64 = 0; + let mut x440: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x439, &mut x440, x438, (x426 as u64), (0x0 as u64)); + let mut x441: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x441, x440, x427, x415); + let mut x442: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x442, x440, x429, x417); + let mut x443: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x443, x440, x431, x419); + let mut x444: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x444, x440, x433, x421); + let mut x445: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x445, x440, x435, x423); + let mut x446: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x446, x440, x437, x425); + out1[0] = x441; + out1[1] = x442; + out1[2] = x443; + out1[3] = x444; + out1[4] = x445; + out1[5] = x446; +} + +/// The function fiat_p384_scalar_nonzero outputs a single non-zero word if the input is non-zero and zero otherwise. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// out1 = 0 ↔ eval (from_montgomery arg1) mod m = 0 +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +#[inline] +pub fn fiat_p384_scalar_nonzero(out1: &mut u64, arg1: &[u64; 6]) -> () { + let x1: u64 = ((arg1[0]) | ((arg1[1]) | ((arg1[2]) | ((arg1[3]) | ((arg1[4]) | (arg1[5])))))); + *out1 = x1; +} + +/// The function fiat_p384_scalar_selectznz is a multi-limb conditional select. +/// +/// Postconditions: +/// out1 = (if arg1 = 0 then arg2 else arg3) +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +#[inline] +pub fn fiat_p384_scalar_selectznz(out1: &mut [u64; 6], arg1: fiat_p384_scalar_u1, arg2: &[u64; 6], arg3: &[u64; 6]) -> () { + let mut x1: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x1, arg1, (arg2[0]), (arg3[0])); + let mut x2: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x2, arg1, (arg2[1]), (arg3[1])); + let mut x3: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x3, arg1, (arg2[2]), (arg3[2])); + let mut x4: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x4, arg1, (arg2[3]), (arg3[3])); + let mut x5: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x5, arg1, (arg2[4]), (arg3[4])); + let mut x6: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x6, arg1, (arg2[5]), (arg3[5])); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; + out1[3] = x4; + out1[4] = x5; + out1[5] = x6; +} + +/// The function fiat_p384_scalar_to_bytes serializes a field element NOT in the Montgomery domain to bytes in little-endian order. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..47] +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] +#[inline] +pub fn fiat_p384_scalar_to_bytes(out1: &mut [u8; 48], arg1: &[u64; 6]) -> () { + let x1: u64 = (arg1[5]); + let x2: u64 = (arg1[4]); + let x3: u64 = (arg1[3]); + let x4: u64 = (arg1[2]); + let x5: u64 = (arg1[1]); + let x6: u64 = (arg1[0]); + let x7: u8 = ((x6 & (0xff as u64)) as u8); + let x8: u64 = (x6 >> 8); + let x9: u8 = ((x8 & (0xff as u64)) as u8); + let x10: u64 = (x8 >> 8); + let x11: u8 = ((x10 & (0xff as u64)) as u8); + let x12: u64 = (x10 >> 8); + let x13: u8 = ((x12 & (0xff as u64)) as u8); + let x14: u64 = (x12 >> 8); + let x15: u8 = ((x14 & (0xff as u64)) as u8); + let x16: u64 = (x14 >> 8); + let x17: u8 = ((x16 & (0xff as u64)) as u8); + let x18: u64 = (x16 >> 8); + let x19: u8 = ((x18 & (0xff as u64)) as u8); + let x20: u8 = ((x18 >> 8) as u8); + let x21: u8 = ((x5 & (0xff as u64)) as u8); + let x22: u64 = (x5 >> 8); + let x23: u8 = ((x22 & (0xff as u64)) as u8); + let x24: u64 = (x22 >> 8); + let x25: u8 = ((x24 & (0xff as u64)) as u8); + let x26: u64 = (x24 >> 8); + let x27: u8 = ((x26 & (0xff as u64)) as u8); + let x28: u64 = (x26 >> 8); + let x29: u8 = ((x28 & (0xff as u64)) as u8); + let x30: u64 = (x28 >> 8); + let x31: u8 = ((x30 & (0xff as u64)) as u8); + let x32: u64 = (x30 >> 8); + let x33: u8 = ((x32 & (0xff as u64)) as u8); + let x34: u8 = ((x32 >> 8) as u8); + let x35: u8 = ((x4 & (0xff as u64)) as u8); + let x36: u64 = (x4 >> 8); + let x37: u8 = ((x36 & (0xff as u64)) as u8); + let x38: u64 = (x36 >> 8); + let x39: u8 = ((x38 & (0xff as u64)) as u8); + let x40: u64 = (x38 >> 8); + let x41: u8 = ((x40 & (0xff as u64)) as u8); + let x42: u64 = (x40 >> 8); + let x43: u8 = ((x42 & (0xff as u64)) as u8); + let x44: u64 = (x42 >> 8); + let x45: u8 = ((x44 & (0xff as u64)) as u8); + let x46: u64 = (x44 >> 8); + let x47: u8 = ((x46 & (0xff as u64)) as u8); + let x48: u8 = ((x46 >> 8) as u8); + let x49: u8 = ((x3 & (0xff as u64)) as u8); + let x50: u64 = (x3 >> 8); + let x51: u8 = ((x50 & (0xff as u64)) as u8); + let x52: u64 = (x50 >> 8); + let x53: u8 = ((x52 & (0xff as u64)) as u8); + let x54: u64 = (x52 >> 8); + let x55: u8 = ((x54 & (0xff as u64)) as u8); + let x56: u64 = (x54 >> 8); + let x57: u8 = ((x56 & (0xff as u64)) as u8); + let x58: u64 = (x56 >> 8); + let x59: u8 = ((x58 & (0xff as u64)) as u8); + let x60: u64 = (x58 >> 8); + let x61: u8 = ((x60 & (0xff as u64)) as u8); + let x62: u8 = ((x60 >> 8) as u8); + let x63: u8 = ((x2 & (0xff as u64)) as u8); + let x64: u64 = (x2 >> 8); + let x65: u8 = ((x64 & (0xff as u64)) as u8); + let x66: u64 = (x64 >> 8); + let x67: u8 = ((x66 & (0xff as u64)) as u8); + let x68: u64 = (x66 >> 8); + let x69: u8 = ((x68 & (0xff as u64)) as u8); + let x70: u64 = (x68 >> 8); + let x71: u8 = ((x70 & (0xff as u64)) as u8); + let x72: u64 = (x70 >> 8); + let x73: u8 = ((x72 & (0xff as u64)) as u8); + let x74: u64 = (x72 >> 8); + let x75: u8 = ((x74 & (0xff as u64)) as u8); + let x76: u8 = ((x74 >> 8) as u8); + let x77: u8 = ((x1 & (0xff as u64)) as u8); + let x78: u64 = (x1 >> 8); + let x79: u8 = ((x78 & (0xff as u64)) as u8); + let x80: u64 = (x78 >> 8); + let x81: u8 = ((x80 & (0xff as u64)) as u8); + let x82: u64 = (x80 >> 8); + let x83: u8 = ((x82 & (0xff as u64)) as u8); + let x84: u64 = (x82 >> 8); + let x85: u8 = ((x84 & (0xff as u64)) as u8); + let x86: u64 = (x84 >> 8); + let x87: u8 = ((x86 & (0xff as u64)) as u8); + let x88: u64 = (x86 >> 8); + let x89: u8 = ((x88 & (0xff as u64)) as u8); + let x90: u8 = ((x88 >> 8) as u8); + out1[0] = x7; + out1[1] = x9; + out1[2] = x11; + out1[3] = x13; + out1[4] = x15; + out1[5] = x17; + out1[6] = x19; + out1[7] = x20; + out1[8] = x21; + out1[9] = x23; + out1[10] = x25; + out1[11] = x27; + out1[12] = x29; + out1[13] = x31; + out1[14] = x33; + out1[15] = x34; + out1[16] = x35; + out1[17] = x37; + out1[18] = x39; + out1[19] = x41; + out1[20] = x43; + out1[21] = x45; + out1[22] = x47; + out1[23] = x48; + out1[24] = x49; + out1[25] = x51; + out1[26] = x53; + out1[27] = x55; + out1[28] = x57; + out1[29] = x59; + out1[30] = x61; + out1[31] = x62; + out1[32] = x63; + out1[33] = x65; + out1[34] = x67; + out1[35] = x69; + out1[36] = x71; + out1[37] = x73; + out1[38] = x75; + out1[39] = x76; + out1[40] = x77; + out1[41] = x79; + out1[42] = x81; + out1[43] = x83; + out1[44] = x85; + out1[45] = x87; + out1[46] = x89; + out1[47] = x90; +} + +/// The function fiat_p384_scalar_from_bytes deserializes a field element NOT in the Montgomery domain from bytes in little-endian order. +/// +/// Preconditions: +/// 0 ≤ bytes_eval arg1 < m +/// Postconditions: +/// eval out1 mod m = bytes_eval arg1 mod m +/// 0 ≤ eval out1 < m +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +#[inline] +pub fn fiat_p384_scalar_from_bytes(out1: &mut [u64; 6], arg1: &[u8; 48]) -> () { + let x1: u64 = (((arg1[47]) as u64) << 56); + let x2: u64 = (((arg1[46]) as u64) << 48); + let x3: u64 = (((arg1[45]) as u64) << 40); + let x4: u64 = (((arg1[44]) as u64) << 32); + let x5: u64 = (((arg1[43]) as u64) << 24); + let x6: u64 = (((arg1[42]) as u64) << 16); + let x7: u64 = (((arg1[41]) as u64) << 8); + let x8: u8 = (arg1[40]); + let x9: u64 = (((arg1[39]) as u64) << 56); + let x10: u64 = (((arg1[38]) as u64) << 48); + let x11: u64 = (((arg1[37]) as u64) << 40); + let x12: u64 = (((arg1[36]) as u64) << 32); + let x13: u64 = (((arg1[35]) as u64) << 24); + let x14: u64 = (((arg1[34]) as u64) << 16); + let x15: u64 = (((arg1[33]) as u64) << 8); + let x16: u8 = (arg1[32]); + let x17: u64 = (((arg1[31]) as u64) << 56); + let x18: u64 = (((arg1[30]) as u64) << 48); + let x19: u64 = (((arg1[29]) as u64) << 40); + let x20: u64 = (((arg1[28]) as u64) << 32); + let x21: u64 = (((arg1[27]) as u64) << 24); + let x22: u64 = (((arg1[26]) as u64) << 16); + let x23: u64 = (((arg1[25]) as u64) << 8); + let x24: u8 = (arg1[24]); + let x25: u64 = (((arg1[23]) as u64) << 56); + let x26: u64 = (((arg1[22]) as u64) << 48); + let x27: u64 = (((arg1[21]) as u64) << 40); + let x28: u64 = (((arg1[20]) as u64) << 32); + let x29: u64 = (((arg1[19]) as u64) << 24); + let x30: u64 = (((arg1[18]) as u64) << 16); + let x31: u64 = (((arg1[17]) as u64) << 8); + let x32: u8 = (arg1[16]); + let x33: u64 = (((arg1[15]) as u64) << 56); + let x34: u64 = (((arg1[14]) as u64) << 48); + let x35: u64 = (((arg1[13]) as u64) << 40); + let x36: u64 = (((arg1[12]) as u64) << 32); + let x37: u64 = (((arg1[11]) as u64) << 24); + let x38: u64 = (((arg1[10]) as u64) << 16); + let x39: u64 = (((arg1[9]) as u64) << 8); + let x40: u8 = (arg1[8]); + let x41: u64 = (((arg1[7]) as u64) << 56); + let x42: u64 = (((arg1[6]) as u64) << 48); + let x43: u64 = (((arg1[5]) as u64) << 40); + let x44: u64 = (((arg1[4]) as u64) << 32); + let x45: u64 = (((arg1[3]) as u64) << 24); + let x46: u64 = (((arg1[2]) as u64) << 16); + let x47: u64 = (((arg1[1]) as u64) << 8); + let x48: u8 = (arg1[0]); + let x49: u64 = (x47 + (x48 as u64)); + let x50: u64 = (x46 + x49); + let x51: u64 = (x45 + x50); + let x52: u64 = (x44 + x51); + let x53: u64 = (x43 + x52); + let x54: u64 = (x42 + x53); + let x55: u64 = (x41 + x54); + let x56: u64 = (x39 + (x40 as u64)); + let x57: u64 = (x38 + x56); + let x58: u64 = (x37 + x57); + let x59: u64 = (x36 + x58); + let x60: u64 = (x35 + x59); + let x61: u64 = (x34 + x60); + let x62: u64 = (x33 + x61); + let x63: u64 = (x31 + (x32 as u64)); + let x64: u64 = (x30 + x63); + let x65: u64 = (x29 + x64); + let x66: u64 = (x28 + x65); + let x67: u64 = (x27 + x66); + let x68: u64 = (x26 + x67); + let x69: u64 = (x25 + x68); + let x70: u64 = (x23 + (x24 as u64)); + let x71: u64 = (x22 + x70); + let x72: u64 = (x21 + x71); + let x73: u64 = (x20 + x72); + let x74: u64 = (x19 + x73); + let x75: u64 = (x18 + x74); + let x76: u64 = (x17 + x75); + let x77: u64 = (x15 + (x16 as u64)); + let x78: u64 = (x14 + x77); + let x79: u64 = (x13 + x78); + let x80: u64 = (x12 + x79); + let x81: u64 = (x11 + x80); + let x82: u64 = (x10 + x81); + let x83: u64 = (x9 + x82); + let x84: u64 = (x7 + (x8 as u64)); + let x85: u64 = (x6 + x84); + let x86: u64 = (x5 + x85); + let x87: u64 = (x4 + x86); + let x88: u64 = (x3 + x87); + let x89: u64 = (x2 + x88); + let x90: u64 = (x1 + x89); + out1[0] = x55; + out1[1] = x62; + out1[2] = x69; + out1[3] = x76; + out1[4] = x83; + out1[5] = x90; +} + +/// The function fiat_p384_scalar_set_one returns the field element one in the Montgomery domain. +/// +/// Postconditions: +/// eval (from_montgomery out1) mod m = 1 mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p384_scalar_set_one(out1: &mut fiat_p384_scalar_montgomery_domain_field_element) -> () { + out1[0] = 0x1313e695333ad68d; + out1[1] = 0xa7e5f24db74f5885; + out1[2] = 0x389cb27e0bc8d220; + out1[3] = (0x0 as u64); + out1[4] = (0x0 as u64); + out1[5] = (0x0 as u64); +} + +/// The function fiat_p384_scalar_msat returns the saturated representation of the prime modulus. +/// +/// Postconditions: +/// twos_complement_eval out1 = m +/// 0 ≤ eval out1 < m +/// +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +#[inline] +pub fn fiat_p384_scalar_msat(out1: &mut [u64; 7]) -> () { + out1[0] = 0xecec196accc52973; + out1[1] = 0x581a0db248b0a77a; + out1[2] = 0xc7634d81f4372ddf; + out1[3] = 0xffffffffffffffff; + out1[4] = 0xffffffffffffffff; + out1[5] = 0xffffffffffffffff; + out1[6] = (0x0 as u64); +} + +/// The function fiat_p384_scalar_divstep computes a divstep. +/// +/// Preconditions: +/// 0 ≤ eval arg4 < m +/// 0 ≤ eval arg5 < m +/// Postconditions: +/// out1 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then 1 - arg1 else 1 + arg1) +/// twos_complement_eval out2 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then twos_complement_eval arg3 else twos_complement_eval arg2) +/// twos_complement_eval out3 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then ⌊(twos_complement_eval arg3 - twos_complement_eval arg2) / 2⌋ else ⌊(twos_complement_eval arg3 + (twos_complement_eval arg3 mod 2) * twos_complement_eval arg2) / 2⌋) +/// eval (from_montgomery out4) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (2 * eval (from_montgomery arg5)) mod m else (2 * eval (from_montgomery arg4)) mod m) +/// eval (from_montgomery out5) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (eval (from_montgomery arg4) - eval (from_montgomery arg4)) mod m else (eval (from_montgomery arg5) + (twos_complement_eval arg3 mod 2) * eval (from_montgomery arg4)) mod m) +/// 0 ≤ eval out5 < m +/// 0 ≤ eval out5 < m +/// 0 ≤ eval out2 < m +/// 0 ≤ eval out3 < m +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0xffffffffffffffff] +/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// arg4: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// arg5: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +/// out2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// out3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// out4: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// out5: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +#[inline] +pub fn fiat_p384_scalar_divstep(out1: &mut u64, out2: &mut [u64; 7], out3: &mut [u64; 7], out4: &mut [u64; 6], out5: &mut [u64; 6], arg1: u64, arg2: &[u64; 7], arg3: &[u64; 7], arg4: &[u64; 6], arg5: &[u64; 6]) -> () { + let mut x1: u64 = 0; + let mut x2: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x1, &mut x2, 0x0, (!arg1), (0x1 as u64)); + let x3: fiat_p384_scalar_u1 = (((x1 >> 63) as fiat_p384_scalar_u1) & (((arg3[0]) & (0x1 as u64)) as fiat_p384_scalar_u1)); + let mut x4: u64 = 0; + let mut x5: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x4, &mut x5, 0x0, (!arg1), (0x1 as u64)); + let mut x6: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x6, x3, arg1, x4); + let mut x7: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x7, x3, (arg2[0]), (arg3[0])); + let mut x8: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x8, x3, (arg2[1]), (arg3[1])); + let mut x9: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x9, x3, (arg2[2]), (arg3[2])); + let mut x10: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x10, x3, (arg2[3]), (arg3[3])); + let mut x11: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x11, x3, (arg2[4]), (arg3[4])); + let mut x12: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x12, x3, (arg2[5]), (arg3[5])); + let mut x13: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x13, x3, (arg2[6]), (arg3[6])); + let mut x14: u64 = 0; + let mut x15: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x14, &mut x15, 0x0, (0x1 as u64), (!(arg2[0]))); + let mut x16: u64 = 0; + let mut x17: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x16, &mut x17, x15, (0x0 as u64), (!(arg2[1]))); + let mut x18: u64 = 0; + let mut x19: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x18, &mut x19, x17, (0x0 as u64), (!(arg2[2]))); + let mut x20: u64 = 0; + let mut x21: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x20, &mut x21, x19, (0x0 as u64), (!(arg2[3]))); + let mut x22: u64 = 0; + let mut x23: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x22, &mut x23, x21, (0x0 as u64), (!(arg2[4]))); + let mut x24: u64 = 0; + let mut x25: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x24, &mut x25, x23, (0x0 as u64), (!(arg2[5]))); + let mut x26: u64 = 0; + let mut x27: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x26, &mut x27, x25, (0x0 as u64), (!(arg2[6]))); + let mut x28: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x28, x3, (arg3[0]), x14); + let mut x29: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x29, x3, (arg3[1]), x16); + let mut x30: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x30, x3, (arg3[2]), x18); + let mut x31: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x31, x3, (arg3[3]), x20); + let mut x32: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x32, x3, (arg3[4]), x22); + let mut x33: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x33, x3, (arg3[5]), x24); + let mut x34: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x34, x3, (arg3[6]), x26); + let mut x35: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x35, x3, (arg4[0]), (arg5[0])); + let mut x36: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x36, x3, (arg4[1]), (arg5[1])); + let mut x37: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x37, x3, (arg4[2]), (arg5[2])); + let mut x38: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x38, x3, (arg4[3]), (arg5[3])); + let mut x39: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x39, x3, (arg4[4]), (arg5[4])); + let mut x40: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x40, x3, (arg4[5]), (arg5[5])); + let mut x41: u64 = 0; + let mut x42: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x41, &mut x42, 0x0, x35, x35); + let mut x43: u64 = 0; + let mut x44: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x43, &mut x44, x42, x36, x36); + let mut x45: u64 = 0; + let mut x46: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x45, &mut x46, x44, x37, x37); + let mut x47: u64 = 0; + let mut x48: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x47, &mut x48, x46, x38, x38); + let mut x49: u64 = 0; + let mut x50: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x49, &mut x50, x48, x39, x39); + let mut x51: u64 = 0; + let mut x52: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x51, &mut x52, x50, x40, x40); + let mut x53: u64 = 0; + let mut x54: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x53, &mut x54, 0x0, x41, 0xecec196accc52973); + let mut x55: u64 = 0; + let mut x56: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x55, &mut x56, x54, x43, 0x581a0db248b0a77a); + let mut x57: u64 = 0; + let mut x58: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x57, &mut x58, x56, x45, 0xc7634d81f4372ddf); + let mut x59: u64 = 0; + let mut x60: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x59, &mut x60, x58, x47, 0xffffffffffffffff); + let mut x61: u64 = 0; + let mut x62: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x61, &mut x62, x60, x49, 0xffffffffffffffff); + let mut x63: u64 = 0; + let mut x64: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x63, &mut x64, x62, x51, 0xffffffffffffffff); + let mut x65: u64 = 0; + let mut x66: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x65, &mut x66, x64, (x52 as u64), (0x0 as u64)); + let x67: u64 = (arg4[5]); + let x68: u64 = (arg4[4]); + let x69: u64 = (arg4[3]); + let x70: u64 = (arg4[2]); + let x71: u64 = (arg4[1]); + let x72: u64 = (arg4[0]); + let mut x73: u64 = 0; + let mut x74: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x73, &mut x74, 0x0, (0x0 as u64), x72); + let mut x75: u64 = 0; + let mut x76: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x75, &mut x76, x74, (0x0 as u64), x71); + let mut x77: u64 = 0; + let mut x78: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x77, &mut x78, x76, (0x0 as u64), x70); + let mut x79: u64 = 0; + let mut x80: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x79, &mut x80, x78, (0x0 as u64), x69); + let mut x81: u64 = 0; + let mut x82: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x81, &mut x82, x80, (0x0 as u64), x68); + let mut x83: u64 = 0; + let mut x84: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x83, &mut x84, x82, (0x0 as u64), x67); + let mut x85: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x85, x84, (0x0 as u64), 0xffffffffffffffff); + let mut x86: u64 = 0; + let mut x87: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x86, &mut x87, 0x0, x73, (x85 & 0xecec196accc52973)); + let mut x88: u64 = 0; + let mut x89: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x88, &mut x89, x87, x75, (x85 & 0x581a0db248b0a77a)); + let mut x90: u64 = 0; + let mut x91: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x90, &mut x91, x89, x77, (x85 & 0xc7634d81f4372ddf)); + let mut x92: u64 = 0; + let mut x93: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x92, &mut x93, x91, x79, x85); + let mut x94: u64 = 0; + let mut x95: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x94, &mut x95, x93, x81, x85); + let mut x96: u64 = 0; + let mut x97: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x96, &mut x97, x95, x83, x85); + let mut x98: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x98, x3, (arg5[0]), x86); + let mut x99: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x99, x3, (arg5[1]), x88); + let mut x100: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x100, x3, (arg5[2]), x90); + let mut x101: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x101, x3, (arg5[3]), x92); + let mut x102: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x102, x3, (arg5[4]), x94); + let mut x103: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x103, x3, (arg5[5]), x96); + let x104: fiat_p384_scalar_u1 = ((x28 & (0x1 as u64)) as fiat_p384_scalar_u1); + let mut x105: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x105, x104, (0x0 as u64), x7); + let mut x106: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x106, x104, (0x0 as u64), x8); + let mut x107: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x107, x104, (0x0 as u64), x9); + let mut x108: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x108, x104, (0x0 as u64), x10); + let mut x109: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x109, x104, (0x0 as u64), x11); + let mut x110: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x110, x104, (0x0 as u64), x12); + let mut x111: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x111, x104, (0x0 as u64), x13); + let mut x112: u64 = 0; + let mut x113: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x112, &mut x113, 0x0, x28, x105); + let mut x114: u64 = 0; + let mut x115: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x114, &mut x115, x113, x29, x106); + let mut x116: u64 = 0; + let mut x117: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x116, &mut x117, x115, x30, x107); + let mut x118: u64 = 0; + let mut x119: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x118, &mut x119, x117, x31, x108); + let mut x120: u64 = 0; + let mut x121: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x120, &mut x121, x119, x32, x109); + let mut x122: u64 = 0; + let mut x123: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x122, &mut x123, x121, x33, x110); + let mut x124: u64 = 0; + let mut x125: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x124, &mut x125, x123, x34, x111); + let mut x126: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x126, x104, (0x0 as u64), x35); + let mut x127: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x127, x104, (0x0 as u64), x36); + let mut x128: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x128, x104, (0x0 as u64), x37); + let mut x129: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x129, x104, (0x0 as u64), x38); + let mut x130: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x130, x104, (0x0 as u64), x39); + let mut x131: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x131, x104, (0x0 as u64), x40); + let mut x132: u64 = 0; + let mut x133: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x132, &mut x133, 0x0, x98, x126); + let mut x134: u64 = 0; + let mut x135: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x134, &mut x135, x133, x99, x127); + let mut x136: u64 = 0; + let mut x137: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x136, &mut x137, x135, x100, x128); + let mut x138: u64 = 0; + let mut x139: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x138, &mut x139, x137, x101, x129); + let mut x140: u64 = 0; + let mut x141: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x140, &mut x141, x139, x102, x130); + let mut x142: u64 = 0; + let mut x143: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x142, &mut x143, x141, x103, x131); + let mut x144: u64 = 0; + let mut x145: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x144, &mut x145, 0x0, x132, 0xecec196accc52973); + let mut x146: u64 = 0; + let mut x147: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x146, &mut x147, x145, x134, 0x581a0db248b0a77a); + let mut x148: u64 = 0; + let mut x149: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x148, &mut x149, x147, x136, 0xc7634d81f4372ddf); + let mut x150: u64 = 0; + let mut x151: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x150, &mut x151, x149, x138, 0xffffffffffffffff); + let mut x152: u64 = 0; + let mut x153: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x152, &mut x153, x151, x140, 0xffffffffffffffff); + let mut x154: u64 = 0; + let mut x155: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x154, &mut x155, x153, x142, 0xffffffffffffffff); + let mut x156: u64 = 0; + let mut x157: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_subborrowx_u64(&mut x156, &mut x157, x155, (x143 as u64), (0x0 as u64)); + let mut x158: u64 = 0; + let mut x159: fiat_p384_scalar_u1 = 0; + fiat_p384_scalar_addcarryx_u64(&mut x158, &mut x159, 0x0, x6, (0x1 as u64)); + let x160: u64 = ((x112 >> 1) | ((x114 << 63) & 0xffffffffffffffff)); + let x161: u64 = ((x114 >> 1) | ((x116 << 63) & 0xffffffffffffffff)); + let x162: u64 = ((x116 >> 1) | ((x118 << 63) & 0xffffffffffffffff)); + let x163: u64 = ((x118 >> 1) | ((x120 << 63) & 0xffffffffffffffff)); + let x164: u64 = ((x120 >> 1) | ((x122 << 63) & 0xffffffffffffffff)); + let x165: u64 = ((x122 >> 1) | ((x124 << 63) & 0xffffffffffffffff)); + let x166: u64 = ((x124 & 0x8000000000000000) | (x124 >> 1)); + let mut x167: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x167, x66, x53, x41); + let mut x168: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x168, x66, x55, x43); + let mut x169: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x169, x66, x57, x45); + let mut x170: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x170, x66, x59, x47); + let mut x171: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x171, x66, x61, x49); + let mut x172: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x172, x66, x63, x51); + let mut x173: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x173, x157, x144, x132); + let mut x174: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x174, x157, x146, x134); + let mut x175: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x175, x157, x148, x136); + let mut x176: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x176, x157, x150, x138); + let mut x177: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x177, x157, x152, x140); + let mut x178: u64 = 0; + fiat_p384_scalar_cmovznz_u64(&mut x178, x157, x154, x142); + *out1 = x158; + out2[0] = x7; + out2[1] = x8; + out2[2] = x9; + out2[3] = x10; + out2[4] = x11; + out2[5] = x12; + out2[6] = x13; + out3[0] = x160; + out3[1] = x161; + out3[2] = x162; + out3[3] = x163; + out3[4] = x164; + out3[5] = x165; + out3[6] = x166; + out4[0] = x167; + out4[1] = x168; + out4[2] = x169; + out4[3] = x170; + out4[4] = x171; + out4[5] = x172; + out5[0] = x173; + out5[1] = x174; + out5[2] = x175; + out5[3] = x176; + out5[4] = x177; + out5[5] = x178; +} + +/// The function fiat_p384_scalar_divstep_precomp returns the precomputed value for Bernstein-Yang-inversion (in montgomery form). +/// +/// Postconditions: +/// eval (from_montgomery out1) = ⌊(m - 1) / 2⌋^(if ⌊log2 m⌋ + 1 < 46 then ⌊(49 * (⌊log2 m⌋ + 1) + 80) / 17⌋ else ⌊(49 * (⌊log2 m⌋ + 1) + 57) / 17⌋) +/// 0 ≤ eval out1 < m +/// +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +#[inline] +pub fn fiat_p384_scalar_divstep_precomp(out1: &mut [u64; 6]) -> () { + out1[0] = 0x49589ae0e6045b6a; + out1[1] = 0x3c9a5352870040ed; + out1[2] = 0xdacb097e977dc242; + out1[3] = 0xb5ab30a6d1ecbe36; + out1[4] = 0x97d7a1081f959973; + out1[5] = 0x2ba012f8d27192bc; +} diff --git a/vendor/fiat-crypto/src/p434_64.rs b/vendor/fiat-crypto/src/p434_64.rs new file mode 100644 index 000000000..187947960 --- /dev/null +++ b/vendor/fiat-crypto/src/p434_64.rs @@ -0,0 +1,4480 @@ +//! Autogenerated: 'src/ExtractionOCaml/word_by_word_montgomery' --lang Rust --inline p434 64 '2^216 * 3^137 - 1' mul square add sub opp from_montgomery to_montgomery nonzero selectznz to_bytes from_bytes one msat divstep divstep_precomp +//! curve description: p434 +//! machine_wordsize = 64 (from "64") +//! requested operations: mul, square, add, sub, opp, from_montgomery, to_montgomery, nonzero, selectznz, to_bytes, from_bytes, one, msat, divstep, divstep_precomp +//! m = 0x2341f271773446cfc5fd681c520567bc65c783158aea3fdc1767ae2ffffffffffffffffffffffffffffffffffffffffffffffffffffff (from "2^216 * 3^137 - 1") +//! +//! NOTE: In addition to the bounds specified above each function, all +//! functions synthesized for this Montgomery arithmetic require the +//! input to be strictly less than the prime modulus (m), and also +//! require the input to be in the unique saturated representation. +//! All functions also ensure that these two properties are true of +//! return values. +//! +//! Computed values: +//! eval z = z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) + (z[4] << 256) + (z[5] << 0x140) + (z[6] << 0x180) +//! bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248) + (z[32] << 256) + (z[33] << 0x108) + (z[34] << 0x110) + (z[35] << 0x118) + (z[36] << 0x120) + (z[37] << 0x128) + (z[38] << 0x130) + (z[39] << 0x138) + (z[40] << 0x140) + (z[41] << 0x148) + (z[42] << 0x150) + (z[43] << 0x158) + (z[44] << 0x160) + (z[45] << 0x168) + (z[46] << 0x170) + (z[47] << 0x178) + (z[48] << 0x180) + (z[49] << 0x188) + (z[50] << 0x190) + (z[51] << 0x198) + (z[52] << 0x1a0) + (z[53] << 0x1a8) + (z[54] << 0x1b0) +//! twos_complement_eval z = let x1 := z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) + (z[4] << 256) + (z[5] << 0x140) + (z[6] << 0x180) in +//! if x1 & (2^448-1) < 2^447 then x1 & (2^448-1) else (x1 & (2^448-1)) - 2^448 + +#![allow(unused_parens)] +#![allow(non_camel_case_types)] + +pub type fiat_p434_u1 = u8; +pub type fiat_p434_i1 = i8; +pub type fiat_p434_u2 = u8; +pub type fiat_p434_i2 = i8; + +/* The type fiat_p434_montgomery_domain_field_element is a field element in the Montgomery domain. */ +/* Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] */ +pub type fiat_p434_montgomery_domain_field_element = [u64; 7]; + +/* The type fiat_p434_non_montgomery_domain_field_element is a field element NOT in the Montgomery domain. */ +/* Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] */ +pub type fiat_p434_non_montgomery_domain_field_element = [u64; 7]; + + +/// The function fiat_p434_addcarryx_u64 is an addition with carry. +/// +/// Postconditions: +/// out1 = (arg1 + arg2 + arg3) mod 2^64 +/// out2 = ⌊(arg1 + arg2 + arg3) / 2^64⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffffffffffff] +/// arg3: [0x0 ~> 0xffffffffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_p434_addcarryx_u64(out1: &mut u64, out2: &mut fiat_p434_u1, arg1: fiat_p434_u1, arg2: u64, arg3: u64) -> () { + let x1: u128 = (((arg1 as u128) + (arg2 as u128)) + (arg3 as u128)); + let x2: u64 = ((x1 & (0xffffffffffffffff as u128)) as u64); + let x3: fiat_p434_u1 = ((x1 >> 64) as fiat_p434_u1); + *out1 = x2; + *out2 = x3; +} + +/// The function fiat_p434_subborrowx_u64 is a subtraction with borrow. +/// +/// Postconditions: +/// out1 = (-arg1 + arg2 + -arg3) mod 2^64 +/// out2 = -⌊(-arg1 + arg2 + -arg3) / 2^64⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffffffffffff] +/// arg3: [0x0 ~> 0xffffffffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_p434_subborrowx_u64(out1: &mut u64, out2: &mut fiat_p434_u1, arg1: fiat_p434_u1, arg2: u64, arg3: u64) -> () { + let x1: i128 = (((arg2 as i128) - (arg1 as i128)) - (arg3 as i128)); + let x2: fiat_p434_i1 = ((x1 >> 64) as fiat_p434_i1); + let x3: u64 = ((x1 & (0xffffffffffffffff as i128)) as u64); + *out1 = x3; + *out2 = (((0x0 as fiat_p434_i2) - (x2 as fiat_p434_i2)) as fiat_p434_u1); +} + +/// The function fiat_p434_mulx_u64 is a multiplication, returning the full double-width result. +/// +/// Postconditions: +/// out1 = (arg1 * arg2) mod 2^64 +/// out2 = ⌊arg1 * arg2 / 2^64⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0xffffffffffffffff] +/// arg2: [0x0 ~> 0xffffffffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +/// out2: [0x0 ~> 0xffffffffffffffff] +#[inline] +pub fn fiat_p434_mulx_u64(out1: &mut u64, out2: &mut u64, arg1: u64, arg2: u64) -> () { + let x1: u128 = ((arg1 as u128) * (arg2 as u128)); + let x2: u64 = ((x1 & (0xffffffffffffffff as u128)) as u64); + let x3: u64 = ((x1 >> 64) as u64); + *out1 = x2; + *out2 = x3; +} + +/// The function fiat_p434_cmovznz_u64 is a single-word conditional move. +/// +/// Postconditions: +/// out1 = (if arg1 = 0 then arg2 else arg3) +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffffffffffff] +/// arg3: [0x0 ~> 0xffffffffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +#[inline] +pub fn fiat_p434_cmovznz_u64(out1: &mut u64, arg1: fiat_p434_u1, arg2: u64, arg3: u64) -> () { + let x1: fiat_p434_u1 = (!(!arg1)); + let x2: u64 = ((((((0x0 as fiat_p434_i2) - (x1 as fiat_p434_i2)) as fiat_p434_i1) as i128) & (0xffffffffffffffff as i128)) as u64); + let x3: u64 = ((x2 & arg3) | ((!x2) & arg2)); + *out1 = x3; +} + +/// The function fiat_p434_mul multiplies two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p434_mul(out1: &mut fiat_p434_montgomery_domain_field_element, arg1: &fiat_p434_montgomery_domain_field_element, arg2: &fiat_p434_montgomery_domain_field_element) -> () { + let x1: u64 = (arg1[1]); + let x2: u64 = (arg1[2]); + let x3: u64 = (arg1[3]); + let x4: u64 = (arg1[4]); + let x5: u64 = (arg1[5]); + let x6: u64 = (arg1[6]); + let x7: u64 = (arg1[0]); + let mut x8: u64 = 0; + let mut x9: u64 = 0; + fiat_p434_mulx_u64(&mut x8, &mut x9, x7, (arg2[6])); + let mut x10: u64 = 0; + let mut x11: u64 = 0; + fiat_p434_mulx_u64(&mut x10, &mut x11, x7, (arg2[5])); + let mut x12: u64 = 0; + let mut x13: u64 = 0; + fiat_p434_mulx_u64(&mut x12, &mut x13, x7, (arg2[4])); + let mut x14: u64 = 0; + let mut x15: u64 = 0; + fiat_p434_mulx_u64(&mut x14, &mut x15, x7, (arg2[3])); + let mut x16: u64 = 0; + let mut x17: u64 = 0; + fiat_p434_mulx_u64(&mut x16, &mut x17, x7, (arg2[2])); + let mut x18: u64 = 0; + let mut x19: u64 = 0; + fiat_p434_mulx_u64(&mut x18, &mut x19, x7, (arg2[1])); + let mut x20: u64 = 0; + let mut x21: u64 = 0; + fiat_p434_mulx_u64(&mut x20, &mut x21, x7, (arg2[0])); + let mut x22: u64 = 0; + let mut x23: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x22, &mut x23, 0x0, x21, x18); + let mut x24: u64 = 0; + let mut x25: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x24, &mut x25, x23, x19, x16); + let mut x26: u64 = 0; + let mut x27: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x26, &mut x27, x25, x17, x14); + let mut x28: u64 = 0; + let mut x29: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x28, &mut x29, x27, x15, x12); + let mut x30: u64 = 0; + let mut x31: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x30, &mut x31, x29, x13, x10); + let mut x32: u64 = 0; + let mut x33: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x32, &mut x33, x31, x11, x8); + let x34: u64 = ((x33 as u64) + x9); + let mut x35: u64 = 0; + let mut x36: u64 = 0; + fiat_p434_mulx_u64(&mut x35, &mut x36, x20, 0x2341f27177344); + let mut x37: u64 = 0; + let mut x38: u64 = 0; + fiat_p434_mulx_u64(&mut x37, &mut x38, x20, 0x6cfc5fd681c52056); + let mut x39: u64 = 0; + let mut x40: u64 = 0; + fiat_p434_mulx_u64(&mut x39, &mut x40, x20, 0x7bc65c783158aea3); + let mut x41: u64 = 0; + let mut x42: u64 = 0; + fiat_p434_mulx_u64(&mut x41, &mut x42, x20, 0xfdc1767ae2ffffff); + let mut x43: u64 = 0; + let mut x44: u64 = 0; + fiat_p434_mulx_u64(&mut x43, &mut x44, x20, 0xffffffffffffffff); + let mut x45: u64 = 0; + let mut x46: u64 = 0; + fiat_p434_mulx_u64(&mut x45, &mut x46, x20, 0xffffffffffffffff); + let mut x47: u64 = 0; + let mut x48: u64 = 0; + fiat_p434_mulx_u64(&mut x47, &mut x48, x20, 0xffffffffffffffff); + let mut x49: u64 = 0; + let mut x50: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x49, &mut x50, 0x0, x48, x45); + let mut x51: u64 = 0; + let mut x52: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x51, &mut x52, x50, x46, x43); + let mut x53: u64 = 0; + let mut x54: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x53, &mut x54, x52, x44, x41); + let mut x55: u64 = 0; + let mut x56: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x55, &mut x56, x54, x42, x39); + let mut x57: u64 = 0; + let mut x58: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x57, &mut x58, x56, x40, x37); + let mut x59: u64 = 0; + let mut x60: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x59, &mut x60, x58, x38, x35); + let x61: u64 = ((x60 as u64) + x36); + let mut x62: u64 = 0; + let mut x63: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x62, &mut x63, 0x0, x20, x47); + let mut x64: u64 = 0; + let mut x65: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x64, &mut x65, x63, x22, x49); + let mut x66: u64 = 0; + let mut x67: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x66, &mut x67, x65, x24, x51); + let mut x68: u64 = 0; + let mut x69: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x68, &mut x69, x67, x26, x53); + let mut x70: u64 = 0; + let mut x71: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x70, &mut x71, x69, x28, x55); + let mut x72: u64 = 0; + let mut x73: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x72, &mut x73, x71, x30, x57); + let mut x74: u64 = 0; + let mut x75: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x74, &mut x75, x73, x32, x59); + let mut x76: u64 = 0; + let mut x77: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x76, &mut x77, x75, x34, x61); + let mut x78: u64 = 0; + let mut x79: u64 = 0; + fiat_p434_mulx_u64(&mut x78, &mut x79, x1, (arg2[6])); + let mut x80: u64 = 0; + let mut x81: u64 = 0; + fiat_p434_mulx_u64(&mut x80, &mut x81, x1, (arg2[5])); + let mut x82: u64 = 0; + let mut x83: u64 = 0; + fiat_p434_mulx_u64(&mut x82, &mut x83, x1, (arg2[4])); + let mut x84: u64 = 0; + let mut x85: u64 = 0; + fiat_p434_mulx_u64(&mut x84, &mut x85, x1, (arg2[3])); + let mut x86: u64 = 0; + let mut x87: u64 = 0; + fiat_p434_mulx_u64(&mut x86, &mut x87, x1, (arg2[2])); + let mut x88: u64 = 0; + let mut x89: u64 = 0; + fiat_p434_mulx_u64(&mut x88, &mut x89, x1, (arg2[1])); + let mut x90: u64 = 0; + let mut x91: u64 = 0; + fiat_p434_mulx_u64(&mut x90, &mut x91, x1, (arg2[0])); + let mut x92: u64 = 0; + let mut x93: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x92, &mut x93, 0x0, x91, x88); + let mut x94: u64 = 0; + let mut x95: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x94, &mut x95, x93, x89, x86); + let mut x96: u64 = 0; + let mut x97: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x96, &mut x97, x95, x87, x84); + let mut x98: u64 = 0; + let mut x99: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x98, &mut x99, x97, x85, x82); + let mut x100: u64 = 0; + let mut x101: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x100, &mut x101, x99, x83, x80); + let mut x102: u64 = 0; + let mut x103: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x102, &mut x103, x101, x81, x78); + let x104: u64 = ((x103 as u64) + x79); + let mut x105: u64 = 0; + let mut x106: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x105, &mut x106, 0x0, x64, x90); + let mut x107: u64 = 0; + let mut x108: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x107, &mut x108, x106, x66, x92); + let mut x109: u64 = 0; + let mut x110: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x109, &mut x110, x108, x68, x94); + let mut x111: u64 = 0; + let mut x112: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x111, &mut x112, x110, x70, x96); + let mut x113: u64 = 0; + let mut x114: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x113, &mut x114, x112, x72, x98); + let mut x115: u64 = 0; + let mut x116: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x115, &mut x116, x114, x74, x100); + let mut x117: u64 = 0; + let mut x118: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x117, &mut x118, x116, x76, x102); + let mut x119: u64 = 0; + let mut x120: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x119, &mut x120, x118, (x77 as u64), x104); + let mut x121: u64 = 0; + let mut x122: u64 = 0; + fiat_p434_mulx_u64(&mut x121, &mut x122, x105, 0x2341f27177344); + let mut x123: u64 = 0; + let mut x124: u64 = 0; + fiat_p434_mulx_u64(&mut x123, &mut x124, x105, 0x6cfc5fd681c52056); + let mut x125: u64 = 0; + let mut x126: u64 = 0; + fiat_p434_mulx_u64(&mut x125, &mut x126, x105, 0x7bc65c783158aea3); + let mut x127: u64 = 0; + let mut x128: u64 = 0; + fiat_p434_mulx_u64(&mut x127, &mut x128, x105, 0xfdc1767ae2ffffff); + let mut x129: u64 = 0; + let mut x130: u64 = 0; + fiat_p434_mulx_u64(&mut x129, &mut x130, x105, 0xffffffffffffffff); + let mut x131: u64 = 0; + let mut x132: u64 = 0; + fiat_p434_mulx_u64(&mut x131, &mut x132, x105, 0xffffffffffffffff); + let mut x133: u64 = 0; + let mut x134: u64 = 0; + fiat_p434_mulx_u64(&mut x133, &mut x134, x105, 0xffffffffffffffff); + let mut x135: u64 = 0; + let mut x136: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x135, &mut x136, 0x0, x134, x131); + let mut x137: u64 = 0; + let mut x138: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x137, &mut x138, x136, x132, x129); + let mut x139: u64 = 0; + let mut x140: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x139, &mut x140, x138, x130, x127); + let mut x141: u64 = 0; + let mut x142: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x141, &mut x142, x140, x128, x125); + let mut x143: u64 = 0; + let mut x144: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x143, &mut x144, x142, x126, x123); + let mut x145: u64 = 0; + let mut x146: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x145, &mut x146, x144, x124, x121); + let x147: u64 = ((x146 as u64) + x122); + let mut x148: u64 = 0; + let mut x149: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x148, &mut x149, 0x0, x105, x133); + let mut x150: u64 = 0; + let mut x151: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x150, &mut x151, x149, x107, x135); + let mut x152: u64 = 0; + let mut x153: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x152, &mut x153, x151, x109, x137); + let mut x154: u64 = 0; + let mut x155: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x154, &mut x155, x153, x111, x139); + let mut x156: u64 = 0; + let mut x157: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x156, &mut x157, x155, x113, x141); + let mut x158: u64 = 0; + let mut x159: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x158, &mut x159, x157, x115, x143); + let mut x160: u64 = 0; + let mut x161: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x160, &mut x161, x159, x117, x145); + let mut x162: u64 = 0; + let mut x163: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x162, &mut x163, x161, x119, x147); + let x164: u64 = ((x163 as u64) + (x120 as u64)); + let mut x165: u64 = 0; + let mut x166: u64 = 0; + fiat_p434_mulx_u64(&mut x165, &mut x166, x2, (arg2[6])); + let mut x167: u64 = 0; + let mut x168: u64 = 0; + fiat_p434_mulx_u64(&mut x167, &mut x168, x2, (arg2[5])); + let mut x169: u64 = 0; + let mut x170: u64 = 0; + fiat_p434_mulx_u64(&mut x169, &mut x170, x2, (arg2[4])); + let mut x171: u64 = 0; + let mut x172: u64 = 0; + fiat_p434_mulx_u64(&mut x171, &mut x172, x2, (arg2[3])); + let mut x173: u64 = 0; + let mut x174: u64 = 0; + fiat_p434_mulx_u64(&mut x173, &mut x174, x2, (arg2[2])); + let mut x175: u64 = 0; + let mut x176: u64 = 0; + fiat_p434_mulx_u64(&mut x175, &mut x176, x2, (arg2[1])); + let mut x177: u64 = 0; + let mut x178: u64 = 0; + fiat_p434_mulx_u64(&mut x177, &mut x178, x2, (arg2[0])); + let mut x179: u64 = 0; + let mut x180: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x179, &mut x180, 0x0, x178, x175); + let mut x181: u64 = 0; + let mut x182: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x181, &mut x182, x180, x176, x173); + let mut x183: u64 = 0; + let mut x184: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x183, &mut x184, x182, x174, x171); + let mut x185: u64 = 0; + let mut x186: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x185, &mut x186, x184, x172, x169); + let mut x187: u64 = 0; + let mut x188: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x187, &mut x188, x186, x170, x167); + let mut x189: u64 = 0; + let mut x190: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x189, &mut x190, x188, x168, x165); + let x191: u64 = ((x190 as u64) + x166); + let mut x192: u64 = 0; + let mut x193: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x192, &mut x193, 0x0, x150, x177); + let mut x194: u64 = 0; + let mut x195: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x194, &mut x195, x193, x152, x179); + let mut x196: u64 = 0; + let mut x197: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x196, &mut x197, x195, x154, x181); + let mut x198: u64 = 0; + let mut x199: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x198, &mut x199, x197, x156, x183); + let mut x200: u64 = 0; + let mut x201: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x200, &mut x201, x199, x158, x185); + let mut x202: u64 = 0; + let mut x203: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x202, &mut x203, x201, x160, x187); + let mut x204: u64 = 0; + let mut x205: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x204, &mut x205, x203, x162, x189); + let mut x206: u64 = 0; + let mut x207: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x206, &mut x207, x205, x164, x191); + let mut x208: u64 = 0; + let mut x209: u64 = 0; + fiat_p434_mulx_u64(&mut x208, &mut x209, x192, 0x2341f27177344); + let mut x210: u64 = 0; + let mut x211: u64 = 0; + fiat_p434_mulx_u64(&mut x210, &mut x211, x192, 0x6cfc5fd681c52056); + let mut x212: u64 = 0; + let mut x213: u64 = 0; + fiat_p434_mulx_u64(&mut x212, &mut x213, x192, 0x7bc65c783158aea3); + let mut x214: u64 = 0; + let mut x215: u64 = 0; + fiat_p434_mulx_u64(&mut x214, &mut x215, x192, 0xfdc1767ae2ffffff); + let mut x216: u64 = 0; + let mut x217: u64 = 0; + fiat_p434_mulx_u64(&mut x216, &mut x217, x192, 0xffffffffffffffff); + let mut x218: u64 = 0; + let mut x219: u64 = 0; + fiat_p434_mulx_u64(&mut x218, &mut x219, x192, 0xffffffffffffffff); + let mut x220: u64 = 0; + let mut x221: u64 = 0; + fiat_p434_mulx_u64(&mut x220, &mut x221, x192, 0xffffffffffffffff); + let mut x222: u64 = 0; + let mut x223: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x222, &mut x223, 0x0, x221, x218); + let mut x224: u64 = 0; + let mut x225: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x224, &mut x225, x223, x219, x216); + let mut x226: u64 = 0; + let mut x227: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x226, &mut x227, x225, x217, x214); + let mut x228: u64 = 0; + let mut x229: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x228, &mut x229, x227, x215, x212); + let mut x230: u64 = 0; + let mut x231: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x230, &mut x231, x229, x213, x210); + let mut x232: u64 = 0; + let mut x233: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x232, &mut x233, x231, x211, x208); + let x234: u64 = ((x233 as u64) + x209); + let mut x235: u64 = 0; + let mut x236: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x235, &mut x236, 0x0, x192, x220); + let mut x237: u64 = 0; + let mut x238: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x237, &mut x238, x236, x194, x222); + let mut x239: u64 = 0; + let mut x240: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x239, &mut x240, x238, x196, x224); + let mut x241: u64 = 0; + let mut x242: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x241, &mut x242, x240, x198, x226); + let mut x243: u64 = 0; + let mut x244: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x243, &mut x244, x242, x200, x228); + let mut x245: u64 = 0; + let mut x246: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x245, &mut x246, x244, x202, x230); + let mut x247: u64 = 0; + let mut x248: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x247, &mut x248, x246, x204, x232); + let mut x249: u64 = 0; + let mut x250: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x249, &mut x250, x248, x206, x234); + let x251: u64 = ((x250 as u64) + (x207 as u64)); + let mut x252: u64 = 0; + let mut x253: u64 = 0; + fiat_p434_mulx_u64(&mut x252, &mut x253, x3, (arg2[6])); + let mut x254: u64 = 0; + let mut x255: u64 = 0; + fiat_p434_mulx_u64(&mut x254, &mut x255, x3, (arg2[5])); + let mut x256: u64 = 0; + let mut x257: u64 = 0; + fiat_p434_mulx_u64(&mut x256, &mut x257, x3, (arg2[4])); + let mut x258: u64 = 0; + let mut x259: u64 = 0; + fiat_p434_mulx_u64(&mut x258, &mut x259, x3, (arg2[3])); + let mut x260: u64 = 0; + let mut x261: u64 = 0; + fiat_p434_mulx_u64(&mut x260, &mut x261, x3, (arg2[2])); + let mut x262: u64 = 0; + let mut x263: u64 = 0; + fiat_p434_mulx_u64(&mut x262, &mut x263, x3, (arg2[1])); + let mut x264: u64 = 0; + let mut x265: u64 = 0; + fiat_p434_mulx_u64(&mut x264, &mut x265, x3, (arg2[0])); + let mut x266: u64 = 0; + let mut x267: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x266, &mut x267, 0x0, x265, x262); + let mut x268: u64 = 0; + let mut x269: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x268, &mut x269, x267, x263, x260); + let mut x270: u64 = 0; + let mut x271: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x270, &mut x271, x269, x261, x258); + let mut x272: u64 = 0; + let mut x273: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x272, &mut x273, x271, x259, x256); + let mut x274: u64 = 0; + let mut x275: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x274, &mut x275, x273, x257, x254); + let mut x276: u64 = 0; + let mut x277: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x276, &mut x277, x275, x255, x252); + let x278: u64 = ((x277 as u64) + x253); + let mut x279: u64 = 0; + let mut x280: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x279, &mut x280, 0x0, x237, x264); + let mut x281: u64 = 0; + let mut x282: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x281, &mut x282, x280, x239, x266); + let mut x283: u64 = 0; + let mut x284: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x283, &mut x284, x282, x241, x268); + let mut x285: u64 = 0; + let mut x286: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x285, &mut x286, x284, x243, x270); + let mut x287: u64 = 0; + let mut x288: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x287, &mut x288, x286, x245, x272); + let mut x289: u64 = 0; + let mut x290: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x289, &mut x290, x288, x247, x274); + let mut x291: u64 = 0; + let mut x292: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x291, &mut x292, x290, x249, x276); + let mut x293: u64 = 0; + let mut x294: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x293, &mut x294, x292, x251, x278); + let mut x295: u64 = 0; + let mut x296: u64 = 0; + fiat_p434_mulx_u64(&mut x295, &mut x296, x279, 0x2341f27177344); + let mut x297: u64 = 0; + let mut x298: u64 = 0; + fiat_p434_mulx_u64(&mut x297, &mut x298, x279, 0x6cfc5fd681c52056); + let mut x299: u64 = 0; + let mut x300: u64 = 0; + fiat_p434_mulx_u64(&mut x299, &mut x300, x279, 0x7bc65c783158aea3); + let mut x301: u64 = 0; + let mut x302: u64 = 0; + fiat_p434_mulx_u64(&mut x301, &mut x302, x279, 0xfdc1767ae2ffffff); + let mut x303: u64 = 0; + let mut x304: u64 = 0; + fiat_p434_mulx_u64(&mut x303, &mut x304, x279, 0xffffffffffffffff); + let mut x305: u64 = 0; + let mut x306: u64 = 0; + fiat_p434_mulx_u64(&mut x305, &mut x306, x279, 0xffffffffffffffff); + let mut x307: u64 = 0; + let mut x308: u64 = 0; + fiat_p434_mulx_u64(&mut x307, &mut x308, x279, 0xffffffffffffffff); + let mut x309: u64 = 0; + let mut x310: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x309, &mut x310, 0x0, x308, x305); + let mut x311: u64 = 0; + let mut x312: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x311, &mut x312, x310, x306, x303); + let mut x313: u64 = 0; + let mut x314: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x313, &mut x314, x312, x304, x301); + let mut x315: u64 = 0; + let mut x316: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x315, &mut x316, x314, x302, x299); + let mut x317: u64 = 0; + let mut x318: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x317, &mut x318, x316, x300, x297); + let mut x319: u64 = 0; + let mut x320: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x319, &mut x320, x318, x298, x295); + let x321: u64 = ((x320 as u64) + x296); + let mut x322: u64 = 0; + let mut x323: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x322, &mut x323, 0x0, x279, x307); + let mut x324: u64 = 0; + let mut x325: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x324, &mut x325, x323, x281, x309); + let mut x326: u64 = 0; + let mut x327: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x326, &mut x327, x325, x283, x311); + let mut x328: u64 = 0; + let mut x329: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x328, &mut x329, x327, x285, x313); + let mut x330: u64 = 0; + let mut x331: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x330, &mut x331, x329, x287, x315); + let mut x332: u64 = 0; + let mut x333: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x332, &mut x333, x331, x289, x317); + let mut x334: u64 = 0; + let mut x335: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x334, &mut x335, x333, x291, x319); + let mut x336: u64 = 0; + let mut x337: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x336, &mut x337, x335, x293, x321); + let x338: u64 = ((x337 as u64) + (x294 as u64)); + let mut x339: u64 = 0; + let mut x340: u64 = 0; + fiat_p434_mulx_u64(&mut x339, &mut x340, x4, (arg2[6])); + let mut x341: u64 = 0; + let mut x342: u64 = 0; + fiat_p434_mulx_u64(&mut x341, &mut x342, x4, (arg2[5])); + let mut x343: u64 = 0; + let mut x344: u64 = 0; + fiat_p434_mulx_u64(&mut x343, &mut x344, x4, (arg2[4])); + let mut x345: u64 = 0; + let mut x346: u64 = 0; + fiat_p434_mulx_u64(&mut x345, &mut x346, x4, (arg2[3])); + let mut x347: u64 = 0; + let mut x348: u64 = 0; + fiat_p434_mulx_u64(&mut x347, &mut x348, x4, (arg2[2])); + let mut x349: u64 = 0; + let mut x350: u64 = 0; + fiat_p434_mulx_u64(&mut x349, &mut x350, x4, (arg2[1])); + let mut x351: u64 = 0; + let mut x352: u64 = 0; + fiat_p434_mulx_u64(&mut x351, &mut x352, x4, (arg2[0])); + let mut x353: u64 = 0; + let mut x354: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x353, &mut x354, 0x0, x352, x349); + let mut x355: u64 = 0; + let mut x356: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x355, &mut x356, x354, x350, x347); + let mut x357: u64 = 0; + let mut x358: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x357, &mut x358, x356, x348, x345); + let mut x359: u64 = 0; + let mut x360: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x359, &mut x360, x358, x346, x343); + let mut x361: u64 = 0; + let mut x362: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x361, &mut x362, x360, x344, x341); + let mut x363: u64 = 0; + let mut x364: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x363, &mut x364, x362, x342, x339); + let x365: u64 = ((x364 as u64) + x340); + let mut x366: u64 = 0; + let mut x367: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x366, &mut x367, 0x0, x324, x351); + let mut x368: u64 = 0; + let mut x369: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x368, &mut x369, x367, x326, x353); + let mut x370: u64 = 0; + let mut x371: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x370, &mut x371, x369, x328, x355); + let mut x372: u64 = 0; + let mut x373: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x372, &mut x373, x371, x330, x357); + let mut x374: u64 = 0; + let mut x375: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x374, &mut x375, x373, x332, x359); + let mut x376: u64 = 0; + let mut x377: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x376, &mut x377, x375, x334, x361); + let mut x378: u64 = 0; + let mut x379: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x378, &mut x379, x377, x336, x363); + let mut x380: u64 = 0; + let mut x381: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x380, &mut x381, x379, x338, x365); + let mut x382: u64 = 0; + let mut x383: u64 = 0; + fiat_p434_mulx_u64(&mut x382, &mut x383, x366, 0x2341f27177344); + let mut x384: u64 = 0; + let mut x385: u64 = 0; + fiat_p434_mulx_u64(&mut x384, &mut x385, x366, 0x6cfc5fd681c52056); + let mut x386: u64 = 0; + let mut x387: u64 = 0; + fiat_p434_mulx_u64(&mut x386, &mut x387, x366, 0x7bc65c783158aea3); + let mut x388: u64 = 0; + let mut x389: u64 = 0; + fiat_p434_mulx_u64(&mut x388, &mut x389, x366, 0xfdc1767ae2ffffff); + let mut x390: u64 = 0; + let mut x391: u64 = 0; + fiat_p434_mulx_u64(&mut x390, &mut x391, x366, 0xffffffffffffffff); + let mut x392: u64 = 0; + let mut x393: u64 = 0; + fiat_p434_mulx_u64(&mut x392, &mut x393, x366, 0xffffffffffffffff); + let mut x394: u64 = 0; + let mut x395: u64 = 0; + fiat_p434_mulx_u64(&mut x394, &mut x395, x366, 0xffffffffffffffff); + let mut x396: u64 = 0; + let mut x397: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x396, &mut x397, 0x0, x395, x392); + let mut x398: u64 = 0; + let mut x399: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x398, &mut x399, x397, x393, x390); + let mut x400: u64 = 0; + let mut x401: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x400, &mut x401, x399, x391, x388); + let mut x402: u64 = 0; + let mut x403: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x402, &mut x403, x401, x389, x386); + let mut x404: u64 = 0; + let mut x405: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x404, &mut x405, x403, x387, x384); + let mut x406: u64 = 0; + let mut x407: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x406, &mut x407, x405, x385, x382); + let x408: u64 = ((x407 as u64) + x383); + let mut x409: u64 = 0; + let mut x410: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x409, &mut x410, 0x0, x366, x394); + let mut x411: u64 = 0; + let mut x412: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x411, &mut x412, x410, x368, x396); + let mut x413: u64 = 0; + let mut x414: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x413, &mut x414, x412, x370, x398); + let mut x415: u64 = 0; + let mut x416: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x415, &mut x416, x414, x372, x400); + let mut x417: u64 = 0; + let mut x418: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x417, &mut x418, x416, x374, x402); + let mut x419: u64 = 0; + let mut x420: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x419, &mut x420, x418, x376, x404); + let mut x421: u64 = 0; + let mut x422: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x421, &mut x422, x420, x378, x406); + let mut x423: u64 = 0; + let mut x424: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x423, &mut x424, x422, x380, x408); + let x425: u64 = ((x424 as u64) + (x381 as u64)); + let mut x426: u64 = 0; + let mut x427: u64 = 0; + fiat_p434_mulx_u64(&mut x426, &mut x427, x5, (arg2[6])); + let mut x428: u64 = 0; + let mut x429: u64 = 0; + fiat_p434_mulx_u64(&mut x428, &mut x429, x5, (arg2[5])); + let mut x430: u64 = 0; + let mut x431: u64 = 0; + fiat_p434_mulx_u64(&mut x430, &mut x431, x5, (arg2[4])); + let mut x432: u64 = 0; + let mut x433: u64 = 0; + fiat_p434_mulx_u64(&mut x432, &mut x433, x5, (arg2[3])); + let mut x434: u64 = 0; + let mut x435: u64 = 0; + fiat_p434_mulx_u64(&mut x434, &mut x435, x5, (arg2[2])); + let mut x436: u64 = 0; + let mut x437: u64 = 0; + fiat_p434_mulx_u64(&mut x436, &mut x437, x5, (arg2[1])); + let mut x438: u64 = 0; + let mut x439: u64 = 0; + fiat_p434_mulx_u64(&mut x438, &mut x439, x5, (arg2[0])); + let mut x440: u64 = 0; + let mut x441: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x440, &mut x441, 0x0, x439, x436); + let mut x442: u64 = 0; + let mut x443: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x442, &mut x443, x441, x437, x434); + let mut x444: u64 = 0; + let mut x445: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x444, &mut x445, x443, x435, x432); + let mut x446: u64 = 0; + let mut x447: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x446, &mut x447, x445, x433, x430); + let mut x448: u64 = 0; + let mut x449: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x448, &mut x449, x447, x431, x428); + let mut x450: u64 = 0; + let mut x451: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x450, &mut x451, x449, x429, x426); + let x452: u64 = ((x451 as u64) + x427); + let mut x453: u64 = 0; + let mut x454: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x453, &mut x454, 0x0, x411, x438); + let mut x455: u64 = 0; + let mut x456: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x455, &mut x456, x454, x413, x440); + let mut x457: u64 = 0; + let mut x458: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x457, &mut x458, x456, x415, x442); + let mut x459: u64 = 0; + let mut x460: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x459, &mut x460, x458, x417, x444); + let mut x461: u64 = 0; + let mut x462: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x461, &mut x462, x460, x419, x446); + let mut x463: u64 = 0; + let mut x464: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x463, &mut x464, x462, x421, x448); + let mut x465: u64 = 0; + let mut x466: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x465, &mut x466, x464, x423, x450); + let mut x467: u64 = 0; + let mut x468: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x467, &mut x468, x466, x425, x452); + let mut x469: u64 = 0; + let mut x470: u64 = 0; + fiat_p434_mulx_u64(&mut x469, &mut x470, x453, 0x2341f27177344); + let mut x471: u64 = 0; + let mut x472: u64 = 0; + fiat_p434_mulx_u64(&mut x471, &mut x472, x453, 0x6cfc5fd681c52056); + let mut x473: u64 = 0; + let mut x474: u64 = 0; + fiat_p434_mulx_u64(&mut x473, &mut x474, x453, 0x7bc65c783158aea3); + let mut x475: u64 = 0; + let mut x476: u64 = 0; + fiat_p434_mulx_u64(&mut x475, &mut x476, x453, 0xfdc1767ae2ffffff); + let mut x477: u64 = 0; + let mut x478: u64 = 0; + fiat_p434_mulx_u64(&mut x477, &mut x478, x453, 0xffffffffffffffff); + let mut x479: u64 = 0; + let mut x480: u64 = 0; + fiat_p434_mulx_u64(&mut x479, &mut x480, x453, 0xffffffffffffffff); + let mut x481: u64 = 0; + let mut x482: u64 = 0; + fiat_p434_mulx_u64(&mut x481, &mut x482, x453, 0xffffffffffffffff); + let mut x483: u64 = 0; + let mut x484: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x483, &mut x484, 0x0, x482, x479); + let mut x485: u64 = 0; + let mut x486: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x485, &mut x486, x484, x480, x477); + let mut x487: u64 = 0; + let mut x488: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x487, &mut x488, x486, x478, x475); + let mut x489: u64 = 0; + let mut x490: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x489, &mut x490, x488, x476, x473); + let mut x491: u64 = 0; + let mut x492: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x491, &mut x492, x490, x474, x471); + let mut x493: u64 = 0; + let mut x494: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x493, &mut x494, x492, x472, x469); + let x495: u64 = ((x494 as u64) + x470); + let mut x496: u64 = 0; + let mut x497: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x496, &mut x497, 0x0, x453, x481); + let mut x498: u64 = 0; + let mut x499: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x498, &mut x499, x497, x455, x483); + let mut x500: u64 = 0; + let mut x501: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x500, &mut x501, x499, x457, x485); + let mut x502: u64 = 0; + let mut x503: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x502, &mut x503, x501, x459, x487); + let mut x504: u64 = 0; + let mut x505: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x504, &mut x505, x503, x461, x489); + let mut x506: u64 = 0; + let mut x507: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x506, &mut x507, x505, x463, x491); + let mut x508: u64 = 0; + let mut x509: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x508, &mut x509, x507, x465, x493); + let mut x510: u64 = 0; + let mut x511: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x510, &mut x511, x509, x467, x495); + let x512: u64 = ((x511 as u64) + (x468 as u64)); + let mut x513: u64 = 0; + let mut x514: u64 = 0; + fiat_p434_mulx_u64(&mut x513, &mut x514, x6, (arg2[6])); + let mut x515: u64 = 0; + let mut x516: u64 = 0; + fiat_p434_mulx_u64(&mut x515, &mut x516, x6, (arg2[5])); + let mut x517: u64 = 0; + let mut x518: u64 = 0; + fiat_p434_mulx_u64(&mut x517, &mut x518, x6, (arg2[4])); + let mut x519: u64 = 0; + let mut x520: u64 = 0; + fiat_p434_mulx_u64(&mut x519, &mut x520, x6, (arg2[3])); + let mut x521: u64 = 0; + let mut x522: u64 = 0; + fiat_p434_mulx_u64(&mut x521, &mut x522, x6, (arg2[2])); + let mut x523: u64 = 0; + let mut x524: u64 = 0; + fiat_p434_mulx_u64(&mut x523, &mut x524, x6, (arg2[1])); + let mut x525: u64 = 0; + let mut x526: u64 = 0; + fiat_p434_mulx_u64(&mut x525, &mut x526, x6, (arg2[0])); + let mut x527: u64 = 0; + let mut x528: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x527, &mut x528, 0x0, x526, x523); + let mut x529: u64 = 0; + let mut x530: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x529, &mut x530, x528, x524, x521); + let mut x531: u64 = 0; + let mut x532: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x531, &mut x532, x530, x522, x519); + let mut x533: u64 = 0; + let mut x534: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x533, &mut x534, x532, x520, x517); + let mut x535: u64 = 0; + let mut x536: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x535, &mut x536, x534, x518, x515); + let mut x537: u64 = 0; + let mut x538: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x537, &mut x538, x536, x516, x513); + let x539: u64 = ((x538 as u64) + x514); + let mut x540: u64 = 0; + let mut x541: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x540, &mut x541, 0x0, x498, x525); + let mut x542: u64 = 0; + let mut x543: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x542, &mut x543, x541, x500, x527); + let mut x544: u64 = 0; + let mut x545: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x544, &mut x545, x543, x502, x529); + let mut x546: u64 = 0; + let mut x547: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x546, &mut x547, x545, x504, x531); + let mut x548: u64 = 0; + let mut x549: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x548, &mut x549, x547, x506, x533); + let mut x550: u64 = 0; + let mut x551: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x550, &mut x551, x549, x508, x535); + let mut x552: u64 = 0; + let mut x553: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x552, &mut x553, x551, x510, x537); + let mut x554: u64 = 0; + let mut x555: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x554, &mut x555, x553, x512, x539); + let mut x556: u64 = 0; + let mut x557: u64 = 0; + fiat_p434_mulx_u64(&mut x556, &mut x557, x540, 0x2341f27177344); + let mut x558: u64 = 0; + let mut x559: u64 = 0; + fiat_p434_mulx_u64(&mut x558, &mut x559, x540, 0x6cfc5fd681c52056); + let mut x560: u64 = 0; + let mut x561: u64 = 0; + fiat_p434_mulx_u64(&mut x560, &mut x561, x540, 0x7bc65c783158aea3); + let mut x562: u64 = 0; + let mut x563: u64 = 0; + fiat_p434_mulx_u64(&mut x562, &mut x563, x540, 0xfdc1767ae2ffffff); + let mut x564: u64 = 0; + let mut x565: u64 = 0; + fiat_p434_mulx_u64(&mut x564, &mut x565, x540, 0xffffffffffffffff); + let mut x566: u64 = 0; + let mut x567: u64 = 0; + fiat_p434_mulx_u64(&mut x566, &mut x567, x540, 0xffffffffffffffff); + let mut x568: u64 = 0; + let mut x569: u64 = 0; + fiat_p434_mulx_u64(&mut x568, &mut x569, x540, 0xffffffffffffffff); + let mut x570: u64 = 0; + let mut x571: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x570, &mut x571, 0x0, x569, x566); + let mut x572: u64 = 0; + let mut x573: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x572, &mut x573, x571, x567, x564); + let mut x574: u64 = 0; + let mut x575: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x574, &mut x575, x573, x565, x562); + let mut x576: u64 = 0; + let mut x577: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x576, &mut x577, x575, x563, x560); + let mut x578: u64 = 0; + let mut x579: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x578, &mut x579, x577, x561, x558); + let mut x580: u64 = 0; + let mut x581: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x580, &mut x581, x579, x559, x556); + let x582: u64 = ((x581 as u64) + x557); + let mut x583: u64 = 0; + let mut x584: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x583, &mut x584, 0x0, x540, x568); + let mut x585: u64 = 0; + let mut x586: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x585, &mut x586, x584, x542, x570); + let mut x587: u64 = 0; + let mut x588: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x587, &mut x588, x586, x544, x572); + let mut x589: u64 = 0; + let mut x590: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x589, &mut x590, x588, x546, x574); + let mut x591: u64 = 0; + let mut x592: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x591, &mut x592, x590, x548, x576); + let mut x593: u64 = 0; + let mut x594: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x593, &mut x594, x592, x550, x578); + let mut x595: u64 = 0; + let mut x596: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x595, &mut x596, x594, x552, x580); + let mut x597: u64 = 0; + let mut x598: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x597, &mut x598, x596, x554, x582); + let x599: u64 = ((x598 as u64) + (x555 as u64)); + let mut x600: u64 = 0; + let mut x601: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x600, &mut x601, 0x0, x585, 0xffffffffffffffff); + let mut x602: u64 = 0; + let mut x603: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x602, &mut x603, x601, x587, 0xffffffffffffffff); + let mut x604: u64 = 0; + let mut x605: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x604, &mut x605, x603, x589, 0xffffffffffffffff); + let mut x606: u64 = 0; + let mut x607: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x606, &mut x607, x605, x591, 0xfdc1767ae2ffffff); + let mut x608: u64 = 0; + let mut x609: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x608, &mut x609, x607, x593, 0x7bc65c783158aea3); + let mut x610: u64 = 0; + let mut x611: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x610, &mut x611, x609, x595, 0x6cfc5fd681c52056); + let mut x612: u64 = 0; + let mut x613: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x612, &mut x613, x611, x597, 0x2341f27177344); + let mut x614: u64 = 0; + let mut x615: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x614, &mut x615, x613, x599, (0x0 as u64)); + let mut x616: u64 = 0; + fiat_p434_cmovznz_u64(&mut x616, x615, x600, x585); + let mut x617: u64 = 0; + fiat_p434_cmovznz_u64(&mut x617, x615, x602, x587); + let mut x618: u64 = 0; + fiat_p434_cmovznz_u64(&mut x618, x615, x604, x589); + let mut x619: u64 = 0; + fiat_p434_cmovznz_u64(&mut x619, x615, x606, x591); + let mut x620: u64 = 0; + fiat_p434_cmovznz_u64(&mut x620, x615, x608, x593); + let mut x621: u64 = 0; + fiat_p434_cmovznz_u64(&mut x621, x615, x610, x595); + let mut x622: u64 = 0; + fiat_p434_cmovznz_u64(&mut x622, x615, x612, x597); + out1[0] = x616; + out1[1] = x617; + out1[2] = x618; + out1[3] = x619; + out1[4] = x620; + out1[5] = x621; + out1[6] = x622; +} + +/// The function fiat_p434_square squares a field element in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg1)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p434_square(out1: &mut fiat_p434_montgomery_domain_field_element, arg1: &fiat_p434_montgomery_domain_field_element) -> () { + let x1: u64 = (arg1[1]); + let x2: u64 = (arg1[2]); + let x3: u64 = (arg1[3]); + let x4: u64 = (arg1[4]); + let x5: u64 = (arg1[5]); + let x6: u64 = (arg1[6]); + let x7: u64 = (arg1[0]); + let mut x8: u64 = 0; + let mut x9: u64 = 0; + fiat_p434_mulx_u64(&mut x8, &mut x9, x7, (arg1[6])); + let mut x10: u64 = 0; + let mut x11: u64 = 0; + fiat_p434_mulx_u64(&mut x10, &mut x11, x7, (arg1[5])); + let mut x12: u64 = 0; + let mut x13: u64 = 0; + fiat_p434_mulx_u64(&mut x12, &mut x13, x7, (arg1[4])); + let mut x14: u64 = 0; + let mut x15: u64 = 0; + fiat_p434_mulx_u64(&mut x14, &mut x15, x7, (arg1[3])); + let mut x16: u64 = 0; + let mut x17: u64 = 0; + fiat_p434_mulx_u64(&mut x16, &mut x17, x7, (arg1[2])); + let mut x18: u64 = 0; + let mut x19: u64 = 0; + fiat_p434_mulx_u64(&mut x18, &mut x19, x7, (arg1[1])); + let mut x20: u64 = 0; + let mut x21: u64 = 0; + fiat_p434_mulx_u64(&mut x20, &mut x21, x7, (arg1[0])); + let mut x22: u64 = 0; + let mut x23: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x22, &mut x23, 0x0, x21, x18); + let mut x24: u64 = 0; + let mut x25: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x24, &mut x25, x23, x19, x16); + let mut x26: u64 = 0; + let mut x27: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x26, &mut x27, x25, x17, x14); + let mut x28: u64 = 0; + let mut x29: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x28, &mut x29, x27, x15, x12); + let mut x30: u64 = 0; + let mut x31: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x30, &mut x31, x29, x13, x10); + let mut x32: u64 = 0; + let mut x33: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x32, &mut x33, x31, x11, x8); + let x34: u64 = ((x33 as u64) + x9); + let mut x35: u64 = 0; + let mut x36: u64 = 0; + fiat_p434_mulx_u64(&mut x35, &mut x36, x20, 0x2341f27177344); + let mut x37: u64 = 0; + let mut x38: u64 = 0; + fiat_p434_mulx_u64(&mut x37, &mut x38, x20, 0x6cfc5fd681c52056); + let mut x39: u64 = 0; + let mut x40: u64 = 0; + fiat_p434_mulx_u64(&mut x39, &mut x40, x20, 0x7bc65c783158aea3); + let mut x41: u64 = 0; + let mut x42: u64 = 0; + fiat_p434_mulx_u64(&mut x41, &mut x42, x20, 0xfdc1767ae2ffffff); + let mut x43: u64 = 0; + let mut x44: u64 = 0; + fiat_p434_mulx_u64(&mut x43, &mut x44, x20, 0xffffffffffffffff); + let mut x45: u64 = 0; + let mut x46: u64 = 0; + fiat_p434_mulx_u64(&mut x45, &mut x46, x20, 0xffffffffffffffff); + let mut x47: u64 = 0; + let mut x48: u64 = 0; + fiat_p434_mulx_u64(&mut x47, &mut x48, x20, 0xffffffffffffffff); + let mut x49: u64 = 0; + let mut x50: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x49, &mut x50, 0x0, x48, x45); + let mut x51: u64 = 0; + let mut x52: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x51, &mut x52, x50, x46, x43); + let mut x53: u64 = 0; + let mut x54: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x53, &mut x54, x52, x44, x41); + let mut x55: u64 = 0; + let mut x56: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x55, &mut x56, x54, x42, x39); + let mut x57: u64 = 0; + let mut x58: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x57, &mut x58, x56, x40, x37); + let mut x59: u64 = 0; + let mut x60: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x59, &mut x60, x58, x38, x35); + let x61: u64 = ((x60 as u64) + x36); + let mut x62: u64 = 0; + let mut x63: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x62, &mut x63, 0x0, x20, x47); + let mut x64: u64 = 0; + let mut x65: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x64, &mut x65, x63, x22, x49); + let mut x66: u64 = 0; + let mut x67: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x66, &mut x67, x65, x24, x51); + let mut x68: u64 = 0; + let mut x69: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x68, &mut x69, x67, x26, x53); + let mut x70: u64 = 0; + let mut x71: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x70, &mut x71, x69, x28, x55); + let mut x72: u64 = 0; + let mut x73: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x72, &mut x73, x71, x30, x57); + let mut x74: u64 = 0; + let mut x75: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x74, &mut x75, x73, x32, x59); + let mut x76: u64 = 0; + let mut x77: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x76, &mut x77, x75, x34, x61); + let mut x78: u64 = 0; + let mut x79: u64 = 0; + fiat_p434_mulx_u64(&mut x78, &mut x79, x1, (arg1[6])); + let mut x80: u64 = 0; + let mut x81: u64 = 0; + fiat_p434_mulx_u64(&mut x80, &mut x81, x1, (arg1[5])); + let mut x82: u64 = 0; + let mut x83: u64 = 0; + fiat_p434_mulx_u64(&mut x82, &mut x83, x1, (arg1[4])); + let mut x84: u64 = 0; + let mut x85: u64 = 0; + fiat_p434_mulx_u64(&mut x84, &mut x85, x1, (arg1[3])); + let mut x86: u64 = 0; + let mut x87: u64 = 0; + fiat_p434_mulx_u64(&mut x86, &mut x87, x1, (arg1[2])); + let mut x88: u64 = 0; + let mut x89: u64 = 0; + fiat_p434_mulx_u64(&mut x88, &mut x89, x1, (arg1[1])); + let mut x90: u64 = 0; + let mut x91: u64 = 0; + fiat_p434_mulx_u64(&mut x90, &mut x91, x1, (arg1[0])); + let mut x92: u64 = 0; + let mut x93: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x92, &mut x93, 0x0, x91, x88); + let mut x94: u64 = 0; + let mut x95: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x94, &mut x95, x93, x89, x86); + let mut x96: u64 = 0; + let mut x97: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x96, &mut x97, x95, x87, x84); + let mut x98: u64 = 0; + let mut x99: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x98, &mut x99, x97, x85, x82); + let mut x100: u64 = 0; + let mut x101: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x100, &mut x101, x99, x83, x80); + let mut x102: u64 = 0; + let mut x103: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x102, &mut x103, x101, x81, x78); + let x104: u64 = ((x103 as u64) + x79); + let mut x105: u64 = 0; + let mut x106: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x105, &mut x106, 0x0, x64, x90); + let mut x107: u64 = 0; + let mut x108: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x107, &mut x108, x106, x66, x92); + let mut x109: u64 = 0; + let mut x110: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x109, &mut x110, x108, x68, x94); + let mut x111: u64 = 0; + let mut x112: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x111, &mut x112, x110, x70, x96); + let mut x113: u64 = 0; + let mut x114: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x113, &mut x114, x112, x72, x98); + let mut x115: u64 = 0; + let mut x116: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x115, &mut x116, x114, x74, x100); + let mut x117: u64 = 0; + let mut x118: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x117, &mut x118, x116, x76, x102); + let mut x119: u64 = 0; + let mut x120: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x119, &mut x120, x118, (x77 as u64), x104); + let mut x121: u64 = 0; + let mut x122: u64 = 0; + fiat_p434_mulx_u64(&mut x121, &mut x122, x105, 0x2341f27177344); + let mut x123: u64 = 0; + let mut x124: u64 = 0; + fiat_p434_mulx_u64(&mut x123, &mut x124, x105, 0x6cfc5fd681c52056); + let mut x125: u64 = 0; + let mut x126: u64 = 0; + fiat_p434_mulx_u64(&mut x125, &mut x126, x105, 0x7bc65c783158aea3); + let mut x127: u64 = 0; + let mut x128: u64 = 0; + fiat_p434_mulx_u64(&mut x127, &mut x128, x105, 0xfdc1767ae2ffffff); + let mut x129: u64 = 0; + let mut x130: u64 = 0; + fiat_p434_mulx_u64(&mut x129, &mut x130, x105, 0xffffffffffffffff); + let mut x131: u64 = 0; + let mut x132: u64 = 0; + fiat_p434_mulx_u64(&mut x131, &mut x132, x105, 0xffffffffffffffff); + let mut x133: u64 = 0; + let mut x134: u64 = 0; + fiat_p434_mulx_u64(&mut x133, &mut x134, x105, 0xffffffffffffffff); + let mut x135: u64 = 0; + let mut x136: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x135, &mut x136, 0x0, x134, x131); + let mut x137: u64 = 0; + let mut x138: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x137, &mut x138, x136, x132, x129); + let mut x139: u64 = 0; + let mut x140: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x139, &mut x140, x138, x130, x127); + let mut x141: u64 = 0; + let mut x142: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x141, &mut x142, x140, x128, x125); + let mut x143: u64 = 0; + let mut x144: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x143, &mut x144, x142, x126, x123); + let mut x145: u64 = 0; + let mut x146: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x145, &mut x146, x144, x124, x121); + let x147: u64 = ((x146 as u64) + x122); + let mut x148: u64 = 0; + let mut x149: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x148, &mut x149, 0x0, x105, x133); + let mut x150: u64 = 0; + let mut x151: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x150, &mut x151, x149, x107, x135); + let mut x152: u64 = 0; + let mut x153: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x152, &mut x153, x151, x109, x137); + let mut x154: u64 = 0; + let mut x155: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x154, &mut x155, x153, x111, x139); + let mut x156: u64 = 0; + let mut x157: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x156, &mut x157, x155, x113, x141); + let mut x158: u64 = 0; + let mut x159: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x158, &mut x159, x157, x115, x143); + let mut x160: u64 = 0; + let mut x161: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x160, &mut x161, x159, x117, x145); + let mut x162: u64 = 0; + let mut x163: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x162, &mut x163, x161, x119, x147); + let x164: u64 = ((x163 as u64) + (x120 as u64)); + let mut x165: u64 = 0; + let mut x166: u64 = 0; + fiat_p434_mulx_u64(&mut x165, &mut x166, x2, (arg1[6])); + let mut x167: u64 = 0; + let mut x168: u64 = 0; + fiat_p434_mulx_u64(&mut x167, &mut x168, x2, (arg1[5])); + let mut x169: u64 = 0; + let mut x170: u64 = 0; + fiat_p434_mulx_u64(&mut x169, &mut x170, x2, (arg1[4])); + let mut x171: u64 = 0; + let mut x172: u64 = 0; + fiat_p434_mulx_u64(&mut x171, &mut x172, x2, (arg1[3])); + let mut x173: u64 = 0; + let mut x174: u64 = 0; + fiat_p434_mulx_u64(&mut x173, &mut x174, x2, (arg1[2])); + let mut x175: u64 = 0; + let mut x176: u64 = 0; + fiat_p434_mulx_u64(&mut x175, &mut x176, x2, (arg1[1])); + let mut x177: u64 = 0; + let mut x178: u64 = 0; + fiat_p434_mulx_u64(&mut x177, &mut x178, x2, (arg1[0])); + let mut x179: u64 = 0; + let mut x180: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x179, &mut x180, 0x0, x178, x175); + let mut x181: u64 = 0; + let mut x182: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x181, &mut x182, x180, x176, x173); + let mut x183: u64 = 0; + let mut x184: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x183, &mut x184, x182, x174, x171); + let mut x185: u64 = 0; + let mut x186: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x185, &mut x186, x184, x172, x169); + let mut x187: u64 = 0; + let mut x188: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x187, &mut x188, x186, x170, x167); + let mut x189: u64 = 0; + let mut x190: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x189, &mut x190, x188, x168, x165); + let x191: u64 = ((x190 as u64) + x166); + let mut x192: u64 = 0; + let mut x193: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x192, &mut x193, 0x0, x150, x177); + let mut x194: u64 = 0; + let mut x195: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x194, &mut x195, x193, x152, x179); + let mut x196: u64 = 0; + let mut x197: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x196, &mut x197, x195, x154, x181); + let mut x198: u64 = 0; + let mut x199: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x198, &mut x199, x197, x156, x183); + let mut x200: u64 = 0; + let mut x201: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x200, &mut x201, x199, x158, x185); + let mut x202: u64 = 0; + let mut x203: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x202, &mut x203, x201, x160, x187); + let mut x204: u64 = 0; + let mut x205: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x204, &mut x205, x203, x162, x189); + let mut x206: u64 = 0; + let mut x207: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x206, &mut x207, x205, x164, x191); + let mut x208: u64 = 0; + let mut x209: u64 = 0; + fiat_p434_mulx_u64(&mut x208, &mut x209, x192, 0x2341f27177344); + let mut x210: u64 = 0; + let mut x211: u64 = 0; + fiat_p434_mulx_u64(&mut x210, &mut x211, x192, 0x6cfc5fd681c52056); + let mut x212: u64 = 0; + let mut x213: u64 = 0; + fiat_p434_mulx_u64(&mut x212, &mut x213, x192, 0x7bc65c783158aea3); + let mut x214: u64 = 0; + let mut x215: u64 = 0; + fiat_p434_mulx_u64(&mut x214, &mut x215, x192, 0xfdc1767ae2ffffff); + let mut x216: u64 = 0; + let mut x217: u64 = 0; + fiat_p434_mulx_u64(&mut x216, &mut x217, x192, 0xffffffffffffffff); + let mut x218: u64 = 0; + let mut x219: u64 = 0; + fiat_p434_mulx_u64(&mut x218, &mut x219, x192, 0xffffffffffffffff); + let mut x220: u64 = 0; + let mut x221: u64 = 0; + fiat_p434_mulx_u64(&mut x220, &mut x221, x192, 0xffffffffffffffff); + let mut x222: u64 = 0; + let mut x223: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x222, &mut x223, 0x0, x221, x218); + let mut x224: u64 = 0; + let mut x225: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x224, &mut x225, x223, x219, x216); + let mut x226: u64 = 0; + let mut x227: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x226, &mut x227, x225, x217, x214); + let mut x228: u64 = 0; + let mut x229: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x228, &mut x229, x227, x215, x212); + let mut x230: u64 = 0; + let mut x231: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x230, &mut x231, x229, x213, x210); + let mut x232: u64 = 0; + let mut x233: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x232, &mut x233, x231, x211, x208); + let x234: u64 = ((x233 as u64) + x209); + let mut x235: u64 = 0; + let mut x236: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x235, &mut x236, 0x0, x192, x220); + let mut x237: u64 = 0; + let mut x238: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x237, &mut x238, x236, x194, x222); + let mut x239: u64 = 0; + let mut x240: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x239, &mut x240, x238, x196, x224); + let mut x241: u64 = 0; + let mut x242: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x241, &mut x242, x240, x198, x226); + let mut x243: u64 = 0; + let mut x244: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x243, &mut x244, x242, x200, x228); + let mut x245: u64 = 0; + let mut x246: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x245, &mut x246, x244, x202, x230); + let mut x247: u64 = 0; + let mut x248: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x247, &mut x248, x246, x204, x232); + let mut x249: u64 = 0; + let mut x250: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x249, &mut x250, x248, x206, x234); + let x251: u64 = ((x250 as u64) + (x207 as u64)); + let mut x252: u64 = 0; + let mut x253: u64 = 0; + fiat_p434_mulx_u64(&mut x252, &mut x253, x3, (arg1[6])); + let mut x254: u64 = 0; + let mut x255: u64 = 0; + fiat_p434_mulx_u64(&mut x254, &mut x255, x3, (arg1[5])); + let mut x256: u64 = 0; + let mut x257: u64 = 0; + fiat_p434_mulx_u64(&mut x256, &mut x257, x3, (arg1[4])); + let mut x258: u64 = 0; + let mut x259: u64 = 0; + fiat_p434_mulx_u64(&mut x258, &mut x259, x3, (arg1[3])); + let mut x260: u64 = 0; + let mut x261: u64 = 0; + fiat_p434_mulx_u64(&mut x260, &mut x261, x3, (arg1[2])); + let mut x262: u64 = 0; + let mut x263: u64 = 0; + fiat_p434_mulx_u64(&mut x262, &mut x263, x3, (arg1[1])); + let mut x264: u64 = 0; + let mut x265: u64 = 0; + fiat_p434_mulx_u64(&mut x264, &mut x265, x3, (arg1[0])); + let mut x266: u64 = 0; + let mut x267: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x266, &mut x267, 0x0, x265, x262); + let mut x268: u64 = 0; + let mut x269: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x268, &mut x269, x267, x263, x260); + let mut x270: u64 = 0; + let mut x271: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x270, &mut x271, x269, x261, x258); + let mut x272: u64 = 0; + let mut x273: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x272, &mut x273, x271, x259, x256); + let mut x274: u64 = 0; + let mut x275: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x274, &mut x275, x273, x257, x254); + let mut x276: u64 = 0; + let mut x277: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x276, &mut x277, x275, x255, x252); + let x278: u64 = ((x277 as u64) + x253); + let mut x279: u64 = 0; + let mut x280: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x279, &mut x280, 0x0, x237, x264); + let mut x281: u64 = 0; + let mut x282: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x281, &mut x282, x280, x239, x266); + let mut x283: u64 = 0; + let mut x284: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x283, &mut x284, x282, x241, x268); + let mut x285: u64 = 0; + let mut x286: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x285, &mut x286, x284, x243, x270); + let mut x287: u64 = 0; + let mut x288: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x287, &mut x288, x286, x245, x272); + let mut x289: u64 = 0; + let mut x290: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x289, &mut x290, x288, x247, x274); + let mut x291: u64 = 0; + let mut x292: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x291, &mut x292, x290, x249, x276); + let mut x293: u64 = 0; + let mut x294: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x293, &mut x294, x292, x251, x278); + let mut x295: u64 = 0; + let mut x296: u64 = 0; + fiat_p434_mulx_u64(&mut x295, &mut x296, x279, 0x2341f27177344); + let mut x297: u64 = 0; + let mut x298: u64 = 0; + fiat_p434_mulx_u64(&mut x297, &mut x298, x279, 0x6cfc5fd681c52056); + let mut x299: u64 = 0; + let mut x300: u64 = 0; + fiat_p434_mulx_u64(&mut x299, &mut x300, x279, 0x7bc65c783158aea3); + let mut x301: u64 = 0; + let mut x302: u64 = 0; + fiat_p434_mulx_u64(&mut x301, &mut x302, x279, 0xfdc1767ae2ffffff); + let mut x303: u64 = 0; + let mut x304: u64 = 0; + fiat_p434_mulx_u64(&mut x303, &mut x304, x279, 0xffffffffffffffff); + let mut x305: u64 = 0; + let mut x306: u64 = 0; + fiat_p434_mulx_u64(&mut x305, &mut x306, x279, 0xffffffffffffffff); + let mut x307: u64 = 0; + let mut x308: u64 = 0; + fiat_p434_mulx_u64(&mut x307, &mut x308, x279, 0xffffffffffffffff); + let mut x309: u64 = 0; + let mut x310: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x309, &mut x310, 0x0, x308, x305); + let mut x311: u64 = 0; + let mut x312: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x311, &mut x312, x310, x306, x303); + let mut x313: u64 = 0; + let mut x314: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x313, &mut x314, x312, x304, x301); + let mut x315: u64 = 0; + let mut x316: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x315, &mut x316, x314, x302, x299); + let mut x317: u64 = 0; + let mut x318: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x317, &mut x318, x316, x300, x297); + let mut x319: u64 = 0; + let mut x320: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x319, &mut x320, x318, x298, x295); + let x321: u64 = ((x320 as u64) + x296); + let mut x322: u64 = 0; + let mut x323: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x322, &mut x323, 0x0, x279, x307); + let mut x324: u64 = 0; + let mut x325: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x324, &mut x325, x323, x281, x309); + let mut x326: u64 = 0; + let mut x327: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x326, &mut x327, x325, x283, x311); + let mut x328: u64 = 0; + let mut x329: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x328, &mut x329, x327, x285, x313); + let mut x330: u64 = 0; + let mut x331: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x330, &mut x331, x329, x287, x315); + let mut x332: u64 = 0; + let mut x333: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x332, &mut x333, x331, x289, x317); + let mut x334: u64 = 0; + let mut x335: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x334, &mut x335, x333, x291, x319); + let mut x336: u64 = 0; + let mut x337: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x336, &mut x337, x335, x293, x321); + let x338: u64 = ((x337 as u64) + (x294 as u64)); + let mut x339: u64 = 0; + let mut x340: u64 = 0; + fiat_p434_mulx_u64(&mut x339, &mut x340, x4, (arg1[6])); + let mut x341: u64 = 0; + let mut x342: u64 = 0; + fiat_p434_mulx_u64(&mut x341, &mut x342, x4, (arg1[5])); + let mut x343: u64 = 0; + let mut x344: u64 = 0; + fiat_p434_mulx_u64(&mut x343, &mut x344, x4, (arg1[4])); + let mut x345: u64 = 0; + let mut x346: u64 = 0; + fiat_p434_mulx_u64(&mut x345, &mut x346, x4, (arg1[3])); + let mut x347: u64 = 0; + let mut x348: u64 = 0; + fiat_p434_mulx_u64(&mut x347, &mut x348, x4, (arg1[2])); + let mut x349: u64 = 0; + let mut x350: u64 = 0; + fiat_p434_mulx_u64(&mut x349, &mut x350, x4, (arg1[1])); + let mut x351: u64 = 0; + let mut x352: u64 = 0; + fiat_p434_mulx_u64(&mut x351, &mut x352, x4, (arg1[0])); + let mut x353: u64 = 0; + let mut x354: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x353, &mut x354, 0x0, x352, x349); + let mut x355: u64 = 0; + let mut x356: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x355, &mut x356, x354, x350, x347); + let mut x357: u64 = 0; + let mut x358: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x357, &mut x358, x356, x348, x345); + let mut x359: u64 = 0; + let mut x360: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x359, &mut x360, x358, x346, x343); + let mut x361: u64 = 0; + let mut x362: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x361, &mut x362, x360, x344, x341); + let mut x363: u64 = 0; + let mut x364: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x363, &mut x364, x362, x342, x339); + let x365: u64 = ((x364 as u64) + x340); + let mut x366: u64 = 0; + let mut x367: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x366, &mut x367, 0x0, x324, x351); + let mut x368: u64 = 0; + let mut x369: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x368, &mut x369, x367, x326, x353); + let mut x370: u64 = 0; + let mut x371: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x370, &mut x371, x369, x328, x355); + let mut x372: u64 = 0; + let mut x373: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x372, &mut x373, x371, x330, x357); + let mut x374: u64 = 0; + let mut x375: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x374, &mut x375, x373, x332, x359); + let mut x376: u64 = 0; + let mut x377: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x376, &mut x377, x375, x334, x361); + let mut x378: u64 = 0; + let mut x379: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x378, &mut x379, x377, x336, x363); + let mut x380: u64 = 0; + let mut x381: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x380, &mut x381, x379, x338, x365); + let mut x382: u64 = 0; + let mut x383: u64 = 0; + fiat_p434_mulx_u64(&mut x382, &mut x383, x366, 0x2341f27177344); + let mut x384: u64 = 0; + let mut x385: u64 = 0; + fiat_p434_mulx_u64(&mut x384, &mut x385, x366, 0x6cfc5fd681c52056); + let mut x386: u64 = 0; + let mut x387: u64 = 0; + fiat_p434_mulx_u64(&mut x386, &mut x387, x366, 0x7bc65c783158aea3); + let mut x388: u64 = 0; + let mut x389: u64 = 0; + fiat_p434_mulx_u64(&mut x388, &mut x389, x366, 0xfdc1767ae2ffffff); + let mut x390: u64 = 0; + let mut x391: u64 = 0; + fiat_p434_mulx_u64(&mut x390, &mut x391, x366, 0xffffffffffffffff); + let mut x392: u64 = 0; + let mut x393: u64 = 0; + fiat_p434_mulx_u64(&mut x392, &mut x393, x366, 0xffffffffffffffff); + let mut x394: u64 = 0; + let mut x395: u64 = 0; + fiat_p434_mulx_u64(&mut x394, &mut x395, x366, 0xffffffffffffffff); + let mut x396: u64 = 0; + let mut x397: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x396, &mut x397, 0x0, x395, x392); + let mut x398: u64 = 0; + let mut x399: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x398, &mut x399, x397, x393, x390); + let mut x400: u64 = 0; + let mut x401: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x400, &mut x401, x399, x391, x388); + let mut x402: u64 = 0; + let mut x403: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x402, &mut x403, x401, x389, x386); + let mut x404: u64 = 0; + let mut x405: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x404, &mut x405, x403, x387, x384); + let mut x406: u64 = 0; + let mut x407: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x406, &mut x407, x405, x385, x382); + let x408: u64 = ((x407 as u64) + x383); + let mut x409: u64 = 0; + let mut x410: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x409, &mut x410, 0x0, x366, x394); + let mut x411: u64 = 0; + let mut x412: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x411, &mut x412, x410, x368, x396); + let mut x413: u64 = 0; + let mut x414: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x413, &mut x414, x412, x370, x398); + let mut x415: u64 = 0; + let mut x416: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x415, &mut x416, x414, x372, x400); + let mut x417: u64 = 0; + let mut x418: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x417, &mut x418, x416, x374, x402); + let mut x419: u64 = 0; + let mut x420: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x419, &mut x420, x418, x376, x404); + let mut x421: u64 = 0; + let mut x422: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x421, &mut x422, x420, x378, x406); + let mut x423: u64 = 0; + let mut x424: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x423, &mut x424, x422, x380, x408); + let x425: u64 = ((x424 as u64) + (x381 as u64)); + let mut x426: u64 = 0; + let mut x427: u64 = 0; + fiat_p434_mulx_u64(&mut x426, &mut x427, x5, (arg1[6])); + let mut x428: u64 = 0; + let mut x429: u64 = 0; + fiat_p434_mulx_u64(&mut x428, &mut x429, x5, (arg1[5])); + let mut x430: u64 = 0; + let mut x431: u64 = 0; + fiat_p434_mulx_u64(&mut x430, &mut x431, x5, (arg1[4])); + let mut x432: u64 = 0; + let mut x433: u64 = 0; + fiat_p434_mulx_u64(&mut x432, &mut x433, x5, (arg1[3])); + let mut x434: u64 = 0; + let mut x435: u64 = 0; + fiat_p434_mulx_u64(&mut x434, &mut x435, x5, (arg1[2])); + let mut x436: u64 = 0; + let mut x437: u64 = 0; + fiat_p434_mulx_u64(&mut x436, &mut x437, x5, (arg1[1])); + let mut x438: u64 = 0; + let mut x439: u64 = 0; + fiat_p434_mulx_u64(&mut x438, &mut x439, x5, (arg1[0])); + let mut x440: u64 = 0; + let mut x441: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x440, &mut x441, 0x0, x439, x436); + let mut x442: u64 = 0; + let mut x443: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x442, &mut x443, x441, x437, x434); + let mut x444: u64 = 0; + let mut x445: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x444, &mut x445, x443, x435, x432); + let mut x446: u64 = 0; + let mut x447: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x446, &mut x447, x445, x433, x430); + let mut x448: u64 = 0; + let mut x449: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x448, &mut x449, x447, x431, x428); + let mut x450: u64 = 0; + let mut x451: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x450, &mut x451, x449, x429, x426); + let x452: u64 = ((x451 as u64) + x427); + let mut x453: u64 = 0; + let mut x454: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x453, &mut x454, 0x0, x411, x438); + let mut x455: u64 = 0; + let mut x456: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x455, &mut x456, x454, x413, x440); + let mut x457: u64 = 0; + let mut x458: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x457, &mut x458, x456, x415, x442); + let mut x459: u64 = 0; + let mut x460: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x459, &mut x460, x458, x417, x444); + let mut x461: u64 = 0; + let mut x462: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x461, &mut x462, x460, x419, x446); + let mut x463: u64 = 0; + let mut x464: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x463, &mut x464, x462, x421, x448); + let mut x465: u64 = 0; + let mut x466: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x465, &mut x466, x464, x423, x450); + let mut x467: u64 = 0; + let mut x468: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x467, &mut x468, x466, x425, x452); + let mut x469: u64 = 0; + let mut x470: u64 = 0; + fiat_p434_mulx_u64(&mut x469, &mut x470, x453, 0x2341f27177344); + let mut x471: u64 = 0; + let mut x472: u64 = 0; + fiat_p434_mulx_u64(&mut x471, &mut x472, x453, 0x6cfc5fd681c52056); + let mut x473: u64 = 0; + let mut x474: u64 = 0; + fiat_p434_mulx_u64(&mut x473, &mut x474, x453, 0x7bc65c783158aea3); + let mut x475: u64 = 0; + let mut x476: u64 = 0; + fiat_p434_mulx_u64(&mut x475, &mut x476, x453, 0xfdc1767ae2ffffff); + let mut x477: u64 = 0; + let mut x478: u64 = 0; + fiat_p434_mulx_u64(&mut x477, &mut x478, x453, 0xffffffffffffffff); + let mut x479: u64 = 0; + let mut x480: u64 = 0; + fiat_p434_mulx_u64(&mut x479, &mut x480, x453, 0xffffffffffffffff); + let mut x481: u64 = 0; + let mut x482: u64 = 0; + fiat_p434_mulx_u64(&mut x481, &mut x482, x453, 0xffffffffffffffff); + let mut x483: u64 = 0; + let mut x484: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x483, &mut x484, 0x0, x482, x479); + let mut x485: u64 = 0; + let mut x486: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x485, &mut x486, x484, x480, x477); + let mut x487: u64 = 0; + let mut x488: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x487, &mut x488, x486, x478, x475); + let mut x489: u64 = 0; + let mut x490: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x489, &mut x490, x488, x476, x473); + let mut x491: u64 = 0; + let mut x492: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x491, &mut x492, x490, x474, x471); + let mut x493: u64 = 0; + let mut x494: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x493, &mut x494, x492, x472, x469); + let x495: u64 = ((x494 as u64) + x470); + let mut x496: u64 = 0; + let mut x497: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x496, &mut x497, 0x0, x453, x481); + let mut x498: u64 = 0; + let mut x499: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x498, &mut x499, x497, x455, x483); + let mut x500: u64 = 0; + let mut x501: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x500, &mut x501, x499, x457, x485); + let mut x502: u64 = 0; + let mut x503: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x502, &mut x503, x501, x459, x487); + let mut x504: u64 = 0; + let mut x505: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x504, &mut x505, x503, x461, x489); + let mut x506: u64 = 0; + let mut x507: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x506, &mut x507, x505, x463, x491); + let mut x508: u64 = 0; + let mut x509: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x508, &mut x509, x507, x465, x493); + let mut x510: u64 = 0; + let mut x511: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x510, &mut x511, x509, x467, x495); + let x512: u64 = ((x511 as u64) + (x468 as u64)); + let mut x513: u64 = 0; + let mut x514: u64 = 0; + fiat_p434_mulx_u64(&mut x513, &mut x514, x6, (arg1[6])); + let mut x515: u64 = 0; + let mut x516: u64 = 0; + fiat_p434_mulx_u64(&mut x515, &mut x516, x6, (arg1[5])); + let mut x517: u64 = 0; + let mut x518: u64 = 0; + fiat_p434_mulx_u64(&mut x517, &mut x518, x6, (arg1[4])); + let mut x519: u64 = 0; + let mut x520: u64 = 0; + fiat_p434_mulx_u64(&mut x519, &mut x520, x6, (arg1[3])); + let mut x521: u64 = 0; + let mut x522: u64 = 0; + fiat_p434_mulx_u64(&mut x521, &mut x522, x6, (arg1[2])); + let mut x523: u64 = 0; + let mut x524: u64 = 0; + fiat_p434_mulx_u64(&mut x523, &mut x524, x6, (arg1[1])); + let mut x525: u64 = 0; + let mut x526: u64 = 0; + fiat_p434_mulx_u64(&mut x525, &mut x526, x6, (arg1[0])); + let mut x527: u64 = 0; + let mut x528: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x527, &mut x528, 0x0, x526, x523); + let mut x529: u64 = 0; + let mut x530: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x529, &mut x530, x528, x524, x521); + let mut x531: u64 = 0; + let mut x532: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x531, &mut x532, x530, x522, x519); + let mut x533: u64 = 0; + let mut x534: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x533, &mut x534, x532, x520, x517); + let mut x535: u64 = 0; + let mut x536: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x535, &mut x536, x534, x518, x515); + let mut x537: u64 = 0; + let mut x538: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x537, &mut x538, x536, x516, x513); + let x539: u64 = ((x538 as u64) + x514); + let mut x540: u64 = 0; + let mut x541: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x540, &mut x541, 0x0, x498, x525); + let mut x542: u64 = 0; + let mut x543: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x542, &mut x543, x541, x500, x527); + let mut x544: u64 = 0; + let mut x545: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x544, &mut x545, x543, x502, x529); + let mut x546: u64 = 0; + let mut x547: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x546, &mut x547, x545, x504, x531); + let mut x548: u64 = 0; + let mut x549: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x548, &mut x549, x547, x506, x533); + let mut x550: u64 = 0; + let mut x551: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x550, &mut x551, x549, x508, x535); + let mut x552: u64 = 0; + let mut x553: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x552, &mut x553, x551, x510, x537); + let mut x554: u64 = 0; + let mut x555: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x554, &mut x555, x553, x512, x539); + let mut x556: u64 = 0; + let mut x557: u64 = 0; + fiat_p434_mulx_u64(&mut x556, &mut x557, x540, 0x2341f27177344); + let mut x558: u64 = 0; + let mut x559: u64 = 0; + fiat_p434_mulx_u64(&mut x558, &mut x559, x540, 0x6cfc5fd681c52056); + let mut x560: u64 = 0; + let mut x561: u64 = 0; + fiat_p434_mulx_u64(&mut x560, &mut x561, x540, 0x7bc65c783158aea3); + let mut x562: u64 = 0; + let mut x563: u64 = 0; + fiat_p434_mulx_u64(&mut x562, &mut x563, x540, 0xfdc1767ae2ffffff); + let mut x564: u64 = 0; + let mut x565: u64 = 0; + fiat_p434_mulx_u64(&mut x564, &mut x565, x540, 0xffffffffffffffff); + let mut x566: u64 = 0; + let mut x567: u64 = 0; + fiat_p434_mulx_u64(&mut x566, &mut x567, x540, 0xffffffffffffffff); + let mut x568: u64 = 0; + let mut x569: u64 = 0; + fiat_p434_mulx_u64(&mut x568, &mut x569, x540, 0xffffffffffffffff); + let mut x570: u64 = 0; + let mut x571: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x570, &mut x571, 0x0, x569, x566); + let mut x572: u64 = 0; + let mut x573: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x572, &mut x573, x571, x567, x564); + let mut x574: u64 = 0; + let mut x575: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x574, &mut x575, x573, x565, x562); + let mut x576: u64 = 0; + let mut x577: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x576, &mut x577, x575, x563, x560); + let mut x578: u64 = 0; + let mut x579: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x578, &mut x579, x577, x561, x558); + let mut x580: u64 = 0; + let mut x581: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x580, &mut x581, x579, x559, x556); + let x582: u64 = ((x581 as u64) + x557); + let mut x583: u64 = 0; + let mut x584: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x583, &mut x584, 0x0, x540, x568); + let mut x585: u64 = 0; + let mut x586: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x585, &mut x586, x584, x542, x570); + let mut x587: u64 = 0; + let mut x588: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x587, &mut x588, x586, x544, x572); + let mut x589: u64 = 0; + let mut x590: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x589, &mut x590, x588, x546, x574); + let mut x591: u64 = 0; + let mut x592: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x591, &mut x592, x590, x548, x576); + let mut x593: u64 = 0; + let mut x594: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x593, &mut x594, x592, x550, x578); + let mut x595: u64 = 0; + let mut x596: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x595, &mut x596, x594, x552, x580); + let mut x597: u64 = 0; + let mut x598: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x597, &mut x598, x596, x554, x582); + let x599: u64 = ((x598 as u64) + (x555 as u64)); + let mut x600: u64 = 0; + let mut x601: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x600, &mut x601, 0x0, x585, 0xffffffffffffffff); + let mut x602: u64 = 0; + let mut x603: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x602, &mut x603, x601, x587, 0xffffffffffffffff); + let mut x604: u64 = 0; + let mut x605: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x604, &mut x605, x603, x589, 0xffffffffffffffff); + let mut x606: u64 = 0; + let mut x607: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x606, &mut x607, x605, x591, 0xfdc1767ae2ffffff); + let mut x608: u64 = 0; + let mut x609: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x608, &mut x609, x607, x593, 0x7bc65c783158aea3); + let mut x610: u64 = 0; + let mut x611: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x610, &mut x611, x609, x595, 0x6cfc5fd681c52056); + let mut x612: u64 = 0; + let mut x613: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x612, &mut x613, x611, x597, 0x2341f27177344); + let mut x614: u64 = 0; + let mut x615: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x614, &mut x615, x613, x599, (0x0 as u64)); + let mut x616: u64 = 0; + fiat_p434_cmovznz_u64(&mut x616, x615, x600, x585); + let mut x617: u64 = 0; + fiat_p434_cmovznz_u64(&mut x617, x615, x602, x587); + let mut x618: u64 = 0; + fiat_p434_cmovznz_u64(&mut x618, x615, x604, x589); + let mut x619: u64 = 0; + fiat_p434_cmovznz_u64(&mut x619, x615, x606, x591); + let mut x620: u64 = 0; + fiat_p434_cmovznz_u64(&mut x620, x615, x608, x593); + let mut x621: u64 = 0; + fiat_p434_cmovznz_u64(&mut x621, x615, x610, x595); + let mut x622: u64 = 0; + fiat_p434_cmovznz_u64(&mut x622, x615, x612, x597); + out1[0] = x616; + out1[1] = x617; + out1[2] = x618; + out1[3] = x619; + out1[4] = x620; + out1[5] = x621; + out1[6] = x622; +} + +/// The function fiat_p434_add adds two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) + eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p434_add(out1: &mut fiat_p434_montgomery_domain_field_element, arg1: &fiat_p434_montgomery_domain_field_element, arg2: &fiat_p434_montgomery_domain_field_element) -> () { + let mut x1: u64 = 0; + let mut x2: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x1, &mut x2, 0x0, (arg1[0]), (arg2[0])); + let mut x3: u64 = 0; + let mut x4: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x3, &mut x4, x2, (arg1[1]), (arg2[1])); + let mut x5: u64 = 0; + let mut x6: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x5, &mut x6, x4, (arg1[2]), (arg2[2])); + let mut x7: u64 = 0; + let mut x8: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x7, &mut x8, x6, (arg1[3]), (arg2[3])); + let mut x9: u64 = 0; + let mut x10: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x9, &mut x10, x8, (arg1[4]), (arg2[4])); + let mut x11: u64 = 0; + let mut x12: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x11, &mut x12, x10, (arg1[5]), (arg2[5])); + let mut x13: u64 = 0; + let mut x14: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x13, &mut x14, x12, (arg1[6]), (arg2[6])); + let mut x15: u64 = 0; + let mut x16: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x15, &mut x16, 0x0, x1, 0xffffffffffffffff); + let mut x17: u64 = 0; + let mut x18: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x17, &mut x18, x16, x3, 0xffffffffffffffff); + let mut x19: u64 = 0; + let mut x20: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x19, &mut x20, x18, x5, 0xffffffffffffffff); + let mut x21: u64 = 0; + let mut x22: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x21, &mut x22, x20, x7, 0xfdc1767ae2ffffff); + let mut x23: u64 = 0; + let mut x24: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x23, &mut x24, x22, x9, 0x7bc65c783158aea3); + let mut x25: u64 = 0; + let mut x26: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x25, &mut x26, x24, x11, 0x6cfc5fd681c52056); + let mut x27: u64 = 0; + let mut x28: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x27, &mut x28, x26, x13, 0x2341f27177344); + let mut x29: u64 = 0; + let mut x30: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x29, &mut x30, x28, (x14 as u64), (0x0 as u64)); + let mut x31: u64 = 0; + fiat_p434_cmovznz_u64(&mut x31, x30, x15, x1); + let mut x32: u64 = 0; + fiat_p434_cmovznz_u64(&mut x32, x30, x17, x3); + let mut x33: u64 = 0; + fiat_p434_cmovznz_u64(&mut x33, x30, x19, x5); + let mut x34: u64 = 0; + fiat_p434_cmovznz_u64(&mut x34, x30, x21, x7); + let mut x35: u64 = 0; + fiat_p434_cmovznz_u64(&mut x35, x30, x23, x9); + let mut x36: u64 = 0; + fiat_p434_cmovznz_u64(&mut x36, x30, x25, x11); + let mut x37: u64 = 0; + fiat_p434_cmovznz_u64(&mut x37, x30, x27, x13); + out1[0] = x31; + out1[1] = x32; + out1[2] = x33; + out1[3] = x34; + out1[4] = x35; + out1[5] = x36; + out1[6] = x37; +} + +/// The function fiat_p434_sub subtracts two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) - eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p434_sub(out1: &mut fiat_p434_montgomery_domain_field_element, arg1: &fiat_p434_montgomery_domain_field_element, arg2: &fiat_p434_montgomery_domain_field_element) -> () { + let mut x1: u64 = 0; + let mut x2: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x1, &mut x2, 0x0, (arg1[0]), (arg2[0])); + let mut x3: u64 = 0; + let mut x4: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x3, &mut x4, x2, (arg1[1]), (arg2[1])); + let mut x5: u64 = 0; + let mut x6: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x5, &mut x6, x4, (arg1[2]), (arg2[2])); + let mut x7: u64 = 0; + let mut x8: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x7, &mut x8, x6, (arg1[3]), (arg2[3])); + let mut x9: u64 = 0; + let mut x10: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x9, &mut x10, x8, (arg1[4]), (arg2[4])); + let mut x11: u64 = 0; + let mut x12: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x11, &mut x12, x10, (arg1[5]), (arg2[5])); + let mut x13: u64 = 0; + let mut x14: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x13, &mut x14, x12, (arg1[6]), (arg2[6])); + let mut x15: u64 = 0; + fiat_p434_cmovznz_u64(&mut x15, x14, (0x0 as u64), 0xffffffffffffffff); + let mut x16: u64 = 0; + let mut x17: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x16, &mut x17, 0x0, x1, x15); + let mut x18: u64 = 0; + let mut x19: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x18, &mut x19, x17, x3, x15); + let mut x20: u64 = 0; + let mut x21: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x20, &mut x21, x19, x5, x15); + let mut x22: u64 = 0; + let mut x23: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x22, &mut x23, x21, x7, (x15 & 0xfdc1767ae2ffffff)); + let mut x24: u64 = 0; + let mut x25: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x24, &mut x25, x23, x9, (x15 & 0x7bc65c783158aea3)); + let mut x26: u64 = 0; + let mut x27: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x26, &mut x27, x25, x11, (x15 & 0x6cfc5fd681c52056)); + let mut x28: u64 = 0; + let mut x29: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x28, &mut x29, x27, x13, (x15 & 0x2341f27177344)); + out1[0] = x16; + out1[1] = x18; + out1[2] = x20; + out1[3] = x22; + out1[4] = x24; + out1[5] = x26; + out1[6] = x28; +} + +/// The function fiat_p434_opp negates a field element in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = -eval (from_montgomery arg1) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p434_opp(out1: &mut fiat_p434_montgomery_domain_field_element, arg1: &fiat_p434_montgomery_domain_field_element) -> () { + let mut x1: u64 = 0; + let mut x2: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x1, &mut x2, 0x0, (0x0 as u64), (arg1[0])); + let mut x3: u64 = 0; + let mut x4: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x3, &mut x4, x2, (0x0 as u64), (arg1[1])); + let mut x5: u64 = 0; + let mut x6: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x5, &mut x6, x4, (0x0 as u64), (arg1[2])); + let mut x7: u64 = 0; + let mut x8: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x7, &mut x8, x6, (0x0 as u64), (arg1[3])); + let mut x9: u64 = 0; + let mut x10: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x9, &mut x10, x8, (0x0 as u64), (arg1[4])); + let mut x11: u64 = 0; + let mut x12: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x11, &mut x12, x10, (0x0 as u64), (arg1[5])); + let mut x13: u64 = 0; + let mut x14: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x13, &mut x14, x12, (0x0 as u64), (arg1[6])); + let mut x15: u64 = 0; + fiat_p434_cmovznz_u64(&mut x15, x14, (0x0 as u64), 0xffffffffffffffff); + let mut x16: u64 = 0; + let mut x17: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x16, &mut x17, 0x0, x1, x15); + let mut x18: u64 = 0; + let mut x19: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x18, &mut x19, x17, x3, x15); + let mut x20: u64 = 0; + let mut x21: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x20, &mut x21, x19, x5, x15); + let mut x22: u64 = 0; + let mut x23: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x22, &mut x23, x21, x7, (x15 & 0xfdc1767ae2ffffff)); + let mut x24: u64 = 0; + let mut x25: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x24, &mut x25, x23, x9, (x15 & 0x7bc65c783158aea3)); + let mut x26: u64 = 0; + let mut x27: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x26, &mut x27, x25, x11, (x15 & 0x6cfc5fd681c52056)); + let mut x28: u64 = 0; + let mut x29: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x28, &mut x29, x27, x13, (x15 & 0x2341f27177344)); + out1[0] = x16; + out1[1] = x18; + out1[2] = x20; + out1[3] = x22; + out1[4] = x24; + out1[5] = x26; + out1[6] = x28; +} + +/// The function fiat_p434_from_montgomery translates a field element out of the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval out1 mod m = (eval arg1 * ((2^64)⁻¹ mod m)^7) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p434_from_montgomery(out1: &mut fiat_p434_non_montgomery_domain_field_element, arg1: &fiat_p434_montgomery_domain_field_element) -> () { + let x1: u64 = (arg1[0]); + let mut x2: u64 = 0; + let mut x3: u64 = 0; + fiat_p434_mulx_u64(&mut x2, &mut x3, x1, 0x2341f27177344); + let mut x4: u64 = 0; + let mut x5: u64 = 0; + fiat_p434_mulx_u64(&mut x4, &mut x5, x1, 0x6cfc5fd681c52056); + let mut x6: u64 = 0; + let mut x7: u64 = 0; + fiat_p434_mulx_u64(&mut x6, &mut x7, x1, 0x7bc65c783158aea3); + let mut x8: u64 = 0; + let mut x9: u64 = 0; + fiat_p434_mulx_u64(&mut x8, &mut x9, x1, 0xfdc1767ae2ffffff); + let mut x10: u64 = 0; + let mut x11: u64 = 0; + fiat_p434_mulx_u64(&mut x10, &mut x11, x1, 0xffffffffffffffff); + let mut x12: u64 = 0; + let mut x13: u64 = 0; + fiat_p434_mulx_u64(&mut x12, &mut x13, x1, 0xffffffffffffffff); + let mut x14: u64 = 0; + let mut x15: u64 = 0; + fiat_p434_mulx_u64(&mut x14, &mut x15, x1, 0xffffffffffffffff); + let mut x16: u64 = 0; + let mut x17: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x16, &mut x17, 0x0, x15, x12); + let mut x18: u64 = 0; + let mut x19: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x18, &mut x19, x17, x13, x10); + let mut x20: u64 = 0; + let mut x21: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x20, &mut x21, x19, x11, x8); + let mut x22: u64 = 0; + let mut x23: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x22, &mut x23, x21, x9, x6); + let mut x24: u64 = 0; + let mut x25: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x24, &mut x25, x23, x7, x4); + let mut x26: u64 = 0; + let mut x27: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x26, &mut x27, x25, x5, x2); + let mut x28: u64 = 0; + let mut x29: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x28, &mut x29, 0x0, x1, x14); + let mut x30: u64 = 0; + let mut x31: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x30, &mut x31, x29, (0x0 as u64), x16); + let mut x32: u64 = 0; + let mut x33: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x32, &mut x33, x31, (0x0 as u64), x18); + let mut x34: u64 = 0; + let mut x35: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x34, &mut x35, x33, (0x0 as u64), x20); + let mut x36: u64 = 0; + let mut x37: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x36, &mut x37, x35, (0x0 as u64), x22); + let mut x38: u64 = 0; + let mut x39: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x38, &mut x39, x37, (0x0 as u64), x24); + let mut x40: u64 = 0; + let mut x41: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x40, &mut x41, x39, (0x0 as u64), x26); + let mut x42: u64 = 0; + let mut x43: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x42, &mut x43, 0x0, x30, (arg1[1])); + let mut x44: u64 = 0; + let mut x45: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x44, &mut x45, x43, x32, (0x0 as u64)); + let mut x46: u64 = 0; + let mut x47: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x46, &mut x47, x45, x34, (0x0 as u64)); + let mut x48: u64 = 0; + let mut x49: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x48, &mut x49, x47, x36, (0x0 as u64)); + let mut x50: u64 = 0; + let mut x51: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x50, &mut x51, x49, x38, (0x0 as u64)); + let mut x52: u64 = 0; + let mut x53: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x52, &mut x53, x51, x40, (0x0 as u64)); + let mut x54: u64 = 0; + let mut x55: u64 = 0; + fiat_p434_mulx_u64(&mut x54, &mut x55, x42, 0x2341f27177344); + let mut x56: u64 = 0; + let mut x57: u64 = 0; + fiat_p434_mulx_u64(&mut x56, &mut x57, x42, 0x6cfc5fd681c52056); + let mut x58: u64 = 0; + let mut x59: u64 = 0; + fiat_p434_mulx_u64(&mut x58, &mut x59, x42, 0x7bc65c783158aea3); + let mut x60: u64 = 0; + let mut x61: u64 = 0; + fiat_p434_mulx_u64(&mut x60, &mut x61, x42, 0xfdc1767ae2ffffff); + let mut x62: u64 = 0; + let mut x63: u64 = 0; + fiat_p434_mulx_u64(&mut x62, &mut x63, x42, 0xffffffffffffffff); + let mut x64: u64 = 0; + let mut x65: u64 = 0; + fiat_p434_mulx_u64(&mut x64, &mut x65, x42, 0xffffffffffffffff); + let mut x66: u64 = 0; + let mut x67: u64 = 0; + fiat_p434_mulx_u64(&mut x66, &mut x67, x42, 0xffffffffffffffff); + let mut x68: u64 = 0; + let mut x69: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x68, &mut x69, 0x0, x67, x64); + let mut x70: u64 = 0; + let mut x71: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x70, &mut x71, x69, x65, x62); + let mut x72: u64 = 0; + let mut x73: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x72, &mut x73, x71, x63, x60); + let mut x74: u64 = 0; + let mut x75: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x74, &mut x75, x73, x61, x58); + let mut x76: u64 = 0; + let mut x77: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x76, &mut x77, x75, x59, x56); + let mut x78: u64 = 0; + let mut x79: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x78, &mut x79, x77, x57, x54); + let mut x80: u64 = 0; + let mut x81: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x80, &mut x81, 0x0, x42, x66); + let mut x82: u64 = 0; + let mut x83: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x82, &mut x83, x81, x44, x68); + let mut x84: u64 = 0; + let mut x85: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x84, &mut x85, x83, x46, x70); + let mut x86: u64 = 0; + let mut x87: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x86, &mut x87, x85, x48, x72); + let mut x88: u64 = 0; + let mut x89: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x88, &mut x89, x87, x50, x74); + let mut x90: u64 = 0; + let mut x91: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x90, &mut x91, x89, x52, x76); + let mut x92: u64 = 0; + let mut x93: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x92, &mut x93, x91, ((x53 as u64) + ((x41 as u64) + ((x27 as u64) + x3))), x78); + let mut x94: u64 = 0; + let mut x95: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x94, &mut x95, 0x0, x82, (arg1[2])); + let mut x96: u64 = 0; + let mut x97: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x96, &mut x97, x95, x84, (0x0 as u64)); + let mut x98: u64 = 0; + let mut x99: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x98, &mut x99, x97, x86, (0x0 as u64)); + let mut x100: u64 = 0; + let mut x101: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x100, &mut x101, x99, x88, (0x0 as u64)); + let mut x102: u64 = 0; + let mut x103: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x102, &mut x103, x101, x90, (0x0 as u64)); + let mut x104: u64 = 0; + let mut x105: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x104, &mut x105, x103, x92, (0x0 as u64)); + let mut x106: u64 = 0; + let mut x107: u64 = 0; + fiat_p434_mulx_u64(&mut x106, &mut x107, x94, 0x2341f27177344); + let mut x108: u64 = 0; + let mut x109: u64 = 0; + fiat_p434_mulx_u64(&mut x108, &mut x109, x94, 0x6cfc5fd681c52056); + let mut x110: u64 = 0; + let mut x111: u64 = 0; + fiat_p434_mulx_u64(&mut x110, &mut x111, x94, 0x7bc65c783158aea3); + let mut x112: u64 = 0; + let mut x113: u64 = 0; + fiat_p434_mulx_u64(&mut x112, &mut x113, x94, 0xfdc1767ae2ffffff); + let mut x114: u64 = 0; + let mut x115: u64 = 0; + fiat_p434_mulx_u64(&mut x114, &mut x115, x94, 0xffffffffffffffff); + let mut x116: u64 = 0; + let mut x117: u64 = 0; + fiat_p434_mulx_u64(&mut x116, &mut x117, x94, 0xffffffffffffffff); + let mut x118: u64 = 0; + let mut x119: u64 = 0; + fiat_p434_mulx_u64(&mut x118, &mut x119, x94, 0xffffffffffffffff); + let mut x120: u64 = 0; + let mut x121: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x120, &mut x121, 0x0, x119, x116); + let mut x122: u64 = 0; + let mut x123: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x122, &mut x123, x121, x117, x114); + let mut x124: u64 = 0; + let mut x125: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x124, &mut x125, x123, x115, x112); + let mut x126: u64 = 0; + let mut x127: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x126, &mut x127, x125, x113, x110); + let mut x128: u64 = 0; + let mut x129: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x128, &mut x129, x127, x111, x108); + let mut x130: u64 = 0; + let mut x131: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x130, &mut x131, x129, x109, x106); + let mut x132: u64 = 0; + let mut x133: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x132, &mut x133, 0x0, x94, x118); + let mut x134: u64 = 0; + let mut x135: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x134, &mut x135, x133, x96, x120); + let mut x136: u64 = 0; + let mut x137: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x136, &mut x137, x135, x98, x122); + let mut x138: u64 = 0; + let mut x139: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x138, &mut x139, x137, x100, x124); + let mut x140: u64 = 0; + let mut x141: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x140, &mut x141, x139, x102, x126); + let mut x142: u64 = 0; + let mut x143: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x142, &mut x143, x141, x104, x128); + let mut x144: u64 = 0; + let mut x145: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x144, &mut x145, x143, ((x105 as u64) + ((x93 as u64) + ((x79 as u64) + x55))), x130); + let mut x146: u64 = 0; + let mut x147: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x146, &mut x147, 0x0, x134, (arg1[3])); + let mut x148: u64 = 0; + let mut x149: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x148, &mut x149, x147, x136, (0x0 as u64)); + let mut x150: u64 = 0; + let mut x151: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x150, &mut x151, x149, x138, (0x0 as u64)); + let mut x152: u64 = 0; + let mut x153: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x152, &mut x153, x151, x140, (0x0 as u64)); + let mut x154: u64 = 0; + let mut x155: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x154, &mut x155, x153, x142, (0x0 as u64)); + let mut x156: u64 = 0; + let mut x157: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x156, &mut x157, x155, x144, (0x0 as u64)); + let mut x158: u64 = 0; + let mut x159: u64 = 0; + fiat_p434_mulx_u64(&mut x158, &mut x159, x146, 0x2341f27177344); + let mut x160: u64 = 0; + let mut x161: u64 = 0; + fiat_p434_mulx_u64(&mut x160, &mut x161, x146, 0x6cfc5fd681c52056); + let mut x162: u64 = 0; + let mut x163: u64 = 0; + fiat_p434_mulx_u64(&mut x162, &mut x163, x146, 0x7bc65c783158aea3); + let mut x164: u64 = 0; + let mut x165: u64 = 0; + fiat_p434_mulx_u64(&mut x164, &mut x165, x146, 0xfdc1767ae2ffffff); + let mut x166: u64 = 0; + let mut x167: u64 = 0; + fiat_p434_mulx_u64(&mut x166, &mut x167, x146, 0xffffffffffffffff); + let mut x168: u64 = 0; + let mut x169: u64 = 0; + fiat_p434_mulx_u64(&mut x168, &mut x169, x146, 0xffffffffffffffff); + let mut x170: u64 = 0; + let mut x171: u64 = 0; + fiat_p434_mulx_u64(&mut x170, &mut x171, x146, 0xffffffffffffffff); + let mut x172: u64 = 0; + let mut x173: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x172, &mut x173, 0x0, x171, x168); + let mut x174: u64 = 0; + let mut x175: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x174, &mut x175, x173, x169, x166); + let mut x176: u64 = 0; + let mut x177: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x176, &mut x177, x175, x167, x164); + let mut x178: u64 = 0; + let mut x179: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x178, &mut x179, x177, x165, x162); + let mut x180: u64 = 0; + let mut x181: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x180, &mut x181, x179, x163, x160); + let mut x182: u64 = 0; + let mut x183: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x182, &mut x183, x181, x161, x158); + let mut x184: u64 = 0; + let mut x185: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x184, &mut x185, 0x0, x146, x170); + let mut x186: u64 = 0; + let mut x187: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x186, &mut x187, x185, x148, x172); + let mut x188: u64 = 0; + let mut x189: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x188, &mut x189, x187, x150, x174); + let mut x190: u64 = 0; + let mut x191: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x190, &mut x191, x189, x152, x176); + let mut x192: u64 = 0; + let mut x193: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x192, &mut x193, x191, x154, x178); + let mut x194: u64 = 0; + let mut x195: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x194, &mut x195, x193, x156, x180); + let mut x196: u64 = 0; + let mut x197: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x196, &mut x197, x195, ((x157 as u64) + ((x145 as u64) + ((x131 as u64) + x107))), x182); + let mut x198: u64 = 0; + let mut x199: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x198, &mut x199, 0x0, x186, (arg1[4])); + let mut x200: u64 = 0; + let mut x201: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x200, &mut x201, x199, x188, (0x0 as u64)); + let mut x202: u64 = 0; + let mut x203: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x202, &mut x203, x201, x190, (0x0 as u64)); + let mut x204: u64 = 0; + let mut x205: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x204, &mut x205, x203, x192, (0x0 as u64)); + let mut x206: u64 = 0; + let mut x207: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x206, &mut x207, x205, x194, (0x0 as u64)); + let mut x208: u64 = 0; + let mut x209: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x208, &mut x209, x207, x196, (0x0 as u64)); + let mut x210: u64 = 0; + let mut x211: u64 = 0; + fiat_p434_mulx_u64(&mut x210, &mut x211, x198, 0x2341f27177344); + let mut x212: u64 = 0; + let mut x213: u64 = 0; + fiat_p434_mulx_u64(&mut x212, &mut x213, x198, 0x6cfc5fd681c52056); + let mut x214: u64 = 0; + let mut x215: u64 = 0; + fiat_p434_mulx_u64(&mut x214, &mut x215, x198, 0x7bc65c783158aea3); + let mut x216: u64 = 0; + let mut x217: u64 = 0; + fiat_p434_mulx_u64(&mut x216, &mut x217, x198, 0xfdc1767ae2ffffff); + let mut x218: u64 = 0; + let mut x219: u64 = 0; + fiat_p434_mulx_u64(&mut x218, &mut x219, x198, 0xffffffffffffffff); + let mut x220: u64 = 0; + let mut x221: u64 = 0; + fiat_p434_mulx_u64(&mut x220, &mut x221, x198, 0xffffffffffffffff); + let mut x222: u64 = 0; + let mut x223: u64 = 0; + fiat_p434_mulx_u64(&mut x222, &mut x223, x198, 0xffffffffffffffff); + let mut x224: u64 = 0; + let mut x225: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x224, &mut x225, 0x0, x223, x220); + let mut x226: u64 = 0; + let mut x227: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x226, &mut x227, x225, x221, x218); + let mut x228: u64 = 0; + let mut x229: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x228, &mut x229, x227, x219, x216); + let mut x230: u64 = 0; + let mut x231: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x230, &mut x231, x229, x217, x214); + let mut x232: u64 = 0; + let mut x233: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x232, &mut x233, x231, x215, x212); + let mut x234: u64 = 0; + let mut x235: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x234, &mut x235, x233, x213, x210); + let mut x236: u64 = 0; + let mut x237: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x236, &mut x237, 0x0, x198, x222); + let mut x238: u64 = 0; + let mut x239: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x238, &mut x239, x237, x200, x224); + let mut x240: u64 = 0; + let mut x241: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x240, &mut x241, x239, x202, x226); + let mut x242: u64 = 0; + let mut x243: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x242, &mut x243, x241, x204, x228); + let mut x244: u64 = 0; + let mut x245: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x244, &mut x245, x243, x206, x230); + let mut x246: u64 = 0; + let mut x247: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x246, &mut x247, x245, x208, x232); + let mut x248: u64 = 0; + let mut x249: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x248, &mut x249, x247, ((x209 as u64) + ((x197 as u64) + ((x183 as u64) + x159))), x234); + let mut x250: u64 = 0; + let mut x251: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x250, &mut x251, 0x0, x238, (arg1[5])); + let mut x252: u64 = 0; + let mut x253: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x252, &mut x253, x251, x240, (0x0 as u64)); + let mut x254: u64 = 0; + let mut x255: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x254, &mut x255, x253, x242, (0x0 as u64)); + let mut x256: u64 = 0; + let mut x257: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x256, &mut x257, x255, x244, (0x0 as u64)); + let mut x258: u64 = 0; + let mut x259: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x258, &mut x259, x257, x246, (0x0 as u64)); + let mut x260: u64 = 0; + let mut x261: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x260, &mut x261, x259, x248, (0x0 as u64)); + let mut x262: u64 = 0; + let mut x263: u64 = 0; + fiat_p434_mulx_u64(&mut x262, &mut x263, x250, 0x2341f27177344); + let mut x264: u64 = 0; + let mut x265: u64 = 0; + fiat_p434_mulx_u64(&mut x264, &mut x265, x250, 0x6cfc5fd681c52056); + let mut x266: u64 = 0; + let mut x267: u64 = 0; + fiat_p434_mulx_u64(&mut x266, &mut x267, x250, 0x7bc65c783158aea3); + let mut x268: u64 = 0; + let mut x269: u64 = 0; + fiat_p434_mulx_u64(&mut x268, &mut x269, x250, 0xfdc1767ae2ffffff); + let mut x270: u64 = 0; + let mut x271: u64 = 0; + fiat_p434_mulx_u64(&mut x270, &mut x271, x250, 0xffffffffffffffff); + let mut x272: u64 = 0; + let mut x273: u64 = 0; + fiat_p434_mulx_u64(&mut x272, &mut x273, x250, 0xffffffffffffffff); + let mut x274: u64 = 0; + let mut x275: u64 = 0; + fiat_p434_mulx_u64(&mut x274, &mut x275, x250, 0xffffffffffffffff); + let mut x276: u64 = 0; + let mut x277: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x276, &mut x277, 0x0, x275, x272); + let mut x278: u64 = 0; + let mut x279: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x278, &mut x279, x277, x273, x270); + let mut x280: u64 = 0; + let mut x281: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x280, &mut x281, x279, x271, x268); + let mut x282: u64 = 0; + let mut x283: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x282, &mut x283, x281, x269, x266); + let mut x284: u64 = 0; + let mut x285: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x284, &mut x285, x283, x267, x264); + let mut x286: u64 = 0; + let mut x287: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x286, &mut x287, x285, x265, x262); + let mut x288: u64 = 0; + let mut x289: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x288, &mut x289, 0x0, x250, x274); + let mut x290: u64 = 0; + let mut x291: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x290, &mut x291, x289, x252, x276); + let mut x292: u64 = 0; + let mut x293: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x292, &mut x293, x291, x254, x278); + let mut x294: u64 = 0; + let mut x295: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x294, &mut x295, x293, x256, x280); + let mut x296: u64 = 0; + let mut x297: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x296, &mut x297, x295, x258, x282); + let mut x298: u64 = 0; + let mut x299: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x298, &mut x299, x297, x260, x284); + let mut x300: u64 = 0; + let mut x301: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x300, &mut x301, x299, ((x261 as u64) + ((x249 as u64) + ((x235 as u64) + x211))), x286); + let mut x302: u64 = 0; + let mut x303: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x302, &mut x303, 0x0, x290, (arg1[6])); + let mut x304: u64 = 0; + let mut x305: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x304, &mut x305, x303, x292, (0x0 as u64)); + let mut x306: u64 = 0; + let mut x307: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x306, &mut x307, x305, x294, (0x0 as u64)); + let mut x308: u64 = 0; + let mut x309: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x308, &mut x309, x307, x296, (0x0 as u64)); + let mut x310: u64 = 0; + let mut x311: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x310, &mut x311, x309, x298, (0x0 as u64)); + let mut x312: u64 = 0; + let mut x313: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x312, &mut x313, x311, x300, (0x0 as u64)); + let mut x314: u64 = 0; + let mut x315: u64 = 0; + fiat_p434_mulx_u64(&mut x314, &mut x315, x302, 0x2341f27177344); + let mut x316: u64 = 0; + let mut x317: u64 = 0; + fiat_p434_mulx_u64(&mut x316, &mut x317, x302, 0x6cfc5fd681c52056); + let mut x318: u64 = 0; + let mut x319: u64 = 0; + fiat_p434_mulx_u64(&mut x318, &mut x319, x302, 0x7bc65c783158aea3); + let mut x320: u64 = 0; + let mut x321: u64 = 0; + fiat_p434_mulx_u64(&mut x320, &mut x321, x302, 0xfdc1767ae2ffffff); + let mut x322: u64 = 0; + let mut x323: u64 = 0; + fiat_p434_mulx_u64(&mut x322, &mut x323, x302, 0xffffffffffffffff); + let mut x324: u64 = 0; + let mut x325: u64 = 0; + fiat_p434_mulx_u64(&mut x324, &mut x325, x302, 0xffffffffffffffff); + let mut x326: u64 = 0; + let mut x327: u64 = 0; + fiat_p434_mulx_u64(&mut x326, &mut x327, x302, 0xffffffffffffffff); + let mut x328: u64 = 0; + let mut x329: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x328, &mut x329, 0x0, x327, x324); + let mut x330: u64 = 0; + let mut x331: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x330, &mut x331, x329, x325, x322); + let mut x332: u64 = 0; + let mut x333: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x332, &mut x333, x331, x323, x320); + let mut x334: u64 = 0; + let mut x335: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x334, &mut x335, x333, x321, x318); + let mut x336: u64 = 0; + let mut x337: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x336, &mut x337, x335, x319, x316); + let mut x338: u64 = 0; + let mut x339: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x338, &mut x339, x337, x317, x314); + let mut x340: u64 = 0; + let mut x341: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x340, &mut x341, 0x0, x302, x326); + let mut x342: u64 = 0; + let mut x343: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x342, &mut x343, x341, x304, x328); + let mut x344: u64 = 0; + let mut x345: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x344, &mut x345, x343, x306, x330); + let mut x346: u64 = 0; + let mut x347: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x346, &mut x347, x345, x308, x332); + let mut x348: u64 = 0; + let mut x349: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x348, &mut x349, x347, x310, x334); + let mut x350: u64 = 0; + let mut x351: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x350, &mut x351, x349, x312, x336); + let mut x352: u64 = 0; + let mut x353: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x352, &mut x353, x351, ((x313 as u64) + ((x301 as u64) + ((x287 as u64) + x263))), x338); + let x354: u64 = ((x353 as u64) + ((x339 as u64) + x315)); + let mut x355: u64 = 0; + let mut x356: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x355, &mut x356, 0x0, x342, 0xffffffffffffffff); + let mut x357: u64 = 0; + let mut x358: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x357, &mut x358, x356, x344, 0xffffffffffffffff); + let mut x359: u64 = 0; + let mut x360: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x359, &mut x360, x358, x346, 0xffffffffffffffff); + let mut x361: u64 = 0; + let mut x362: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x361, &mut x362, x360, x348, 0xfdc1767ae2ffffff); + let mut x363: u64 = 0; + let mut x364: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x363, &mut x364, x362, x350, 0x7bc65c783158aea3); + let mut x365: u64 = 0; + let mut x366: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x365, &mut x366, x364, x352, 0x6cfc5fd681c52056); + let mut x367: u64 = 0; + let mut x368: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x367, &mut x368, x366, x354, 0x2341f27177344); + let mut x369: u64 = 0; + let mut x370: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x369, &mut x370, x368, (0x0 as u64), (0x0 as u64)); + let mut x371: u64 = 0; + fiat_p434_cmovznz_u64(&mut x371, x370, x355, x342); + let mut x372: u64 = 0; + fiat_p434_cmovznz_u64(&mut x372, x370, x357, x344); + let mut x373: u64 = 0; + fiat_p434_cmovznz_u64(&mut x373, x370, x359, x346); + let mut x374: u64 = 0; + fiat_p434_cmovznz_u64(&mut x374, x370, x361, x348); + let mut x375: u64 = 0; + fiat_p434_cmovznz_u64(&mut x375, x370, x363, x350); + let mut x376: u64 = 0; + fiat_p434_cmovznz_u64(&mut x376, x370, x365, x352); + let mut x377: u64 = 0; + fiat_p434_cmovznz_u64(&mut x377, x370, x367, x354); + out1[0] = x371; + out1[1] = x372; + out1[2] = x373; + out1[3] = x374; + out1[4] = x375; + out1[5] = x376; + out1[6] = x377; +} + +/// The function fiat_p434_to_montgomery translates a field element into the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = eval arg1 mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p434_to_montgomery(out1: &mut fiat_p434_montgomery_domain_field_element, arg1: &fiat_p434_non_montgomery_domain_field_element) -> () { + let x1: u64 = (arg1[1]); + let x2: u64 = (arg1[2]); + let x3: u64 = (arg1[3]); + let x4: u64 = (arg1[4]); + let x5: u64 = (arg1[5]); + let x6: u64 = (arg1[6]); + let x7: u64 = (arg1[0]); + let mut x8: u64 = 0; + let mut x9: u64 = 0; + fiat_p434_mulx_u64(&mut x8, &mut x9, x7, 0x25a89bcdd12a); + let mut x10: u64 = 0; + let mut x11: u64 = 0; + fiat_p434_mulx_u64(&mut x10, &mut x11, x7, 0x69e16a61c7686d9a); + let mut x12: u64 = 0; + let mut x13: u64 = 0; + fiat_p434_mulx_u64(&mut x12, &mut x13, x7, 0xabcd92bf2dde347e); + let mut x14: u64 = 0; + let mut x15: u64 = 0; + fiat_p434_mulx_u64(&mut x14, &mut x15, x7, 0x175cc6af8d6c7c0b); + let mut x16: u64 = 0; + let mut x17: u64 = 0; + fiat_p434_mulx_u64(&mut x16, &mut x17, x7, 0xab27973f8311688d); + let mut x18: u64 = 0; + let mut x19: u64 = 0; + fiat_p434_mulx_u64(&mut x18, &mut x19, x7, 0xacec7367768798c2); + let mut x20: u64 = 0; + let mut x21: u64 = 0; + fiat_p434_mulx_u64(&mut x20, &mut x21, x7, 0x28e55b65dcd69b30); + let mut x22: u64 = 0; + let mut x23: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x22, &mut x23, 0x0, x21, x18); + let mut x24: u64 = 0; + let mut x25: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x24, &mut x25, x23, x19, x16); + let mut x26: u64 = 0; + let mut x27: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x26, &mut x27, x25, x17, x14); + let mut x28: u64 = 0; + let mut x29: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x28, &mut x29, x27, x15, x12); + let mut x30: u64 = 0; + let mut x31: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x30, &mut x31, x29, x13, x10); + let mut x32: u64 = 0; + let mut x33: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x32, &mut x33, x31, x11, x8); + let mut x34: u64 = 0; + let mut x35: u64 = 0; + fiat_p434_mulx_u64(&mut x34, &mut x35, x20, 0x2341f27177344); + let mut x36: u64 = 0; + let mut x37: u64 = 0; + fiat_p434_mulx_u64(&mut x36, &mut x37, x20, 0x6cfc5fd681c52056); + let mut x38: u64 = 0; + let mut x39: u64 = 0; + fiat_p434_mulx_u64(&mut x38, &mut x39, x20, 0x7bc65c783158aea3); + let mut x40: u64 = 0; + let mut x41: u64 = 0; + fiat_p434_mulx_u64(&mut x40, &mut x41, x20, 0xfdc1767ae2ffffff); + let mut x42: u64 = 0; + let mut x43: u64 = 0; + fiat_p434_mulx_u64(&mut x42, &mut x43, x20, 0xffffffffffffffff); + let mut x44: u64 = 0; + let mut x45: u64 = 0; + fiat_p434_mulx_u64(&mut x44, &mut x45, x20, 0xffffffffffffffff); + let mut x46: u64 = 0; + let mut x47: u64 = 0; + fiat_p434_mulx_u64(&mut x46, &mut x47, x20, 0xffffffffffffffff); + let mut x48: u64 = 0; + let mut x49: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x48, &mut x49, 0x0, x47, x44); + let mut x50: u64 = 0; + let mut x51: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x50, &mut x51, x49, x45, x42); + let mut x52: u64 = 0; + let mut x53: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x52, &mut x53, x51, x43, x40); + let mut x54: u64 = 0; + let mut x55: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x54, &mut x55, x53, x41, x38); + let mut x56: u64 = 0; + let mut x57: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x56, &mut x57, x55, x39, x36); + let mut x58: u64 = 0; + let mut x59: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x58, &mut x59, x57, x37, x34); + let mut x60: u64 = 0; + let mut x61: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x60, &mut x61, 0x0, x20, x46); + let mut x62: u64 = 0; + let mut x63: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x62, &mut x63, x61, x22, x48); + let mut x64: u64 = 0; + let mut x65: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x64, &mut x65, x63, x24, x50); + let mut x66: u64 = 0; + let mut x67: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x66, &mut x67, x65, x26, x52); + let mut x68: u64 = 0; + let mut x69: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x68, &mut x69, x67, x28, x54); + let mut x70: u64 = 0; + let mut x71: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x70, &mut x71, x69, x30, x56); + let mut x72: u64 = 0; + let mut x73: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x72, &mut x73, x71, x32, x58); + let mut x74: u64 = 0; + let mut x75: u64 = 0; + fiat_p434_mulx_u64(&mut x74, &mut x75, x1, 0x25a89bcdd12a); + let mut x76: u64 = 0; + let mut x77: u64 = 0; + fiat_p434_mulx_u64(&mut x76, &mut x77, x1, 0x69e16a61c7686d9a); + let mut x78: u64 = 0; + let mut x79: u64 = 0; + fiat_p434_mulx_u64(&mut x78, &mut x79, x1, 0xabcd92bf2dde347e); + let mut x80: u64 = 0; + let mut x81: u64 = 0; + fiat_p434_mulx_u64(&mut x80, &mut x81, x1, 0x175cc6af8d6c7c0b); + let mut x82: u64 = 0; + let mut x83: u64 = 0; + fiat_p434_mulx_u64(&mut x82, &mut x83, x1, 0xab27973f8311688d); + let mut x84: u64 = 0; + let mut x85: u64 = 0; + fiat_p434_mulx_u64(&mut x84, &mut x85, x1, 0xacec7367768798c2); + let mut x86: u64 = 0; + let mut x87: u64 = 0; + fiat_p434_mulx_u64(&mut x86, &mut x87, x1, 0x28e55b65dcd69b30); + let mut x88: u64 = 0; + let mut x89: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x88, &mut x89, 0x0, x87, x84); + let mut x90: u64 = 0; + let mut x91: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x90, &mut x91, x89, x85, x82); + let mut x92: u64 = 0; + let mut x93: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x92, &mut x93, x91, x83, x80); + let mut x94: u64 = 0; + let mut x95: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x94, &mut x95, x93, x81, x78); + let mut x96: u64 = 0; + let mut x97: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x96, &mut x97, x95, x79, x76); + let mut x98: u64 = 0; + let mut x99: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x98, &mut x99, x97, x77, x74); + let mut x100: u64 = 0; + let mut x101: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x100, &mut x101, 0x0, x62, x86); + let mut x102: u64 = 0; + let mut x103: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x102, &mut x103, x101, x64, x88); + let mut x104: u64 = 0; + let mut x105: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x104, &mut x105, x103, x66, x90); + let mut x106: u64 = 0; + let mut x107: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x106, &mut x107, x105, x68, x92); + let mut x108: u64 = 0; + let mut x109: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x108, &mut x109, x107, x70, x94); + let mut x110: u64 = 0; + let mut x111: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x110, &mut x111, x109, x72, x96); + let mut x112: u64 = 0; + let mut x113: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x112, &mut x113, x111, (((x73 as u64) + ((x33 as u64) + x9)) + ((x59 as u64) + x35)), x98); + let mut x114: u64 = 0; + let mut x115: u64 = 0; + fiat_p434_mulx_u64(&mut x114, &mut x115, x100, 0x2341f27177344); + let mut x116: u64 = 0; + let mut x117: u64 = 0; + fiat_p434_mulx_u64(&mut x116, &mut x117, x100, 0x6cfc5fd681c52056); + let mut x118: u64 = 0; + let mut x119: u64 = 0; + fiat_p434_mulx_u64(&mut x118, &mut x119, x100, 0x7bc65c783158aea3); + let mut x120: u64 = 0; + let mut x121: u64 = 0; + fiat_p434_mulx_u64(&mut x120, &mut x121, x100, 0xfdc1767ae2ffffff); + let mut x122: u64 = 0; + let mut x123: u64 = 0; + fiat_p434_mulx_u64(&mut x122, &mut x123, x100, 0xffffffffffffffff); + let mut x124: u64 = 0; + let mut x125: u64 = 0; + fiat_p434_mulx_u64(&mut x124, &mut x125, x100, 0xffffffffffffffff); + let mut x126: u64 = 0; + let mut x127: u64 = 0; + fiat_p434_mulx_u64(&mut x126, &mut x127, x100, 0xffffffffffffffff); + let mut x128: u64 = 0; + let mut x129: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x128, &mut x129, 0x0, x127, x124); + let mut x130: u64 = 0; + let mut x131: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x130, &mut x131, x129, x125, x122); + let mut x132: u64 = 0; + let mut x133: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x132, &mut x133, x131, x123, x120); + let mut x134: u64 = 0; + let mut x135: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x134, &mut x135, x133, x121, x118); + let mut x136: u64 = 0; + let mut x137: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x136, &mut x137, x135, x119, x116); + let mut x138: u64 = 0; + let mut x139: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x138, &mut x139, x137, x117, x114); + let mut x140: u64 = 0; + let mut x141: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x140, &mut x141, 0x0, x100, x126); + let mut x142: u64 = 0; + let mut x143: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x142, &mut x143, x141, x102, x128); + let mut x144: u64 = 0; + let mut x145: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x144, &mut x145, x143, x104, x130); + let mut x146: u64 = 0; + let mut x147: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x146, &mut x147, x145, x106, x132); + let mut x148: u64 = 0; + let mut x149: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x148, &mut x149, x147, x108, x134); + let mut x150: u64 = 0; + let mut x151: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x150, &mut x151, x149, x110, x136); + let mut x152: u64 = 0; + let mut x153: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x152, &mut x153, x151, x112, x138); + let mut x154: u64 = 0; + let mut x155: u64 = 0; + fiat_p434_mulx_u64(&mut x154, &mut x155, x2, 0x25a89bcdd12a); + let mut x156: u64 = 0; + let mut x157: u64 = 0; + fiat_p434_mulx_u64(&mut x156, &mut x157, x2, 0x69e16a61c7686d9a); + let mut x158: u64 = 0; + let mut x159: u64 = 0; + fiat_p434_mulx_u64(&mut x158, &mut x159, x2, 0xabcd92bf2dde347e); + let mut x160: u64 = 0; + let mut x161: u64 = 0; + fiat_p434_mulx_u64(&mut x160, &mut x161, x2, 0x175cc6af8d6c7c0b); + let mut x162: u64 = 0; + let mut x163: u64 = 0; + fiat_p434_mulx_u64(&mut x162, &mut x163, x2, 0xab27973f8311688d); + let mut x164: u64 = 0; + let mut x165: u64 = 0; + fiat_p434_mulx_u64(&mut x164, &mut x165, x2, 0xacec7367768798c2); + let mut x166: u64 = 0; + let mut x167: u64 = 0; + fiat_p434_mulx_u64(&mut x166, &mut x167, x2, 0x28e55b65dcd69b30); + let mut x168: u64 = 0; + let mut x169: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x168, &mut x169, 0x0, x167, x164); + let mut x170: u64 = 0; + let mut x171: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x170, &mut x171, x169, x165, x162); + let mut x172: u64 = 0; + let mut x173: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x172, &mut x173, x171, x163, x160); + let mut x174: u64 = 0; + let mut x175: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x174, &mut x175, x173, x161, x158); + let mut x176: u64 = 0; + let mut x177: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x176, &mut x177, x175, x159, x156); + let mut x178: u64 = 0; + let mut x179: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x178, &mut x179, x177, x157, x154); + let mut x180: u64 = 0; + let mut x181: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x180, &mut x181, 0x0, x142, x166); + let mut x182: u64 = 0; + let mut x183: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x182, &mut x183, x181, x144, x168); + let mut x184: u64 = 0; + let mut x185: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x184, &mut x185, x183, x146, x170); + let mut x186: u64 = 0; + let mut x187: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x186, &mut x187, x185, x148, x172); + let mut x188: u64 = 0; + let mut x189: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x188, &mut x189, x187, x150, x174); + let mut x190: u64 = 0; + let mut x191: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x190, &mut x191, x189, x152, x176); + let mut x192: u64 = 0; + let mut x193: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x192, &mut x193, x191, (((x153 as u64) + ((x113 as u64) + ((x99 as u64) + x75))) + ((x139 as u64) + x115)), x178); + let mut x194: u64 = 0; + let mut x195: u64 = 0; + fiat_p434_mulx_u64(&mut x194, &mut x195, x180, 0x2341f27177344); + let mut x196: u64 = 0; + let mut x197: u64 = 0; + fiat_p434_mulx_u64(&mut x196, &mut x197, x180, 0x6cfc5fd681c52056); + let mut x198: u64 = 0; + let mut x199: u64 = 0; + fiat_p434_mulx_u64(&mut x198, &mut x199, x180, 0x7bc65c783158aea3); + let mut x200: u64 = 0; + let mut x201: u64 = 0; + fiat_p434_mulx_u64(&mut x200, &mut x201, x180, 0xfdc1767ae2ffffff); + let mut x202: u64 = 0; + let mut x203: u64 = 0; + fiat_p434_mulx_u64(&mut x202, &mut x203, x180, 0xffffffffffffffff); + let mut x204: u64 = 0; + let mut x205: u64 = 0; + fiat_p434_mulx_u64(&mut x204, &mut x205, x180, 0xffffffffffffffff); + let mut x206: u64 = 0; + let mut x207: u64 = 0; + fiat_p434_mulx_u64(&mut x206, &mut x207, x180, 0xffffffffffffffff); + let mut x208: u64 = 0; + let mut x209: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x208, &mut x209, 0x0, x207, x204); + let mut x210: u64 = 0; + let mut x211: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x210, &mut x211, x209, x205, x202); + let mut x212: u64 = 0; + let mut x213: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x212, &mut x213, x211, x203, x200); + let mut x214: u64 = 0; + let mut x215: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x214, &mut x215, x213, x201, x198); + let mut x216: u64 = 0; + let mut x217: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x216, &mut x217, x215, x199, x196); + let mut x218: u64 = 0; + let mut x219: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x218, &mut x219, x217, x197, x194); + let mut x220: u64 = 0; + let mut x221: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x220, &mut x221, 0x0, x180, x206); + let mut x222: u64 = 0; + let mut x223: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x222, &mut x223, x221, x182, x208); + let mut x224: u64 = 0; + let mut x225: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x224, &mut x225, x223, x184, x210); + let mut x226: u64 = 0; + let mut x227: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x226, &mut x227, x225, x186, x212); + let mut x228: u64 = 0; + let mut x229: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x228, &mut x229, x227, x188, x214); + let mut x230: u64 = 0; + let mut x231: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x230, &mut x231, x229, x190, x216); + let mut x232: u64 = 0; + let mut x233: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x232, &mut x233, x231, x192, x218); + let mut x234: u64 = 0; + let mut x235: u64 = 0; + fiat_p434_mulx_u64(&mut x234, &mut x235, x3, 0x25a89bcdd12a); + let mut x236: u64 = 0; + let mut x237: u64 = 0; + fiat_p434_mulx_u64(&mut x236, &mut x237, x3, 0x69e16a61c7686d9a); + let mut x238: u64 = 0; + let mut x239: u64 = 0; + fiat_p434_mulx_u64(&mut x238, &mut x239, x3, 0xabcd92bf2dde347e); + let mut x240: u64 = 0; + let mut x241: u64 = 0; + fiat_p434_mulx_u64(&mut x240, &mut x241, x3, 0x175cc6af8d6c7c0b); + let mut x242: u64 = 0; + let mut x243: u64 = 0; + fiat_p434_mulx_u64(&mut x242, &mut x243, x3, 0xab27973f8311688d); + let mut x244: u64 = 0; + let mut x245: u64 = 0; + fiat_p434_mulx_u64(&mut x244, &mut x245, x3, 0xacec7367768798c2); + let mut x246: u64 = 0; + let mut x247: u64 = 0; + fiat_p434_mulx_u64(&mut x246, &mut x247, x3, 0x28e55b65dcd69b30); + let mut x248: u64 = 0; + let mut x249: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x248, &mut x249, 0x0, x247, x244); + let mut x250: u64 = 0; + let mut x251: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x250, &mut x251, x249, x245, x242); + let mut x252: u64 = 0; + let mut x253: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x252, &mut x253, x251, x243, x240); + let mut x254: u64 = 0; + let mut x255: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x254, &mut x255, x253, x241, x238); + let mut x256: u64 = 0; + let mut x257: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x256, &mut x257, x255, x239, x236); + let mut x258: u64 = 0; + let mut x259: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x258, &mut x259, x257, x237, x234); + let mut x260: u64 = 0; + let mut x261: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x260, &mut x261, 0x0, x222, x246); + let mut x262: u64 = 0; + let mut x263: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x262, &mut x263, x261, x224, x248); + let mut x264: u64 = 0; + let mut x265: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x264, &mut x265, x263, x226, x250); + let mut x266: u64 = 0; + let mut x267: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x266, &mut x267, x265, x228, x252); + let mut x268: u64 = 0; + let mut x269: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x268, &mut x269, x267, x230, x254); + let mut x270: u64 = 0; + let mut x271: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x270, &mut x271, x269, x232, x256); + let mut x272: u64 = 0; + let mut x273: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x272, &mut x273, x271, (((x233 as u64) + ((x193 as u64) + ((x179 as u64) + x155))) + ((x219 as u64) + x195)), x258); + let mut x274: u64 = 0; + let mut x275: u64 = 0; + fiat_p434_mulx_u64(&mut x274, &mut x275, x260, 0x2341f27177344); + let mut x276: u64 = 0; + let mut x277: u64 = 0; + fiat_p434_mulx_u64(&mut x276, &mut x277, x260, 0x6cfc5fd681c52056); + let mut x278: u64 = 0; + let mut x279: u64 = 0; + fiat_p434_mulx_u64(&mut x278, &mut x279, x260, 0x7bc65c783158aea3); + let mut x280: u64 = 0; + let mut x281: u64 = 0; + fiat_p434_mulx_u64(&mut x280, &mut x281, x260, 0xfdc1767ae2ffffff); + let mut x282: u64 = 0; + let mut x283: u64 = 0; + fiat_p434_mulx_u64(&mut x282, &mut x283, x260, 0xffffffffffffffff); + let mut x284: u64 = 0; + let mut x285: u64 = 0; + fiat_p434_mulx_u64(&mut x284, &mut x285, x260, 0xffffffffffffffff); + let mut x286: u64 = 0; + let mut x287: u64 = 0; + fiat_p434_mulx_u64(&mut x286, &mut x287, x260, 0xffffffffffffffff); + let mut x288: u64 = 0; + let mut x289: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x288, &mut x289, 0x0, x287, x284); + let mut x290: u64 = 0; + let mut x291: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x290, &mut x291, x289, x285, x282); + let mut x292: u64 = 0; + let mut x293: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x292, &mut x293, x291, x283, x280); + let mut x294: u64 = 0; + let mut x295: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x294, &mut x295, x293, x281, x278); + let mut x296: u64 = 0; + let mut x297: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x296, &mut x297, x295, x279, x276); + let mut x298: u64 = 0; + let mut x299: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x298, &mut x299, x297, x277, x274); + let mut x300: u64 = 0; + let mut x301: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x300, &mut x301, 0x0, x260, x286); + let mut x302: u64 = 0; + let mut x303: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x302, &mut x303, x301, x262, x288); + let mut x304: u64 = 0; + let mut x305: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x304, &mut x305, x303, x264, x290); + let mut x306: u64 = 0; + let mut x307: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x306, &mut x307, x305, x266, x292); + let mut x308: u64 = 0; + let mut x309: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x308, &mut x309, x307, x268, x294); + let mut x310: u64 = 0; + let mut x311: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x310, &mut x311, x309, x270, x296); + let mut x312: u64 = 0; + let mut x313: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x312, &mut x313, x311, x272, x298); + let mut x314: u64 = 0; + let mut x315: u64 = 0; + fiat_p434_mulx_u64(&mut x314, &mut x315, x4, 0x25a89bcdd12a); + let mut x316: u64 = 0; + let mut x317: u64 = 0; + fiat_p434_mulx_u64(&mut x316, &mut x317, x4, 0x69e16a61c7686d9a); + let mut x318: u64 = 0; + let mut x319: u64 = 0; + fiat_p434_mulx_u64(&mut x318, &mut x319, x4, 0xabcd92bf2dde347e); + let mut x320: u64 = 0; + let mut x321: u64 = 0; + fiat_p434_mulx_u64(&mut x320, &mut x321, x4, 0x175cc6af8d6c7c0b); + let mut x322: u64 = 0; + let mut x323: u64 = 0; + fiat_p434_mulx_u64(&mut x322, &mut x323, x4, 0xab27973f8311688d); + let mut x324: u64 = 0; + let mut x325: u64 = 0; + fiat_p434_mulx_u64(&mut x324, &mut x325, x4, 0xacec7367768798c2); + let mut x326: u64 = 0; + let mut x327: u64 = 0; + fiat_p434_mulx_u64(&mut x326, &mut x327, x4, 0x28e55b65dcd69b30); + let mut x328: u64 = 0; + let mut x329: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x328, &mut x329, 0x0, x327, x324); + let mut x330: u64 = 0; + let mut x331: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x330, &mut x331, x329, x325, x322); + let mut x332: u64 = 0; + let mut x333: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x332, &mut x333, x331, x323, x320); + let mut x334: u64 = 0; + let mut x335: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x334, &mut x335, x333, x321, x318); + let mut x336: u64 = 0; + let mut x337: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x336, &mut x337, x335, x319, x316); + let mut x338: u64 = 0; + let mut x339: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x338, &mut x339, x337, x317, x314); + let mut x340: u64 = 0; + let mut x341: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x340, &mut x341, 0x0, x302, x326); + let mut x342: u64 = 0; + let mut x343: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x342, &mut x343, x341, x304, x328); + let mut x344: u64 = 0; + let mut x345: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x344, &mut x345, x343, x306, x330); + let mut x346: u64 = 0; + let mut x347: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x346, &mut x347, x345, x308, x332); + let mut x348: u64 = 0; + let mut x349: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x348, &mut x349, x347, x310, x334); + let mut x350: u64 = 0; + let mut x351: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x350, &mut x351, x349, x312, x336); + let mut x352: u64 = 0; + let mut x353: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x352, &mut x353, x351, (((x313 as u64) + ((x273 as u64) + ((x259 as u64) + x235))) + ((x299 as u64) + x275)), x338); + let mut x354: u64 = 0; + let mut x355: u64 = 0; + fiat_p434_mulx_u64(&mut x354, &mut x355, x340, 0x2341f27177344); + let mut x356: u64 = 0; + let mut x357: u64 = 0; + fiat_p434_mulx_u64(&mut x356, &mut x357, x340, 0x6cfc5fd681c52056); + let mut x358: u64 = 0; + let mut x359: u64 = 0; + fiat_p434_mulx_u64(&mut x358, &mut x359, x340, 0x7bc65c783158aea3); + let mut x360: u64 = 0; + let mut x361: u64 = 0; + fiat_p434_mulx_u64(&mut x360, &mut x361, x340, 0xfdc1767ae2ffffff); + let mut x362: u64 = 0; + let mut x363: u64 = 0; + fiat_p434_mulx_u64(&mut x362, &mut x363, x340, 0xffffffffffffffff); + let mut x364: u64 = 0; + let mut x365: u64 = 0; + fiat_p434_mulx_u64(&mut x364, &mut x365, x340, 0xffffffffffffffff); + let mut x366: u64 = 0; + let mut x367: u64 = 0; + fiat_p434_mulx_u64(&mut x366, &mut x367, x340, 0xffffffffffffffff); + let mut x368: u64 = 0; + let mut x369: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x368, &mut x369, 0x0, x367, x364); + let mut x370: u64 = 0; + let mut x371: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x370, &mut x371, x369, x365, x362); + let mut x372: u64 = 0; + let mut x373: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x372, &mut x373, x371, x363, x360); + let mut x374: u64 = 0; + let mut x375: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x374, &mut x375, x373, x361, x358); + let mut x376: u64 = 0; + let mut x377: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x376, &mut x377, x375, x359, x356); + let mut x378: u64 = 0; + let mut x379: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x378, &mut x379, x377, x357, x354); + let mut x380: u64 = 0; + let mut x381: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x380, &mut x381, 0x0, x340, x366); + let mut x382: u64 = 0; + let mut x383: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x382, &mut x383, x381, x342, x368); + let mut x384: u64 = 0; + let mut x385: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x384, &mut x385, x383, x344, x370); + let mut x386: u64 = 0; + let mut x387: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x386, &mut x387, x385, x346, x372); + let mut x388: u64 = 0; + let mut x389: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x388, &mut x389, x387, x348, x374); + let mut x390: u64 = 0; + let mut x391: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x390, &mut x391, x389, x350, x376); + let mut x392: u64 = 0; + let mut x393: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x392, &mut x393, x391, x352, x378); + let mut x394: u64 = 0; + let mut x395: u64 = 0; + fiat_p434_mulx_u64(&mut x394, &mut x395, x5, 0x25a89bcdd12a); + let mut x396: u64 = 0; + let mut x397: u64 = 0; + fiat_p434_mulx_u64(&mut x396, &mut x397, x5, 0x69e16a61c7686d9a); + let mut x398: u64 = 0; + let mut x399: u64 = 0; + fiat_p434_mulx_u64(&mut x398, &mut x399, x5, 0xabcd92bf2dde347e); + let mut x400: u64 = 0; + let mut x401: u64 = 0; + fiat_p434_mulx_u64(&mut x400, &mut x401, x5, 0x175cc6af8d6c7c0b); + let mut x402: u64 = 0; + let mut x403: u64 = 0; + fiat_p434_mulx_u64(&mut x402, &mut x403, x5, 0xab27973f8311688d); + let mut x404: u64 = 0; + let mut x405: u64 = 0; + fiat_p434_mulx_u64(&mut x404, &mut x405, x5, 0xacec7367768798c2); + let mut x406: u64 = 0; + let mut x407: u64 = 0; + fiat_p434_mulx_u64(&mut x406, &mut x407, x5, 0x28e55b65dcd69b30); + let mut x408: u64 = 0; + let mut x409: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x408, &mut x409, 0x0, x407, x404); + let mut x410: u64 = 0; + let mut x411: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x410, &mut x411, x409, x405, x402); + let mut x412: u64 = 0; + let mut x413: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x412, &mut x413, x411, x403, x400); + let mut x414: u64 = 0; + let mut x415: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x414, &mut x415, x413, x401, x398); + let mut x416: u64 = 0; + let mut x417: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x416, &mut x417, x415, x399, x396); + let mut x418: u64 = 0; + let mut x419: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x418, &mut x419, x417, x397, x394); + let mut x420: u64 = 0; + let mut x421: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x420, &mut x421, 0x0, x382, x406); + let mut x422: u64 = 0; + let mut x423: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x422, &mut x423, x421, x384, x408); + let mut x424: u64 = 0; + let mut x425: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x424, &mut x425, x423, x386, x410); + let mut x426: u64 = 0; + let mut x427: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x426, &mut x427, x425, x388, x412); + let mut x428: u64 = 0; + let mut x429: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x428, &mut x429, x427, x390, x414); + let mut x430: u64 = 0; + let mut x431: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x430, &mut x431, x429, x392, x416); + let mut x432: u64 = 0; + let mut x433: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x432, &mut x433, x431, (((x393 as u64) + ((x353 as u64) + ((x339 as u64) + x315))) + ((x379 as u64) + x355)), x418); + let mut x434: u64 = 0; + let mut x435: u64 = 0; + fiat_p434_mulx_u64(&mut x434, &mut x435, x420, 0x2341f27177344); + let mut x436: u64 = 0; + let mut x437: u64 = 0; + fiat_p434_mulx_u64(&mut x436, &mut x437, x420, 0x6cfc5fd681c52056); + let mut x438: u64 = 0; + let mut x439: u64 = 0; + fiat_p434_mulx_u64(&mut x438, &mut x439, x420, 0x7bc65c783158aea3); + let mut x440: u64 = 0; + let mut x441: u64 = 0; + fiat_p434_mulx_u64(&mut x440, &mut x441, x420, 0xfdc1767ae2ffffff); + let mut x442: u64 = 0; + let mut x443: u64 = 0; + fiat_p434_mulx_u64(&mut x442, &mut x443, x420, 0xffffffffffffffff); + let mut x444: u64 = 0; + let mut x445: u64 = 0; + fiat_p434_mulx_u64(&mut x444, &mut x445, x420, 0xffffffffffffffff); + let mut x446: u64 = 0; + let mut x447: u64 = 0; + fiat_p434_mulx_u64(&mut x446, &mut x447, x420, 0xffffffffffffffff); + let mut x448: u64 = 0; + let mut x449: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x448, &mut x449, 0x0, x447, x444); + let mut x450: u64 = 0; + let mut x451: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x450, &mut x451, x449, x445, x442); + let mut x452: u64 = 0; + let mut x453: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x452, &mut x453, x451, x443, x440); + let mut x454: u64 = 0; + let mut x455: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x454, &mut x455, x453, x441, x438); + let mut x456: u64 = 0; + let mut x457: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x456, &mut x457, x455, x439, x436); + let mut x458: u64 = 0; + let mut x459: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x458, &mut x459, x457, x437, x434); + let mut x460: u64 = 0; + let mut x461: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x460, &mut x461, 0x0, x420, x446); + let mut x462: u64 = 0; + let mut x463: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x462, &mut x463, x461, x422, x448); + let mut x464: u64 = 0; + let mut x465: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x464, &mut x465, x463, x424, x450); + let mut x466: u64 = 0; + let mut x467: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x466, &mut x467, x465, x426, x452); + let mut x468: u64 = 0; + let mut x469: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x468, &mut x469, x467, x428, x454); + let mut x470: u64 = 0; + let mut x471: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x470, &mut x471, x469, x430, x456); + let mut x472: u64 = 0; + let mut x473: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x472, &mut x473, x471, x432, x458); + let mut x474: u64 = 0; + let mut x475: u64 = 0; + fiat_p434_mulx_u64(&mut x474, &mut x475, x6, 0x25a89bcdd12a); + let mut x476: u64 = 0; + let mut x477: u64 = 0; + fiat_p434_mulx_u64(&mut x476, &mut x477, x6, 0x69e16a61c7686d9a); + let mut x478: u64 = 0; + let mut x479: u64 = 0; + fiat_p434_mulx_u64(&mut x478, &mut x479, x6, 0xabcd92bf2dde347e); + let mut x480: u64 = 0; + let mut x481: u64 = 0; + fiat_p434_mulx_u64(&mut x480, &mut x481, x6, 0x175cc6af8d6c7c0b); + let mut x482: u64 = 0; + let mut x483: u64 = 0; + fiat_p434_mulx_u64(&mut x482, &mut x483, x6, 0xab27973f8311688d); + let mut x484: u64 = 0; + let mut x485: u64 = 0; + fiat_p434_mulx_u64(&mut x484, &mut x485, x6, 0xacec7367768798c2); + let mut x486: u64 = 0; + let mut x487: u64 = 0; + fiat_p434_mulx_u64(&mut x486, &mut x487, x6, 0x28e55b65dcd69b30); + let mut x488: u64 = 0; + let mut x489: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x488, &mut x489, 0x0, x487, x484); + let mut x490: u64 = 0; + let mut x491: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x490, &mut x491, x489, x485, x482); + let mut x492: u64 = 0; + let mut x493: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x492, &mut x493, x491, x483, x480); + let mut x494: u64 = 0; + let mut x495: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x494, &mut x495, x493, x481, x478); + let mut x496: u64 = 0; + let mut x497: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x496, &mut x497, x495, x479, x476); + let mut x498: u64 = 0; + let mut x499: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x498, &mut x499, x497, x477, x474); + let mut x500: u64 = 0; + let mut x501: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x500, &mut x501, 0x0, x462, x486); + let mut x502: u64 = 0; + let mut x503: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x502, &mut x503, x501, x464, x488); + let mut x504: u64 = 0; + let mut x505: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x504, &mut x505, x503, x466, x490); + let mut x506: u64 = 0; + let mut x507: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x506, &mut x507, x505, x468, x492); + let mut x508: u64 = 0; + let mut x509: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x508, &mut x509, x507, x470, x494); + let mut x510: u64 = 0; + let mut x511: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x510, &mut x511, x509, x472, x496); + let mut x512: u64 = 0; + let mut x513: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x512, &mut x513, x511, (((x473 as u64) + ((x433 as u64) + ((x419 as u64) + x395))) + ((x459 as u64) + x435)), x498); + let mut x514: u64 = 0; + let mut x515: u64 = 0; + fiat_p434_mulx_u64(&mut x514, &mut x515, x500, 0x2341f27177344); + let mut x516: u64 = 0; + let mut x517: u64 = 0; + fiat_p434_mulx_u64(&mut x516, &mut x517, x500, 0x6cfc5fd681c52056); + let mut x518: u64 = 0; + let mut x519: u64 = 0; + fiat_p434_mulx_u64(&mut x518, &mut x519, x500, 0x7bc65c783158aea3); + let mut x520: u64 = 0; + let mut x521: u64 = 0; + fiat_p434_mulx_u64(&mut x520, &mut x521, x500, 0xfdc1767ae2ffffff); + let mut x522: u64 = 0; + let mut x523: u64 = 0; + fiat_p434_mulx_u64(&mut x522, &mut x523, x500, 0xffffffffffffffff); + let mut x524: u64 = 0; + let mut x525: u64 = 0; + fiat_p434_mulx_u64(&mut x524, &mut x525, x500, 0xffffffffffffffff); + let mut x526: u64 = 0; + let mut x527: u64 = 0; + fiat_p434_mulx_u64(&mut x526, &mut x527, x500, 0xffffffffffffffff); + let mut x528: u64 = 0; + let mut x529: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x528, &mut x529, 0x0, x527, x524); + let mut x530: u64 = 0; + let mut x531: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x530, &mut x531, x529, x525, x522); + let mut x532: u64 = 0; + let mut x533: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x532, &mut x533, x531, x523, x520); + let mut x534: u64 = 0; + let mut x535: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x534, &mut x535, x533, x521, x518); + let mut x536: u64 = 0; + let mut x537: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x536, &mut x537, x535, x519, x516); + let mut x538: u64 = 0; + let mut x539: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x538, &mut x539, x537, x517, x514); + let mut x540: u64 = 0; + let mut x541: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x540, &mut x541, 0x0, x500, x526); + let mut x542: u64 = 0; + let mut x543: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x542, &mut x543, x541, x502, x528); + let mut x544: u64 = 0; + let mut x545: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x544, &mut x545, x543, x504, x530); + let mut x546: u64 = 0; + let mut x547: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x546, &mut x547, x545, x506, x532); + let mut x548: u64 = 0; + let mut x549: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x548, &mut x549, x547, x508, x534); + let mut x550: u64 = 0; + let mut x551: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x550, &mut x551, x549, x510, x536); + let mut x552: u64 = 0; + let mut x553: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x552, &mut x553, x551, x512, x538); + let x554: u64 = (((x553 as u64) + ((x513 as u64) + ((x499 as u64) + x475))) + ((x539 as u64) + x515)); + let mut x555: u64 = 0; + let mut x556: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x555, &mut x556, 0x0, x542, 0xffffffffffffffff); + let mut x557: u64 = 0; + let mut x558: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x557, &mut x558, x556, x544, 0xffffffffffffffff); + let mut x559: u64 = 0; + let mut x560: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x559, &mut x560, x558, x546, 0xffffffffffffffff); + let mut x561: u64 = 0; + let mut x562: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x561, &mut x562, x560, x548, 0xfdc1767ae2ffffff); + let mut x563: u64 = 0; + let mut x564: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x563, &mut x564, x562, x550, 0x7bc65c783158aea3); + let mut x565: u64 = 0; + let mut x566: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x565, &mut x566, x564, x552, 0x6cfc5fd681c52056); + let mut x567: u64 = 0; + let mut x568: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x567, &mut x568, x566, x554, 0x2341f27177344); + let mut x569: u64 = 0; + let mut x570: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x569, &mut x570, x568, (0x0 as u64), (0x0 as u64)); + let mut x571: u64 = 0; + fiat_p434_cmovznz_u64(&mut x571, x570, x555, x542); + let mut x572: u64 = 0; + fiat_p434_cmovznz_u64(&mut x572, x570, x557, x544); + let mut x573: u64 = 0; + fiat_p434_cmovznz_u64(&mut x573, x570, x559, x546); + let mut x574: u64 = 0; + fiat_p434_cmovznz_u64(&mut x574, x570, x561, x548); + let mut x575: u64 = 0; + fiat_p434_cmovznz_u64(&mut x575, x570, x563, x550); + let mut x576: u64 = 0; + fiat_p434_cmovznz_u64(&mut x576, x570, x565, x552); + let mut x577: u64 = 0; + fiat_p434_cmovznz_u64(&mut x577, x570, x567, x554); + out1[0] = x571; + out1[1] = x572; + out1[2] = x573; + out1[3] = x574; + out1[4] = x575; + out1[5] = x576; + out1[6] = x577; +} + +/// The function fiat_p434_nonzero outputs a single non-zero word if the input is non-zero and zero otherwise. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// out1 = 0 ↔ eval (from_montgomery arg1) mod m = 0 +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +#[inline] +pub fn fiat_p434_nonzero(out1: &mut u64, arg1: &[u64; 7]) -> () { + let x1: u64 = ((arg1[0]) | ((arg1[1]) | ((arg1[2]) | ((arg1[3]) | ((arg1[4]) | ((arg1[5]) | (arg1[6]))))))); + *out1 = x1; +} + +/// The function fiat_p434_selectznz is a multi-limb conditional select. +/// +/// Postconditions: +/// out1 = (if arg1 = 0 then arg2 else arg3) +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +#[inline] +pub fn fiat_p434_selectznz(out1: &mut [u64; 7], arg1: fiat_p434_u1, arg2: &[u64; 7], arg3: &[u64; 7]) -> () { + let mut x1: u64 = 0; + fiat_p434_cmovznz_u64(&mut x1, arg1, (arg2[0]), (arg3[0])); + let mut x2: u64 = 0; + fiat_p434_cmovznz_u64(&mut x2, arg1, (arg2[1]), (arg3[1])); + let mut x3: u64 = 0; + fiat_p434_cmovznz_u64(&mut x3, arg1, (arg2[2]), (arg3[2])); + let mut x4: u64 = 0; + fiat_p434_cmovznz_u64(&mut x4, arg1, (arg2[3]), (arg3[3])); + let mut x5: u64 = 0; + fiat_p434_cmovznz_u64(&mut x5, arg1, (arg2[4]), (arg3[4])); + let mut x6: u64 = 0; + fiat_p434_cmovznz_u64(&mut x6, arg1, (arg2[5]), (arg3[5])); + let mut x7: u64 = 0; + fiat_p434_cmovznz_u64(&mut x7, arg1, (arg2[6]), (arg3[6])); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; + out1[3] = x4; + out1[4] = x5; + out1[5] = x6; + out1[6] = x7; +} + +/// The function fiat_p434_to_bytes serializes a field element NOT in the Montgomery domain to bytes in little-endian order. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..54] +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0x3ffffffffffff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0x3]] +#[inline] +pub fn fiat_p434_to_bytes(out1: &mut [u8; 55], arg1: &[u64; 7]) -> () { + let x1: u64 = (arg1[6]); + let x2: u64 = (arg1[5]); + let x3: u64 = (arg1[4]); + let x4: u64 = (arg1[3]); + let x5: u64 = (arg1[2]); + let x6: u64 = (arg1[1]); + let x7: u64 = (arg1[0]); + let x8: u8 = ((x7 & (0xff as u64)) as u8); + let x9: u64 = (x7 >> 8); + let x10: u8 = ((x9 & (0xff as u64)) as u8); + let x11: u64 = (x9 >> 8); + let x12: u8 = ((x11 & (0xff as u64)) as u8); + let x13: u64 = (x11 >> 8); + let x14: u8 = ((x13 & (0xff as u64)) as u8); + let x15: u64 = (x13 >> 8); + let x16: u8 = ((x15 & (0xff as u64)) as u8); + let x17: u64 = (x15 >> 8); + let x18: u8 = ((x17 & (0xff as u64)) as u8); + let x19: u64 = (x17 >> 8); + let x20: u8 = ((x19 & (0xff as u64)) as u8); + let x21: u8 = ((x19 >> 8) as u8); + let x22: u8 = ((x6 & (0xff as u64)) as u8); + let x23: u64 = (x6 >> 8); + let x24: u8 = ((x23 & (0xff as u64)) as u8); + let x25: u64 = (x23 >> 8); + let x26: u8 = ((x25 & (0xff as u64)) as u8); + let x27: u64 = (x25 >> 8); + let x28: u8 = ((x27 & (0xff as u64)) as u8); + let x29: u64 = (x27 >> 8); + let x30: u8 = ((x29 & (0xff as u64)) as u8); + let x31: u64 = (x29 >> 8); + let x32: u8 = ((x31 & (0xff as u64)) as u8); + let x33: u64 = (x31 >> 8); + let x34: u8 = ((x33 & (0xff as u64)) as u8); + let x35: u8 = ((x33 >> 8) as u8); + let x36: u8 = ((x5 & (0xff as u64)) as u8); + let x37: u64 = (x5 >> 8); + let x38: u8 = ((x37 & (0xff as u64)) as u8); + let x39: u64 = (x37 >> 8); + let x40: u8 = ((x39 & (0xff as u64)) as u8); + let x41: u64 = (x39 >> 8); + let x42: u8 = ((x41 & (0xff as u64)) as u8); + let x43: u64 = (x41 >> 8); + let x44: u8 = ((x43 & (0xff as u64)) as u8); + let x45: u64 = (x43 >> 8); + let x46: u8 = ((x45 & (0xff as u64)) as u8); + let x47: u64 = (x45 >> 8); + let x48: u8 = ((x47 & (0xff as u64)) as u8); + let x49: u8 = ((x47 >> 8) as u8); + let x50: u8 = ((x4 & (0xff as u64)) as u8); + let x51: u64 = (x4 >> 8); + let x52: u8 = ((x51 & (0xff as u64)) as u8); + let x53: u64 = (x51 >> 8); + let x54: u8 = ((x53 & (0xff as u64)) as u8); + let x55: u64 = (x53 >> 8); + let x56: u8 = ((x55 & (0xff as u64)) as u8); + let x57: u64 = (x55 >> 8); + let x58: u8 = ((x57 & (0xff as u64)) as u8); + let x59: u64 = (x57 >> 8); + let x60: u8 = ((x59 & (0xff as u64)) as u8); + let x61: u64 = (x59 >> 8); + let x62: u8 = ((x61 & (0xff as u64)) as u8); + let x63: u8 = ((x61 >> 8) as u8); + let x64: u8 = ((x3 & (0xff as u64)) as u8); + let x65: u64 = (x3 >> 8); + let x66: u8 = ((x65 & (0xff as u64)) as u8); + let x67: u64 = (x65 >> 8); + let x68: u8 = ((x67 & (0xff as u64)) as u8); + let x69: u64 = (x67 >> 8); + let x70: u8 = ((x69 & (0xff as u64)) as u8); + let x71: u64 = (x69 >> 8); + let x72: u8 = ((x71 & (0xff as u64)) as u8); + let x73: u64 = (x71 >> 8); + let x74: u8 = ((x73 & (0xff as u64)) as u8); + let x75: u64 = (x73 >> 8); + let x76: u8 = ((x75 & (0xff as u64)) as u8); + let x77: u8 = ((x75 >> 8) as u8); + let x78: u8 = ((x2 & (0xff as u64)) as u8); + let x79: u64 = (x2 >> 8); + let x80: u8 = ((x79 & (0xff as u64)) as u8); + let x81: u64 = (x79 >> 8); + let x82: u8 = ((x81 & (0xff as u64)) as u8); + let x83: u64 = (x81 >> 8); + let x84: u8 = ((x83 & (0xff as u64)) as u8); + let x85: u64 = (x83 >> 8); + let x86: u8 = ((x85 & (0xff as u64)) as u8); + let x87: u64 = (x85 >> 8); + let x88: u8 = ((x87 & (0xff as u64)) as u8); + let x89: u64 = (x87 >> 8); + let x90: u8 = ((x89 & (0xff as u64)) as u8); + let x91: u8 = ((x89 >> 8) as u8); + let x92: u8 = ((x1 & (0xff as u64)) as u8); + let x93: u64 = (x1 >> 8); + let x94: u8 = ((x93 & (0xff as u64)) as u8); + let x95: u64 = (x93 >> 8); + let x96: u8 = ((x95 & (0xff as u64)) as u8); + let x97: u64 = (x95 >> 8); + let x98: u8 = ((x97 & (0xff as u64)) as u8); + let x99: u64 = (x97 >> 8); + let x100: u8 = ((x99 & (0xff as u64)) as u8); + let x101: u64 = (x99 >> 8); + let x102: u8 = ((x101 & (0xff as u64)) as u8); + let x103: u8 = ((x101 >> 8) as u8); + out1[0] = x8; + out1[1] = x10; + out1[2] = x12; + out1[3] = x14; + out1[4] = x16; + out1[5] = x18; + out1[6] = x20; + out1[7] = x21; + out1[8] = x22; + out1[9] = x24; + out1[10] = x26; + out1[11] = x28; + out1[12] = x30; + out1[13] = x32; + out1[14] = x34; + out1[15] = x35; + out1[16] = x36; + out1[17] = x38; + out1[18] = x40; + out1[19] = x42; + out1[20] = x44; + out1[21] = x46; + out1[22] = x48; + out1[23] = x49; + out1[24] = x50; + out1[25] = x52; + out1[26] = x54; + out1[27] = x56; + out1[28] = x58; + out1[29] = x60; + out1[30] = x62; + out1[31] = x63; + out1[32] = x64; + out1[33] = x66; + out1[34] = x68; + out1[35] = x70; + out1[36] = x72; + out1[37] = x74; + out1[38] = x76; + out1[39] = x77; + out1[40] = x78; + out1[41] = x80; + out1[42] = x82; + out1[43] = x84; + out1[44] = x86; + out1[45] = x88; + out1[46] = x90; + out1[47] = x91; + out1[48] = x92; + out1[49] = x94; + out1[50] = x96; + out1[51] = x98; + out1[52] = x100; + out1[53] = x102; + out1[54] = x103; +} + +/// The function fiat_p434_from_bytes deserializes a field element NOT in the Montgomery domain from bytes in little-endian order. +/// +/// Preconditions: +/// 0 ≤ bytes_eval arg1 < m +/// Postconditions: +/// eval out1 mod m = bytes_eval arg1 mod m +/// 0 ≤ eval out1 < m +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0x3]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0x3ffffffffffff]] +#[inline] +pub fn fiat_p434_from_bytes(out1: &mut [u64; 7], arg1: &[u8; 55]) -> () { + let x1: u64 = (((arg1[54]) as u64) << 48); + let x2: u64 = (((arg1[53]) as u64) << 40); + let x3: u64 = (((arg1[52]) as u64) << 32); + let x4: u64 = (((arg1[51]) as u64) << 24); + let x5: u64 = (((arg1[50]) as u64) << 16); + let x6: u64 = (((arg1[49]) as u64) << 8); + let x7: u8 = (arg1[48]); + let x8: u64 = (((arg1[47]) as u64) << 56); + let x9: u64 = (((arg1[46]) as u64) << 48); + let x10: u64 = (((arg1[45]) as u64) << 40); + let x11: u64 = (((arg1[44]) as u64) << 32); + let x12: u64 = (((arg1[43]) as u64) << 24); + let x13: u64 = (((arg1[42]) as u64) << 16); + let x14: u64 = (((arg1[41]) as u64) << 8); + let x15: u8 = (arg1[40]); + let x16: u64 = (((arg1[39]) as u64) << 56); + let x17: u64 = (((arg1[38]) as u64) << 48); + let x18: u64 = (((arg1[37]) as u64) << 40); + let x19: u64 = (((arg1[36]) as u64) << 32); + let x20: u64 = (((arg1[35]) as u64) << 24); + let x21: u64 = (((arg1[34]) as u64) << 16); + let x22: u64 = (((arg1[33]) as u64) << 8); + let x23: u8 = (arg1[32]); + let x24: u64 = (((arg1[31]) as u64) << 56); + let x25: u64 = (((arg1[30]) as u64) << 48); + let x26: u64 = (((arg1[29]) as u64) << 40); + let x27: u64 = (((arg1[28]) as u64) << 32); + let x28: u64 = (((arg1[27]) as u64) << 24); + let x29: u64 = (((arg1[26]) as u64) << 16); + let x30: u64 = (((arg1[25]) as u64) << 8); + let x31: u8 = (arg1[24]); + let x32: u64 = (((arg1[23]) as u64) << 56); + let x33: u64 = (((arg1[22]) as u64) << 48); + let x34: u64 = (((arg1[21]) as u64) << 40); + let x35: u64 = (((arg1[20]) as u64) << 32); + let x36: u64 = (((arg1[19]) as u64) << 24); + let x37: u64 = (((arg1[18]) as u64) << 16); + let x38: u64 = (((arg1[17]) as u64) << 8); + let x39: u8 = (arg1[16]); + let x40: u64 = (((arg1[15]) as u64) << 56); + let x41: u64 = (((arg1[14]) as u64) << 48); + let x42: u64 = (((arg1[13]) as u64) << 40); + let x43: u64 = (((arg1[12]) as u64) << 32); + let x44: u64 = (((arg1[11]) as u64) << 24); + let x45: u64 = (((arg1[10]) as u64) << 16); + let x46: u64 = (((arg1[9]) as u64) << 8); + let x47: u8 = (arg1[8]); + let x48: u64 = (((arg1[7]) as u64) << 56); + let x49: u64 = (((arg1[6]) as u64) << 48); + let x50: u64 = (((arg1[5]) as u64) << 40); + let x51: u64 = (((arg1[4]) as u64) << 32); + let x52: u64 = (((arg1[3]) as u64) << 24); + let x53: u64 = (((arg1[2]) as u64) << 16); + let x54: u64 = (((arg1[1]) as u64) << 8); + let x55: u8 = (arg1[0]); + let x56: u64 = (x54 + (x55 as u64)); + let x57: u64 = (x53 + x56); + let x58: u64 = (x52 + x57); + let x59: u64 = (x51 + x58); + let x60: u64 = (x50 + x59); + let x61: u64 = (x49 + x60); + let x62: u64 = (x48 + x61); + let x63: u64 = (x46 + (x47 as u64)); + let x64: u64 = (x45 + x63); + let x65: u64 = (x44 + x64); + let x66: u64 = (x43 + x65); + let x67: u64 = (x42 + x66); + let x68: u64 = (x41 + x67); + let x69: u64 = (x40 + x68); + let x70: u64 = (x38 + (x39 as u64)); + let x71: u64 = (x37 + x70); + let x72: u64 = (x36 + x71); + let x73: u64 = (x35 + x72); + let x74: u64 = (x34 + x73); + let x75: u64 = (x33 + x74); + let x76: u64 = (x32 + x75); + let x77: u64 = (x30 + (x31 as u64)); + let x78: u64 = (x29 + x77); + let x79: u64 = (x28 + x78); + let x80: u64 = (x27 + x79); + let x81: u64 = (x26 + x80); + let x82: u64 = (x25 + x81); + let x83: u64 = (x24 + x82); + let x84: u64 = (x22 + (x23 as u64)); + let x85: u64 = (x21 + x84); + let x86: u64 = (x20 + x85); + let x87: u64 = (x19 + x86); + let x88: u64 = (x18 + x87); + let x89: u64 = (x17 + x88); + let x90: u64 = (x16 + x89); + let x91: u64 = (x14 + (x15 as u64)); + let x92: u64 = (x13 + x91); + let x93: u64 = (x12 + x92); + let x94: u64 = (x11 + x93); + let x95: u64 = (x10 + x94); + let x96: u64 = (x9 + x95); + let x97: u64 = (x8 + x96); + let x98: u64 = (x6 + (x7 as u64)); + let x99: u64 = (x5 + x98); + let x100: u64 = (x4 + x99); + let x101: u64 = (x3 + x100); + let x102: u64 = (x2 + x101); + let x103: u64 = (x1 + x102); + out1[0] = x62; + out1[1] = x69; + out1[2] = x76; + out1[3] = x83; + out1[4] = x90; + out1[5] = x97; + out1[6] = x103; +} + +/// The function fiat_p434_set_one returns the field element one in the Montgomery domain. +/// +/// Postconditions: +/// eval (from_montgomery out1) mod m = 1 mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_p434_set_one(out1: &mut fiat_p434_montgomery_domain_field_element) -> () { + out1[0] = 0x742c; + out1[1] = (0x0 as u64); + out1[2] = (0x0 as u64); + out1[3] = 0xb90ff404fc000000; + out1[4] = 0xd801a4fb559facd4; + out1[5] = 0xe93254545f77410c; + out1[6] = 0xeceea7bd2eda; +} + +/// The function fiat_p434_msat returns the saturated representation of the prime modulus. +/// +/// Postconditions: +/// twos_complement_eval out1 = m +/// 0 ≤ eval out1 < m +/// +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +#[inline] +pub fn fiat_p434_msat(out1: &mut [u64; 8]) -> () { + out1[0] = 0xffffffffffffffff; + out1[1] = 0xffffffffffffffff; + out1[2] = 0xffffffffffffffff; + out1[3] = 0xfdc1767ae2ffffff; + out1[4] = 0x7bc65c783158aea3; + out1[5] = 0x6cfc5fd681c52056; + out1[6] = 0x2341f27177344; + out1[7] = (0x0 as u64); +} + +/// The function fiat_p434_divstep computes a divstep. +/// +/// Preconditions: +/// 0 ≤ eval arg4 < m +/// 0 ≤ eval arg5 < m +/// Postconditions: +/// out1 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then 1 - arg1 else 1 + arg1) +/// twos_complement_eval out2 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then twos_complement_eval arg3 else twos_complement_eval arg2) +/// twos_complement_eval out3 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then ⌊(twos_complement_eval arg3 - twos_complement_eval arg2) / 2⌋ else ⌊(twos_complement_eval arg3 + (twos_complement_eval arg3 mod 2) * twos_complement_eval arg2) / 2⌋) +/// eval (from_montgomery out4) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (2 * eval (from_montgomery arg5)) mod m else (2 * eval (from_montgomery arg4)) mod m) +/// eval (from_montgomery out5) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (eval (from_montgomery arg4) - eval (from_montgomery arg4)) mod m else (eval (from_montgomery arg5) + (twos_complement_eval arg3 mod 2) * eval (from_montgomery arg4)) mod m) +/// 0 ≤ eval out5 < m +/// 0 ≤ eval out5 < m +/// 0 ≤ eval out2 < m +/// 0 ≤ eval out3 < m +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0xffffffffffffffff] +/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// arg4: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// arg5: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +/// out2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// out3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// out4: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// out5: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +#[inline] +pub fn fiat_p434_divstep(out1: &mut u64, out2: &mut [u64; 8], out3: &mut [u64; 8], out4: &mut [u64; 7], out5: &mut [u64; 7], arg1: u64, arg2: &[u64; 8], arg3: &[u64; 8], arg4: &[u64; 7], arg5: &[u64; 7]) -> () { + let mut x1: u64 = 0; + let mut x2: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x1, &mut x2, 0x0, (!arg1), (0x1 as u64)); + let x3: fiat_p434_u1 = (((x1 >> 63) as fiat_p434_u1) & (((arg3[0]) & (0x1 as u64)) as fiat_p434_u1)); + let mut x4: u64 = 0; + let mut x5: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x4, &mut x5, 0x0, (!arg1), (0x1 as u64)); + let mut x6: u64 = 0; + fiat_p434_cmovznz_u64(&mut x6, x3, arg1, x4); + let mut x7: u64 = 0; + fiat_p434_cmovznz_u64(&mut x7, x3, (arg2[0]), (arg3[0])); + let mut x8: u64 = 0; + fiat_p434_cmovznz_u64(&mut x8, x3, (arg2[1]), (arg3[1])); + let mut x9: u64 = 0; + fiat_p434_cmovznz_u64(&mut x9, x3, (arg2[2]), (arg3[2])); + let mut x10: u64 = 0; + fiat_p434_cmovznz_u64(&mut x10, x3, (arg2[3]), (arg3[3])); + let mut x11: u64 = 0; + fiat_p434_cmovznz_u64(&mut x11, x3, (arg2[4]), (arg3[4])); + let mut x12: u64 = 0; + fiat_p434_cmovznz_u64(&mut x12, x3, (arg2[5]), (arg3[5])); + let mut x13: u64 = 0; + fiat_p434_cmovznz_u64(&mut x13, x3, (arg2[6]), (arg3[6])); + let mut x14: u64 = 0; + fiat_p434_cmovznz_u64(&mut x14, x3, (arg2[7]), (arg3[7])); + let mut x15: u64 = 0; + let mut x16: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x15, &mut x16, 0x0, (0x1 as u64), (!(arg2[0]))); + let mut x17: u64 = 0; + let mut x18: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x17, &mut x18, x16, (0x0 as u64), (!(arg2[1]))); + let mut x19: u64 = 0; + let mut x20: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x19, &mut x20, x18, (0x0 as u64), (!(arg2[2]))); + let mut x21: u64 = 0; + let mut x22: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x21, &mut x22, x20, (0x0 as u64), (!(arg2[3]))); + let mut x23: u64 = 0; + let mut x24: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x23, &mut x24, x22, (0x0 as u64), (!(arg2[4]))); + let mut x25: u64 = 0; + let mut x26: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x25, &mut x26, x24, (0x0 as u64), (!(arg2[5]))); + let mut x27: u64 = 0; + let mut x28: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x27, &mut x28, x26, (0x0 as u64), (!(arg2[6]))); + let mut x29: u64 = 0; + let mut x30: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x29, &mut x30, x28, (0x0 as u64), (!(arg2[7]))); + let mut x31: u64 = 0; + fiat_p434_cmovznz_u64(&mut x31, x3, (arg3[0]), x15); + let mut x32: u64 = 0; + fiat_p434_cmovznz_u64(&mut x32, x3, (arg3[1]), x17); + let mut x33: u64 = 0; + fiat_p434_cmovznz_u64(&mut x33, x3, (arg3[2]), x19); + let mut x34: u64 = 0; + fiat_p434_cmovznz_u64(&mut x34, x3, (arg3[3]), x21); + let mut x35: u64 = 0; + fiat_p434_cmovznz_u64(&mut x35, x3, (arg3[4]), x23); + let mut x36: u64 = 0; + fiat_p434_cmovznz_u64(&mut x36, x3, (arg3[5]), x25); + let mut x37: u64 = 0; + fiat_p434_cmovznz_u64(&mut x37, x3, (arg3[6]), x27); + let mut x38: u64 = 0; + fiat_p434_cmovznz_u64(&mut x38, x3, (arg3[7]), x29); + let mut x39: u64 = 0; + fiat_p434_cmovznz_u64(&mut x39, x3, (arg4[0]), (arg5[0])); + let mut x40: u64 = 0; + fiat_p434_cmovznz_u64(&mut x40, x3, (arg4[1]), (arg5[1])); + let mut x41: u64 = 0; + fiat_p434_cmovznz_u64(&mut x41, x3, (arg4[2]), (arg5[2])); + let mut x42: u64 = 0; + fiat_p434_cmovznz_u64(&mut x42, x3, (arg4[3]), (arg5[3])); + let mut x43: u64 = 0; + fiat_p434_cmovznz_u64(&mut x43, x3, (arg4[4]), (arg5[4])); + let mut x44: u64 = 0; + fiat_p434_cmovznz_u64(&mut x44, x3, (arg4[5]), (arg5[5])); + let mut x45: u64 = 0; + fiat_p434_cmovznz_u64(&mut x45, x3, (arg4[6]), (arg5[6])); + let mut x46: u64 = 0; + let mut x47: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x46, &mut x47, 0x0, x39, x39); + let mut x48: u64 = 0; + let mut x49: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x48, &mut x49, x47, x40, x40); + let mut x50: u64 = 0; + let mut x51: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x50, &mut x51, x49, x41, x41); + let mut x52: u64 = 0; + let mut x53: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x52, &mut x53, x51, x42, x42); + let mut x54: u64 = 0; + let mut x55: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x54, &mut x55, x53, x43, x43); + let mut x56: u64 = 0; + let mut x57: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x56, &mut x57, x55, x44, x44); + let mut x58: u64 = 0; + let mut x59: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x58, &mut x59, x57, x45, x45); + let mut x60: u64 = 0; + let mut x61: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x60, &mut x61, 0x0, x46, 0xffffffffffffffff); + let mut x62: u64 = 0; + let mut x63: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x62, &mut x63, x61, x48, 0xffffffffffffffff); + let mut x64: u64 = 0; + let mut x65: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x64, &mut x65, x63, x50, 0xffffffffffffffff); + let mut x66: u64 = 0; + let mut x67: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x66, &mut x67, x65, x52, 0xfdc1767ae2ffffff); + let mut x68: u64 = 0; + let mut x69: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x68, &mut x69, x67, x54, 0x7bc65c783158aea3); + let mut x70: u64 = 0; + let mut x71: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x70, &mut x71, x69, x56, 0x6cfc5fd681c52056); + let mut x72: u64 = 0; + let mut x73: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x72, &mut x73, x71, x58, 0x2341f27177344); + let mut x74: u64 = 0; + let mut x75: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x74, &mut x75, x73, (x59 as u64), (0x0 as u64)); + let x76: u64 = (arg4[6]); + let x77: u64 = (arg4[5]); + let x78: u64 = (arg4[4]); + let x79: u64 = (arg4[3]); + let x80: u64 = (arg4[2]); + let x81: u64 = (arg4[1]); + let x82: u64 = (arg4[0]); + let mut x83: u64 = 0; + let mut x84: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x83, &mut x84, 0x0, (0x0 as u64), x82); + let mut x85: u64 = 0; + let mut x86: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x85, &mut x86, x84, (0x0 as u64), x81); + let mut x87: u64 = 0; + let mut x88: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x87, &mut x88, x86, (0x0 as u64), x80); + let mut x89: u64 = 0; + let mut x90: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x89, &mut x90, x88, (0x0 as u64), x79); + let mut x91: u64 = 0; + let mut x92: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x91, &mut x92, x90, (0x0 as u64), x78); + let mut x93: u64 = 0; + let mut x94: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x93, &mut x94, x92, (0x0 as u64), x77); + let mut x95: u64 = 0; + let mut x96: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x95, &mut x96, x94, (0x0 as u64), x76); + let mut x97: u64 = 0; + fiat_p434_cmovznz_u64(&mut x97, x96, (0x0 as u64), 0xffffffffffffffff); + let mut x98: u64 = 0; + let mut x99: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x98, &mut x99, 0x0, x83, x97); + let mut x100: u64 = 0; + let mut x101: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x100, &mut x101, x99, x85, x97); + let mut x102: u64 = 0; + let mut x103: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x102, &mut x103, x101, x87, x97); + let mut x104: u64 = 0; + let mut x105: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x104, &mut x105, x103, x89, (x97 & 0xfdc1767ae2ffffff)); + let mut x106: u64 = 0; + let mut x107: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x106, &mut x107, x105, x91, (x97 & 0x7bc65c783158aea3)); + let mut x108: u64 = 0; + let mut x109: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x108, &mut x109, x107, x93, (x97 & 0x6cfc5fd681c52056)); + let mut x110: u64 = 0; + let mut x111: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x110, &mut x111, x109, x95, (x97 & 0x2341f27177344)); + let mut x112: u64 = 0; + fiat_p434_cmovznz_u64(&mut x112, x3, (arg5[0]), x98); + let mut x113: u64 = 0; + fiat_p434_cmovznz_u64(&mut x113, x3, (arg5[1]), x100); + let mut x114: u64 = 0; + fiat_p434_cmovznz_u64(&mut x114, x3, (arg5[2]), x102); + let mut x115: u64 = 0; + fiat_p434_cmovznz_u64(&mut x115, x3, (arg5[3]), x104); + let mut x116: u64 = 0; + fiat_p434_cmovznz_u64(&mut x116, x3, (arg5[4]), x106); + let mut x117: u64 = 0; + fiat_p434_cmovznz_u64(&mut x117, x3, (arg5[5]), x108); + let mut x118: u64 = 0; + fiat_p434_cmovznz_u64(&mut x118, x3, (arg5[6]), x110); + let x119: fiat_p434_u1 = ((x31 & (0x1 as u64)) as fiat_p434_u1); + let mut x120: u64 = 0; + fiat_p434_cmovznz_u64(&mut x120, x119, (0x0 as u64), x7); + let mut x121: u64 = 0; + fiat_p434_cmovznz_u64(&mut x121, x119, (0x0 as u64), x8); + let mut x122: u64 = 0; + fiat_p434_cmovznz_u64(&mut x122, x119, (0x0 as u64), x9); + let mut x123: u64 = 0; + fiat_p434_cmovznz_u64(&mut x123, x119, (0x0 as u64), x10); + let mut x124: u64 = 0; + fiat_p434_cmovznz_u64(&mut x124, x119, (0x0 as u64), x11); + let mut x125: u64 = 0; + fiat_p434_cmovznz_u64(&mut x125, x119, (0x0 as u64), x12); + let mut x126: u64 = 0; + fiat_p434_cmovznz_u64(&mut x126, x119, (0x0 as u64), x13); + let mut x127: u64 = 0; + fiat_p434_cmovznz_u64(&mut x127, x119, (0x0 as u64), x14); + let mut x128: u64 = 0; + let mut x129: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x128, &mut x129, 0x0, x31, x120); + let mut x130: u64 = 0; + let mut x131: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x130, &mut x131, x129, x32, x121); + let mut x132: u64 = 0; + let mut x133: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x132, &mut x133, x131, x33, x122); + let mut x134: u64 = 0; + let mut x135: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x134, &mut x135, x133, x34, x123); + let mut x136: u64 = 0; + let mut x137: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x136, &mut x137, x135, x35, x124); + let mut x138: u64 = 0; + let mut x139: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x138, &mut x139, x137, x36, x125); + let mut x140: u64 = 0; + let mut x141: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x140, &mut x141, x139, x37, x126); + let mut x142: u64 = 0; + let mut x143: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x142, &mut x143, x141, x38, x127); + let mut x144: u64 = 0; + fiat_p434_cmovznz_u64(&mut x144, x119, (0x0 as u64), x39); + let mut x145: u64 = 0; + fiat_p434_cmovznz_u64(&mut x145, x119, (0x0 as u64), x40); + let mut x146: u64 = 0; + fiat_p434_cmovznz_u64(&mut x146, x119, (0x0 as u64), x41); + let mut x147: u64 = 0; + fiat_p434_cmovznz_u64(&mut x147, x119, (0x0 as u64), x42); + let mut x148: u64 = 0; + fiat_p434_cmovznz_u64(&mut x148, x119, (0x0 as u64), x43); + let mut x149: u64 = 0; + fiat_p434_cmovznz_u64(&mut x149, x119, (0x0 as u64), x44); + let mut x150: u64 = 0; + fiat_p434_cmovznz_u64(&mut x150, x119, (0x0 as u64), x45); + let mut x151: u64 = 0; + let mut x152: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x151, &mut x152, 0x0, x112, x144); + let mut x153: u64 = 0; + let mut x154: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x153, &mut x154, x152, x113, x145); + let mut x155: u64 = 0; + let mut x156: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x155, &mut x156, x154, x114, x146); + let mut x157: u64 = 0; + let mut x158: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x157, &mut x158, x156, x115, x147); + let mut x159: u64 = 0; + let mut x160: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x159, &mut x160, x158, x116, x148); + let mut x161: u64 = 0; + let mut x162: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x161, &mut x162, x160, x117, x149); + let mut x163: u64 = 0; + let mut x164: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x163, &mut x164, x162, x118, x150); + let mut x165: u64 = 0; + let mut x166: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x165, &mut x166, 0x0, x151, 0xffffffffffffffff); + let mut x167: u64 = 0; + let mut x168: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x167, &mut x168, x166, x153, 0xffffffffffffffff); + let mut x169: u64 = 0; + let mut x170: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x169, &mut x170, x168, x155, 0xffffffffffffffff); + let mut x171: u64 = 0; + let mut x172: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x171, &mut x172, x170, x157, 0xfdc1767ae2ffffff); + let mut x173: u64 = 0; + let mut x174: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x173, &mut x174, x172, x159, 0x7bc65c783158aea3); + let mut x175: u64 = 0; + let mut x176: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x175, &mut x176, x174, x161, 0x6cfc5fd681c52056); + let mut x177: u64 = 0; + let mut x178: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x177, &mut x178, x176, x163, 0x2341f27177344); + let mut x179: u64 = 0; + let mut x180: fiat_p434_u1 = 0; + fiat_p434_subborrowx_u64(&mut x179, &mut x180, x178, (x164 as u64), (0x0 as u64)); + let mut x181: u64 = 0; + let mut x182: fiat_p434_u1 = 0; + fiat_p434_addcarryx_u64(&mut x181, &mut x182, 0x0, x6, (0x1 as u64)); + let x183: u64 = ((x128 >> 1) | ((x130 << 63) & 0xffffffffffffffff)); + let x184: u64 = ((x130 >> 1) | ((x132 << 63) & 0xffffffffffffffff)); + let x185: u64 = ((x132 >> 1) | ((x134 << 63) & 0xffffffffffffffff)); + let x186: u64 = ((x134 >> 1) | ((x136 << 63) & 0xffffffffffffffff)); + let x187: u64 = ((x136 >> 1) | ((x138 << 63) & 0xffffffffffffffff)); + let x188: u64 = ((x138 >> 1) | ((x140 << 63) & 0xffffffffffffffff)); + let x189: u64 = ((x140 >> 1) | ((x142 << 63) & 0xffffffffffffffff)); + let x190: u64 = ((x142 & 0x8000000000000000) | (x142 >> 1)); + let mut x191: u64 = 0; + fiat_p434_cmovznz_u64(&mut x191, x75, x60, x46); + let mut x192: u64 = 0; + fiat_p434_cmovznz_u64(&mut x192, x75, x62, x48); + let mut x193: u64 = 0; + fiat_p434_cmovznz_u64(&mut x193, x75, x64, x50); + let mut x194: u64 = 0; + fiat_p434_cmovznz_u64(&mut x194, x75, x66, x52); + let mut x195: u64 = 0; + fiat_p434_cmovznz_u64(&mut x195, x75, x68, x54); + let mut x196: u64 = 0; + fiat_p434_cmovznz_u64(&mut x196, x75, x70, x56); + let mut x197: u64 = 0; + fiat_p434_cmovznz_u64(&mut x197, x75, x72, x58); + let mut x198: u64 = 0; + fiat_p434_cmovznz_u64(&mut x198, x180, x165, x151); + let mut x199: u64 = 0; + fiat_p434_cmovznz_u64(&mut x199, x180, x167, x153); + let mut x200: u64 = 0; + fiat_p434_cmovznz_u64(&mut x200, x180, x169, x155); + let mut x201: u64 = 0; + fiat_p434_cmovznz_u64(&mut x201, x180, x171, x157); + let mut x202: u64 = 0; + fiat_p434_cmovznz_u64(&mut x202, x180, x173, x159); + let mut x203: u64 = 0; + fiat_p434_cmovznz_u64(&mut x203, x180, x175, x161); + let mut x204: u64 = 0; + fiat_p434_cmovznz_u64(&mut x204, x180, x177, x163); + *out1 = x181; + out2[0] = x7; + out2[1] = x8; + out2[2] = x9; + out2[3] = x10; + out2[4] = x11; + out2[5] = x12; + out2[6] = x13; + out2[7] = x14; + out3[0] = x183; + out3[1] = x184; + out3[2] = x185; + out3[3] = x186; + out3[4] = x187; + out3[5] = x188; + out3[6] = x189; + out3[7] = x190; + out4[0] = x191; + out4[1] = x192; + out4[2] = x193; + out4[3] = x194; + out4[4] = x195; + out4[5] = x196; + out4[6] = x197; + out5[0] = x198; + out5[1] = x199; + out5[2] = x200; + out5[3] = x201; + out5[4] = x202; + out5[5] = x203; + out5[6] = x204; +} + +/// The function fiat_p434_divstep_precomp returns the precomputed value for Bernstein-Yang-inversion (in montgomery form). +/// +/// Postconditions: +/// eval (from_montgomery out1) = ⌊(m - 1) / 2⌋^(if ⌊log2 m⌋ + 1 < 46 then ⌊(49 * (⌊log2 m⌋ + 1) + 80) / 17⌋ else ⌊(49 * (⌊log2 m⌋ + 1) + 57) / 17⌋) +/// 0 ≤ eval out1 < m +/// +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +#[inline] +pub fn fiat_p434_divstep_precomp(out1: &mut [u64; 7]) -> () { + out1[0] = 0x9f9776e27e1a2b72; + out1[1] = 0x28b59f067e2393d0; + out1[2] = 0xcf316ce1572add54; + out1[3] = 0x312c8965f9032c2f; + out1[4] = 0x9d9cab29ad90d34c; + out1[5] = 0x6e1ddae1d9609ae1; + out1[6] = 0x6df82285eec6; +} diff --git a/vendor/fiat-crypto/src/p448_solinas_32.rs b/vendor/fiat-crypto/src/p448_solinas_32.rs new file mode 100644 index 000000000..9f37fd21a --- /dev/null +++ b/vendor/fiat-crypto/src/p448_solinas_32.rs @@ -0,0 +1,1678 @@ +//! Autogenerated: 'src/ExtractionOCaml/unsaturated_solinas' --lang Rust --inline p448 32 16 '2^448 - 2^224 - 1' carry_mul carry_square carry add sub opp selectznz to_bytes from_bytes relax +//! curve description: p448 +//! machine_wordsize = 32 (from "32") +//! requested operations: carry_mul, carry_square, carry, add, sub, opp, selectznz, to_bytes, from_bytes, relax +//! n = 16 (from "16") +//! s-c = 2^448 - [(2^224, 1), (1, 1)] (from "2^448 - 2^224 - 1") +//! tight_bounds_multiplier = 1 (from "") +//! +//! Computed values: +//! carry_chain = [7, 15, 8, 0, 9, 1, 10, 2, 11, 3, 12, 4, 13, 5, 14, 6, 15, 7, 8, 0] +//! eval z = z[0] + (z[1] << 28) + (z[2] << 56) + (z[3] << 84) + (z[4] << 112) + (z[5] << 140) + (z[6] << 168) + (z[7] << 196) + (z[8] << 224) + (z[9] << 252) + (z[10] << 0x118) + (z[11] << 0x134) + (z[12] << 0x150) + (z[13] << 0x16c) + (z[14] << 0x188) + (z[15] << 0x1a4) +//! bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248) + (z[32] << 256) + (z[33] << 0x108) + (z[34] << 0x110) + (z[35] << 0x118) + (z[36] << 0x120) + (z[37] << 0x128) + (z[38] << 0x130) + (z[39] << 0x138) + (z[40] << 0x140) + (z[41] << 0x148) + (z[42] << 0x150) + (z[43] << 0x158) + (z[44] << 0x160) + (z[45] << 0x168) + (z[46] << 0x170) + (z[47] << 0x178) + (z[48] << 0x180) + (z[49] << 0x188) + (z[50] << 0x190) + (z[51] << 0x198) + (z[52] << 0x1a0) + (z[53] << 0x1a8) + (z[54] << 0x1b0) + (z[55] << 0x1b8) +//! balance = [0x1ffffffe, 0x1ffffffe, 0x1ffffffe, 0x1ffffffe, 0x1ffffffe, 0x1ffffffe, 0x1ffffffe, 0x1ffffffe, 0x1ffffffc, 0x1ffffffe, 0x1ffffffe, 0x1ffffffe, 0x1ffffffe, 0x1ffffffe, 0x1ffffffe, 0x1ffffffe] + +#![allow(unused_parens)] +#![allow(non_camel_case_types)] + +pub type fiat_p448_u1 = u8; +pub type fiat_p448_i1 = i8; +pub type fiat_p448_u2 = u8; +pub type fiat_p448_i2 = i8; + +/* The type fiat_p448_loose_field_element is a field element with loose bounds. */ +/* Bounds: [[0x0 ~> 0x30000000], [0x0 ~> 0x30000000], [0x0 ~> 0x30000000], [0x0 ~> 0x30000000], [0x0 ~> 0x30000000], [0x0 ~> 0x30000000], [0x0 ~> 0x30000000], [0x0 ~> 0x30000000], [0x0 ~> 0x30000000], [0x0 ~> 0x30000000], [0x0 ~> 0x30000000], [0x0 ~> 0x30000000], [0x0 ~> 0x30000000], [0x0 ~> 0x30000000], [0x0 ~> 0x30000000], [0x0 ~> 0x30000000]] */ +pub type fiat_p448_loose_field_element = [u32; 16]; + +/* The type fiat_p448_tight_field_element is a field element with tight bounds. */ +/* Bounds: [[0x0 ~> 0x10000000], [0x0 ~> 0x10000000], [0x0 ~> 0x10000000], [0x0 ~> 0x10000000], [0x0 ~> 0x10000000], [0x0 ~> 0x10000000], [0x0 ~> 0x10000000], [0x0 ~> 0x10000000], [0x0 ~> 0x10000000], [0x0 ~> 0x10000000], [0x0 ~> 0x10000000], [0x0 ~> 0x10000000], [0x0 ~> 0x10000000], [0x0 ~> 0x10000000], [0x0 ~> 0x10000000], [0x0 ~> 0x10000000]] */ +pub type fiat_p448_tight_field_element = [u32; 16]; + + +/// The function fiat_p448_addcarryx_u28 is an addition with carry. +/// +/// Postconditions: +/// out1 = (arg1 + arg2 + arg3) mod 2^28 +/// out2 = ⌊(arg1 + arg2 + arg3) / 2^28⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xfffffff] +/// arg3: [0x0 ~> 0xfffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xfffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_p448_addcarryx_u28(out1: &mut u32, out2: &mut fiat_p448_u1, arg1: fiat_p448_u1, arg2: u32, arg3: u32) -> () { + let x1: u32 = (((arg1 as u32) + arg2) + arg3); + let x2: u32 = (x1 & 0xfffffff); + let x3: fiat_p448_u1 = ((x1 >> 28) as fiat_p448_u1); + *out1 = x2; + *out2 = x3; +} + +/// The function fiat_p448_subborrowx_u28 is a subtraction with borrow. +/// +/// Postconditions: +/// out1 = (-arg1 + arg2 + -arg3) mod 2^28 +/// out2 = -⌊(-arg1 + arg2 + -arg3) / 2^28⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xfffffff] +/// arg3: [0x0 ~> 0xfffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xfffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_p448_subborrowx_u28(out1: &mut u32, out2: &mut fiat_p448_u1, arg1: fiat_p448_u1, arg2: u32, arg3: u32) -> () { + let x1: i32 = ((((((arg2 as i64) - (arg1 as i64)) as i32) as i64) - (arg3 as i64)) as i32); + let x2: fiat_p448_i1 = ((x1 >> 28) as fiat_p448_i1); + let x3: u32 = (((x1 as i64) & (0xfffffff as i64)) as u32); + *out1 = x3; + *out2 = (((0x0 as fiat_p448_i2) - (x2 as fiat_p448_i2)) as fiat_p448_u1); +} + +/// The function fiat_p448_cmovznz_u32 is a single-word conditional move. +/// +/// Postconditions: +/// out1 = (if arg1 = 0 then arg2 else arg3) +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffff] +/// arg3: [0x0 ~> 0xffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +#[inline] +pub fn fiat_p448_cmovznz_u32(out1: &mut u32, arg1: fiat_p448_u1, arg2: u32, arg3: u32) -> () { + let x1: fiat_p448_u1 = (!(!arg1)); + let x2: u32 = ((((((0x0 as fiat_p448_i2) - (x1 as fiat_p448_i2)) as fiat_p448_i1) as i64) & (0xffffffff as i64)) as u32); + let x3: u32 = ((x2 & arg3) | ((!x2) & arg2)); + *out1 = x3; +} + +/// The function fiat_p448_carry_mul multiplies two field elements and reduces the result. +/// +/// Postconditions: +/// eval out1 mod m = (eval arg1 * eval arg2) mod m +/// +#[inline] +pub fn fiat_p448_carry_mul(out1: &mut fiat_p448_tight_field_element, arg1: &fiat_p448_loose_field_element, arg2: &fiat_p448_loose_field_element) -> () { + let x1: u64 = (((arg1[15]) as u64) * ((arg2[15]) as u64)); + let x2: u64 = (((arg1[15]) as u64) * ((arg2[14]) as u64)); + let x3: u64 = (((arg1[15]) as u64) * ((arg2[13]) as u64)); + let x4: u64 = (((arg1[15]) as u64) * ((arg2[12]) as u64)); + let x5: u64 = (((arg1[15]) as u64) * ((arg2[11]) as u64)); + let x6: u64 = (((arg1[15]) as u64) * ((arg2[10]) as u64)); + let x7: u64 = (((arg1[15]) as u64) * ((arg2[9]) as u64)); + let x8: u64 = (((arg1[14]) as u64) * ((arg2[15]) as u64)); + let x9: u64 = (((arg1[14]) as u64) * ((arg2[14]) as u64)); + let x10: u64 = (((arg1[14]) as u64) * ((arg2[13]) as u64)); + let x11: u64 = (((arg1[14]) as u64) * ((arg2[12]) as u64)); + let x12: u64 = (((arg1[14]) as u64) * ((arg2[11]) as u64)); + let x13: u64 = (((arg1[14]) as u64) * ((arg2[10]) as u64)); + let x14: u64 = (((arg1[13]) as u64) * ((arg2[15]) as u64)); + let x15: u64 = (((arg1[13]) as u64) * ((arg2[14]) as u64)); + let x16: u64 = (((arg1[13]) as u64) * ((arg2[13]) as u64)); + let x17: u64 = (((arg1[13]) as u64) * ((arg2[12]) as u64)); + let x18: u64 = (((arg1[13]) as u64) * ((arg2[11]) as u64)); + let x19: u64 = (((arg1[12]) as u64) * ((arg2[15]) as u64)); + let x20: u64 = (((arg1[12]) as u64) * ((arg2[14]) as u64)); + let x21: u64 = (((arg1[12]) as u64) * ((arg2[13]) as u64)); + let x22: u64 = (((arg1[12]) as u64) * ((arg2[12]) as u64)); + let x23: u64 = (((arg1[11]) as u64) * ((arg2[15]) as u64)); + let x24: u64 = (((arg1[11]) as u64) * ((arg2[14]) as u64)); + let x25: u64 = (((arg1[11]) as u64) * ((arg2[13]) as u64)); + let x26: u64 = (((arg1[10]) as u64) * ((arg2[15]) as u64)); + let x27: u64 = (((arg1[10]) as u64) * ((arg2[14]) as u64)); + let x28: u64 = (((arg1[9]) as u64) * ((arg2[15]) as u64)); + let x29: u64 = (((arg1[15]) as u64) * ((arg2[15]) as u64)); + let x30: u64 = (((arg1[15]) as u64) * ((arg2[14]) as u64)); + let x31: u64 = (((arg1[15]) as u64) * ((arg2[13]) as u64)); + let x32: u64 = (((arg1[15]) as u64) * ((arg2[12]) as u64)); + let x33: u64 = (((arg1[15]) as u64) * ((arg2[11]) as u64)); + let x34: u64 = (((arg1[15]) as u64) * ((arg2[10]) as u64)); + let x35: u64 = (((arg1[15]) as u64) * ((arg2[9]) as u64)); + let x36: u64 = (((arg1[14]) as u64) * ((arg2[15]) as u64)); + let x37: u64 = (((arg1[14]) as u64) * ((arg2[14]) as u64)); + let x38: u64 = (((arg1[14]) as u64) * ((arg2[13]) as u64)); + let x39: u64 = (((arg1[14]) as u64) * ((arg2[12]) as u64)); + let x40: u64 = (((arg1[14]) as u64) * ((arg2[11]) as u64)); + let x41: u64 = (((arg1[14]) as u64) * ((arg2[10]) as u64)); + let x42: u64 = (((arg1[13]) as u64) * ((arg2[15]) as u64)); + let x43: u64 = (((arg1[13]) as u64) * ((arg2[14]) as u64)); + let x44: u64 = (((arg1[13]) as u64) * ((arg2[13]) as u64)); + let x45: u64 = (((arg1[13]) as u64) * ((arg2[12]) as u64)); + let x46: u64 = (((arg1[13]) as u64) * ((arg2[11]) as u64)); + let x47: u64 = (((arg1[12]) as u64) * ((arg2[15]) as u64)); + let x48: u64 = (((arg1[12]) as u64) * ((arg2[14]) as u64)); + let x49: u64 = (((arg1[12]) as u64) * ((arg2[13]) as u64)); + let x50: u64 = (((arg1[12]) as u64) * ((arg2[12]) as u64)); + let x51: u64 = (((arg1[11]) as u64) * ((arg2[15]) as u64)); + let x52: u64 = (((arg1[11]) as u64) * ((arg2[14]) as u64)); + let x53: u64 = (((arg1[11]) as u64) * ((arg2[13]) as u64)); + let x54: u64 = (((arg1[10]) as u64) * ((arg2[15]) as u64)); + let x55: u64 = (((arg1[10]) as u64) * ((arg2[14]) as u64)); + let x56: u64 = (((arg1[9]) as u64) * ((arg2[15]) as u64)); + let x57: u64 = (((arg1[15]) as u64) * ((arg2[15]) as u64)); + let x58: u64 = (((arg1[15]) as u64) * ((arg2[14]) as u64)); + let x59: u64 = (((arg1[15]) as u64) * ((arg2[13]) as u64)); + let x60: u64 = (((arg1[15]) as u64) * ((arg2[12]) as u64)); + let x61: u64 = (((arg1[15]) as u64) * ((arg2[11]) as u64)); + let x62: u64 = (((arg1[15]) as u64) * ((arg2[10]) as u64)); + let x63: u64 = (((arg1[15]) as u64) * ((arg2[9]) as u64)); + let x64: u64 = (((arg1[15]) as u64) * ((arg2[8]) as u64)); + let x65: u64 = (((arg1[15]) as u64) * ((arg2[7]) as u64)); + let x66: u64 = (((arg1[15]) as u64) * ((arg2[6]) as u64)); + let x67: u64 = (((arg1[15]) as u64) * ((arg2[5]) as u64)); + let x68: u64 = (((arg1[15]) as u64) * ((arg2[4]) as u64)); + let x69: u64 = (((arg1[15]) as u64) * ((arg2[3]) as u64)); + let x70: u64 = (((arg1[15]) as u64) * ((arg2[2]) as u64)); + let x71: u64 = (((arg1[15]) as u64) * ((arg2[1]) as u64)); + let x72: u64 = (((arg1[14]) as u64) * ((arg2[15]) as u64)); + let x73: u64 = (((arg1[14]) as u64) * ((arg2[14]) as u64)); + let x74: u64 = (((arg1[14]) as u64) * ((arg2[13]) as u64)); + let x75: u64 = (((arg1[14]) as u64) * ((arg2[12]) as u64)); + let x76: u64 = (((arg1[14]) as u64) * ((arg2[11]) as u64)); + let x77: u64 = (((arg1[14]) as u64) * ((arg2[10]) as u64)); + let x78: u64 = (((arg1[14]) as u64) * ((arg2[9]) as u64)); + let x79: u64 = (((arg1[14]) as u64) * ((arg2[8]) as u64)); + let x80: u64 = (((arg1[14]) as u64) * ((arg2[7]) as u64)); + let x81: u64 = (((arg1[14]) as u64) * ((arg2[6]) as u64)); + let x82: u64 = (((arg1[14]) as u64) * ((arg2[5]) as u64)); + let x83: u64 = (((arg1[14]) as u64) * ((arg2[4]) as u64)); + let x84: u64 = (((arg1[14]) as u64) * ((arg2[3]) as u64)); + let x85: u64 = (((arg1[14]) as u64) * ((arg2[2]) as u64)); + let x86: u64 = (((arg1[13]) as u64) * ((arg2[15]) as u64)); + let x87: u64 = (((arg1[13]) as u64) * ((arg2[14]) as u64)); + let x88: u64 = (((arg1[13]) as u64) * ((arg2[13]) as u64)); + let x89: u64 = (((arg1[13]) as u64) * ((arg2[12]) as u64)); + let x90: u64 = (((arg1[13]) as u64) * ((arg2[11]) as u64)); + let x91: u64 = (((arg1[13]) as u64) * ((arg2[10]) as u64)); + let x92: u64 = (((arg1[13]) as u64) * ((arg2[9]) as u64)); + let x93: u64 = (((arg1[13]) as u64) * ((arg2[8]) as u64)); + let x94: u64 = (((arg1[13]) as u64) * ((arg2[7]) as u64)); + let x95: u64 = (((arg1[13]) as u64) * ((arg2[6]) as u64)); + let x96: u64 = (((arg1[13]) as u64) * ((arg2[5]) as u64)); + let x97: u64 = (((arg1[13]) as u64) * ((arg2[4]) as u64)); + let x98: u64 = (((arg1[13]) as u64) * ((arg2[3]) as u64)); + let x99: u64 = (((arg1[12]) as u64) * ((arg2[15]) as u64)); + let x100: u64 = (((arg1[12]) as u64) * ((arg2[14]) as u64)); + let x101: u64 = (((arg1[12]) as u64) * ((arg2[13]) as u64)); + let x102: u64 = (((arg1[12]) as u64) * ((arg2[12]) as u64)); + let x103: u64 = (((arg1[12]) as u64) * ((arg2[11]) as u64)); + let x104: u64 = (((arg1[12]) as u64) * ((arg2[10]) as u64)); + let x105: u64 = (((arg1[12]) as u64) * ((arg2[9]) as u64)); + let x106: u64 = (((arg1[12]) as u64) * ((arg2[8]) as u64)); + let x107: u64 = (((arg1[12]) as u64) * ((arg2[7]) as u64)); + let x108: u64 = (((arg1[12]) as u64) * ((arg2[6]) as u64)); + let x109: u64 = (((arg1[12]) as u64) * ((arg2[5]) as u64)); + let x110: u64 = (((arg1[12]) as u64) * ((arg2[4]) as u64)); + let x111: u64 = (((arg1[11]) as u64) * ((arg2[15]) as u64)); + let x112: u64 = (((arg1[11]) as u64) * ((arg2[14]) as u64)); + let x113: u64 = (((arg1[11]) as u64) * ((arg2[13]) as u64)); + let x114: u64 = (((arg1[11]) as u64) * ((arg2[12]) as u64)); + let x115: u64 = (((arg1[11]) as u64) * ((arg2[11]) as u64)); + let x116: u64 = (((arg1[11]) as u64) * ((arg2[10]) as u64)); + let x117: u64 = (((arg1[11]) as u64) * ((arg2[9]) as u64)); + let x118: u64 = (((arg1[11]) as u64) * ((arg2[8]) as u64)); + let x119: u64 = (((arg1[11]) as u64) * ((arg2[7]) as u64)); + let x120: u64 = (((arg1[11]) as u64) * ((arg2[6]) as u64)); + let x121: u64 = (((arg1[11]) as u64) * ((arg2[5]) as u64)); + let x122: u64 = (((arg1[10]) as u64) * ((arg2[15]) as u64)); + let x123: u64 = (((arg1[10]) as u64) * ((arg2[14]) as u64)); + let x124: u64 = (((arg1[10]) as u64) * ((arg2[13]) as u64)); + let x125: u64 = (((arg1[10]) as u64) * ((arg2[12]) as u64)); + let x126: u64 = (((arg1[10]) as u64) * ((arg2[11]) as u64)); + let x127: u64 = (((arg1[10]) as u64) * ((arg2[10]) as u64)); + let x128: u64 = (((arg1[10]) as u64) * ((arg2[9]) as u64)); + let x129: u64 = (((arg1[10]) as u64) * ((arg2[8]) as u64)); + let x130: u64 = (((arg1[10]) as u64) * ((arg2[7]) as u64)); + let x131: u64 = (((arg1[10]) as u64) * ((arg2[6]) as u64)); + let x132: u64 = (((arg1[9]) as u64) * ((arg2[15]) as u64)); + let x133: u64 = (((arg1[9]) as u64) * ((arg2[14]) as u64)); + let x134: u64 = (((arg1[9]) as u64) * ((arg2[13]) as u64)); + let x135: u64 = (((arg1[9]) as u64) * ((arg2[12]) as u64)); + let x136: u64 = (((arg1[9]) as u64) * ((arg2[11]) as u64)); + let x137: u64 = (((arg1[9]) as u64) * ((arg2[10]) as u64)); + let x138: u64 = (((arg1[9]) as u64) * ((arg2[9]) as u64)); + let x139: u64 = (((arg1[9]) as u64) * ((arg2[8]) as u64)); + let x140: u64 = (((arg1[9]) as u64) * ((arg2[7]) as u64)); + let x141: u64 = (((arg1[8]) as u64) * ((arg2[15]) as u64)); + let x142: u64 = (((arg1[8]) as u64) * ((arg2[14]) as u64)); + let x143: u64 = (((arg1[8]) as u64) * ((arg2[13]) as u64)); + let x144: u64 = (((arg1[8]) as u64) * ((arg2[12]) as u64)); + let x145: u64 = (((arg1[8]) as u64) * ((arg2[11]) as u64)); + let x146: u64 = (((arg1[8]) as u64) * ((arg2[10]) as u64)); + let x147: u64 = (((arg1[8]) as u64) * ((arg2[9]) as u64)); + let x148: u64 = (((arg1[8]) as u64) * ((arg2[8]) as u64)); + let x149: u64 = (((arg1[7]) as u64) * ((arg2[15]) as u64)); + let x150: u64 = (((arg1[7]) as u64) * ((arg2[14]) as u64)); + let x151: u64 = (((arg1[7]) as u64) * ((arg2[13]) as u64)); + let x152: u64 = (((arg1[7]) as u64) * ((arg2[12]) as u64)); + let x153: u64 = (((arg1[7]) as u64) * ((arg2[11]) as u64)); + let x154: u64 = (((arg1[7]) as u64) * ((arg2[10]) as u64)); + let x155: u64 = (((arg1[7]) as u64) * ((arg2[9]) as u64)); + let x156: u64 = (((arg1[6]) as u64) * ((arg2[15]) as u64)); + let x157: u64 = (((arg1[6]) as u64) * ((arg2[14]) as u64)); + let x158: u64 = (((arg1[6]) as u64) * ((arg2[13]) as u64)); + let x159: u64 = (((arg1[6]) as u64) * ((arg2[12]) as u64)); + let x160: u64 = (((arg1[6]) as u64) * ((arg2[11]) as u64)); + let x161: u64 = (((arg1[6]) as u64) * ((arg2[10]) as u64)); + let x162: u64 = (((arg1[5]) as u64) * ((arg2[15]) as u64)); + let x163: u64 = (((arg1[5]) as u64) * ((arg2[14]) as u64)); + let x164: u64 = (((arg1[5]) as u64) * ((arg2[13]) as u64)); + let x165: u64 = (((arg1[5]) as u64) * ((arg2[12]) as u64)); + let x166: u64 = (((arg1[5]) as u64) * ((arg2[11]) as u64)); + let x167: u64 = (((arg1[4]) as u64) * ((arg2[15]) as u64)); + let x168: u64 = (((arg1[4]) as u64) * ((arg2[14]) as u64)); + let x169: u64 = (((arg1[4]) as u64) * ((arg2[13]) as u64)); + let x170: u64 = (((arg1[4]) as u64) * ((arg2[12]) as u64)); + let x171: u64 = (((arg1[3]) as u64) * ((arg2[15]) as u64)); + let x172: u64 = (((arg1[3]) as u64) * ((arg2[14]) as u64)); + let x173: u64 = (((arg1[3]) as u64) * ((arg2[13]) as u64)); + let x174: u64 = (((arg1[2]) as u64) * ((arg2[15]) as u64)); + let x175: u64 = (((arg1[2]) as u64) * ((arg2[14]) as u64)); + let x176: u64 = (((arg1[1]) as u64) * ((arg2[15]) as u64)); + let x177: u64 = (((arg1[15]) as u64) * ((arg2[8]) as u64)); + let x178: u64 = (((arg1[15]) as u64) * ((arg2[7]) as u64)); + let x179: u64 = (((arg1[15]) as u64) * ((arg2[6]) as u64)); + let x180: u64 = (((arg1[15]) as u64) * ((arg2[5]) as u64)); + let x181: u64 = (((arg1[15]) as u64) * ((arg2[4]) as u64)); + let x182: u64 = (((arg1[15]) as u64) * ((arg2[3]) as u64)); + let x183: u64 = (((arg1[15]) as u64) * ((arg2[2]) as u64)); + let x184: u64 = (((arg1[15]) as u64) * ((arg2[1]) as u64)); + let x185: u64 = (((arg1[14]) as u64) * ((arg2[9]) as u64)); + let x186: u64 = (((arg1[14]) as u64) * ((arg2[8]) as u64)); + let x187: u64 = (((arg1[14]) as u64) * ((arg2[7]) as u64)); + let x188: u64 = (((arg1[14]) as u64) * ((arg2[6]) as u64)); + let x189: u64 = (((arg1[14]) as u64) * ((arg2[5]) as u64)); + let x190: u64 = (((arg1[14]) as u64) * ((arg2[4]) as u64)); + let x191: u64 = (((arg1[14]) as u64) * ((arg2[3]) as u64)); + let x192: u64 = (((arg1[14]) as u64) * ((arg2[2]) as u64)); + let x193: u64 = (((arg1[13]) as u64) * ((arg2[10]) as u64)); + let x194: u64 = (((arg1[13]) as u64) * ((arg2[9]) as u64)); + let x195: u64 = (((arg1[13]) as u64) * ((arg2[8]) as u64)); + let x196: u64 = (((arg1[13]) as u64) * ((arg2[7]) as u64)); + let x197: u64 = (((arg1[13]) as u64) * ((arg2[6]) as u64)); + let x198: u64 = (((arg1[13]) as u64) * ((arg2[5]) as u64)); + let x199: u64 = (((arg1[13]) as u64) * ((arg2[4]) as u64)); + let x200: u64 = (((arg1[13]) as u64) * ((arg2[3]) as u64)); + let x201: u64 = (((arg1[12]) as u64) * ((arg2[11]) as u64)); + let x202: u64 = (((arg1[12]) as u64) * ((arg2[10]) as u64)); + let x203: u64 = (((arg1[12]) as u64) * ((arg2[9]) as u64)); + let x204: u64 = (((arg1[12]) as u64) * ((arg2[8]) as u64)); + let x205: u64 = (((arg1[12]) as u64) * ((arg2[7]) as u64)); + let x206: u64 = (((arg1[12]) as u64) * ((arg2[6]) as u64)); + let x207: u64 = (((arg1[12]) as u64) * ((arg2[5]) as u64)); + let x208: u64 = (((arg1[12]) as u64) * ((arg2[4]) as u64)); + let x209: u64 = (((arg1[11]) as u64) * ((arg2[12]) as u64)); + let x210: u64 = (((arg1[11]) as u64) * ((arg2[11]) as u64)); + let x211: u64 = (((arg1[11]) as u64) * ((arg2[10]) as u64)); + let x212: u64 = (((arg1[11]) as u64) * ((arg2[9]) as u64)); + let x213: u64 = (((arg1[11]) as u64) * ((arg2[8]) as u64)); + let x214: u64 = (((arg1[11]) as u64) * ((arg2[7]) as u64)); + let x215: u64 = (((arg1[11]) as u64) * ((arg2[6]) as u64)); + let x216: u64 = (((arg1[11]) as u64) * ((arg2[5]) as u64)); + let x217: u64 = (((arg1[10]) as u64) * ((arg2[13]) as u64)); + let x218: u64 = (((arg1[10]) as u64) * ((arg2[12]) as u64)); + let x219: u64 = (((arg1[10]) as u64) * ((arg2[11]) as u64)); + let x220: u64 = (((arg1[10]) as u64) * ((arg2[10]) as u64)); + let x221: u64 = (((arg1[10]) as u64) * ((arg2[9]) as u64)); + let x222: u64 = (((arg1[10]) as u64) * ((arg2[8]) as u64)); + let x223: u64 = (((arg1[10]) as u64) * ((arg2[7]) as u64)); + let x224: u64 = (((arg1[10]) as u64) * ((arg2[6]) as u64)); + let x225: u64 = (((arg1[9]) as u64) * ((arg2[14]) as u64)); + let x226: u64 = (((arg1[9]) as u64) * ((arg2[13]) as u64)); + let x227: u64 = (((arg1[9]) as u64) * ((arg2[12]) as u64)); + let x228: u64 = (((arg1[9]) as u64) * ((arg2[11]) as u64)); + let x229: u64 = (((arg1[9]) as u64) * ((arg2[10]) as u64)); + let x230: u64 = (((arg1[9]) as u64) * ((arg2[9]) as u64)); + let x231: u64 = (((arg1[9]) as u64) * ((arg2[8]) as u64)); + let x232: u64 = (((arg1[9]) as u64) * ((arg2[7]) as u64)); + let x233: u64 = (((arg1[8]) as u64) * ((arg2[15]) as u64)); + let x234: u64 = (((arg1[8]) as u64) * ((arg2[14]) as u64)); + let x235: u64 = (((arg1[8]) as u64) * ((arg2[13]) as u64)); + let x236: u64 = (((arg1[8]) as u64) * ((arg2[12]) as u64)); + let x237: u64 = (((arg1[8]) as u64) * ((arg2[11]) as u64)); + let x238: u64 = (((arg1[8]) as u64) * ((arg2[10]) as u64)); + let x239: u64 = (((arg1[8]) as u64) * ((arg2[9]) as u64)); + let x240: u64 = (((arg1[8]) as u64) * ((arg2[8]) as u64)); + let x241: u64 = (((arg1[7]) as u64) * ((arg2[15]) as u64)); + let x242: u64 = (((arg1[7]) as u64) * ((arg2[14]) as u64)); + let x243: u64 = (((arg1[7]) as u64) * ((arg2[13]) as u64)); + let x244: u64 = (((arg1[7]) as u64) * ((arg2[12]) as u64)); + let x245: u64 = (((arg1[7]) as u64) * ((arg2[11]) as u64)); + let x246: u64 = (((arg1[7]) as u64) * ((arg2[10]) as u64)); + let x247: u64 = (((arg1[7]) as u64) * ((arg2[9]) as u64)); + let x248: u64 = (((arg1[6]) as u64) * ((arg2[15]) as u64)); + let x249: u64 = (((arg1[6]) as u64) * ((arg2[14]) as u64)); + let x250: u64 = (((arg1[6]) as u64) * ((arg2[13]) as u64)); + let x251: u64 = (((arg1[6]) as u64) * ((arg2[12]) as u64)); + let x252: u64 = (((arg1[6]) as u64) * ((arg2[11]) as u64)); + let x253: u64 = (((arg1[6]) as u64) * ((arg2[10]) as u64)); + let x254: u64 = (((arg1[5]) as u64) * ((arg2[15]) as u64)); + let x255: u64 = (((arg1[5]) as u64) * ((arg2[14]) as u64)); + let x256: u64 = (((arg1[5]) as u64) * ((arg2[13]) as u64)); + let x257: u64 = (((arg1[5]) as u64) * ((arg2[12]) as u64)); + let x258: u64 = (((arg1[5]) as u64) * ((arg2[11]) as u64)); + let x259: u64 = (((arg1[4]) as u64) * ((arg2[15]) as u64)); + let x260: u64 = (((arg1[4]) as u64) * ((arg2[14]) as u64)); + let x261: u64 = (((arg1[4]) as u64) * ((arg2[13]) as u64)); + let x262: u64 = (((arg1[4]) as u64) * ((arg2[12]) as u64)); + let x263: u64 = (((arg1[3]) as u64) * ((arg2[15]) as u64)); + let x264: u64 = (((arg1[3]) as u64) * ((arg2[14]) as u64)); + let x265: u64 = (((arg1[3]) as u64) * ((arg2[13]) as u64)); + let x266: u64 = (((arg1[2]) as u64) * ((arg2[15]) as u64)); + let x267: u64 = (((arg1[2]) as u64) * ((arg2[14]) as u64)); + let x268: u64 = (((arg1[1]) as u64) * ((arg2[15]) as u64)); + let x269: u64 = (((arg1[15]) as u64) * ((arg2[0]) as u64)); + let x270: u64 = (((arg1[14]) as u64) * ((arg2[1]) as u64)); + let x271: u64 = (((arg1[14]) as u64) * ((arg2[0]) as u64)); + let x272: u64 = (((arg1[13]) as u64) * ((arg2[2]) as u64)); + let x273: u64 = (((arg1[13]) as u64) * ((arg2[1]) as u64)); + let x274: u64 = (((arg1[13]) as u64) * ((arg2[0]) as u64)); + let x275: u64 = (((arg1[12]) as u64) * ((arg2[3]) as u64)); + let x276: u64 = (((arg1[12]) as u64) * ((arg2[2]) as u64)); + let x277: u64 = (((arg1[12]) as u64) * ((arg2[1]) as u64)); + let x278: u64 = (((arg1[12]) as u64) * ((arg2[0]) as u64)); + let x279: u64 = (((arg1[11]) as u64) * ((arg2[4]) as u64)); + let x280: u64 = (((arg1[11]) as u64) * ((arg2[3]) as u64)); + let x281: u64 = (((arg1[11]) as u64) * ((arg2[2]) as u64)); + let x282: u64 = (((arg1[11]) as u64) * ((arg2[1]) as u64)); + let x283: u64 = (((arg1[11]) as u64) * ((arg2[0]) as u64)); + let x284: u64 = (((arg1[10]) as u64) * ((arg2[5]) as u64)); + let x285: u64 = (((arg1[10]) as u64) * ((arg2[4]) as u64)); + let x286: u64 = (((arg1[10]) as u64) * ((arg2[3]) as u64)); + let x287: u64 = (((arg1[10]) as u64) * ((arg2[2]) as u64)); + let x288: u64 = (((arg1[10]) as u64) * ((arg2[1]) as u64)); + let x289: u64 = (((arg1[10]) as u64) * ((arg2[0]) as u64)); + let x290: u64 = (((arg1[9]) as u64) * ((arg2[6]) as u64)); + let x291: u64 = (((arg1[9]) as u64) * ((arg2[5]) as u64)); + let x292: u64 = (((arg1[9]) as u64) * ((arg2[4]) as u64)); + let x293: u64 = (((arg1[9]) as u64) * ((arg2[3]) as u64)); + let x294: u64 = (((arg1[9]) as u64) * ((arg2[2]) as u64)); + let x295: u64 = (((arg1[9]) as u64) * ((arg2[1]) as u64)); + let x296: u64 = (((arg1[9]) as u64) * ((arg2[0]) as u64)); + let x297: u64 = (((arg1[8]) as u64) * ((arg2[7]) as u64)); + let x298: u64 = (((arg1[8]) as u64) * ((arg2[6]) as u64)); + let x299: u64 = (((arg1[8]) as u64) * ((arg2[5]) as u64)); + let x300: u64 = (((arg1[8]) as u64) * ((arg2[4]) as u64)); + let x301: u64 = (((arg1[8]) as u64) * ((arg2[3]) as u64)); + let x302: u64 = (((arg1[8]) as u64) * ((arg2[2]) as u64)); + let x303: u64 = (((arg1[8]) as u64) * ((arg2[1]) as u64)); + let x304: u64 = (((arg1[8]) as u64) * ((arg2[0]) as u64)); + let x305: u64 = (((arg1[7]) as u64) * ((arg2[8]) as u64)); + let x306: u64 = (((arg1[7]) as u64) * ((arg2[7]) as u64)); + let x307: u64 = (((arg1[7]) as u64) * ((arg2[6]) as u64)); + let x308: u64 = (((arg1[7]) as u64) * ((arg2[5]) as u64)); + let x309: u64 = (((arg1[7]) as u64) * ((arg2[4]) as u64)); + let x310: u64 = (((arg1[7]) as u64) * ((arg2[3]) as u64)); + let x311: u64 = (((arg1[7]) as u64) * ((arg2[2]) as u64)); + let x312: u64 = (((arg1[7]) as u64) * ((arg2[1]) as u64)); + let x313: u64 = (((arg1[7]) as u64) * ((arg2[0]) as u64)); + let x314: u64 = (((arg1[6]) as u64) * ((arg2[9]) as u64)); + let x315: u64 = (((arg1[6]) as u64) * ((arg2[8]) as u64)); + let x316: u64 = (((arg1[6]) as u64) * ((arg2[7]) as u64)); + let x317: u64 = (((arg1[6]) as u64) * ((arg2[6]) as u64)); + let x318: u64 = (((arg1[6]) as u64) * ((arg2[5]) as u64)); + let x319: u64 = (((arg1[6]) as u64) * ((arg2[4]) as u64)); + let x320: u64 = (((arg1[6]) as u64) * ((arg2[3]) as u64)); + let x321: u64 = (((arg1[6]) as u64) * ((arg2[2]) as u64)); + let x322: u64 = (((arg1[6]) as u64) * ((arg2[1]) as u64)); + let x323: u64 = (((arg1[6]) as u64) * ((arg2[0]) as u64)); + let x324: u64 = (((arg1[5]) as u64) * ((arg2[10]) as u64)); + let x325: u64 = (((arg1[5]) as u64) * ((arg2[9]) as u64)); + let x326: u64 = (((arg1[5]) as u64) * ((arg2[8]) as u64)); + let x327: u64 = (((arg1[5]) as u64) * ((arg2[7]) as u64)); + let x328: u64 = (((arg1[5]) as u64) * ((arg2[6]) as u64)); + let x329: u64 = (((arg1[5]) as u64) * ((arg2[5]) as u64)); + let x330: u64 = (((arg1[5]) as u64) * ((arg2[4]) as u64)); + let x331: u64 = (((arg1[5]) as u64) * ((arg2[3]) as u64)); + let x332: u64 = (((arg1[5]) as u64) * ((arg2[2]) as u64)); + let x333: u64 = (((arg1[5]) as u64) * ((arg2[1]) as u64)); + let x334: u64 = (((arg1[5]) as u64) * ((arg2[0]) as u64)); + let x335: u64 = (((arg1[4]) as u64) * ((arg2[11]) as u64)); + let x336: u64 = (((arg1[4]) as u64) * ((arg2[10]) as u64)); + let x337: u64 = (((arg1[4]) as u64) * ((arg2[9]) as u64)); + let x338: u64 = (((arg1[4]) as u64) * ((arg2[8]) as u64)); + let x339: u64 = (((arg1[4]) as u64) * ((arg2[7]) as u64)); + let x340: u64 = (((arg1[4]) as u64) * ((arg2[6]) as u64)); + let x341: u64 = (((arg1[4]) as u64) * ((arg2[5]) as u64)); + let x342: u64 = (((arg1[4]) as u64) * ((arg2[4]) as u64)); + let x343: u64 = (((arg1[4]) as u64) * ((arg2[3]) as u64)); + let x344: u64 = (((arg1[4]) as u64) * ((arg2[2]) as u64)); + let x345: u64 = (((arg1[4]) as u64) * ((arg2[1]) as u64)); + let x346: u64 = (((arg1[4]) as u64) * ((arg2[0]) as u64)); + let x347: u64 = (((arg1[3]) as u64) * ((arg2[12]) as u64)); + let x348: u64 = (((arg1[3]) as u64) * ((arg2[11]) as u64)); + let x349: u64 = (((arg1[3]) as u64) * ((arg2[10]) as u64)); + let x350: u64 = (((arg1[3]) as u64) * ((arg2[9]) as u64)); + let x351: u64 = (((arg1[3]) as u64) * ((arg2[8]) as u64)); + let x352: u64 = (((arg1[3]) as u64) * ((arg2[7]) as u64)); + let x353: u64 = (((arg1[3]) as u64) * ((arg2[6]) as u64)); + let x354: u64 = (((arg1[3]) as u64) * ((arg2[5]) as u64)); + let x355: u64 = (((arg1[3]) as u64) * ((arg2[4]) as u64)); + let x356: u64 = (((arg1[3]) as u64) * ((arg2[3]) as u64)); + let x357: u64 = (((arg1[3]) as u64) * ((arg2[2]) as u64)); + let x358: u64 = (((arg1[3]) as u64) * ((arg2[1]) as u64)); + let x359: u64 = (((arg1[3]) as u64) * ((arg2[0]) as u64)); + let x360: u64 = (((arg1[2]) as u64) * ((arg2[13]) as u64)); + let x361: u64 = (((arg1[2]) as u64) * ((arg2[12]) as u64)); + let x362: u64 = (((arg1[2]) as u64) * ((arg2[11]) as u64)); + let x363: u64 = (((arg1[2]) as u64) * ((arg2[10]) as u64)); + let x364: u64 = (((arg1[2]) as u64) * ((arg2[9]) as u64)); + let x365: u64 = (((arg1[2]) as u64) * ((arg2[8]) as u64)); + let x366: u64 = (((arg1[2]) as u64) * ((arg2[7]) as u64)); + let x367: u64 = (((arg1[2]) as u64) * ((arg2[6]) as u64)); + let x368: u64 = (((arg1[2]) as u64) * ((arg2[5]) as u64)); + let x369: u64 = (((arg1[2]) as u64) * ((arg2[4]) as u64)); + let x370: u64 = (((arg1[2]) as u64) * ((arg2[3]) as u64)); + let x371: u64 = (((arg1[2]) as u64) * ((arg2[2]) as u64)); + let x372: u64 = (((arg1[2]) as u64) * ((arg2[1]) as u64)); + let x373: u64 = (((arg1[2]) as u64) * ((arg2[0]) as u64)); + let x374: u64 = (((arg1[1]) as u64) * ((arg2[14]) as u64)); + let x375: u64 = (((arg1[1]) as u64) * ((arg2[13]) as u64)); + let x376: u64 = (((arg1[1]) as u64) * ((arg2[12]) as u64)); + let x377: u64 = (((arg1[1]) as u64) * ((arg2[11]) as u64)); + let x378: u64 = (((arg1[1]) as u64) * ((arg2[10]) as u64)); + let x379: u64 = (((arg1[1]) as u64) * ((arg2[9]) as u64)); + let x380: u64 = (((arg1[1]) as u64) * ((arg2[8]) as u64)); + let x381: u64 = (((arg1[1]) as u64) * ((arg2[7]) as u64)); + let x382: u64 = (((arg1[1]) as u64) * ((arg2[6]) as u64)); + let x383: u64 = (((arg1[1]) as u64) * ((arg2[5]) as u64)); + let x384: u64 = (((arg1[1]) as u64) * ((arg2[4]) as u64)); + let x385: u64 = (((arg1[1]) as u64) * ((arg2[3]) as u64)); + let x386: u64 = (((arg1[1]) as u64) * ((arg2[2]) as u64)); + let x387: u64 = (((arg1[1]) as u64) * ((arg2[1]) as u64)); + let x388: u64 = (((arg1[1]) as u64) * ((arg2[0]) as u64)); + let x389: u64 = (((arg1[0]) as u64) * ((arg2[15]) as u64)); + let x390: u64 = (((arg1[0]) as u64) * ((arg2[14]) as u64)); + let x391: u64 = (((arg1[0]) as u64) * ((arg2[13]) as u64)); + let x392: u64 = (((arg1[0]) as u64) * ((arg2[12]) as u64)); + let x393: u64 = (((arg1[0]) as u64) * ((arg2[11]) as u64)); + let x394: u64 = (((arg1[0]) as u64) * ((arg2[10]) as u64)); + let x395: u64 = (((arg1[0]) as u64) * ((arg2[9]) as u64)); + let x396: u64 = (((arg1[0]) as u64) * ((arg2[8]) as u64)); + let x397: u64 = (((arg1[0]) as u64) * ((arg2[7]) as u64)); + let x398: u64 = (((arg1[0]) as u64) * ((arg2[6]) as u64)); + let x399: u64 = (((arg1[0]) as u64) * ((arg2[5]) as u64)); + let x400: u64 = (((arg1[0]) as u64) * ((arg2[4]) as u64)); + let x401: u64 = (((arg1[0]) as u64) * ((arg2[3]) as u64)); + let x402: u64 = (((arg1[0]) as u64) * ((arg2[2]) as u64)); + let x403: u64 = (((arg1[0]) as u64) * ((arg2[1]) as u64)); + let x404: u64 = (((arg1[0]) as u64) * ((arg2[0]) as u64)); + let x405: u64 = (x397 + (x382 + (x368 + (x355 + (x343 + (x332 + (x322 + (x313 + (x141 + (x133 + (x124 + (x114 + (x103 + (x91 + (x78 + x64))))))))))))))); + let x406: u64 = (x405 >> 28); + let x407: u32 = ((x405 & (0xfffffff as u64)) as u32); + let x408: u64 = (x389 + (x374 + (x360 + (x347 + (x335 + (x324 + (x314 + (x305 + (x297 + (x290 + (x284 + (x279 + (x275 + (x272 + (x270 + (x269 + (x233 + (x225 + (x217 + (x209 + (x201 + (x193 + (x185 + x177))))))))))))))))))))))); + let x409: u64 = (x390 + (x375 + (x361 + (x348 + (x336 + (x325 + (x315 + (x306 + (x298 + (x291 + (x285 + (x280 + (x276 + (x273 + (x271 + (x241 + (x234 + (x226 + (x218 + (x210 + (x202 + (x194 + (x186 + (x178 + (x57 + x29))))))))))))))))))))))))); + let x410: u64 = (x391 + (x376 + (x362 + (x349 + (x337 + (x326 + (x316 + (x307 + (x299 + (x292 + (x286 + (x281 + (x277 + (x274 + (x248 + (x242 + (x235 + (x227 + (x219 + (x211 + (x203 + (x195 + (x187 + (x179 + (x72 + (x58 + (x36 + x30))))))))))))))))))))))))))); + let x411: u128 = ((x392 as u128) + ((x377 as u128) + ((x363 + (x350 + (x338 + (x327 + (x317 + (x308 + (x300 + (x293 + (x287 + (x282 + (x278 + (x254 + (x249 + (x243 + (x236 + (x228 + (x220 + (x212 + (x204 + (x196 + (x188 + (x180 + (x86 + (x73 + (x59 + (x42 + (x37 + x31))))))))))))))))))))))))))) as u128))); + let x412: u128 = ((x393 as u128) + ((x378 as u128) + ((x364 as u128) + ((x351 as u128) + ((x339 + (x328 + (x318 + (x309 + (x301 + (x294 + (x288 + (x283 + (x259 + (x255 + (x250 + (x244 + (x237 + (x229 + (x221 + (x213 + (x205 + (x197 + (x189 + (x181 + (x99 + (x87 + (x74 + (x60 + (x47 + (x43 + (x38 + x32))))))))))))))))))))))))))) as u128))))); + let x413: u128 = ((x394 as u128) + ((x379 as u128) + ((x365 as u128) + ((x352 as u128) + ((x340 as u128) + ((x329 as u128) + ((x319 + (x310 + (x302 + (x295 + (x289 + (x263 + (x260 + (x256 + (x251 + (x245 + (x238 + (x230 + (x222 + (x214 + (x206 + (x198 + (x190 + (x182 + (x111 + (x100 + (x88 + (x75 + (x61 + (x51 + (x48 + (x44 + (x39 + x33))))))))))))))))))))))))))) as u128))))))); + let x414: u128 = ((x395 as u128) + ((x380 as u128) + ((x366 as u128) + ((x353 as u128) + ((x341 as u128) + ((x330 as u128) + ((x320 as u128) + ((x311 as u128) + ((x303 + (x296 + (x266 + (x264 + (x261 + (x257 + (x252 + (x246 + (x239 + (x231 + (x223 + (x215 + (x207 + (x199 + (x191 + (x183 + (x122 + (x112 + (x101 + (x89 + (x76 + (x62 + (x54 + (x52 + (x49 + (x45 + (x40 + x34))))))))))))))))))))))))))) as u128))))))))); + let x415: u128 = ((x396 as u128) + ((x381 as u128) + ((x367 as u128) + ((x354 as u128) + ((x342 as u128) + ((x331 as u128) + ((x321 as u128) + ((x312 as u128) + ((x304 as u128) + ((x268 as u128) + ((x267 + (x265 + (x262 + (x258 + (x253 + (x247 + (x240 + (x232 + (x224 + (x216 + (x208 + (x200 + (x192 + (x184 + (x132 + (x123 + (x113 + (x102 + (x90 + (x77 + (x63 + (x56 + (x55 + (x53 + (x50 + (x46 + (x41 + x35))))))))))))))))))))))))))) as u128))))))))))); + let x416: u64 = (x398 + (x383 + (x369 + (x356 + (x344 + (x333 + (x323 + (x149 + (x142 + (x134 + (x125 + (x115 + (x104 + (x92 + (x79 + (x65 + x1)))))))))))))))); + let x417: u64 = (x399 + (x384 + (x370 + (x357 + (x345 + (x334 + (x156 + (x150 + (x143 + (x135 + (x126 + (x116 + (x105 + (x93 + (x80 + (x66 + (x8 + x2))))))))))))))))); + let x418: u64 = (x400 + (x385 + (x371 + (x358 + (x346 + (x162 + (x157 + (x151 + (x144 + (x136 + (x127 + (x117 + (x106 + (x94 + (x81 + (x67 + (x14 + (x9 + x3)))))))))))))))))); + let x419: u64 = (x401 + (x386 + (x372 + (x359 + (x167 + (x163 + (x158 + (x152 + (x145 + (x137 + (x128 + (x118 + (x107 + (x95 + (x82 + (x68 + (x19 + (x15 + (x10 + x4))))))))))))))))))); + let x420: u64 = (x402 + (x387 + (x373 + (x171 + (x168 + (x164 + (x159 + (x153 + (x146 + (x138 + (x129 + (x119 + (x108 + (x96 + (x83 + (x69 + (x23 + (x20 + (x16 + (x11 + x5)))))))))))))))))))); + let x421: u64 = (x403 + (x388 + (x174 + (x172 + (x169 + (x165 + (x160 + (x154 + (x147 + (x139 + (x130 + (x120 + (x109 + (x97 + (x84 + (x70 + (x26 + (x24 + (x21 + (x17 + (x12 + x6))))))))))))))))))))); + let x422: u64 = (x404 + (x176 + (x175 + (x173 + (x170 + (x166 + (x161 + (x155 + (x148 + (x140 + (x131 + (x121 + (x110 + (x98 + (x85 + (x71 + (x28 + (x27 + (x25 + (x22 + (x18 + (x13 + x7)))))))))))))))))))))); + let x423: u128 = ((x406 as u128) + x415); + let x424: u64 = (x408 >> 28); + let x425: u32 = ((x408 & (0xfffffff as u64)) as u32); + let x426: u128 = (x423 + (x424 as u128)); + let x427: u64 = ((x426 >> 28) as u64); + let x428: u32 = ((x426 & (0xfffffff as u128)) as u32); + let x429: u64 = (x422 + x424); + let x430: u128 = ((x427 as u128) + x414); + let x431: u64 = (x429 >> 28); + let x432: u32 = ((x429 & (0xfffffff as u64)) as u32); + let x433: u64 = (x431 + x421); + let x434: u64 = ((x430 >> 28) as u64); + let x435: u32 = ((x430 & (0xfffffff as u128)) as u32); + let x436: u128 = ((x434 as u128) + x413); + let x437: u64 = (x433 >> 28); + let x438: u32 = ((x433 & (0xfffffff as u64)) as u32); + let x439: u64 = (x437 + x420); + let x440: u64 = ((x436 >> 28) as u64); + let x441: u32 = ((x436 & (0xfffffff as u128)) as u32); + let x442: u128 = ((x440 as u128) + x412); + let x443: u64 = (x439 >> 28); + let x444: u32 = ((x439 & (0xfffffff as u64)) as u32); + let x445: u64 = (x443 + x419); + let x446: u64 = ((x442 >> 28) as u64); + let x447: u32 = ((x442 & (0xfffffff as u128)) as u32); + let x448: u128 = ((x446 as u128) + x411); + let x449: u64 = (x445 >> 28); + let x450: u32 = ((x445 & (0xfffffff as u64)) as u32); + let x451: u64 = (x449 + x418); + let x452: u64 = ((x448 >> 28) as u64); + let x453: u32 = ((x448 & (0xfffffff as u128)) as u32); + let x454: u64 = (x452 + x410); + let x455: u64 = (x451 >> 28); + let x456: u32 = ((x451 & (0xfffffff as u64)) as u32); + let x457: u64 = (x455 + x417); + let x458: u64 = (x454 >> 28); + let x459: u32 = ((x454 & (0xfffffff as u64)) as u32); + let x460: u64 = (x458 + x409); + let x461: u64 = (x457 >> 28); + let x462: u32 = ((x457 & (0xfffffff as u64)) as u32); + let x463: u64 = (x461 + x416); + let x464: u64 = (x460 >> 28); + let x465: u32 = ((x460 & (0xfffffff as u64)) as u32); + let x466: u64 = (x464 + (x425 as u64)); + let x467: u64 = (x463 >> 28); + let x468: u32 = ((x463 & (0xfffffff as u64)) as u32); + let x469: u64 = (x467 + (x407 as u64)); + let x470: u32 = ((x466 >> 28) as u32); + let x471: u32 = ((x466 & (0xfffffff as u64)) as u32); + let x472: u32 = ((x469 >> 28) as u32); + let x473: u32 = ((x469 & (0xfffffff as u64)) as u32); + let x474: u32 = (x428 + x470); + let x475: u32 = (x432 + x470); + let x476: u32 = (x472 + x474); + let x477: fiat_p448_u1 = ((x476 >> 28) as fiat_p448_u1); + let x478: u32 = (x476 & 0xfffffff); + let x479: u32 = ((x477 as u32) + x435); + let x480: fiat_p448_u1 = ((x475 >> 28) as fiat_p448_u1); + let x481: u32 = (x475 & 0xfffffff); + let x482: u32 = ((x480 as u32) + x438); + out1[0] = x481; + out1[1] = x482; + out1[2] = x444; + out1[3] = x450; + out1[4] = x456; + out1[5] = x462; + out1[6] = x468; + out1[7] = x473; + out1[8] = x478; + out1[9] = x479; + out1[10] = x441; + out1[11] = x447; + out1[12] = x453; + out1[13] = x459; + out1[14] = x465; + out1[15] = x471; +} + +/// The function fiat_p448_carry_square squares a field element and reduces the result. +/// +/// Postconditions: +/// eval out1 mod m = (eval arg1 * eval arg1) mod m +/// +#[inline] +pub fn fiat_p448_carry_square(out1: &mut fiat_p448_tight_field_element, arg1: &fiat_p448_loose_field_element) -> () { + let x1: u32 = (arg1[15]); + let x2: u32 = (arg1[15]); + let x3: u32 = (x1 * 0x2); + let x4: u32 = (x2 * 0x2); + let x5: u32 = ((arg1[15]) * 0x2); + let x6: u32 = (arg1[14]); + let x7: u32 = (arg1[14]); + let x8: u32 = (x6 * 0x2); + let x9: u32 = (x7 * 0x2); + let x10: u32 = ((arg1[14]) * 0x2); + let x11: u32 = (arg1[13]); + let x12: u32 = (arg1[13]); + let x13: u32 = (x11 * 0x2); + let x14: u32 = (x12 * 0x2); + let x15: u32 = ((arg1[13]) * 0x2); + let x16: u32 = (arg1[12]); + let x17: u32 = (arg1[12]); + let x18: u32 = (x16 * 0x2); + let x19: u32 = (x17 * 0x2); + let x20: u32 = ((arg1[12]) * 0x2); + let x21: u32 = (arg1[11]); + let x22: u32 = (arg1[11]); + let x23: u32 = (x21 * 0x2); + let x24: u32 = (x22 * 0x2); + let x25: u32 = ((arg1[11]) * 0x2); + let x26: u32 = (arg1[10]); + let x27: u32 = (arg1[10]); + let x28: u32 = (x26 * 0x2); + let x29: u32 = (x27 * 0x2); + let x30: u32 = ((arg1[10]) * 0x2); + let x31: u32 = (arg1[9]); + let x32: u32 = (arg1[9]); + let x33: u32 = (x31 * 0x2); + let x34: u32 = (x32 * 0x2); + let x35: u32 = ((arg1[9]) * 0x2); + let x36: u32 = (arg1[8]); + let x37: u32 = (arg1[8]); + let x38: u32 = ((arg1[8]) * 0x2); + let x39: u32 = ((arg1[7]) * 0x2); + let x40: u32 = ((arg1[6]) * 0x2); + let x41: u32 = ((arg1[5]) * 0x2); + let x42: u32 = ((arg1[4]) * 0x2); + let x43: u32 = ((arg1[3]) * 0x2); + let x44: u32 = ((arg1[2]) * 0x2); + let x45: u32 = ((arg1[1]) * 0x2); + let x46: u64 = (((arg1[15]) as u64) * (x1 as u64)); + let x47: u64 = (((arg1[14]) as u64) * (x3 as u64)); + let x48: u64 = (((arg1[14]) as u64) * (x6 as u64)); + let x49: u64 = (((arg1[13]) as u64) * (x3 as u64)); + let x50: u64 = (((arg1[13]) as u64) * (x8 as u64)); + let x51: u64 = (((arg1[13]) as u64) * (x11 as u64)); + let x52: u64 = (((arg1[12]) as u64) * (x3 as u64)); + let x53: u64 = (((arg1[12]) as u64) * (x8 as u64)); + let x54: u64 = (((arg1[12]) as u64) * (x13 as u64)); + let x55: u64 = (((arg1[12]) as u64) * (x16 as u64)); + let x56: u64 = (((arg1[11]) as u64) * (x3 as u64)); + let x57: u64 = (((arg1[11]) as u64) * (x8 as u64)); + let x58: u64 = (((arg1[11]) as u64) * (x13 as u64)); + let x59: u64 = (((arg1[10]) as u64) * (x3 as u64)); + let x60: u64 = (((arg1[10]) as u64) * (x8 as u64)); + let x61: u64 = (((arg1[9]) as u64) * (x3 as u64)); + let x62: u64 = (((arg1[15]) as u64) * (x1 as u64)); + let x63: u64 = (((arg1[14]) as u64) * (x3 as u64)); + let x64: u64 = (((arg1[14]) as u64) * (x6 as u64)); + let x65: u64 = (((arg1[13]) as u64) * (x3 as u64)); + let x66: u64 = (((arg1[13]) as u64) * (x8 as u64)); + let x67: u64 = (((arg1[13]) as u64) * (x11 as u64)); + let x68: u64 = (((arg1[12]) as u64) * (x3 as u64)); + let x69: u64 = (((arg1[12]) as u64) * (x8 as u64)); + let x70: u64 = (((arg1[12]) as u64) * (x13 as u64)); + let x71: u64 = (((arg1[12]) as u64) * (x16 as u64)); + let x72: u64 = (((arg1[11]) as u64) * (x3 as u64)); + let x73: u64 = (((arg1[11]) as u64) * (x8 as u64)); + let x74: u64 = (((arg1[11]) as u64) * (x13 as u64)); + let x75: u64 = (((arg1[10]) as u64) * (x3 as u64)); + let x76: u64 = (((arg1[10]) as u64) * (x8 as u64)); + let x77: u64 = (((arg1[9]) as u64) * (x3 as u64)); + let x78: u64 = (((arg1[15]) as u64) * (x2 as u64)); + let x79: u64 = (((arg1[14]) as u64) * (x4 as u64)); + let x80: u64 = (((arg1[14]) as u64) * (x7 as u64)); + let x81: u64 = (((arg1[13]) as u64) * (x4 as u64)); + let x82: u64 = (((arg1[13]) as u64) * (x9 as u64)); + let x83: u64 = (((arg1[13]) as u64) * (x12 as u64)); + let x84: u64 = (((arg1[12]) as u64) * (x4 as u64)); + let x85: u64 = (((arg1[12]) as u64) * (x9 as u64)); + let x86: u64 = (((arg1[12]) as u64) * (x14 as u64)); + let x87: u64 = (((arg1[12]) as u64) * (x17 as u64)); + let x88: u64 = (((arg1[11]) as u64) * (x4 as u64)); + let x89: u64 = (((arg1[11]) as u64) * (x9 as u64)); + let x90: u64 = (((arg1[11]) as u64) * (x14 as u64)); + let x91: u64 = (((arg1[11]) as u64) * (x19 as u64)); + let x92: u64 = (((arg1[11]) as u64) * (x18 as u64)); + let x93: u64 = (((arg1[11]) as u64) * (x22 as u64)); + let x94: u64 = (((arg1[11]) as u64) * (x21 as u64)); + let x95: u64 = (((arg1[10]) as u64) * (x4 as u64)); + let x96: u64 = (((arg1[10]) as u64) * (x9 as u64)); + let x97: u64 = (((arg1[10]) as u64) * (x14 as u64)); + let x98: u64 = (((arg1[10]) as u64) * (x13 as u64)); + let x99: u64 = (((arg1[10]) as u64) * (x19 as u64)); + let x100: u64 = (((arg1[10]) as u64) * (x18 as u64)); + let x101: u64 = (((arg1[10]) as u64) * (x24 as u64)); + let x102: u64 = (((arg1[10]) as u64) * (x23 as u64)); + let x103: u64 = (((arg1[10]) as u64) * (x27 as u64)); + let x104: u64 = (((arg1[10]) as u64) * (x26 as u64)); + let x105: u64 = (((arg1[9]) as u64) * (x4 as u64)); + let x106: u64 = (((arg1[9]) as u64) * (x9 as u64)); + let x107: u64 = (((arg1[9]) as u64) * (x8 as u64)); + let x108: u64 = (((arg1[9]) as u64) * (x14 as u64)); + let x109: u64 = (((arg1[9]) as u64) * (x13 as u64)); + let x110: u64 = (((arg1[9]) as u64) * (x19 as u64)); + let x111: u64 = (((arg1[9]) as u64) * (x18 as u64)); + let x112: u64 = (((arg1[9]) as u64) * (x24 as u64)); + let x113: u64 = (((arg1[9]) as u64) * (x23 as u64)); + let x114: u64 = (((arg1[9]) as u64) * (x29 as u64)); + let x115: u64 = (((arg1[9]) as u64) * (x28 as u64)); + let x116: u64 = (((arg1[9]) as u64) * (x32 as u64)); + let x117: u64 = (((arg1[9]) as u64) * (x31 as u64)); + let x118: u64 = (((arg1[8]) as u64) * (x4 as u64)); + let x119: u64 = (((arg1[8]) as u64) * (x3 as u64)); + let x120: u64 = (((arg1[8]) as u64) * (x9 as u64)); + let x121: u64 = (((arg1[8]) as u64) * (x8 as u64)); + let x122: u64 = (((arg1[8]) as u64) * (x14 as u64)); + let x123: u64 = (((arg1[8]) as u64) * (x13 as u64)); + let x124: u64 = (((arg1[8]) as u64) * (x19 as u64)); + let x125: u64 = (((arg1[8]) as u64) * (x18 as u64)); + let x126: u64 = (((arg1[8]) as u64) * (x24 as u64)); + let x127: u64 = (((arg1[8]) as u64) * (x23 as u64)); + let x128: u64 = (((arg1[8]) as u64) * (x29 as u64)); + let x129: u64 = (((arg1[8]) as u64) * (x28 as u64)); + let x130: u64 = (((arg1[8]) as u64) * (x34 as u64)); + let x131: u64 = (((arg1[8]) as u64) * (x33 as u64)); + let x132: u64 = (((arg1[8]) as u64) * (x37 as u64)); + let x133: u64 = (((arg1[8]) as u64) * (x36 as u64)); + let x134: u64 = (((arg1[7]) as u64) * (x4 as u64)); + let x135: u64 = (((arg1[7]) as u64) * (x3 as u64)); + let x136: u64 = (((arg1[7]) as u64) * (x9 as u64)); + let x137: u64 = (((arg1[7]) as u64) * (x8 as u64)); + let x138: u64 = (((arg1[7]) as u64) * (x14 as u64)); + let x139: u64 = (((arg1[7]) as u64) * (x13 as u64)); + let x140: u64 = (((arg1[7]) as u64) * (x19 as u64)); + let x141: u64 = (((arg1[7]) as u64) * (x18 as u64)); + let x142: u64 = (((arg1[7]) as u64) * (x24 as u64)); + let x143: u64 = (((arg1[7]) as u64) * (x23 as u64)); + let x144: u64 = (((arg1[7]) as u64) * (x29 as u64)); + let x145: u64 = (((arg1[7]) as u64) * (x28 as u64)); + let x146: u64 = (((arg1[7]) as u64) * (x34 as u64)); + let x147: u64 = (((arg1[7]) as u64) * (x33 as u64)); + let x148: u64 = (((arg1[7]) as u64) * (x38 as u64)); + let x149: u64 = (((arg1[7]) as u64) * ((arg1[7]) as u64)); + let x150: u64 = (((arg1[6]) as u64) * (x4 as u64)); + let x151: u64 = (((arg1[6]) as u64) * (x3 as u64)); + let x152: u64 = (((arg1[6]) as u64) * (x9 as u64)); + let x153: u64 = (((arg1[6]) as u64) * (x8 as u64)); + let x154: u64 = (((arg1[6]) as u64) * (x14 as u64)); + let x155: u64 = (((arg1[6]) as u64) * (x13 as u64)); + let x156: u64 = (((arg1[6]) as u64) * (x19 as u64)); + let x157: u64 = (((arg1[6]) as u64) * (x18 as u64)); + let x158: u64 = (((arg1[6]) as u64) * (x24 as u64)); + let x159: u64 = (((arg1[6]) as u64) * (x23 as u64)); + let x160: u64 = (((arg1[6]) as u64) * (x29 as u64)); + let x161: u64 = (((arg1[6]) as u64) * (x28 as u64)); + let x162: u64 = (((arg1[6]) as u64) * (x35 as u64)); + let x163: u64 = (((arg1[6]) as u64) * (x38 as u64)); + let x164: u64 = (((arg1[6]) as u64) * (x39 as u64)); + let x165: u64 = (((arg1[6]) as u64) * ((arg1[6]) as u64)); + let x166: u64 = (((arg1[5]) as u64) * (x4 as u64)); + let x167: u64 = (((arg1[5]) as u64) * (x3 as u64)); + let x168: u64 = (((arg1[5]) as u64) * (x9 as u64)); + let x169: u64 = (((arg1[5]) as u64) * (x8 as u64)); + let x170: u64 = (((arg1[5]) as u64) * (x14 as u64)); + let x171: u64 = (((arg1[5]) as u64) * (x13 as u64)); + let x172: u64 = (((arg1[5]) as u64) * (x19 as u64)); + let x173: u64 = (((arg1[5]) as u64) * (x18 as u64)); + let x174: u64 = (((arg1[5]) as u64) * (x24 as u64)); + let x175: u64 = (((arg1[5]) as u64) * (x23 as u64)); + let x176: u64 = (((arg1[5]) as u64) * (x30 as u64)); + let x177: u64 = (((arg1[5]) as u64) * (x35 as u64)); + let x178: u64 = (((arg1[5]) as u64) * (x38 as u64)); + let x179: u64 = (((arg1[5]) as u64) * (x39 as u64)); + let x180: u64 = (((arg1[5]) as u64) * (x40 as u64)); + let x181: u64 = (((arg1[5]) as u64) * ((arg1[5]) as u64)); + let x182: u64 = (((arg1[4]) as u64) * (x4 as u64)); + let x183: u64 = (((arg1[4]) as u64) * (x3 as u64)); + let x184: u64 = (((arg1[4]) as u64) * (x9 as u64)); + let x185: u64 = (((arg1[4]) as u64) * (x8 as u64)); + let x186: u64 = (((arg1[4]) as u64) * (x14 as u64)); + let x187: u64 = (((arg1[4]) as u64) * (x13 as u64)); + let x188: u64 = (((arg1[4]) as u64) * (x19 as u64)); + let x189: u64 = (((arg1[4]) as u64) * (x18 as u64)); + let x190: u64 = (((arg1[4]) as u64) * (x25 as u64)); + let x191: u64 = (((arg1[4]) as u64) * (x30 as u64)); + let x192: u64 = (((arg1[4]) as u64) * (x35 as u64)); + let x193: u64 = (((arg1[4]) as u64) * (x38 as u64)); + let x194: u64 = (((arg1[4]) as u64) * (x39 as u64)); + let x195: u64 = (((arg1[4]) as u64) * (x40 as u64)); + let x196: u64 = (((arg1[4]) as u64) * (x41 as u64)); + let x197: u64 = (((arg1[4]) as u64) * ((arg1[4]) as u64)); + let x198: u64 = (((arg1[3]) as u64) * (x4 as u64)); + let x199: u64 = (((arg1[3]) as u64) * (x3 as u64)); + let x200: u64 = (((arg1[3]) as u64) * (x9 as u64)); + let x201: u64 = (((arg1[3]) as u64) * (x8 as u64)); + let x202: u64 = (((arg1[3]) as u64) * (x14 as u64)); + let x203: u64 = (((arg1[3]) as u64) * (x13 as u64)); + let x204: u64 = (((arg1[3]) as u64) * (x20 as u64)); + let x205: u64 = (((arg1[3]) as u64) * (x25 as u64)); + let x206: u64 = (((arg1[3]) as u64) * (x30 as u64)); + let x207: u64 = (((arg1[3]) as u64) * (x35 as u64)); + let x208: u64 = (((arg1[3]) as u64) * (x38 as u64)); + let x209: u64 = (((arg1[3]) as u64) * (x39 as u64)); + let x210: u64 = (((arg1[3]) as u64) * (x40 as u64)); + let x211: u64 = (((arg1[3]) as u64) * (x41 as u64)); + let x212: u64 = (((arg1[3]) as u64) * (x42 as u64)); + let x213: u64 = (((arg1[3]) as u64) * ((arg1[3]) as u64)); + let x214: u64 = (((arg1[2]) as u64) * (x4 as u64)); + let x215: u64 = (((arg1[2]) as u64) * (x3 as u64)); + let x216: u64 = (((arg1[2]) as u64) * (x9 as u64)); + let x217: u64 = (((arg1[2]) as u64) * (x8 as u64)); + let x218: u64 = (((arg1[2]) as u64) * (x15 as u64)); + let x219: u64 = (((arg1[2]) as u64) * (x20 as u64)); + let x220: u64 = (((arg1[2]) as u64) * (x25 as u64)); + let x221: u64 = (((arg1[2]) as u64) * (x30 as u64)); + let x222: u64 = (((arg1[2]) as u64) * (x35 as u64)); + let x223: u64 = (((arg1[2]) as u64) * (x38 as u64)); + let x224: u64 = (((arg1[2]) as u64) * (x39 as u64)); + let x225: u64 = (((arg1[2]) as u64) * (x40 as u64)); + let x226: u64 = (((arg1[2]) as u64) * (x41 as u64)); + let x227: u64 = (((arg1[2]) as u64) * (x42 as u64)); + let x228: u64 = (((arg1[2]) as u64) * (x43 as u64)); + let x229: u64 = (((arg1[2]) as u64) * ((arg1[2]) as u64)); + let x230: u64 = (((arg1[1]) as u64) * (x4 as u64)); + let x231: u64 = (((arg1[1]) as u64) * (x3 as u64)); + let x232: u64 = (((arg1[1]) as u64) * (x10 as u64)); + let x233: u64 = (((arg1[1]) as u64) * (x15 as u64)); + let x234: u64 = (((arg1[1]) as u64) * (x20 as u64)); + let x235: u64 = (((arg1[1]) as u64) * (x25 as u64)); + let x236: u64 = (((arg1[1]) as u64) * (x30 as u64)); + let x237: u64 = (((arg1[1]) as u64) * (x35 as u64)); + let x238: u64 = (((arg1[1]) as u64) * (x38 as u64)); + let x239: u64 = (((arg1[1]) as u64) * (x39 as u64)); + let x240: u64 = (((arg1[1]) as u64) * (x40 as u64)); + let x241: u64 = (((arg1[1]) as u64) * (x41 as u64)); + let x242: u64 = (((arg1[1]) as u64) * (x42 as u64)); + let x243: u64 = (((arg1[1]) as u64) * (x43 as u64)); + let x244: u64 = (((arg1[1]) as u64) * (x44 as u64)); + let x245: u64 = (((arg1[1]) as u64) * ((arg1[1]) as u64)); + let x246: u64 = (((arg1[0]) as u64) * (x5 as u64)); + let x247: u64 = (((arg1[0]) as u64) * (x10 as u64)); + let x248: u64 = (((arg1[0]) as u64) * (x15 as u64)); + let x249: u64 = (((arg1[0]) as u64) * (x20 as u64)); + let x250: u64 = (((arg1[0]) as u64) * (x25 as u64)); + let x251: u64 = (((arg1[0]) as u64) * (x30 as u64)); + let x252: u64 = (((arg1[0]) as u64) * (x35 as u64)); + let x253: u64 = (((arg1[0]) as u64) * (x38 as u64)); + let x254: u64 = (((arg1[0]) as u64) * (x39 as u64)); + let x255: u64 = (((arg1[0]) as u64) * (x40 as u64)); + let x256: u64 = (((arg1[0]) as u64) * (x41 as u64)); + let x257: u64 = (((arg1[0]) as u64) * (x42 as u64)); + let x258: u64 = (((arg1[0]) as u64) * (x43 as u64)); + let x259: u64 = (((arg1[0]) as u64) * (x44 as u64)); + let x260: u64 = (((arg1[0]) as u64) * (x45 as u64)); + let x261: u64 = (((arg1[0]) as u64) * ((arg1[0]) as u64)); + let x262: u64 = (x254 + (x240 + (x226 + (x212 + (x118 + (x106 + (x97 + x91))))))); + let x263: u64 = (x262 >> 28); + let x264: u32 = ((x262 & (0xfffffff as u64)) as u32); + let x265: u64 = (x246 + (x232 + (x218 + (x204 + (x190 + (x176 + (x162 + (x148 + (x119 + (x107 + (x98 + x92))))))))))); + let x266: u64 = (x247 + (x233 + (x219 + (x205 + (x191 + (x177 + (x163 + (x149 + (x135 + (x121 + (x109 + (x100 + (x94 + (x78 + x62)))))))))))))); + let x267: u64 = (x248 + (x234 + (x220 + (x206 + (x192 + (x178 + (x164 + (x151 + (x137 + (x123 + (x111 + (x102 + (x79 + x63))))))))))))); + let x268: u128 = ((x249 as u128) + ((x235 + (x221 + (x207 + (x193 + (x179 + (x167 + (x165 + (x153 + (x139 + (x125 + (x113 + (x104 + (x81 + (x80 + (x65 + x64))))))))))))))) as u128)); + let x269: u128 = ((x250 as u128) + ((x236 as u128) + ((x222 + (x208 + (x194 + (x183 + (x180 + (x169 + (x155 + (x141 + (x127 + (x115 + (x84 + (x82 + (x68 + x66))))))))))))) as u128))); + let x270: u128 = ((x251 as u128) + ((x237 as u128) + ((x223 as u128) + ((x209 + (x199 + (x195 + (x185 + (x181 + (x171 + (x157 + (x143 + (x129 + (x117 + (x88 + (x85 + (x83 + (x72 + (x69 + x67))))))))))))))) as u128)))); + let x271: u128 = ((x252 as u128) + ((x238 as u128) + ((x224 as u128) + ((x215 as u128) + ((x210 + (x201 + (x196 + (x187 + (x173 + (x159 + (x145 + (x131 + (x95 + (x89 + (x86 + (x75 + (x73 + x70))))))))))))) as u128))))); + let x272: u128 = ((x253 as u128) + ((x239 as u128) + ((x231 as u128) + ((x225 as u128) + ((x217 as u128) + ((x211 + (x203 + (x197 + (x189 + (x175 + (x161 + (x147 + (x133 + (x105 + (x96 + (x90 + (x87 + (x77 + (x76 + (x74 + x71))))))))))))))) as u128)))))); + let x273: u64 = (x255 + (x241 + (x227 + (x213 + (x134 + (x120 + (x108 + (x99 + (x93 + x46))))))))); + let x274: u64 = (x256 + (x242 + (x228 + (x150 + (x136 + (x122 + (x110 + (x101 + x47)))))))); + let x275: u64 = (x257 + (x243 + (x229 + (x166 + (x152 + (x138 + (x124 + (x112 + (x103 + (x49 + x48)))))))))); + let x276: u64 = (x258 + (x244 + (x182 + (x168 + (x154 + (x140 + (x126 + (x114 + (x52 + x50))))))))); + let x277: u64 = (x259 + (x245 + (x198 + (x184 + (x170 + (x156 + (x142 + (x128 + (x116 + (x56 + (x53 + x51))))))))))); + let x278: u64 = (x260 + (x214 + (x200 + (x186 + (x172 + (x158 + (x144 + (x130 + (x59 + (x57 + x54)))))))))); + let x279: u64 = (x261 + (x230 + (x216 + (x202 + (x188 + (x174 + (x160 + (x146 + (x132 + (x61 + (x60 + (x58 + x55)))))))))))); + let x280: u128 = ((x263 as u128) + x272); + let x281: u64 = (x265 >> 28); + let x282: u32 = ((x265 & (0xfffffff as u64)) as u32); + let x283: u128 = (x280 + (x281 as u128)); + let x284: u64 = ((x283 >> 28) as u64); + let x285: u32 = ((x283 & (0xfffffff as u128)) as u32); + let x286: u64 = (x279 + x281); + let x287: u128 = ((x284 as u128) + x271); + let x288: u64 = (x286 >> 28); + let x289: u32 = ((x286 & (0xfffffff as u64)) as u32); + let x290: u64 = (x288 + x278); + let x291: u64 = ((x287 >> 28) as u64); + let x292: u32 = ((x287 & (0xfffffff as u128)) as u32); + let x293: u128 = ((x291 as u128) + x270); + let x294: u64 = (x290 >> 28); + let x295: u32 = ((x290 & (0xfffffff as u64)) as u32); + let x296: u64 = (x294 + x277); + let x297: u64 = ((x293 >> 28) as u64); + let x298: u32 = ((x293 & (0xfffffff as u128)) as u32); + let x299: u128 = ((x297 as u128) + x269); + let x300: u64 = (x296 >> 28); + let x301: u32 = ((x296 & (0xfffffff as u64)) as u32); + let x302: u64 = (x300 + x276); + let x303: u64 = ((x299 >> 28) as u64); + let x304: u32 = ((x299 & (0xfffffff as u128)) as u32); + let x305: u128 = ((x303 as u128) + x268); + let x306: u64 = (x302 >> 28); + let x307: u32 = ((x302 & (0xfffffff as u64)) as u32); + let x308: u64 = (x306 + x275); + let x309: u64 = ((x305 >> 28) as u64); + let x310: u32 = ((x305 & (0xfffffff as u128)) as u32); + let x311: u64 = (x309 + x267); + let x312: u64 = (x308 >> 28); + let x313: u32 = ((x308 & (0xfffffff as u64)) as u32); + let x314: u64 = (x312 + x274); + let x315: u64 = (x311 >> 28); + let x316: u32 = ((x311 & (0xfffffff as u64)) as u32); + let x317: u64 = (x315 + x266); + let x318: u64 = (x314 >> 28); + let x319: u32 = ((x314 & (0xfffffff as u64)) as u32); + let x320: u64 = (x318 + x273); + let x321: u64 = (x317 >> 28); + let x322: u32 = ((x317 & (0xfffffff as u64)) as u32); + let x323: u64 = (x321 + (x282 as u64)); + let x324: u64 = (x320 >> 28); + let x325: u32 = ((x320 & (0xfffffff as u64)) as u32); + let x326: u64 = (x324 + (x264 as u64)); + let x327: u32 = ((x323 >> 28) as u32); + let x328: u32 = ((x323 & (0xfffffff as u64)) as u32); + let x329: u32 = ((x326 >> 28) as u32); + let x330: u32 = ((x326 & (0xfffffff as u64)) as u32); + let x331: u32 = (x285 + x327); + let x332: u32 = (x289 + x327); + let x333: u32 = (x329 + x331); + let x334: fiat_p448_u1 = ((x333 >> 28) as fiat_p448_u1); + let x335: u32 = (x333 & 0xfffffff); + let x336: u32 = ((x334 as u32) + x292); + let x337: fiat_p448_u1 = ((x332 >> 28) as fiat_p448_u1); + let x338: u32 = (x332 & 0xfffffff); + let x339: u32 = ((x337 as u32) + x295); + out1[0] = x338; + out1[1] = x339; + out1[2] = x301; + out1[3] = x307; + out1[4] = x313; + out1[5] = x319; + out1[6] = x325; + out1[7] = x330; + out1[8] = x335; + out1[9] = x336; + out1[10] = x298; + out1[11] = x304; + out1[12] = x310; + out1[13] = x316; + out1[14] = x322; + out1[15] = x328; +} + +/// The function fiat_p448_carry reduces a field element. +/// +/// Postconditions: +/// eval out1 mod m = eval arg1 mod m +/// +#[inline] +pub fn fiat_p448_carry(out1: &mut fiat_p448_tight_field_element, arg1: &fiat_p448_loose_field_element) -> () { + let x1: u32 = (arg1[7]); + let x2: u32 = (arg1[15]); + let x3: u32 = (x2 >> 28); + let x4: u32 = (((x1 >> 28) + (arg1[8])) + x3); + let x5: u32 = ((arg1[0]) + x3); + let x6: u32 = ((x4 >> 28) + (arg1[9])); + let x7: u32 = ((x5 >> 28) + (arg1[1])); + let x8: u32 = ((x6 >> 28) + (arg1[10])); + let x9: u32 = ((x7 >> 28) + (arg1[2])); + let x10: u32 = ((x8 >> 28) + (arg1[11])); + let x11: u32 = ((x9 >> 28) + (arg1[3])); + let x12: u32 = ((x10 >> 28) + (arg1[12])); + let x13: u32 = ((x11 >> 28) + (arg1[4])); + let x14: u32 = ((x12 >> 28) + (arg1[13])); + let x15: u32 = ((x13 >> 28) + (arg1[5])); + let x16: u32 = ((x14 >> 28) + (arg1[14])); + let x17: u32 = ((x15 >> 28) + (arg1[6])); + let x18: u32 = ((x16 >> 28) + (x2 & 0xfffffff)); + let x19: u32 = ((x17 >> 28) + (x1 & 0xfffffff)); + let x20: fiat_p448_u1 = ((x18 >> 28) as fiat_p448_u1); + let x21: u32 = ((x5 & 0xfffffff) + (x20 as u32)); + let x22: u32 = ((((x19 >> 28) as fiat_p448_u1) as u32) + ((x4 & 0xfffffff) + (x20 as u32))); + let x23: u32 = (x21 & 0xfffffff); + let x24: u32 = ((((x21 >> 28) as fiat_p448_u1) as u32) + (x7 & 0xfffffff)); + let x25: u32 = (x9 & 0xfffffff); + let x26: u32 = (x11 & 0xfffffff); + let x27: u32 = (x13 & 0xfffffff); + let x28: u32 = (x15 & 0xfffffff); + let x29: u32 = (x17 & 0xfffffff); + let x30: u32 = (x19 & 0xfffffff); + let x31: u32 = (x22 & 0xfffffff); + let x32: u32 = ((((x22 >> 28) as fiat_p448_u1) as u32) + (x6 & 0xfffffff)); + let x33: u32 = (x8 & 0xfffffff); + let x34: u32 = (x10 & 0xfffffff); + let x35: u32 = (x12 & 0xfffffff); + let x36: u32 = (x14 & 0xfffffff); + let x37: u32 = (x16 & 0xfffffff); + let x38: u32 = (x18 & 0xfffffff); + out1[0] = x23; + out1[1] = x24; + out1[2] = x25; + out1[3] = x26; + out1[4] = x27; + out1[5] = x28; + out1[6] = x29; + out1[7] = x30; + out1[8] = x31; + out1[9] = x32; + out1[10] = x33; + out1[11] = x34; + out1[12] = x35; + out1[13] = x36; + out1[14] = x37; + out1[15] = x38; +} + +/// The function fiat_p448_add adds two field elements. +/// +/// Postconditions: +/// eval out1 mod m = (eval arg1 + eval arg2) mod m +/// +#[inline] +pub fn fiat_p448_add(out1: &mut fiat_p448_loose_field_element, arg1: &fiat_p448_tight_field_element, arg2: &fiat_p448_tight_field_element) -> () { + let x1: u32 = ((arg1[0]) + (arg2[0])); + let x2: u32 = ((arg1[1]) + (arg2[1])); + let x3: u32 = ((arg1[2]) + (arg2[2])); + let x4: u32 = ((arg1[3]) + (arg2[3])); + let x5: u32 = ((arg1[4]) + (arg2[4])); + let x6: u32 = ((arg1[5]) + (arg2[5])); + let x7: u32 = ((arg1[6]) + (arg2[6])); + let x8: u32 = ((arg1[7]) + (arg2[7])); + let x9: u32 = ((arg1[8]) + (arg2[8])); + let x10: u32 = ((arg1[9]) + (arg2[9])); + let x11: u32 = ((arg1[10]) + (arg2[10])); + let x12: u32 = ((arg1[11]) + (arg2[11])); + let x13: u32 = ((arg1[12]) + (arg2[12])); + let x14: u32 = ((arg1[13]) + (arg2[13])); + let x15: u32 = ((arg1[14]) + (arg2[14])); + let x16: u32 = ((arg1[15]) + (arg2[15])); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; + out1[3] = x4; + out1[4] = x5; + out1[5] = x6; + out1[6] = x7; + out1[7] = x8; + out1[8] = x9; + out1[9] = x10; + out1[10] = x11; + out1[11] = x12; + out1[12] = x13; + out1[13] = x14; + out1[14] = x15; + out1[15] = x16; +} + +/// The function fiat_p448_sub subtracts two field elements. +/// +/// Postconditions: +/// eval out1 mod m = (eval arg1 - eval arg2) mod m +/// +#[inline] +pub fn fiat_p448_sub(out1: &mut fiat_p448_loose_field_element, arg1: &fiat_p448_tight_field_element, arg2: &fiat_p448_tight_field_element) -> () { + let x1: u32 = ((0x1ffffffe + (arg1[0])) - (arg2[0])); + let x2: u32 = ((0x1ffffffe + (arg1[1])) - (arg2[1])); + let x3: u32 = ((0x1ffffffe + (arg1[2])) - (arg2[2])); + let x4: u32 = ((0x1ffffffe + (arg1[3])) - (arg2[3])); + let x5: u32 = ((0x1ffffffe + (arg1[4])) - (arg2[4])); + let x6: u32 = ((0x1ffffffe + (arg1[5])) - (arg2[5])); + let x7: u32 = ((0x1ffffffe + (arg1[6])) - (arg2[6])); + let x8: u32 = ((0x1ffffffe + (arg1[7])) - (arg2[7])); + let x9: u32 = ((0x1ffffffc + (arg1[8])) - (arg2[8])); + let x10: u32 = ((0x1ffffffe + (arg1[9])) - (arg2[9])); + let x11: u32 = ((0x1ffffffe + (arg1[10])) - (arg2[10])); + let x12: u32 = ((0x1ffffffe + (arg1[11])) - (arg2[11])); + let x13: u32 = ((0x1ffffffe + (arg1[12])) - (arg2[12])); + let x14: u32 = ((0x1ffffffe + (arg1[13])) - (arg2[13])); + let x15: u32 = ((0x1ffffffe + (arg1[14])) - (arg2[14])); + let x16: u32 = ((0x1ffffffe + (arg1[15])) - (arg2[15])); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; + out1[3] = x4; + out1[4] = x5; + out1[5] = x6; + out1[6] = x7; + out1[7] = x8; + out1[8] = x9; + out1[9] = x10; + out1[10] = x11; + out1[11] = x12; + out1[12] = x13; + out1[13] = x14; + out1[14] = x15; + out1[15] = x16; +} + +/// The function fiat_p448_opp negates a field element. +/// +/// Postconditions: +/// eval out1 mod m = -eval arg1 mod m +/// +#[inline] +pub fn fiat_p448_opp(out1: &mut fiat_p448_loose_field_element, arg1: &fiat_p448_tight_field_element) -> () { + let x1: u32 = (0x1ffffffe - (arg1[0])); + let x2: u32 = (0x1ffffffe - (arg1[1])); + let x3: u32 = (0x1ffffffe - (arg1[2])); + let x4: u32 = (0x1ffffffe - (arg1[3])); + let x5: u32 = (0x1ffffffe - (arg1[4])); + let x6: u32 = (0x1ffffffe - (arg1[5])); + let x7: u32 = (0x1ffffffe - (arg1[6])); + let x8: u32 = (0x1ffffffe - (arg1[7])); + let x9: u32 = (0x1ffffffc - (arg1[8])); + let x10: u32 = (0x1ffffffe - (arg1[9])); + let x11: u32 = (0x1ffffffe - (arg1[10])); + let x12: u32 = (0x1ffffffe - (arg1[11])); + let x13: u32 = (0x1ffffffe - (arg1[12])); + let x14: u32 = (0x1ffffffe - (arg1[13])); + let x15: u32 = (0x1ffffffe - (arg1[14])); + let x16: u32 = (0x1ffffffe - (arg1[15])); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; + out1[3] = x4; + out1[4] = x5; + out1[5] = x6; + out1[6] = x7; + out1[7] = x8; + out1[8] = x9; + out1[9] = x10; + out1[10] = x11; + out1[11] = x12; + out1[12] = x13; + out1[13] = x14; + out1[14] = x15; + out1[15] = x16; +} + +/// The function fiat_p448_selectznz is a multi-limb conditional select. +/// +/// Postconditions: +/// out1 = (if arg1 = 0 then arg2 else arg3) +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// arg3: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +#[inline] +pub fn fiat_p448_selectznz(out1: &mut [u32; 16], arg1: fiat_p448_u1, arg2: &[u32; 16], arg3: &[u32; 16]) -> () { + let mut x1: u32 = 0; + fiat_p448_cmovznz_u32(&mut x1, arg1, (arg2[0]), (arg3[0])); + let mut x2: u32 = 0; + fiat_p448_cmovznz_u32(&mut x2, arg1, (arg2[1]), (arg3[1])); + let mut x3: u32 = 0; + fiat_p448_cmovznz_u32(&mut x3, arg1, (arg2[2]), (arg3[2])); + let mut x4: u32 = 0; + fiat_p448_cmovznz_u32(&mut x4, arg1, (arg2[3]), (arg3[3])); + let mut x5: u32 = 0; + fiat_p448_cmovznz_u32(&mut x5, arg1, (arg2[4]), (arg3[4])); + let mut x6: u32 = 0; + fiat_p448_cmovznz_u32(&mut x6, arg1, (arg2[5]), (arg3[5])); + let mut x7: u32 = 0; + fiat_p448_cmovznz_u32(&mut x7, arg1, (arg2[6]), (arg3[6])); + let mut x8: u32 = 0; + fiat_p448_cmovznz_u32(&mut x8, arg1, (arg2[7]), (arg3[7])); + let mut x9: u32 = 0; + fiat_p448_cmovznz_u32(&mut x9, arg1, (arg2[8]), (arg3[8])); + let mut x10: u32 = 0; + fiat_p448_cmovznz_u32(&mut x10, arg1, (arg2[9]), (arg3[9])); + let mut x11: u32 = 0; + fiat_p448_cmovznz_u32(&mut x11, arg1, (arg2[10]), (arg3[10])); + let mut x12: u32 = 0; + fiat_p448_cmovznz_u32(&mut x12, arg1, (arg2[11]), (arg3[11])); + let mut x13: u32 = 0; + fiat_p448_cmovznz_u32(&mut x13, arg1, (arg2[12]), (arg3[12])); + let mut x14: u32 = 0; + fiat_p448_cmovznz_u32(&mut x14, arg1, (arg2[13]), (arg3[13])); + let mut x15: u32 = 0; + fiat_p448_cmovznz_u32(&mut x15, arg1, (arg2[14]), (arg3[14])); + let mut x16: u32 = 0; + fiat_p448_cmovznz_u32(&mut x16, arg1, (arg2[15]), (arg3[15])); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; + out1[3] = x4; + out1[4] = x5; + out1[5] = x6; + out1[6] = x7; + out1[7] = x8; + out1[8] = x9; + out1[9] = x10; + out1[10] = x11; + out1[11] = x12; + out1[12] = x13; + out1[13] = x14; + out1[14] = x15; + out1[15] = x16; +} + +/// The function fiat_p448_to_bytes serializes a field element to bytes in little-endian order. +/// +/// Postconditions: +/// out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..55] +/// +/// Output Bounds: +/// out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] +#[inline] +pub fn fiat_p448_to_bytes(out1: &mut [u8; 56], arg1: &fiat_p448_tight_field_element) -> () { + let mut x1: u32 = 0; + let mut x2: fiat_p448_u1 = 0; + fiat_p448_subborrowx_u28(&mut x1, &mut x2, 0x0, (arg1[0]), 0xfffffff); + let mut x3: u32 = 0; + let mut x4: fiat_p448_u1 = 0; + fiat_p448_subborrowx_u28(&mut x3, &mut x4, x2, (arg1[1]), 0xfffffff); + let mut x5: u32 = 0; + let mut x6: fiat_p448_u1 = 0; + fiat_p448_subborrowx_u28(&mut x5, &mut x6, x4, (arg1[2]), 0xfffffff); + let mut x7: u32 = 0; + let mut x8: fiat_p448_u1 = 0; + fiat_p448_subborrowx_u28(&mut x7, &mut x8, x6, (arg1[3]), 0xfffffff); + let mut x9: u32 = 0; + let mut x10: fiat_p448_u1 = 0; + fiat_p448_subborrowx_u28(&mut x9, &mut x10, x8, (arg1[4]), 0xfffffff); + let mut x11: u32 = 0; + let mut x12: fiat_p448_u1 = 0; + fiat_p448_subborrowx_u28(&mut x11, &mut x12, x10, (arg1[5]), 0xfffffff); + let mut x13: u32 = 0; + let mut x14: fiat_p448_u1 = 0; + fiat_p448_subborrowx_u28(&mut x13, &mut x14, x12, (arg1[6]), 0xfffffff); + let mut x15: u32 = 0; + let mut x16: fiat_p448_u1 = 0; + fiat_p448_subborrowx_u28(&mut x15, &mut x16, x14, (arg1[7]), 0xfffffff); + let mut x17: u32 = 0; + let mut x18: fiat_p448_u1 = 0; + fiat_p448_subborrowx_u28(&mut x17, &mut x18, x16, (arg1[8]), 0xffffffe); + let mut x19: u32 = 0; + let mut x20: fiat_p448_u1 = 0; + fiat_p448_subborrowx_u28(&mut x19, &mut x20, x18, (arg1[9]), 0xfffffff); + let mut x21: u32 = 0; + let mut x22: fiat_p448_u1 = 0; + fiat_p448_subborrowx_u28(&mut x21, &mut x22, x20, (arg1[10]), 0xfffffff); + let mut x23: u32 = 0; + let mut x24: fiat_p448_u1 = 0; + fiat_p448_subborrowx_u28(&mut x23, &mut x24, x22, (arg1[11]), 0xfffffff); + let mut x25: u32 = 0; + let mut x26: fiat_p448_u1 = 0; + fiat_p448_subborrowx_u28(&mut x25, &mut x26, x24, (arg1[12]), 0xfffffff); + let mut x27: u32 = 0; + let mut x28: fiat_p448_u1 = 0; + fiat_p448_subborrowx_u28(&mut x27, &mut x28, x26, (arg1[13]), 0xfffffff); + let mut x29: u32 = 0; + let mut x30: fiat_p448_u1 = 0; + fiat_p448_subborrowx_u28(&mut x29, &mut x30, x28, (arg1[14]), 0xfffffff); + let mut x31: u32 = 0; + let mut x32: fiat_p448_u1 = 0; + fiat_p448_subborrowx_u28(&mut x31, &mut x32, x30, (arg1[15]), 0xfffffff); + let mut x33: u32 = 0; + fiat_p448_cmovznz_u32(&mut x33, x32, (0x0 as u32), 0xffffffff); + let mut x34: u32 = 0; + let mut x35: fiat_p448_u1 = 0; + fiat_p448_addcarryx_u28(&mut x34, &mut x35, 0x0, x1, (x33 & 0xfffffff)); + let mut x36: u32 = 0; + let mut x37: fiat_p448_u1 = 0; + fiat_p448_addcarryx_u28(&mut x36, &mut x37, x35, x3, (x33 & 0xfffffff)); + let mut x38: u32 = 0; + let mut x39: fiat_p448_u1 = 0; + fiat_p448_addcarryx_u28(&mut x38, &mut x39, x37, x5, (x33 & 0xfffffff)); + let mut x40: u32 = 0; + let mut x41: fiat_p448_u1 = 0; + fiat_p448_addcarryx_u28(&mut x40, &mut x41, x39, x7, (x33 & 0xfffffff)); + let mut x42: u32 = 0; + let mut x43: fiat_p448_u1 = 0; + fiat_p448_addcarryx_u28(&mut x42, &mut x43, x41, x9, (x33 & 0xfffffff)); + let mut x44: u32 = 0; + let mut x45: fiat_p448_u1 = 0; + fiat_p448_addcarryx_u28(&mut x44, &mut x45, x43, x11, (x33 & 0xfffffff)); + let mut x46: u32 = 0; + let mut x47: fiat_p448_u1 = 0; + fiat_p448_addcarryx_u28(&mut x46, &mut x47, x45, x13, (x33 & 0xfffffff)); + let mut x48: u32 = 0; + let mut x49: fiat_p448_u1 = 0; + fiat_p448_addcarryx_u28(&mut x48, &mut x49, x47, x15, (x33 & 0xfffffff)); + let mut x50: u32 = 0; + let mut x51: fiat_p448_u1 = 0; + fiat_p448_addcarryx_u28(&mut x50, &mut x51, x49, x17, (x33 & 0xffffffe)); + let mut x52: u32 = 0; + let mut x53: fiat_p448_u1 = 0; + fiat_p448_addcarryx_u28(&mut x52, &mut x53, x51, x19, (x33 & 0xfffffff)); + let mut x54: u32 = 0; + let mut x55: fiat_p448_u1 = 0; + fiat_p448_addcarryx_u28(&mut x54, &mut x55, x53, x21, (x33 & 0xfffffff)); + let mut x56: u32 = 0; + let mut x57: fiat_p448_u1 = 0; + fiat_p448_addcarryx_u28(&mut x56, &mut x57, x55, x23, (x33 & 0xfffffff)); + let mut x58: u32 = 0; + let mut x59: fiat_p448_u1 = 0; + fiat_p448_addcarryx_u28(&mut x58, &mut x59, x57, x25, (x33 & 0xfffffff)); + let mut x60: u32 = 0; + let mut x61: fiat_p448_u1 = 0; + fiat_p448_addcarryx_u28(&mut x60, &mut x61, x59, x27, (x33 & 0xfffffff)); + let mut x62: u32 = 0; + let mut x63: fiat_p448_u1 = 0; + fiat_p448_addcarryx_u28(&mut x62, &mut x63, x61, x29, (x33 & 0xfffffff)); + let mut x64: u32 = 0; + let mut x65: fiat_p448_u1 = 0; + fiat_p448_addcarryx_u28(&mut x64, &mut x65, x63, x31, (x33 & 0xfffffff)); + let x66: u32 = (x64 << 4); + let x67: u32 = (x60 << 4); + let x68: u32 = (x56 << 4); + let x69: u32 = (x52 << 4); + let x70: u32 = (x48 << 4); + let x71: u32 = (x44 << 4); + let x72: u32 = (x40 << 4); + let x73: u32 = (x36 << 4); + let x74: u8 = ((x34 & (0xff as u32)) as u8); + let x75: u32 = (x34 >> 8); + let x76: u8 = ((x75 & (0xff as u32)) as u8); + let x77: u32 = (x75 >> 8); + let x78: u8 = ((x77 & (0xff as u32)) as u8); + let x79: u8 = ((x77 >> 8) as u8); + let x80: u32 = (x73 + (x79 as u32)); + let x81: u8 = ((x80 & (0xff as u32)) as u8); + let x82: u32 = (x80 >> 8); + let x83: u8 = ((x82 & (0xff as u32)) as u8); + let x84: u32 = (x82 >> 8); + let x85: u8 = ((x84 & (0xff as u32)) as u8); + let x86: u8 = ((x84 >> 8) as u8); + let x87: u8 = ((x38 & (0xff as u32)) as u8); + let x88: u32 = (x38 >> 8); + let x89: u8 = ((x88 & (0xff as u32)) as u8); + let x90: u32 = (x88 >> 8); + let x91: u8 = ((x90 & (0xff as u32)) as u8); + let x92: u8 = ((x90 >> 8) as u8); + let x93: u32 = (x72 + (x92 as u32)); + let x94: u8 = ((x93 & (0xff as u32)) as u8); + let x95: u32 = (x93 >> 8); + let x96: u8 = ((x95 & (0xff as u32)) as u8); + let x97: u32 = (x95 >> 8); + let x98: u8 = ((x97 & (0xff as u32)) as u8); + let x99: u8 = ((x97 >> 8) as u8); + let x100: u8 = ((x42 & (0xff as u32)) as u8); + let x101: u32 = (x42 >> 8); + let x102: u8 = ((x101 & (0xff as u32)) as u8); + let x103: u32 = (x101 >> 8); + let x104: u8 = ((x103 & (0xff as u32)) as u8); + let x105: u8 = ((x103 >> 8) as u8); + let x106: u32 = (x71 + (x105 as u32)); + let x107: u8 = ((x106 & (0xff as u32)) as u8); + let x108: u32 = (x106 >> 8); + let x109: u8 = ((x108 & (0xff as u32)) as u8); + let x110: u32 = (x108 >> 8); + let x111: u8 = ((x110 & (0xff as u32)) as u8); + let x112: u8 = ((x110 >> 8) as u8); + let x113: u8 = ((x46 & (0xff as u32)) as u8); + let x114: u32 = (x46 >> 8); + let x115: u8 = ((x114 & (0xff as u32)) as u8); + let x116: u32 = (x114 >> 8); + let x117: u8 = ((x116 & (0xff as u32)) as u8); + let x118: u8 = ((x116 >> 8) as u8); + let x119: u32 = (x70 + (x118 as u32)); + let x120: u8 = ((x119 & (0xff as u32)) as u8); + let x121: u32 = (x119 >> 8); + let x122: u8 = ((x121 & (0xff as u32)) as u8); + let x123: u32 = (x121 >> 8); + let x124: u8 = ((x123 & (0xff as u32)) as u8); + let x125: u8 = ((x123 >> 8) as u8); + let x126: u8 = ((x50 & (0xff as u32)) as u8); + let x127: u32 = (x50 >> 8); + let x128: u8 = ((x127 & (0xff as u32)) as u8); + let x129: u32 = (x127 >> 8); + let x130: u8 = ((x129 & (0xff as u32)) as u8); + let x131: u8 = ((x129 >> 8) as u8); + let x132: u32 = (x69 + (x131 as u32)); + let x133: u8 = ((x132 & (0xff as u32)) as u8); + let x134: u32 = (x132 >> 8); + let x135: u8 = ((x134 & (0xff as u32)) as u8); + let x136: u32 = (x134 >> 8); + let x137: u8 = ((x136 & (0xff as u32)) as u8); + let x138: u8 = ((x136 >> 8) as u8); + let x139: u8 = ((x54 & (0xff as u32)) as u8); + let x140: u32 = (x54 >> 8); + let x141: u8 = ((x140 & (0xff as u32)) as u8); + let x142: u32 = (x140 >> 8); + let x143: u8 = ((x142 & (0xff as u32)) as u8); + let x144: u8 = ((x142 >> 8) as u8); + let x145: u32 = (x68 + (x144 as u32)); + let x146: u8 = ((x145 & (0xff as u32)) as u8); + let x147: u32 = (x145 >> 8); + let x148: u8 = ((x147 & (0xff as u32)) as u8); + let x149: u32 = (x147 >> 8); + let x150: u8 = ((x149 & (0xff as u32)) as u8); + let x151: u8 = ((x149 >> 8) as u8); + let x152: u8 = ((x58 & (0xff as u32)) as u8); + let x153: u32 = (x58 >> 8); + let x154: u8 = ((x153 & (0xff as u32)) as u8); + let x155: u32 = (x153 >> 8); + let x156: u8 = ((x155 & (0xff as u32)) as u8); + let x157: u8 = ((x155 >> 8) as u8); + let x158: u32 = (x67 + (x157 as u32)); + let x159: u8 = ((x158 & (0xff as u32)) as u8); + let x160: u32 = (x158 >> 8); + let x161: u8 = ((x160 & (0xff as u32)) as u8); + let x162: u32 = (x160 >> 8); + let x163: u8 = ((x162 & (0xff as u32)) as u8); + let x164: u8 = ((x162 >> 8) as u8); + let x165: u8 = ((x62 & (0xff as u32)) as u8); + let x166: u32 = (x62 >> 8); + let x167: u8 = ((x166 & (0xff as u32)) as u8); + let x168: u32 = (x166 >> 8); + let x169: u8 = ((x168 & (0xff as u32)) as u8); + let x170: u8 = ((x168 >> 8) as u8); + let x171: u32 = (x66 + (x170 as u32)); + let x172: u8 = ((x171 & (0xff as u32)) as u8); + let x173: u32 = (x171 >> 8); + let x174: u8 = ((x173 & (0xff as u32)) as u8); + let x175: u32 = (x173 >> 8); + let x176: u8 = ((x175 & (0xff as u32)) as u8); + let x177: u8 = ((x175 >> 8) as u8); + out1[0] = x74; + out1[1] = x76; + out1[2] = x78; + out1[3] = x81; + out1[4] = x83; + out1[5] = x85; + out1[6] = x86; + out1[7] = x87; + out1[8] = x89; + out1[9] = x91; + out1[10] = x94; + out1[11] = x96; + out1[12] = x98; + out1[13] = x99; + out1[14] = x100; + out1[15] = x102; + out1[16] = x104; + out1[17] = x107; + out1[18] = x109; + out1[19] = x111; + out1[20] = x112; + out1[21] = x113; + out1[22] = x115; + out1[23] = x117; + out1[24] = x120; + out1[25] = x122; + out1[26] = x124; + out1[27] = x125; + out1[28] = x126; + out1[29] = x128; + out1[30] = x130; + out1[31] = x133; + out1[32] = x135; + out1[33] = x137; + out1[34] = x138; + out1[35] = x139; + out1[36] = x141; + out1[37] = x143; + out1[38] = x146; + out1[39] = x148; + out1[40] = x150; + out1[41] = x151; + out1[42] = x152; + out1[43] = x154; + out1[44] = x156; + out1[45] = x159; + out1[46] = x161; + out1[47] = x163; + out1[48] = x164; + out1[49] = x165; + out1[50] = x167; + out1[51] = x169; + out1[52] = x172; + out1[53] = x174; + out1[54] = x176; + out1[55] = x177; +} + +/// The function fiat_p448_from_bytes deserializes a field element from bytes in little-endian order. +/// +/// Postconditions: +/// eval out1 mod m = bytes_eval arg1 mod m +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] +#[inline] +pub fn fiat_p448_from_bytes(out1: &mut fiat_p448_tight_field_element, arg1: &[u8; 56]) -> () { + let x1: u32 = (((arg1[55]) as u32) << 20); + let x2: u32 = (((arg1[54]) as u32) << 12); + let x3: u32 = (((arg1[53]) as u32) << 4); + let x4: u32 = (((arg1[52]) as u32) << 24); + let x5: u32 = (((arg1[51]) as u32) << 16); + let x6: u32 = (((arg1[50]) as u32) << 8); + let x7: u8 = (arg1[49]); + let x8: u32 = (((arg1[48]) as u32) << 20); + let x9: u32 = (((arg1[47]) as u32) << 12); + let x10: u32 = (((arg1[46]) as u32) << 4); + let x11: u32 = (((arg1[45]) as u32) << 24); + let x12: u32 = (((arg1[44]) as u32) << 16); + let x13: u32 = (((arg1[43]) as u32) << 8); + let x14: u8 = (arg1[42]); + let x15: u32 = (((arg1[41]) as u32) << 20); + let x16: u32 = (((arg1[40]) as u32) << 12); + let x17: u32 = (((arg1[39]) as u32) << 4); + let x18: u32 = (((arg1[38]) as u32) << 24); + let x19: u32 = (((arg1[37]) as u32) << 16); + let x20: u32 = (((arg1[36]) as u32) << 8); + let x21: u8 = (arg1[35]); + let x22: u32 = (((arg1[34]) as u32) << 20); + let x23: u32 = (((arg1[33]) as u32) << 12); + let x24: u32 = (((arg1[32]) as u32) << 4); + let x25: u32 = (((arg1[31]) as u32) << 24); + let x26: u32 = (((arg1[30]) as u32) << 16); + let x27: u32 = (((arg1[29]) as u32) << 8); + let x28: u8 = (arg1[28]); + let x29: u32 = (((arg1[27]) as u32) << 20); + let x30: u32 = (((arg1[26]) as u32) << 12); + let x31: u32 = (((arg1[25]) as u32) << 4); + let x32: u32 = (((arg1[24]) as u32) << 24); + let x33: u32 = (((arg1[23]) as u32) << 16); + let x34: u32 = (((arg1[22]) as u32) << 8); + let x35: u8 = (arg1[21]); + let x36: u32 = (((arg1[20]) as u32) << 20); + let x37: u32 = (((arg1[19]) as u32) << 12); + let x38: u32 = (((arg1[18]) as u32) << 4); + let x39: u32 = (((arg1[17]) as u32) << 24); + let x40: u32 = (((arg1[16]) as u32) << 16); + let x41: u32 = (((arg1[15]) as u32) << 8); + let x42: u8 = (arg1[14]); + let x43: u32 = (((arg1[13]) as u32) << 20); + let x44: u32 = (((arg1[12]) as u32) << 12); + let x45: u32 = (((arg1[11]) as u32) << 4); + let x46: u32 = (((arg1[10]) as u32) << 24); + let x47: u32 = (((arg1[9]) as u32) << 16); + let x48: u32 = (((arg1[8]) as u32) << 8); + let x49: u8 = (arg1[7]); + let x50: u32 = (((arg1[6]) as u32) << 20); + let x51: u32 = (((arg1[5]) as u32) << 12); + let x52: u32 = (((arg1[4]) as u32) << 4); + let x53: u32 = (((arg1[3]) as u32) << 24); + let x54: u32 = (((arg1[2]) as u32) << 16); + let x55: u32 = (((arg1[1]) as u32) << 8); + let x56: u8 = (arg1[0]); + let x57: u32 = (x55 + (x56 as u32)); + let x58: u32 = (x54 + x57); + let x59: u32 = (x53 + x58); + let x60: u32 = (x59 & 0xfffffff); + let x61: u8 = ((x59 >> 28) as u8); + let x62: u32 = (x52 + (x61 as u32)); + let x63: u32 = (x51 + x62); + let x64: u32 = (x50 + x63); + let x65: u32 = (x48 + (x49 as u32)); + let x66: u32 = (x47 + x65); + let x67: u32 = (x46 + x66); + let x68: u32 = (x67 & 0xfffffff); + let x69: u8 = ((x67 >> 28) as u8); + let x70: u32 = (x45 + (x69 as u32)); + let x71: u32 = (x44 + x70); + let x72: u32 = (x43 + x71); + let x73: u32 = (x41 + (x42 as u32)); + let x74: u32 = (x40 + x73); + let x75: u32 = (x39 + x74); + let x76: u32 = (x75 & 0xfffffff); + let x77: u8 = ((x75 >> 28) as u8); + let x78: u32 = (x38 + (x77 as u32)); + let x79: u32 = (x37 + x78); + let x80: u32 = (x36 + x79); + let x81: u32 = (x34 + (x35 as u32)); + let x82: u32 = (x33 + x81); + let x83: u32 = (x32 + x82); + let x84: u32 = (x83 & 0xfffffff); + let x85: u8 = ((x83 >> 28) as u8); + let x86: u32 = (x31 + (x85 as u32)); + let x87: u32 = (x30 + x86); + let x88: u32 = (x29 + x87); + let x89: u32 = (x27 + (x28 as u32)); + let x90: u32 = (x26 + x89); + let x91: u32 = (x25 + x90); + let x92: u32 = (x91 & 0xfffffff); + let x93: u8 = ((x91 >> 28) as u8); + let x94: u32 = (x24 + (x93 as u32)); + let x95: u32 = (x23 + x94); + let x96: u32 = (x22 + x95); + let x97: u32 = (x20 + (x21 as u32)); + let x98: u32 = (x19 + x97); + let x99: u32 = (x18 + x98); + let x100: u32 = (x99 & 0xfffffff); + let x101: u8 = ((x99 >> 28) as u8); + let x102: u32 = (x17 + (x101 as u32)); + let x103: u32 = (x16 + x102); + let x104: u32 = (x15 + x103); + let x105: u32 = (x13 + (x14 as u32)); + let x106: u32 = (x12 + x105); + let x107: u32 = (x11 + x106); + let x108: u32 = (x107 & 0xfffffff); + let x109: u8 = ((x107 >> 28) as u8); + let x110: u32 = (x10 + (x109 as u32)); + let x111: u32 = (x9 + x110); + let x112: u32 = (x8 + x111); + let x113: u32 = (x6 + (x7 as u32)); + let x114: u32 = (x5 + x113); + let x115: u32 = (x4 + x114); + let x116: u32 = (x115 & 0xfffffff); + let x117: u8 = ((x115 >> 28) as u8); + let x118: u32 = (x3 + (x117 as u32)); + let x119: u32 = (x2 + x118); + let x120: u32 = (x1 + x119); + out1[0] = x60; + out1[1] = x64; + out1[2] = x68; + out1[3] = x72; + out1[4] = x76; + out1[5] = x80; + out1[6] = x84; + out1[7] = x88; + out1[8] = x92; + out1[9] = x96; + out1[10] = x100; + out1[11] = x104; + out1[12] = x108; + out1[13] = x112; + out1[14] = x116; + out1[15] = x120; +} + +/// The function fiat_p448_relax is the identity function converting from tight field elements to loose field elements. +/// +/// Postconditions: +/// out1 = arg1 +/// +#[inline] +pub fn fiat_p448_relax(out1: &mut fiat_p448_loose_field_element, arg1: &fiat_p448_tight_field_element) -> () { + let x1: u32 = (arg1[0]); + let x2: u32 = (arg1[1]); + let x3: u32 = (arg1[2]); + let x4: u32 = (arg1[3]); + let x5: u32 = (arg1[4]); + let x6: u32 = (arg1[5]); + let x7: u32 = (arg1[6]); + let x8: u32 = (arg1[7]); + let x9: u32 = (arg1[8]); + let x10: u32 = (arg1[9]); + let x11: u32 = (arg1[10]); + let x12: u32 = (arg1[11]); + let x13: u32 = (arg1[12]); + let x14: u32 = (arg1[13]); + let x15: u32 = (arg1[14]); + let x16: u32 = (arg1[15]); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; + out1[3] = x4; + out1[4] = x5; + out1[5] = x6; + out1[6] = x7; + out1[7] = x8; + out1[8] = x9; + out1[9] = x10; + out1[10] = x11; + out1[11] = x12; + out1[12] = x13; + out1[13] = x14; + out1[14] = x15; + out1[15] = x16; +} diff --git a/vendor/fiat-crypto/src/p448_solinas_64.rs b/vendor/fiat-crypto/src/p448_solinas_64.rs new file mode 100644 index 000000000..13a99ccc6 --- /dev/null +++ b/vendor/fiat-crypto/src/p448_solinas_64.rs @@ -0,0 +1,908 @@ +//! Autogenerated: 'src/ExtractionOCaml/unsaturated_solinas' --lang Rust --inline p448 64 8 '2^448 - 2^224 - 1' carry_mul carry_square carry add sub opp selectznz to_bytes from_bytes relax +//! curve description: p448 +//! machine_wordsize = 64 (from "64") +//! requested operations: carry_mul, carry_square, carry, add, sub, opp, selectznz, to_bytes, from_bytes, relax +//! n = 8 (from "8") +//! s-c = 2^448 - [(2^224, 1), (1, 1)] (from "2^448 - 2^224 - 1") +//! tight_bounds_multiplier = 1 (from "") +//! +//! Computed values: +//! carry_chain = [3, 7, 4, 0, 5, 1, 6, 2, 7, 3, 4, 0] +//! eval z = z[0] + (z[1] << 56) + (z[2] << 112) + (z[3] << 168) + (z[4] << 224) + (z[5] << 0x118) + (z[6] << 0x150) + (z[7] << 0x188) +//! bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248) + (z[32] << 256) + (z[33] << 0x108) + (z[34] << 0x110) + (z[35] << 0x118) + (z[36] << 0x120) + (z[37] << 0x128) + (z[38] << 0x130) + (z[39] << 0x138) + (z[40] << 0x140) + (z[41] << 0x148) + (z[42] << 0x150) + (z[43] << 0x158) + (z[44] << 0x160) + (z[45] << 0x168) + (z[46] << 0x170) + (z[47] << 0x178) + (z[48] << 0x180) + (z[49] << 0x188) + (z[50] << 0x190) + (z[51] << 0x198) + (z[52] << 0x1a0) + (z[53] << 0x1a8) + (z[54] << 0x1b0) + (z[55] << 0x1b8) +//! balance = [0x1fffffffffffffe, 0x1fffffffffffffe, 0x1fffffffffffffe, 0x1fffffffffffffe, 0x1fffffffffffffc, 0x1fffffffffffffe, 0x1fffffffffffffe, 0x1fffffffffffffe] + +#![allow(unused_parens)] +#![allow(non_camel_case_types)] + +pub type fiat_p448_u1 = u8; +pub type fiat_p448_i1 = i8; +pub type fiat_p448_u2 = u8; +pub type fiat_p448_i2 = i8; + +/* The type fiat_p448_loose_field_element is a field element with loose bounds. */ +/* Bounds: [[0x0 ~> 0x300000000000000], [0x0 ~> 0x300000000000000], [0x0 ~> 0x300000000000000], [0x0 ~> 0x300000000000000], [0x0 ~> 0x300000000000000], [0x0 ~> 0x300000000000000], [0x0 ~> 0x300000000000000], [0x0 ~> 0x300000000000000]] */ +pub type fiat_p448_loose_field_element = [u64; 8]; + +/* The type fiat_p448_tight_field_element is a field element with tight bounds. */ +/* Bounds: [[0x0 ~> 0x100000000000000], [0x0 ~> 0x100000000000000], [0x0 ~> 0x100000000000000], [0x0 ~> 0x100000000000000], [0x0 ~> 0x100000000000000], [0x0 ~> 0x100000000000000], [0x0 ~> 0x100000000000000], [0x0 ~> 0x100000000000000]] */ +pub type fiat_p448_tight_field_element = [u64; 8]; + + +/// The function fiat_p448_addcarryx_u56 is an addition with carry. +/// +/// Postconditions: +/// out1 = (arg1 + arg2 + arg3) mod 2^56 +/// out2 = ⌊(arg1 + arg2 + arg3) / 2^56⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffffffffff] +/// arg3: [0x0 ~> 0xffffffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_p448_addcarryx_u56(out1: &mut u64, out2: &mut fiat_p448_u1, arg1: fiat_p448_u1, arg2: u64, arg3: u64) -> () { + let x1: u64 = (((arg1 as u64) + arg2) + arg3); + let x2: u64 = (x1 & 0xffffffffffffff); + let x3: fiat_p448_u1 = ((x1 >> 56) as fiat_p448_u1); + *out1 = x2; + *out2 = x3; +} + +/// The function fiat_p448_subborrowx_u56 is a subtraction with borrow. +/// +/// Postconditions: +/// out1 = (-arg1 + arg2 + -arg3) mod 2^56 +/// out2 = -⌊(-arg1 + arg2 + -arg3) / 2^56⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffffffffff] +/// arg3: [0x0 ~> 0xffffffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_p448_subborrowx_u56(out1: &mut u64, out2: &mut fiat_p448_u1, arg1: fiat_p448_u1, arg2: u64, arg3: u64) -> () { + let x1: i64 = ((((((arg2 as i128) - (arg1 as i128)) as i64) as i128) - (arg3 as i128)) as i64); + let x2: fiat_p448_i1 = ((x1 >> 56) as fiat_p448_i1); + let x3: u64 = (((x1 as i128) & (0xffffffffffffff as i128)) as u64); + *out1 = x3; + *out2 = (((0x0 as fiat_p448_i2) - (x2 as fiat_p448_i2)) as fiat_p448_u1); +} + +/// The function fiat_p448_cmovznz_u64 is a single-word conditional move. +/// +/// Postconditions: +/// out1 = (if arg1 = 0 then arg2 else arg3) +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffffffffffff] +/// arg3: [0x0 ~> 0xffffffffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +#[inline] +pub fn fiat_p448_cmovznz_u64(out1: &mut u64, arg1: fiat_p448_u1, arg2: u64, arg3: u64) -> () { + let x1: fiat_p448_u1 = (!(!arg1)); + let x2: u64 = ((((((0x0 as fiat_p448_i2) - (x1 as fiat_p448_i2)) as fiat_p448_i1) as i128) & (0xffffffffffffffff as i128)) as u64); + let x3: u64 = ((x2 & arg3) | ((!x2) & arg2)); + *out1 = x3; +} + +/// The function fiat_p448_carry_mul multiplies two field elements and reduces the result. +/// +/// Postconditions: +/// eval out1 mod m = (eval arg1 * eval arg2) mod m +/// +#[inline] +pub fn fiat_p448_carry_mul(out1: &mut fiat_p448_tight_field_element, arg1: &fiat_p448_loose_field_element, arg2: &fiat_p448_loose_field_element) -> () { + let x1: u128 = (((arg1[7]) as u128) * ((arg2[7]) as u128)); + let x2: u128 = (((arg1[7]) as u128) * ((arg2[6]) as u128)); + let x3: u128 = (((arg1[7]) as u128) * ((arg2[5]) as u128)); + let x4: u128 = (((arg1[6]) as u128) * ((arg2[7]) as u128)); + let x5: u128 = (((arg1[6]) as u128) * ((arg2[6]) as u128)); + let x6: u128 = (((arg1[5]) as u128) * ((arg2[7]) as u128)); + let x7: u128 = (((arg1[7]) as u128) * ((arg2[7]) as u128)); + let x8: u128 = (((arg1[7]) as u128) * ((arg2[6]) as u128)); + let x9: u128 = (((arg1[7]) as u128) * ((arg2[5]) as u128)); + let x10: u128 = (((arg1[6]) as u128) * ((arg2[7]) as u128)); + let x11: u128 = (((arg1[6]) as u128) * ((arg2[6]) as u128)); + let x12: u128 = (((arg1[5]) as u128) * ((arg2[7]) as u128)); + let x13: u128 = (((arg1[7]) as u128) * ((arg2[7]) as u128)); + let x14: u128 = (((arg1[7]) as u128) * ((arg2[6]) as u128)); + let x15: u128 = (((arg1[7]) as u128) * ((arg2[5]) as u128)); + let x16: u128 = (((arg1[7]) as u128) * ((arg2[4]) as u128)); + let x17: u128 = (((arg1[7]) as u128) * ((arg2[3]) as u128)); + let x18: u128 = (((arg1[7]) as u128) * ((arg2[2]) as u128)); + let x19: u128 = (((arg1[7]) as u128) * ((arg2[1]) as u128)); + let x20: u128 = (((arg1[6]) as u128) * ((arg2[7]) as u128)); + let x21: u128 = (((arg1[6]) as u128) * ((arg2[6]) as u128)); + let x22: u128 = (((arg1[6]) as u128) * ((arg2[5]) as u128)); + let x23: u128 = (((arg1[6]) as u128) * ((arg2[4]) as u128)); + let x24: u128 = (((arg1[6]) as u128) * ((arg2[3]) as u128)); + let x25: u128 = (((arg1[6]) as u128) * ((arg2[2]) as u128)); + let x26: u128 = (((arg1[5]) as u128) * ((arg2[7]) as u128)); + let x27: u128 = (((arg1[5]) as u128) * ((arg2[6]) as u128)); + let x28: u128 = (((arg1[5]) as u128) * ((arg2[5]) as u128)); + let x29: u128 = (((arg1[5]) as u128) * ((arg2[4]) as u128)); + let x30: u128 = (((arg1[5]) as u128) * ((arg2[3]) as u128)); + let x31: u128 = (((arg1[4]) as u128) * ((arg2[7]) as u128)); + let x32: u128 = (((arg1[4]) as u128) * ((arg2[6]) as u128)); + let x33: u128 = (((arg1[4]) as u128) * ((arg2[5]) as u128)); + let x34: u128 = (((arg1[4]) as u128) * ((arg2[4]) as u128)); + let x35: u128 = (((arg1[3]) as u128) * ((arg2[7]) as u128)); + let x36: u128 = (((arg1[3]) as u128) * ((arg2[6]) as u128)); + let x37: u128 = (((arg1[3]) as u128) * ((arg2[5]) as u128)); + let x38: u128 = (((arg1[2]) as u128) * ((arg2[7]) as u128)); + let x39: u128 = (((arg1[2]) as u128) * ((arg2[6]) as u128)); + let x40: u128 = (((arg1[1]) as u128) * ((arg2[7]) as u128)); + let x41: u128 = (((arg1[7]) as u128) * ((arg2[4]) as u128)); + let x42: u128 = (((arg1[7]) as u128) * ((arg2[3]) as u128)); + let x43: u128 = (((arg1[7]) as u128) * ((arg2[2]) as u128)); + let x44: u128 = (((arg1[7]) as u128) * ((arg2[1]) as u128)); + let x45: u128 = (((arg1[6]) as u128) * ((arg2[5]) as u128)); + let x46: u128 = (((arg1[6]) as u128) * ((arg2[4]) as u128)); + let x47: u128 = (((arg1[6]) as u128) * ((arg2[3]) as u128)); + let x48: u128 = (((arg1[6]) as u128) * ((arg2[2]) as u128)); + let x49: u128 = (((arg1[5]) as u128) * ((arg2[6]) as u128)); + let x50: u128 = (((arg1[5]) as u128) * ((arg2[5]) as u128)); + let x51: u128 = (((arg1[5]) as u128) * ((arg2[4]) as u128)); + let x52: u128 = (((arg1[5]) as u128) * ((arg2[3]) as u128)); + let x53: u128 = (((arg1[4]) as u128) * ((arg2[7]) as u128)); + let x54: u128 = (((arg1[4]) as u128) * ((arg2[6]) as u128)); + let x55: u128 = (((arg1[4]) as u128) * ((arg2[5]) as u128)); + let x56: u128 = (((arg1[4]) as u128) * ((arg2[4]) as u128)); + let x57: u128 = (((arg1[3]) as u128) * ((arg2[7]) as u128)); + let x58: u128 = (((arg1[3]) as u128) * ((arg2[6]) as u128)); + let x59: u128 = (((arg1[3]) as u128) * ((arg2[5]) as u128)); + let x60: u128 = (((arg1[2]) as u128) * ((arg2[7]) as u128)); + let x61: u128 = (((arg1[2]) as u128) * ((arg2[6]) as u128)); + let x62: u128 = (((arg1[1]) as u128) * ((arg2[7]) as u128)); + let x63: u128 = (((arg1[7]) as u128) * ((arg2[0]) as u128)); + let x64: u128 = (((arg1[6]) as u128) * ((arg2[1]) as u128)); + let x65: u128 = (((arg1[6]) as u128) * ((arg2[0]) as u128)); + let x66: u128 = (((arg1[5]) as u128) * ((arg2[2]) as u128)); + let x67: u128 = (((arg1[5]) as u128) * ((arg2[1]) as u128)); + let x68: u128 = (((arg1[5]) as u128) * ((arg2[0]) as u128)); + let x69: u128 = (((arg1[4]) as u128) * ((arg2[3]) as u128)); + let x70: u128 = (((arg1[4]) as u128) * ((arg2[2]) as u128)); + let x71: u128 = (((arg1[4]) as u128) * ((arg2[1]) as u128)); + let x72: u128 = (((arg1[4]) as u128) * ((arg2[0]) as u128)); + let x73: u128 = (((arg1[3]) as u128) * ((arg2[4]) as u128)); + let x74: u128 = (((arg1[3]) as u128) * ((arg2[3]) as u128)); + let x75: u128 = (((arg1[3]) as u128) * ((arg2[2]) as u128)); + let x76: u128 = (((arg1[3]) as u128) * ((arg2[1]) as u128)); + let x77: u128 = (((arg1[3]) as u128) * ((arg2[0]) as u128)); + let x78: u128 = (((arg1[2]) as u128) * ((arg2[5]) as u128)); + let x79: u128 = (((arg1[2]) as u128) * ((arg2[4]) as u128)); + let x80: u128 = (((arg1[2]) as u128) * ((arg2[3]) as u128)); + let x81: u128 = (((arg1[2]) as u128) * ((arg2[2]) as u128)); + let x82: u128 = (((arg1[2]) as u128) * ((arg2[1]) as u128)); + let x83: u128 = (((arg1[2]) as u128) * ((arg2[0]) as u128)); + let x84: u128 = (((arg1[1]) as u128) * ((arg2[6]) as u128)); + let x85: u128 = (((arg1[1]) as u128) * ((arg2[5]) as u128)); + let x86: u128 = (((arg1[1]) as u128) * ((arg2[4]) as u128)); + let x87: u128 = (((arg1[1]) as u128) * ((arg2[3]) as u128)); + let x88: u128 = (((arg1[1]) as u128) * ((arg2[2]) as u128)); + let x89: u128 = (((arg1[1]) as u128) * ((arg2[1]) as u128)); + let x90: u128 = (((arg1[1]) as u128) * ((arg2[0]) as u128)); + let x91: u128 = (((arg1[0]) as u128) * ((arg2[7]) as u128)); + let x92: u128 = (((arg1[0]) as u128) * ((arg2[6]) as u128)); + let x93: u128 = (((arg1[0]) as u128) * ((arg2[5]) as u128)); + let x94: u128 = (((arg1[0]) as u128) * ((arg2[4]) as u128)); + let x95: u128 = (((arg1[0]) as u128) * ((arg2[3]) as u128)); + let x96: u128 = (((arg1[0]) as u128) * ((arg2[2]) as u128)); + let x97: u128 = (((arg1[0]) as u128) * ((arg2[1]) as u128)); + let x98: u128 = (((arg1[0]) as u128) * ((arg2[0]) as u128)); + let x99: u128 = (x95 + (x88 + (x82 + (x77 + (x31 + (x27 + (x22 + x16))))))); + let x100: u64 = ((x99 >> 56) as u64); + let x101: u64 = ((x99 & (0xffffffffffffff as u128)) as u64); + let x102: u128 = (x91 + (x84 + (x78 + (x73 + (x69 + (x66 + (x64 + (x63 + (x53 + (x49 + (x45 + x41))))))))))); + let x103: u128 = (x92 + (x85 + (x79 + (x74 + (x70 + (x67 + (x65 + (x57 + (x54 + (x50 + (x46 + (x42 + (x13 + x7))))))))))))); + let x104: u128 = (x93 + (x86 + (x80 + (x75 + (x71 + (x68 + (x60 + (x58 + (x55 + (x51 + (x47 + (x43 + (x20 + (x14 + (x10 + x8))))))))))))))); + let x105: u128 = (x94 + (x87 + (x81 + (x76 + (x72 + (x62 + (x61 + (x59 + (x56 + (x52 + (x48 + (x44 + (x26 + (x21 + (x15 + (x12 + (x11 + x9))))))))))))))))); + let x106: u128 = (x96 + (x89 + (x83 + (x35 + (x32 + (x28 + (x23 + (x17 + x1)))))))); + let x107: u128 = (x97 + (x90 + (x38 + (x36 + (x33 + (x29 + (x24 + (x18 + (x4 + x2))))))))); + let x108: u128 = (x98 + (x40 + (x39 + (x37 + (x34 + (x30 + (x25 + (x19 + (x6 + (x5 + x3)))))))))); + let x109: u128 = ((x100 as u128) + x105); + let x110: u64 = ((x102 >> 56) as u64); + let x111: u64 = ((x102 & (0xffffffffffffff as u128)) as u64); + let x112: u128 = (x109 + (x110 as u128)); + let x113: u64 = ((x112 >> 56) as u64); + let x114: u64 = ((x112 & (0xffffffffffffff as u128)) as u64); + let x115: u128 = (x108 + (x110 as u128)); + let x116: u128 = ((x113 as u128) + x104); + let x117: u64 = ((x115 >> 56) as u64); + let x118: u64 = ((x115 & (0xffffffffffffff as u128)) as u64); + let x119: u128 = ((x117 as u128) + x107); + let x120: u64 = ((x116 >> 56) as u64); + let x121: u64 = ((x116 & (0xffffffffffffff as u128)) as u64); + let x122: u128 = ((x120 as u128) + x103); + let x123: u64 = ((x119 >> 56) as u64); + let x124: u64 = ((x119 & (0xffffffffffffff as u128)) as u64); + let x125: u128 = ((x123 as u128) + x106); + let x126: u64 = ((x122 >> 56) as u64); + let x127: u64 = ((x122 & (0xffffffffffffff as u128)) as u64); + let x128: u64 = (x126 + x111); + let x129: u64 = ((x125 >> 56) as u64); + let x130: u64 = ((x125 & (0xffffffffffffff as u128)) as u64); + let x131: u64 = (x129 + x101); + let x132: u64 = (x128 >> 56); + let x133: u64 = (x128 & 0xffffffffffffff); + let x134: u64 = (x131 >> 56); + let x135: u64 = (x131 & 0xffffffffffffff); + let x136: u64 = (x114 + x132); + let x137: u64 = (x118 + x132); + let x138: u64 = (x134 + x136); + let x139: fiat_p448_u1 = ((x138 >> 56) as fiat_p448_u1); + let x140: u64 = (x138 & 0xffffffffffffff); + let x141: u64 = ((x139 as u64) + x121); + let x142: fiat_p448_u1 = ((x137 >> 56) as fiat_p448_u1); + let x143: u64 = (x137 & 0xffffffffffffff); + let x144: u64 = ((x142 as u64) + x124); + out1[0] = x143; + out1[1] = x144; + out1[2] = x130; + out1[3] = x135; + out1[4] = x140; + out1[5] = x141; + out1[6] = x127; + out1[7] = x133; +} + +/// The function fiat_p448_carry_square squares a field element and reduces the result. +/// +/// Postconditions: +/// eval out1 mod m = (eval arg1 * eval arg1) mod m +/// +#[inline] +pub fn fiat_p448_carry_square(out1: &mut fiat_p448_tight_field_element, arg1: &fiat_p448_loose_field_element) -> () { + let x1: u64 = (arg1[7]); + let x2: u64 = (arg1[7]); + let x3: u64 = (x1 * 0x2); + let x4: u64 = (x2 * 0x2); + let x5: u64 = ((arg1[7]) * 0x2); + let x6: u64 = (arg1[6]); + let x7: u64 = (arg1[6]); + let x8: u64 = (x6 * 0x2); + let x9: u64 = (x7 * 0x2); + let x10: u64 = ((arg1[6]) * 0x2); + let x11: u64 = (arg1[5]); + let x12: u64 = (arg1[5]); + let x13: u64 = (x11 * 0x2); + let x14: u64 = (x12 * 0x2); + let x15: u64 = ((arg1[5]) * 0x2); + let x16: u64 = (arg1[4]); + let x17: u64 = (arg1[4]); + let x18: u64 = ((arg1[4]) * 0x2); + let x19: u64 = ((arg1[3]) * 0x2); + let x20: u64 = ((arg1[2]) * 0x2); + let x21: u64 = ((arg1[1]) * 0x2); + let x22: u128 = (((arg1[7]) as u128) * (x1 as u128)); + let x23: u128 = (((arg1[6]) as u128) * (x3 as u128)); + let x24: u128 = (((arg1[6]) as u128) * (x6 as u128)); + let x25: u128 = (((arg1[5]) as u128) * (x3 as u128)); + let x26: u128 = (((arg1[7]) as u128) * (x1 as u128)); + let x27: u128 = (((arg1[6]) as u128) * (x3 as u128)); + let x28: u128 = (((arg1[6]) as u128) * (x6 as u128)); + let x29: u128 = (((arg1[5]) as u128) * (x3 as u128)); + let x30: u128 = (((arg1[7]) as u128) * (x2 as u128)); + let x31: u128 = (((arg1[6]) as u128) * (x4 as u128)); + let x32: u128 = (((arg1[6]) as u128) * (x7 as u128)); + let x33: u128 = (((arg1[5]) as u128) * (x4 as u128)); + let x34: u128 = (((arg1[5]) as u128) * (x9 as u128)); + let x35: u128 = (((arg1[5]) as u128) * (x8 as u128)); + let x36: u128 = (((arg1[5]) as u128) * (x12 as u128)); + let x37: u128 = (((arg1[5]) as u128) * (x11 as u128)); + let x38: u128 = (((arg1[4]) as u128) * (x4 as u128)); + let x39: u128 = (((arg1[4]) as u128) * (x3 as u128)); + let x40: u128 = (((arg1[4]) as u128) * (x9 as u128)); + let x41: u128 = (((arg1[4]) as u128) * (x8 as u128)); + let x42: u128 = (((arg1[4]) as u128) * (x14 as u128)); + let x43: u128 = (((arg1[4]) as u128) * (x13 as u128)); + let x44: u128 = (((arg1[4]) as u128) * (x17 as u128)); + let x45: u128 = (((arg1[4]) as u128) * (x16 as u128)); + let x46: u128 = (((arg1[3]) as u128) * (x4 as u128)); + let x47: u128 = (((arg1[3]) as u128) * (x3 as u128)); + let x48: u128 = (((arg1[3]) as u128) * (x9 as u128)); + let x49: u128 = (((arg1[3]) as u128) * (x8 as u128)); + let x50: u128 = (((arg1[3]) as u128) * (x14 as u128)); + let x51: u128 = (((arg1[3]) as u128) * (x13 as u128)); + let x52: u128 = (((arg1[3]) as u128) * (x18 as u128)); + let x53: u128 = (((arg1[3]) as u128) * ((arg1[3]) as u128)); + let x54: u128 = (((arg1[2]) as u128) * (x4 as u128)); + let x55: u128 = (((arg1[2]) as u128) * (x3 as u128)); + let x56: u128 = (((arg1[2]) as u128) * (x9 as u128)); + let x57: u128 = (((arg1[2]) as u128) * (x8 as u128)); + let x58: u128 = (((arg1[2]) as u128) * (x15 as u128)); + let x59: u128 = (((arg1[2]) as u128) * (x18 as u128)); + let x60: u128 = (((arg1[2]) as u128) * (x19 as u128)); + let x61: u128 = (((arg1[2]) as u128) * ((arg1[2]) as u128)); + let x62: u128 = (((arg1[1]) as u128) * (x4 as u128)); + let x63: u128 = (((arg1[1]) as u128) * (x3 as u128)); + let x64: u128 = (((arg1[1]) as u128) * (x10 as u128)); + let x65: u128 = (((arg1[1]) as u128) * (x15 as u128)); + let x66: u128 = (((arg1[1]) as u128) * (x18 as u128)); + let x67: u128 = (((arg1[1]) as u128) * (x19 as u128)); + let x68: u128 = (((arg1[1]) as u128) * (x20 as u128)); + let x69: u128 = (((arg1[1]) as u128) * ((arg1[1]) as u128)); + let x70: u128 = (((arg1[0]) as u128) * (x5 as u128)); + let x71: u128 = (((arg1[0]) as u128) * (x10 as u128)); + let x72: u128 = (((arg1[0]) as u128) * (x15 as u128)); + let x73: u128 = (((arg1[0]) as u128) * (x18 as u128)); + let x74: u128 = (((arg1[0]) as u128) * (x19 as u128)); + let x75: u128 = (((arg1[0]) as u128) * (x20 as u128)); + let x76: u128 = (((arg1[0]) as u128) * (x21 as u128)); + let x77: u128 = (((arg1[0]) as u128) * ((arg1[0]) as u128)); + let x78: u128 = (x74 + (x68 + (x38 + x34))); + let x79: u64 = ((x78 >> 56) as u64); + let x80: u64 = ((x78 & (0xffffffffffffff as u128)) as u64); + let x81: u128 = (x70 + (x64 + (x58 + (x52 + (x39 + x35))))); + let x82: u128 = (x71 + (x65 + (x59 + (x53 + (x47 + (x41 + (x37 + (x30 + x26)))))))); + let x83: u128 = (x72 + (x66 + (x60 + (x55 + (x49 + (x43 + (x31 + x27))))))); + let x84: u128 = (x73 + (x67 + (x63 + (x61 + (x57 + (x51 + (x45 + (x33 + (x32 + (x29 + x28)))))))))); + let x85: u128 = (x75 + (x69 + (x46 + (x40 + (x36 + x22))))); + let x86: u128 = (x76 + (x54 + (x48 + (x42 + x23)))); + let x87: u128 = (x77 + (x62 + (x56 + (x50 + (x44 + (x25 + x24)))))); + let x88: u128 = ((x79 as u128) + x84); + let x89: u64 = ((x81 >> 56) as u64); + let x90: u64 = ((x81 & (0xffffffffffffff as u128)) as u64); + let x91: u128 = (x88 + (x89 as u128)); + let x92: u64 = ((x91 >> 56) as u64); + let x93: u64 = ((x91 & (0xffffffffffffff as u128)) as u64); + let x94: u128 = (x87 + (x89 as u128)); + let x95: u128 = ((x92 as u128) + x83); + let x96: u64 = ((x94 >> 56) as u64); + let x97: u64 = ((x94 & (0xffffffffffffff as u128)) as u64); + let x98: u128 = ((x96 as u128) + x86); + let x99: u64 = ((x95 >> 56) as u64); + let x100: u64 = ((x95 & (0xffffffffffffff as u128)) as u64); + let x101: u128 = ((x99 as u128) + x82); + let x102: u64 = ((x98 >> 56) as u64); + let x103: u64 = ((x98 & (0xffffffffffffff as u128)) as u64); + let x104: u128 = ((x102 as u128) + x85); + let x105: u64 = ((x101 >> 56) as u64); + let x106: u64 = ((x101 & (0xffffffffffffff as u128)) as u64); + let x107: u64 = (x105 + x90); + let x108: u64 = ((x104 >> 56) as u64); + let x109: u64 = ((x104 & (0xffffffffffffff as u128)) as u64); + let x110: u64 = (x108 + x80); + let x111: u64 = (x107 >> 56); + let x112: u64 = (x107 & 0xffffffffffffff); + let x113: u64 = (x110 >> 56); + let x114: u64 = (x110 & 0xffffffffffffff); + let x115: u64 = (x93 + x111); + let x116: u64 = (x97 + x111); + let x117: u64 = (x113 + x115); + let x118: fiat_p448_u1 = ((x117 >> 56) as fiat_p448_u1); + let x119: u64 = (x117 & 0xffffffffffffff); + let x120: u64 = ((x118 as u64) + x100); + let x121: fiat_p448_u1 = ((x116 >> 56) as fiat_p448_u1); + let x122: u64 = (x116 & 0xffffffffffffff); + let x123: u64 = ((x121 as u64) + x103); + out1[0] = x122; + out1[1] = x123; + out1[2] = x109; + out1[3] = x114; + out1[4] = x119; + out1[5] = x120; + out1[6] = x106; + out1[7] = x112; +} + +/// The function fiat_p448_carry reduces a field element. +/// +/// Postconditions: +/// eval out1 mod m = eval arg1 mod m +/// +#[inline] +pub fn fiat_p448_carry(out1: &mut fiat_p448_tight_field_element, arg1: &fiat_p448_loose_field_element) -> () { + let x1: u64 = (arg1[3]); + let x2: u64 = (arg1[7]); + let x3: u64 = (x2 >> 56); + let x4: u64 = (((x1 >> 56) + (arg1[4])) + x3); + let x5: u64 = ((arg1[0]) + x3); + let x6: u64 = ((x4 >> 56) + (arg1[5])); + let x7: u64 = ((x5 >> 56) + (arg1[1])); + let x8: u64 = ((x6 >> 56) + (arg1[6])); + let x9: u64 = ((x7 >> 56) + (arg1[2])); + let x10: u64 = ((x8 >> 56) + (x2 & 0xffffffffffffff)); + let x11: u64 = ((x9 >> 56) + (x1 & 0xffffffffffffff)); + let x12: fiat_p448_u1 = ((x10 >> 56) as fiat_p448_u1); + let x13: u64 = ((x5 & 0xffffffffffffff) + (x12 as u64)); + let x14: u64 = ((((x11 >> 56) as fiat_p448_u1) as u64) + ((x4 & 0xffffffffffffff) + (x12 as u64))); + let x15: u64 = (x13 & 0xffffffffffffff); + let x16: u64 = ((((x13 >> 56) as fiat_p448_u1) as u64) + (x7 & 0xffffffffffffff)); + let x17: u64 = (x9 & 0xffffffffffffff); + let x18: u64 = (x11 & 0xffffffffffffff); + let x19: u64 = (x14 & 0xffffffffffffff); + let x20: u64 = ((((x14 >> 56) as fiat_p448_u1) as u64) + (x6 & 0xffffffffffffff)); + let x21: u64 = (x8 & 0xffffffffffffff); + let x22: u64 = (x10 & 0xffffffffffffff); + out1[0] = x15; + out1[1] = x16; + out1[2] = x17; + out1[3] = x18; + out1[4] = x19; + out1[5] = x20; + out1[6] = x21; + out1[7] = x22; +} + +/// The function fiat_p448_add adds two field elements. +/// +/// Postconditions: +/// eval out1 mod m = (eval arg1 + eval arg2) mod m +/// +#[inline] +pub fn fiat_p448_add(out1: &mut fiat_p448_loose_field_element, arg1: &fiat_p448_tight_field_element, arg2: &fiat_p448_tight_field_element) -> () { + let x1: u64 = ((arg1[0]) + (arg2[0])); + let x2: u64 = ((arg1[1]) + (arg2[1])); + let x3: u64 = ((arg1[2]) + (arg2[2])); + let x4: u64 = ((arg1[3]) + (arg2[3])); + let x5: u64 = ((arg1[4]) + (arg2[4])); + let x6: u64 = ((arg1[5]) + (arg2[5])); + let x7: u64 = ((arg1[6]) + (arg2[6])); + let x8: u64 = ((arg1[7]) + (arg2[7])); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; + out1[3] = x4; + out1[4] = x5; + out1[5] = x6; + out1[6] = x7; + out1[7] = x8; +} + +/// The function fiat_p448_sub subtracts two field elements. +/// +/// Postconditions: +/// eval out1 mod m = (eval arg1 - eval arg2) mod m +/// +#[inline] +pub fn fiat_p448_sub(out1: &mut fiat_p448_loose_field_element, arg1: &fiat_p448_tight_field_element, arg2: &fiat_p448_tight_field_element) -> () { + let x1: u64 = ((0x1fffffffffffffe + (arg1[0])) - (arg2[0])); + let x2: u64 = ((0x1fffffffffffffe + (arg1[1])) - (arg2[1])); + let x3: u64 = ((0x1fffffffffffffe + (arg1[2])) - (arg2[2])); + let x4: u64 = ((0x1fffffffffffffe + (arg1[3])) - (arg2[3])); + let x5: u64 = ((0x1fffffffffffffc + (arg1[4])) - (arg2[4])); + let x6: u64 = ((0x1fffffffffffffe + (arg1[5])) - (arg2[5])); + let x7: u64 = ((0x1fffffffffffffe + (arg1[6])) - (arg2[6])); + let x8: u64 = ((0x1fffffffffffffe + (arg1[7])) - (arg2[7])); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; + out1[3] = x4; + out1[4] = x5; + out1[5] = x6; + out1[6] = x7; + out1[7] = x8; +} + +/// The function fiat_p448_opp negates a field element. +/// +/// Postconditions: +/// eval out1 mod m = -eval arg1 mod m +/// +#[inline] +pub fn fiat_p448_opp(out1: &mut fiat_p448_loose_field_element, arg1: &fiat_p448_tight_field_element) -> () { + let x1: u64 = (0x1fffffffffffffe - (arg1[0])); + let x2: u64 = (0x1fffffffffffffe - (arg1[1])); + let x3: u64 = (0x1fffffffffffffe - (arg1[2])); + let x4: u64 = (0x1fffffffffffffe - (arg1[3])); + let x5: u64 = (0x1fffffffffffffc - (arg1[4])); + let x6: u64 = (0x1fffffffffffffe - (arg1[5])); + let x7: u64 = (0x1fffffffffffffe - (arg1[6])); + let x8: u64 = (0x1fffffffffffffe - (arg1[7])); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; + out1[3] = x4; + out1[4] = x5; + out1[5] = x6; + out1[6] = x7; + out1[7] = x8; +} + +/// The function fiat_p448_selectznz is a multi-limb conditional select. +/// +/// Postconditions: +/// out1 = (if arg1 = 0 then arg2 else arg3) +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +#[inline] +pub fn fiat_p448_selectznz(out1: &mut [u64; 8], arg1: fiat_p448_u1, arg2: &[u64; 8], arg3: &[u64; 8]) -> () { + let mut x1: u64 = 0; + fiat_p448_cmovznz_u64(&mut x1, arg1, (arg2[0]), (arg3[0])); + let mut x2: u64 = 0; + fiat_p448_cmovznz_u64(&mut x2, arg1, (arg2[1]), (arg3[1])); + let mut x3: u64 = 0; + fiat_p448_cmovznz_u64(&mut x3, arg1, (arg2[2]), (arg3[2])); + let mut x4: u64 = 0; + fiat_p448_cmovznz_u64(&mut x4, arg1, (arg2[3]), (arg3[3])); + let mut x5: u64 = 0; + fiat_p448_cmovznz_u64(&mut x5, arg1, (arg2[4]), (arg3[4])); + let mut x6: u64 = 0; + fiat_p448_cmovznz_u64(&mut x6, arg1, (arg2[5]), (arg3[5])); + let mut x7: u64 = 0; + fiat_p448_cmovznz_u64(&mut x7, arg1, (arg2[6]), (arg3[6])); + let mut x8: u64 = 0; + fiat_p448_cmovznz_u64(&mut x8, arg1, (arg2[7]), (arg3[7])); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; + out1[3] = x4; + out1[4] = x5; + out1[5] = x6; + out1[6] = x7; + out1[7] = x8; +} + +/// The function fiat_p448_to_bytes serializes a field element to bytes in little-endian order. +/// +/// Postconditions: +/// out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..55] +/// +/// Output Bounds: +/// out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] +#[inline] +pub fn fiat_p448_to_bytes(out1: &mut [u8; 56], arg1: &fiat_p448_tight_field_element) -> () { + let mut x1: u64 = 0; + let mut x2: fiat_p448_u1 = 0; + fiat_p448_subborrowx_u56(&mut x1, &mut x2, 0x0, (arg1[0]), 0xffffffffffffff); + let mut x3: u64 = 0; + let mut x4: fiat_p448_u1 = 0; + fiat_p448_subborrowx_u56(&mut x3, &mut x4, x2, (arg1[1]), 0xffffffffffffff); + let mut x5: u64 = 0; + let mut x6: fiat_p448_u1 = 0; + fiat_p448_subborrowx_u56(&mut x5, &mut x6, x4, (arg1[2]), 0xffffffffffffff); + let mut x7: u64 = 0; + let mut x8: fiat_p448_u1 = 0; + fiat_p448_subborrowx_u56(&mut x7, &mut x8, x6, (arg1[3]), 0xffffffffffffff); + let mut x9: u64 = 0; + let mut x10: fiat_p448_u1 = 0; + fiat_p448_subborrowx_u56(&mut x9, &mut x10, x8, (arg1[4]), 0xfffffffffffffe); + let mut x11: u64 = 0; + let mut x12: fiat_p448_u1 = 0; + fiat_p448_subborrowx_u56(&mut x11, &mut x12, x10, (arg1[5]), 0xffffffffffffff); + let mut x13: u64 = 0; + let mut x14: fiat_p448_u1 = 0; + fiat_p448_subborrowx_u56(&mut x13, &mut x14, x12, (arg1[6]), 0xffffffffffffff); + let mut x15: u64 = 0; + let mut x16: fiat_p448_u1 = 0; + fiat_p448_subborrowx_u56(&mut x15, &mut x16, x14, (arg1[7]), 0xffffffffffffff); + let mut x17: u64 = 0; + fiat_p448_cmovznz_u64(&mut x17, x16, (0x0 as u64), 0xffffffffffffffff); + let mut x18: u64 = 0; + let mut x19: fiat_p448_u1 = 0; + fiat_p448_addcarryx_u56(&mut x18, &mut x19, 0x0, x1, (x17 & 0xffffffffffffff)); + let mut x20: u64 = 0; + let mut x21: fiat_p448_u1 = 0; + fiat_p448_addcarryx_u56(&mut x20, &mut x21, x19, x3, (x17 & 0xffffffffffffff)); + let mut x22: u64 = 0; + let mut x23: fiat_p448_u1 = 0; + fiat_p448_addcarryx_u56(&mut x22, &mut x23, x21, x5, (x17 & 0xffffffffffffff)); + let mut x24: u64 = 0; + let mut x25: fiat_p448_u1 = 0; + fiat_p448_addcarryx_u56(&mut x24, &mut x25, x23, x7, (x17 & 0xffffffffffffff)); + let mut x26: u64 = 0; + let mut x27: fiat_p448_u1 = 0; + fiat_p448_addcarryx_u56(&mut x26, &mut x27, x25, x9, (x17 & 0xfffffffffffffe)); + let mut x28: u64 = 0; + let mut x29: fiat_p448_u1 = 0; + fiat_p448_addcarryx_u56(&mut x28, &mut x29, x27, x11, (x17 & 0xffffffffffffff)); + let mut x30: u64 = 0; + let mut x31: fiat_p448_u1 = 0; + fiat_p448_addcarryx_u56(&mut x30, &mut x31, x29, x13, (x17 & 0xffffffffffffff)); + let mut x32: u64 = 0; + let mut x33: fiat_p448_u1 = 0; + fiat_p448_addcarryx_u56(&mut x32, &mut x33, x31, x15, (x17 & 0xffffffffffffff)); + let x34: u8 = ((x18 & (0xff as u64)) as u8); + let x35: u64 = (x18 >> 8); + let x36: u8 = ((x35 & (0xff as u64)) as u8); + let x37: u64 = (x35 >> 8); + let x38: u8 = ((x37 & (0xff as u64)) as u8); + let x39: u64 = (x37 >> 8); + let x40: u8 = ((x39 & (0xff as u64)) as u8); + let x41: u64 = (x39 >> 8); + let x42: u8 = ((x41 & (0xff as u64)) as u8); + let x43: u64 = (x41 >> 8); + let x44: u8 = ((x43 & (0xff as u64)) as u8); + let x45: u8 = ((x43 >> 8) as u8); + let x46: u8 = ((x20 & (0xff as u64)) as u8); + let x47: u64 = (x20 >> 8); + let x48: u8 = ((x47 & (0xff as u64)) as u8); + let x49: u64 = (x47 >> 8); + let x50: u8 = ((x49 & (0xff as u64)) as u8); + let x51: u64 = (x49 >> 8); + let x52: u8 = ((x51 & (0xff as u64)) as u8); + let x53: u64 = (x51 >> 8); + let x54: u8 = ((x53 & (0xff as u64)) as u8); + let x55: u64 = (x53 >> 8); + let x56: u8 = ((x55 & (0xff as u64)) as u8); + let x57: u8 = ((x55 >> 8) as u8); + let x58: u8 = ((x22 & (0xff as u64)) as u8); + let x59: u64 = (x22 >> 8); + let x60: u8 = ((x59 & (0xff as u64)) as u8); + let x61: u64 = (x59 >> 8); + let x62: u8 = ((x61 & (0xff as u64)) as u8); + let x63: u64 = (x61 >> 8); + let x64: u8 = ((x63 & (0xff as u64)) as u8); + let x65: u64 = (x63 >> 8); + let x66: u8 = ((x65 & (0xff as u64)) as u8); + let x67: u64 = (x65 >> 8); + let x68: u8 = ((x67 & (0xff as u64)) as u8); + let x69: u8 = ((x67 >> 8) as u8); + let x70: u8 = ((x24 & (0xff as u64)) as u8); + let x71: u64 = (x24 >> 8); + let x72: u8 = ((x71 & (0xff as u64)) as u8); + let x73: u64 = (x71 >> 8); + let x74: u8 = ((x73 & (0xff as u64)) as u8); + let x75: u64 = (x73 >> 8); + let x76: u8 = ((x75 & (0xff as u64)) as u8); + let x77: u64 = (x75 >> 8); + let x78: u8 = ((x77 & (0xff as u64)) as u8); + let x79: u64 = (x77 >> 8); + let x80: u8 = ((x79 & (0xff as u64)) as u8); + let x81: u8 = ((x79 >> 8) as u8); + let x82: u8 = ((x26 & (0xff as u64)) as u8); + let x83: u64 = (x26 >> 8); + let x84: u8 = ((x83 & (0xff as u64)) as u8); + let x85: u64 = (x83 >> 8); + let x86: u8 = ((x85 & (0xff as u64)) as u8); + let x87: u64 = (x85 >> 8); + let x88: u8 = ((x87 & (0xff as u64)) as u8); + let x89: u64 = (x87 >> 8); + let x90: u8 = ((x89 & (0xff as u64)) as u8); + let x91: u64 = (x89 >> 8); + let x92: u8 = ((x91 & (0xff as u64)) as u8); + let x93: u8 = ((x91 >> 8) as u8); + let x94: u8 = ((x28 & (0xff as u64)) as u8); + let x95: u64 = (x28 >> 8); + let x96: u8 = ((x95 & (0xff as u64)) as u8); + let x97: u64 = (x95 >> 8); + let x98: u8 = ((x97 & (0xff as u64)) as u8); + let x99: u64 = (x97 >> 8); + let x100: u8 = ((x99 & (0xff as u64)) as u8); + let x101: u64 = (x99 >> 8); + let x102: u8 = ((x101 & (0xff as u64)) as u8); + let x103: u64 = (x101 >> 8); + let x104: u8 = ((x103 & (0xff as u64)) as u8); + let x105: u8 = ((x103 >> 8) as u8); + let x106: u8 = ((x30 & (0xff as u64)) as u8); + let x107: u64 = (x30 >> 8); + let x108: u8 = ((x107 & (0xff as u64)) as u8); + let x109: u64 = (x107 >> 8); + let x110: u8 = ((x109 & (0xff as u64)) as u8); + let x111: u64 = (x109 >> 8); + let x112: u8 = ((x111 & (0xff as u64)) as u8); + let x113: u64 = (x111 >> 8); + let x114: u8 = ((x113 & (0xff as u64)) as u8); + let x115: u64 = (x113 >> 8); + let x116: u8 = ((x115 & (0xff as u64)) as u8); + let x117: u8 = ((x115 >> 8) as u8); + let x118: u8 = ((x32 & (0xff as u64)) as u8); + let x119: u64 = (x32 >> 8); + let x120: u8 = ((x119 & (0xff as u64)) as u8); + let x121: u64 = (x119 >> 8); + let x122: u8 = ((x121 & (0xff as u64)) as u8); + let x123: u64 = (x121 >> 8); + let x124: u8 = ((x123 & (0xff as u64)) as u8); + let x125: u64 = (x123 >> 8); + let x126: u8 = ((x125 & (0xff as u64)) as u8); + let x127: u64 = (x125 >> 8); + let x128: u8 = ((x127 & (0xff as u64)) as u8); + let x129: u8 = ((x127 >> 8) as u8); + out1[0] = x34; + out1[1] = x36; + out1[2] = x38; + out1[3] = x40; + out1[4] = x42; + out1[5] = x44; + out1[6] = x45; + out1[7] = x46; + out1[8] = x48; + out1[9] = x50; + out1[10] = x52; + out1[11] = x54; + out1[12] = x56; + out1[13] = x57; + out1[14] = x58; + out1[15] = x60; + out1[16] = x62; + out1[17] = x64; + out1[18] = x66; + out1[19] = x68; + out1[20] = x69; + out1[21] = x70; + out1[22] = x72; + out1[23] = x74; + out1[24] = x76; + out1[25] = x78; + out1[26] = x80; + out1[27] = x81; + out1[28] = x82; + out1[29] = x84; + out1[30] = x86; + out1[31] = x88; + out1[32] = x90; + out1[33] = x92; + out1[34] = x93; + out1[35] = x94; + out1[36] = x96; + out1[37] = x98; + out1[38] = x100; + out1[39] = x102; + out1[40] = x104; + out1[41] = x105; + out1[42] = x106; + out1[43] = x108; + out1[44] = x110; + out1[45] = x112; + out1[46] = x114; + out1[47] = x116; + out1[48] = x117; + out1[49] = x118; + out1[50] = x120; + out1[51] = x122; + out1[52] = x124; + out1[53] = x126; + out1[54] = x128; + out1[55] = x129; +} + +/// The function fiat_p448_from_bytes deserializes a field element from bytes in little-endian order. +/// +/// Postconditions: +/// eval out1 mod m = bytes_eval arg1 mod m +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] +#[inline] +pub fn fiat_p448_from_bytes(out1: &mut fiat_p448_tight_field_element, arg1: &[u8; 56]) -> () { + let x1: u64 = (((arg1[55]) as u64) << 48); + let x2: u64 = (((arg1[54]) as u64) << 40); + let x3: u64 = (((arg1[53]) as u64) << 32); + let x4: u64 = (((arg1[52]) as u64) << 24); + let x5: u64 = (((arg1[51]) as u64) << 16); + let x6: u64 = (((arg1[50]) as u64) << 8); + let x7: u8 = (arg1[49]); + let x8: u64 = (((arg1[48]) as u64) << 48); + let x9: u64 = (((arg1[47]) as u64) << 40); + let x10: u64 = (((arg1[46]) as u64) << 32); + let x11: u64 = (((arg1[45]) as u64) << 24); + let x12: u64 = (((arg1[44]) as u64) << 16); + let x13: u64 = (((arg1[43]) as u64) << 8); + let x14: u8 = (arg1[42]); + let x15: u64 = (((arg1[41]) as u64) << 48); + let x16: u64 = (((arg1[40]) as u64) << 40); + let x17: u64 = (((arg1[39]) as u64) << 32); + let x18: u64 = (((arg1[38]) as u64) << 24); + let x19: u64 = (((arg1[37]) as u64) << 16); + let x20: u64 = (((arg1[36]) as u64) << 8); + let x21: u8 = (arg1[35]); + let x22: u64 = (((arg1[34]) as u64) << 48); + let x23: u64 = (((arg1[33]) as u64) << 40); + let x24: u64 = (((arg1[32]) as u64) << 32); + let x25: u64 = (((arg1[31]) as u64) << 24); + let x26: u64 = (((arg1[30]) as u64) << 16); + let x27: u64 = (((arg1[29]) as u64) << 8); + let x28: u8 = (arg1[28]); + let x29: u64 = (((arg1[27]) as u64) << 48); + let x30: u64 = (((arg1[26]) as u64) << 40); + let x31: u64 = (((arg1[25]) as u64) << 32); + let x32: u64 = (((arg1[24]) as u64) << 24); + let x33: u64 = (((arg1[23]) as u64) << 16); + let x34: u64 = (((arg1[22]) as u64) << 8); + let x35: u8 = (arg1[21]); + let x36: u64 = (((arg1[20]) as u64) << 48); + let x37: u64 = (((arg1[19]) as u64) << 40); + let x38: u64 = (((arg1[18]) as u64) << 32); + let x39: u64 = (((arg1[17]) as u64) << 24); + let x40: u64 = (((arg1[16]) as u64) << 16); + let x41: u64 = (((arg1[15]) as u64) << 8); + let x42: u8 = (arg1[14]); + let x43: u64 = (((arg1[13]) as u64) << 48); + let x44: u64 = (((arg1[12]) as u64) << 40); + let x45: u64 = (((arg1[11]) as u64) << 32); + let x46: u64 = (((arg1[10]) as u64) << 24); + let x47: u64 = (((arg1[9]) as u64) << 16); + let x48: u64 = (((arg1[8]) as u64) << 8); + let x49: u8 = (arg1[7]); + let x50: u64 = (((arg1[6]) as u64) << 48); + let x51: u64 = (((arg1[5]) as u64) << 40); + let x52: u64 = (((arg1[4]) as u64) << 32); + let x53: u64 = (((arg1[3]) as u64) << 24); + let x54: u64 = (((arg1[2]) as u64) << 16); + let x55: u64 = (((arg1[1]) as u64) << 8); + let x56: u8 = (arg1[0]); + let x57: u64 = (x55 + (x56 as u64)); + let x58: u64 = (x54 + x57); + let x59: u64 = (x53 + x58); + let x60: u64 = (x52 + x59); + let x61: u64 = (x51 + x60); + let x62: u64 = (x50 + x61); + let x63: u64 = (x48 + (x49 as u64)); + let x64: u64 = (x47 + x63); + let x65: u64 = (x46 + x64); + let x66: u64 = (x45 + x65); + let x67: u64 = (x44 + x66); + let x68: u64 = (x43 + x67); + let x69: u64 = (x41 + (x42 as u64)); + let x70: u64 = (x40 + x69); + let x71: u64 = (x39 + x70); + let x72: u64 = (x38 + x71); + let x73: u64 = (x37 + x72); + let x74: u64 = (x36 + x73); + let x75: u64 = (x34 + (x35 as u64)); + let x76: u64 = (x33 + x75); + let x77: u64 = (x32 + x76); + let x78: u64 = (x31 + x77); + let x79: u64 = (x30 + x78); + let x80: u64 = (x29 + x79); + let x81: u64 = (x27 + (x28 as u64)); + let x82: u64 = (x26 + x81); + let x83: u64 = (x25 + x82); + let x84: u64 = (x24 + x83); + let x85: u64 = (x23 + x84); + let x86: u64 = (x22 + x85); + let x87: u64 = (x20 + (x21 as u64)); + let x88: u64 = (x19 + x87); + let x89: u64 = (x18 + x88); + let x90: u64 = (x17 + x89); + let x91: u64 = (x16 + x90); + let x92: u64 = (x15 + x91); + let x93: u64 = (x13 + (x14 as u64)); + let x94: u64 = (x12 + x93); + let x95: u64 = (x11 + x94); + let x96: u64 = (x10 + x95); + let x97: u64 = (x9 + x96); + let x98: u64 = (x8 + x97); + let x99: u64 = (x6 + (x7 as u64)); + let x100: u64 = (x5 + x99); + let x101: u64 = (x4 + x100); + let x102: u64 = (x3 + x101); + let x103: u64 = (x2 + x102); + let x104: u64 = (x1 + x103); + out1[0] = x62; + out1[1] = x68; + out1[2] = x74; + out1[3] = x80; + out1[4] = x86; + out1[5] = x92; + out1[6] = x98; + out1[7] = x104; +} + +/// The function fiat_p448_relax is the identity function converting from tight field elements to loose field elements. +/// +/// Postconditions: +/// out1 = arg1 +/// +#[inline] +pub fn fiat_p448_relax(out1: &mut fiat_p448_loose_field_element, arg1: &fiat_p448_tight_field_element) -> () { + let x1: u64 = (arg1[0]); + let x2: u64 = (arg1[1]); + let x3: u64 = (arg1[2]); + let x4: u64 = (arg1[3]); + let x5: u64 = (arg1[4]); + let x6: u64 = (arg1[5]); + let x7: u64 = (arg1[6]); + let x8: u64 = (arg1[7]); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; + out1[3] = x4; + out1[4] = x5; + out1[5] = x6; + out1[6] = x7; + out1[7] = x8; +} diff --git a/vendor/fiat-crypto/src/p521_64.rs b/vendor/fiat-crypto/src/p521_64.rs new file mode 100644 index 000000000..c9e82ff70 --- /dev/null +++ b/vendor/fiat-crypto/src/p521_64.rs @@ -0,0 +1,1019 @@ +//! Autogenerated: 'src/ExtractionOCaml/unsaturated_solinas' --lang Rust --inline p521 64 9 '2^521 - 1' carry_mul carry_square carry add sub opp selectznz to_bytes from_bytes relax +//! curve description: p521 +//! machine_wordsize = 64 (from "64") +//! requested operations: carry_mul, carry_square, carry, add, sub, opp, selectznz, to_bytes, from_bytes, relax +//! n = 9 (from "9") +//! s-c = 2^521 - [(1, 1)] (from "2^521 - 1") +//! tight_bounds_multiplier = 1 (from "") +//! +//! Computed values: +//! carry_chain = [0, 1, 2, 3, 4, 5, 6, 7, 8, 0, 1] +//! eval z = z[0] + (z[1] << 58) + (z[2] << 116) + (z[3] << 174) + (z[4] << 232) + (z[5] << 0x122) + (z[6] << 0x15c) + (z[7] << 0x196) + (z[8] << 0x1d0) +//! bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248) + (z[32] << 256) + (z[33] << 0x108) + (z[34] << 0x110) + (z[35] << 0x118) + (z[36] << 0x120) + (z[37] << 0x128) + (z[38] << 0x130) + (z[39] << 0x138) + (z[40] << 0x140) + (z[41] << 0x148) + (z[42] << 0x150) + (z[43] << 0x158) + (z[44] << 0x160) + (z[45] << 0x168) + (z[46] << 0x170) + (z[47] << 0x178) + (z[48] << 0x180) + (z[49] << 0x188) + (z[50] << 0x190) + (z[51] << 0x198) + (z[52] << 0x1a0) + (z[53] << 0x1a8) + (z[54] << 0x1b0) + (z[55] << 0x1b8) + (z[56] << 0x1c0) + (z[57] << 0x1c8) + (z[58] << 0x1d0) + (z[59] << 0x1d8) + (z[60] << 0x1e0) + (z[61] << 0x1e8) + (z[62] << 0x1f0) + (z[63] << 0x1f8) + (z[64] << 2^9) + (z[65] << 0x208) +//! balance = [0x7fffffffffffffe, 0x7fffffffffffffe, 0x7fffffffffffffe, 0x7fffffffffffffe, 0x7fffffffffffffe, 0x7fffffffffffffe, 0x7fffffffffffffe, 0x7fffffffffffffe, 0x3fffffffffffffe] + +#![allow(unused_parens)] +#![allow(non_camel_case_types)] + +pub type fiat_p521_u1 = u8; +pub type fiat_p521_i1 = i8; +pub type fiat_p521_u2 = u8; +pub type fiat_p521_i2 = i8; + +/* The type fiat_p521_loose_field_element is a field element with loose bounds. */ +/* Bounds: [[0x0 ~> 0xc00000000000000], [0x0 ~> 0xc00000000000000], [0x0 ~> 0xc00000000000000], [0x0 ~> 0xc00000000000000], [0x0 ~> 0xc00000000000000], [0x0 ~> 0xc00000000000000], [0x0 ~> 0xc00000000000000], [0x0 ~> 0xc00000000000000], [0x0 ~> 0x600000000000000]] */ +pub type fiat_p521_loose_field_element = [u64; 9]; + +/* The type fiat_p521_tight_field_element is a field element with tight bounds. */ +/* Bounds: [[0x0 ~> 0x400000000000000], [0x0 ~> 0x400000000000000], [0x0 ~> 0x400000000000000], [0x0 ~> 0x400000000000000], [0x0 ~> 0x400000000000000], [0x0 ~> 0x400000000000000], [0x0 ~> 0x400000000000000], [0x0 ~> 0x400000000000000], [0x0 ~> 0x200000000000000]] */ +pub type fiat_p521_tight_field_element = [u64; 9]; + + +/// The function fiat_p521_addcarryx_u58 is an addition with carry. +/// +/// Postconditions: +/// out1 = (arg1 + arg2 + arg3) mod 2^58 +/// out2 = ⌊(arg1 + arg2 + arg3) / 2^58⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0x3ffffffffffffff] +/// arg3: [0x0 ~> 0x3ffffffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0x3ffffffffffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_p521_addcarryx_u58(out1: &mut u64, out2: &mut fiat_p521_u1, arg1: fiat_p521_u1, arg2: u64, arg3: u64) -> () { + let x1: u64 = (((arg1 as u64) + arg2) + arg3); + let x2: u64 = (x1 & 0x3ffffffffffffff); + let x3: fiat_p521_u1 = ((x1 >> 58) as fiat_p521_u1); + *out1 = x2; + *out2 = x3; +} + +/// The function fiat_p521_subborrowx_u58 is a subtraction with borrow. +/// +/// Postconditions: +/// out1 = (-arg1 + arg2 + -arg3) mod 2^58 +/// out2 = -⌊(-arg1 + arg2 + -arg3) / 2^58⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0x3ffffffffffffff] +/// arg3: [0x0 ~> 0x3ffffffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0x3ffffffffffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_p521_subborrowx_u58(out1: &mut u64, out2: &mut fiat_p521_u1, arg1: fiat_p521_u1, arg2: u64, arg3: u64) -> () { + let x1: i64 = ((((((arg2 as i128) - (arg1 as i128)) as i64) as i128) - (arg3 as i128)) as i64); + let x2: fiat_p521_i1 = ((x1 >> 58) as fiat_p521_i1); + let x3: u64 = (((x1 as i128) & (0x3ffffffffffffff as i128)) as u64); + *out1 = x3; + *out2 = (((0x0 as fiat_p521_i2) - (x2 as fiat_p521_i2)) as fiat_p521_u1); +} + +/// The function fiat_p521_addcarryx_u57 is an addition with carry. +/// +/// Postconditions: +/// out1 = (arg1 + arg2 + arg3) mod 2^57 +/// out2 = ⌊(arg1 + arg2 + arg3) / 2^57⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0x1ffffffffffffff] +/// arg3: [0x0 ~> 0x1ffffffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0x1ffffffffffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_p521_addcarryx_u57(out1: &mut u64, out2: &mut fiat_p521_u1, arg1: fiat_p521_u1, arg2: u64, arg3: u64) -> () { + let x1: u64 = (((arg1 as u64) + arg2) + arg3); + let x2: u64 = (x1 & 0x1ffffffffffffff); + let x3: fiat_p521_u1 = ((x1 >> 57) as fiat_p521_u1); + *out1 = x2; + *out2 = x3; +} + +/// The function fiat_p521_subborrowx_u57 is a subtraction with borrow. +/// +/// Postconditions: +/// out1 = (-arg1 + arg2 + -arg3) mod 2^57 +/// out2 = -⌊(-arg1 + arg2 + -arg3) / 2^57⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0x1ffffffffffffff] +/// arg3: [0x0 ~> 0x1ffffffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0x1ffffffffffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_p521_subborrowx_u57(out1: &mut u64, out2: &mut fiat_p521_u1, arg1: fiat_p521_u1, arg2: u64, arg3: u64) -> () { + let x1: i64 = ((((((arg2 as i128) - (arg1 as i128)) as i64) as i128) - (arg3 as i128)) as i64); + let x2: fiat_p521_i1 = ((x1 >> 57) as fiat_p521_i1); + let x3: u64 = (((x1 as i128) & (0x1ffffffffffffff as i128)) as u64); + *out1 = x3; + *out2 = (((0x0 as fiat_p521_i2) - (x2 as fiat_p521_i2)) as fiat_p521_u1); +} + +/// The function fiat_p521_cmovznz_u64 is a single-word conditional move. +/// +/// Postconditions: +/// out1 = (if arg1 = 0 then arg2 else arg3) +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffffffffffff] +/// arg3: [0x0 ~> 0xffffffffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +#[inline] +pub fn fiat_p521_cmovznz_u64(out1: &mut u64, arg1: fiat_p521_u1, arg2: u64, arg3: u64) -> () { + let x1: fiat_p521_u1 = (!(!arg1)); + let x2: u64 = ((((((0x0 as fiat_p521_i2) - (x1 as fiat_p521_i2)) as fiat_p521_i1) as i128) & (0xffffffffffffffff as i128)) as u64); + let x3: u64 = ((x2 & arg3) | ((!x2) & arg2)); + *out1 = x3; +} + +/// The function fiat_p521_carry_mul multiplies two field elements and reduces the result. +/// +/// Postconditions: +/// eval out1 mod m = (eval arg1 * eval arg2) mod m +/// +#[inline] +pub fn fiat_p521_carry_mul(out1: &mut fiat_p521_tight_field_element, arg1: &fiat_p521_loose_field_element, arg2: &fiat_p521_loose_field_element) -> () { + let x1: u128 = (((arg1[8]) as u128) * (((arg2[8]) * 0x2) as u128)); + let x2: u128 = (((arg1[8]) as u128) * (((arg2[7]) * 0x2) as u128)); + let x3: u128 = (((arg1[8]) as u128) * (((arg2[6]) * 0x2) as u128)); + let x4: u128 = (((arg1[8]) as u128) * (((arg2[5]) * 0x2) as u128)); + let x5: u128 = (((arg1[8]) as u128) * (((arg2[4]) * 0x2) as u128)); + let x6: u128 = (((arg1[8]) as u128) * (((arg2[3]) * 0x2) as u128)); + let x7: u128 = (((arg1[8]) as u128) * (((arg2[2]) * 0x2) as u128)); + let x8: u128 = (((arg1[8]) as u128) * (((arg2[1]) * 0x2) as u128)); + let x9: u128 = (((arg1[7]) as u128) * (((arg2[8]) * 0x2) as u128)); + let x10: u128 = (((arg1[7]) as u128) * (((arg2[7]) * 0x2) as u128)); + let x11: u128 = (((arg1[7]) as u128) * (((arg2[6]) * 0x2) as u128)); + let x12: u128 = (((arg1[7]) as u128) * (((arg2[5]) * 0x2) as u128)); + let x13: u128 = (((arg1[7]) as u128) * (((arg2[4]) * 0x2) as u128)); + let x14: u128 = (((arg1[7]) as u128) * (((arg2[3]) * 0x2) as u128)); + let x15: u128 = (((arg1[7]) as u128) * (((arg2[2]) * 0x2) as u128)); + let x16: u128 = (((arg1[6]) as u128) * (((arg2[8]) * 0x2) as u128)); + let x17: u128 = (((arg1[6]) as u128) * (((arg2[7]) * 0x2) as u128)); + let x18: u128 = (((arg1[6]) as u128) * (((arg2[6]) * 0x2) as u128)); + let x19: u128 = (((arg1[6]) as u128) * (((arg2[5]) * 0x2) as u128)); + let x20: u128 = (((arg1[6]) as u128) * (((arg2[4]) * 0x2) as u128)); + let x21: u128 = (((arg1[6]) as u128) * (((arg2[3]) * 0x2) as u128)); + let x22: u128 = (((arg1[5]) as u128) * (((arg2[8]) * 0x2) as u128)); + let x23: u128 = (((arg1[5]) as u128) * (((arg2[7]) * 0x2) as u128)); + let x24: u128 = (((arg1[5]) as u128) * (((arg2[6]) * 0x2) as u128)); + let x25: u128 = (((arg1[5]) as u128) * (((arg2[5]) * 0x2) as u128)); + let x26: u128 = (((arg1[5]) as u128) * (((arg2[4]) * 0x2) as u128)); + let x27: u128 = (((arg1[4]) as u128) * (((arg2[8]) * 0x2) as u128)); + let x28: u128 = (((arg1[4]) as u128) * (((arg2[7]) * 0x2) as u128)); + let x29: u128 = (((arg1[4]) as u128) * (((arg2[6]) * 0x2) as u128)); + let x30: u128 = (((arg1[4]) as u128) * (((arg2[5]) * 0x2) as u128)); + let x31: u128 = (((arg1[3]) as u128) * (((arg2[8]) * 0x2) as u128)); + let x32: u128 = (((arg1[3]) as u128) * (((arg2[7]) * 0x2) as u128)); + let x33: u128 = (((arg1[3]) as u128) * (((arg2[6]) * 0x2) as u128)); + let x34: u128 = (((arg1[2]) as u128) * (((arg2[8]) * 0x2) as u128)); + let x35: u128 = (((arg1[2]) as u128) * (((arg2[7]) * 0x2) as u128)); + let x36: u128 = (((arg1[1]) as u128) * (((arg2[8]) * 0x2) as u128)); + let x37: u128 = (((arg1[8]) as u128) * ((arg2[0]) as u128)); + let x38: u128 = (((arg1[7]) as u128) * ((arg2[1]) as u128)); + let x39: u128 = (((arg1[7]) as u128) * ((arg2[0]) as u128)); + let x40: u128 = (((arg1[6]) as u128) * ((arg2[2]) as u128)); + let x41: u128 = (((arg1[6]) as u128) * ((arg2[1]) as u128)); + let x42: u128 = (((arg1[6]) as u128) * ((arg2[0]) as u128)); + let x43: u128 = (((arg1[5]) as u128) * ((arg2[3]) as u128)); + let x44: u128 = (((arg1[5]) as u128) * ((arg2[2]) as u128)); + let x45: u128 = (((arg1[5]) as u128) * ((arg2[1]) as u128)); + let x46: u128 = (((arg1[5]) as u128) * ((arg2[0]) as u128)); + let x47: u128 = (((arg1[4]) as u128) * ((arg2[4]) as u128)); + let x48: u128 = (((arg1[4]) as u128) * ((arg2[3]) as u128)); + let x49: u128 = (((arg1[4]) as u128) * ((arg2[2]) as u128)); + let x50: u128 = (((arg1[4]) as u128) * ((arg2[1]) as u128)); + let x51: u128 = (((arg1[4]) as u128) * ((arg2[0]) as u128)); + let x52: u128 = (((arg1[3]) as u128) * ((arg2[5]) as u128)); + let x53: u128 = (((arg1[3]) as u128) * ((arg2[4]) as u128)); + let x54: u128 = (((arg1[3]) as u128) * ((arg2[3]) as u128)); + let x55: u128 = (((arg1[3]) as u128) * ((arg2[2]) as u128)); + let x56: u128 = (((arg1[3]) as u128) * ((arg2[1]) as u128)); + let x57: u128 = (((arg1[3]) as u128) * ((arg2[0]) as u128)); + let x58: u128 = (((arg1[2]) as u128) * ((arg2[6]) as u128)); + let x59: u128 = (((arg1[2]) as u128) * ((arg2[5]) as u128)); + let x60: u128 = (((arg1[2]) as u128) * ((arg2[4]) as u128)); + let x61: u128 = (((arg1[2]) as u128) * ((arg2[3]) as u128)); + let x62: u128 = (((arg1[2]) as u128) * ((arg2[2]) as u128)); + let x63: u128 = (((arg1[2]) as u128) * ((arg2[1]) as u128)); + let x64: u128 = (((arg1[2]) as u128) * ((arg2[0]) as u128)); + let x65: u128 = (((arg1[1]) as u128) * ((arg2[7]) as u128)); + let x66: u128 = (((arg1[1]) as u128) * ((arg2[6]) as u128)); + let x67: u128 = (((arg1[1]) as u128) * ((arg2[5]) as u128)); + let x68: u128 = (((arg1[1]) as u128) * ((arg2[4]) as u128)); + let x69: u128 = (((arg1[1]) as u128) * ((arg2[3]) as u128)); + let x70: u128 = (((arg1[1]) as u128) * ((arg2[2]) as u128)); + let x71: u128 = (((arg1[1]) as u128) * ((arg2[1]) as u128)); + let x72: u128 = (((arg1[1]) as u128) * ((arg2[0]) as u128)); + let x73: u128 = (((arg1[0]) as u128) * ((arg2[8]) as u128)); + let x74: u128 = (((arg1[0]) as u128) * ((arg2[7]) as u128)); + let x75: u128 = (((arg1[0]) as u128) * ((arg2[6]) as u128)); + let x76: u128 = (((arg1[0]) as u128) * ((arg2[5]) as u128)); + let x77: u128 = (((arg1[0]) as u128) * ((arg2[4]) as u128)); + let x78: u128 = (((arg1[0]) as u128) * ((arg2[3]) as u128)); + let x79: u128 = (((arg1[0]) as u128) * ((arg2[2]) as u128)); + let x80: u128 = (((arg1[0]) as u128) * ((arg2[1]) as u128)); + let x81: u128 = (((arg1[0]) as u128) * ((arg2[0]) as u128)); + let x82: u128 = (x81 + (x36 + (x35 + (x33 + (x30 + (x26 + (x21 + (x15 + x8)))))))); + let x83: u128 = (x82 >> 58); + let x84: u64 = ((x82 & (0x3ffffffffffffff as u128)) as u64); + let x85: u128 = (x73 + (x65 + (x58 + (x52 + (x47 + (x43 + (x40 + (x38 + x37)))))))); + let x86: u128 = (x74 + (x66 + (x59 + (x53 + (x48 + (x44 + (x41 + (x39 + x1)))))))); + let x87: u128 = (x75 + (x67 + (x60 + (x54 + (x49 + (x45 + (x42 + (x9 + x2)))))))); + let x88: u128 = (x76 + (x68 + (x61 + (x55 + (x50 + (x46 + (x16 + (x10 + x3)))))))); + let x89: u128 = (x77 + (x69 + (x62 + (x56 + (x51 + (x22 + (x17 + (x11 + x4)))))))); + let x90: u128 = (x78 + (x70 + (x63 + (x57 + (x27 + (x23 + (x18 + (x12 + x5)))))))); + let x91: u128 = (x79 + (x71 + (x64 + (x31 + (x28 + (x24 + (x19 + (x13 + x6)))))))); + let x92: u128 = (x80 + (x72 + (x34 + (x32 + (x29 + (x25 + (x20 + (x14 + x7)))))))); + let x93: u128 = (x83 + x92); + let x94: u128 = (x93 >> 58); + let x95: u64 = ((x93 & (0x3ffffffffffffff as u128)) as u64); + let x96: u128 = (x94 + x91); + let x97: u128 = (x96 >> 58); + let x98: u64 = ((x96 & (0x3ffffffffffffff as u128)) as u64); + let x99: u128 = (x97 + x90); + let x100: u128 = (x99 >> 58); + let x101: u64 = ((x99 & (0x3ffffffffffffff as u128)) as u64); + let x102: u128 = (x100 + x89); + let x103: u128 = (x102 >> 58); + let x104: u64 = ((x102 & (0x3ffffffffffffff as u128)) as u64); + let x105: u128 = (x103 + x88); + let x106: u128 = (x105 >> 58); + let x107: u64 = ((x105 & (0x3ffffffffffffff as u128)) as u64); + let x108: u128 = (x106 + x87); + let x109: u128 = (x108 >> 58); + let x110: u64 = ((x108 & (0x3ffffffffffffff as u128)) as u64); + let x111: u128 = (x109 + x86); + let x112: u128 = (x111 >> 58); + let x113: u64 = ((x111 & (0x3ffffffffffffff as u128)) as u64); + let x114: u128 = (x112 + x85); + let x115: u128 = (x114 >> 57); + let x116: u64 = ((x114 & (0x1ffffffffffffff as u128)) as u64); + let x117: u128 = ((x84 as u128) + x115); + let x118: u64 = ((x117 >> 58) as u64); + let x119: u64 = ((x117 & (0x3ffffffffffffff as u128)) as u64); + let x120: u64 = (x118 + x95); + let x121: fiat_p521_u1 = ((x120 >> 58) as fiat_p521_u1); + let x122: u64 = (x120 & 0x3ffffffffffffff); + let x123: u64 = ((x121 as u64) + x98); + out1[0] = x119; + out1[1] = x122; + out1[2] = x123; + out1[3] = x101; + out1[4] = x104; + out1[5] = x107; + out1[6] = x110; + out1[7] = x113; + out1[8] = x116; +} + +/// The function fiat_p521_carry_square squares a field element and reduces the result. +/// +/// Postconditions: +/// eval out1 mod m = (eval arg1 * eval arg1) mod m +/// +#[inline] +pub fn fiat_p521_carry_square(out1: &mut fiat_p521_tight_field_element, arg1: &fiat_p521_loose_field_element) -> () { + let x1: u64 = (arg1[8]); + let x2: u64 = (x1 * 0x2); + let x3: u64 = ((arg1[8]) * 0x2); + let x4: u64 = (arg1[7]); + let x5: u64 = (x4 * 0x2); + let x6: u64 = ((arg1[7]) * 0x2); + let x7: u64 = (arg1[6]); + let x8: u64 = (x7 * 0x2); + let x9: u64 = ((arg1[6]) * 0x2); + let x10: u64 = (arg1[5]); + let x11: u64 = (x10 * 0x2); + let x12: u64 = ((arg1[5]) * 0x2); + let x13: u64 = ((arg1[4]) * 0x2); + let x14: u64 = ((arg1[3]) * 0x2); + let x15: u64 = ((arg1[2]) * 0x2); + let x16: u64 = ((arg1[1]) * 0x2); + let x17: u128 = (((arg1[8]) as u128) * ((x1 * 0x2) as u128)); + let x18: u128 = (((arg1[7]) as u128) * ((x2 * 0x2) as u128)); + let x19: u128 = (((arg1[7]) as u128) * ((x4 * 0x2) as u128)); + let x20: u128 = (((arg1[6]) as u128) * ((x2 * 0x2) as u128)); + let x21: u128 = (((arg1[6]) as u128) * ((x5 * 0x2) as u128)); + let x22: u128 = (((arg1[6]) as u128) * ((x7 * 0x2) as u128)); + let x23: u128 = (((arg1[5]) as u128) * ((x2 * 0x2) as u128)); + let x24: u128 = (((arg1[5]) as u128) * ((x5 * 0x2) as u128)); + let x25: u128 = (((arg1[5]) as u128) * ((x8 * 0x2) as u128)); + let x26: u128 = (((arg1[5]) as u128) * ((x10 * 0x2) as u128)); + let x27: u128 = (((arg1[4]) as u128) * ((x2 * 0x2) as u128)); + let x28: u128 = (((arg1[4]) as u128) * ((x5 * 0x2) as u128)); + let x29: u128 = (((arg1[4]) as u128) * ((x8 * 0x2) as u128)); + let x30: u128 = (((arg1[4]) as u128) * ((x11 * 0x2) as u128)); + let x31: u128 = (((arg1[4]) as u128) * ((arg1[4]) as u128)); + let x32: u128 = (((arg1[3]) as u128) * ((x2 * 0x2) as u128)); + let x33: u128 = (((arg1[3]) as u128) * ((x5 * 0x2) as u128)); + let x34: u128 = (((arg1[3]) as u128) * ((x8 * 0x2) as u128)); + let x35: u128 = (((arg1[3]) as u128) * (x12 as u128)); + let x36: u128 = (((arg1[3]) as u128) * (x13 as u128)); + let x37: u128 = (((arg1[3]) as u128) * ((arg1[3]) as u128)); + let x38: u128 = (((arg1[2]) as u128) * ((x2 * 0x2) as u128)); + let x39: u128 = (((arg1[2]) as u128) * ((x5 * 0x2) as u128)); + let x40: u128 = (((arg1[2]) as u128) * (x9 as u128)); + let x41: u128 = (((arg1[2]) as u128) * (x12 as u128)); + let x42: u128 = (((arg1[2]) as u128) * (x13 as u128)); + let x43: u128 = (((arg1[2]) as u128) * (x14 as u128)); + let x44: u128 = (((arg1[2]) as u128) * ((arg1[2]) as u128)); + let x45: u128 = (((arg1[1]) as u128) * ((x2 * 0x2) as u128)); + let x46: u128 = (((arg1[1]) as u128) * (x6 as u128)); + let x47: u128 = (((arg1[1]) as u128) * (x9 as u128)); + let x48: u128 = (((arg1[1]) as u128) * (x12 as u128)); + let x49: u128 = (((arg1[1]) as u128) * (x13 as u128)); + let x50: u128 = (((arg1[1]) as u128) * (x14 as u128)); + let x51: u128 = (((arg1[1]) as u128) * (x15 as u128)); + let x52: u128 = (((arg1[1]) as u128) * ((arg1[1]) as u128)); + let x53: u128 = (((arg1[0]) as u128) * (x3 as u128)); + let x54: u128 = (((arg1[0]) as u128) * (x6 as u128)); + let x55: u128 = (((arg1[0]) as u128) * (x9 as u128)); + let x56: u128 = (((arg1[0]) as u128) * (x12 as u128)); + let x57: u128 = (((arg1[0]) as u128) * (x13 as u128)); + let x58: u128 = (((arg1[0]) as u128) * (x14 as u128)); + let x59: u128 = (((arg1[0]) as u128) * (x15 as u128)); + let x60: u128 = (((arg1[0]) as u128) * (x16 as u128)); + let x61: u128 = (((arg1[0]) as u128) * ((arg1[0]) as u128)); + let x62: u128 = (x61 + (x45 + (x39 + (x34 + x30)))); + let x63: u128 = (x62 >> 58); + let x64: u64 = ((x62 & (0x3ffffffffffffff as u128)) as u64); + let x65: u128 = (x53 + (x46 + (x40 + (x35 + x31)))); + let x66: u128 = (x54 + (x47 + (x41 + (x36 + x17)))); + let x67: u128 = (x55 + (x48 + (x42 + (x37 + x18)))); + let x68: u128 = (x56 + (x49 + (x43 + (x20 + x19)))); + let x69: u128 = (x57 + (x50 + (x44 + (x23 + x21)))); + let x70: u128 = (x58 + (x51 + (x27 + (x24 + x22)))); + let x71: u128 = (x59 + (x52 + (x32 + (x28 + x25)))); + let x72: u128 = (x60 + (x38 + (x33 + (x29 + x26)))); + let x73: u128 = (x63 + x72); + let x74: u128 = (x73 >> 58); + let x75: u64 = ((x73 & (0x3ffffffffffffff as u128)) as u64); + let x76: u128 = (x74 + x71); + let x77: u128 = (x76 >> 58); + let x78: u64 = ((x76 & (0x3ffffffffffffff as u128)) as u64); + let x79: u128 = (x77 + x70); + let x80: u128 = (x79 >> 58); + let x81: u64 = ((x79 & (0x3ffffffffffffff as u128)) as u64); + let x82: u128 = (x80 + x69); + let x83: u128 = (x82 >> 58); + let x84: u64 = ((x82 & (0x3ffffffffffffff as u128)) as u64); + let x85: u128 = (x83 + x68); + let x86: u128 = (x85 >> 58); + let x87: u64 = ((x85 & (0x3ffffffffffffff as u128)) as u64); + let x88: u128 = (x86 + x67); + let x89: u128 = (x88 >> 58); + let x90: u64 = ((x88 & (0x3ffffffffffffff as u128)) as u64); + let x91: u128 = (x89 + x66); + let x92: u128 = (x91 >> 58); + let x93: u64 = ((x91 & (0x3ffffffffffffff as u128)) as u64); + let x94: u128 = (x92 + x65); + let x95: u128 = (x94 >> 57); + let x96: u64 = ((x94 & (0x1ffffffffffffff as u128)) as u64); + let x97: u128 = ((x64 as u128) + x95); + let x98: u64 = ((x97 >> 58) as u64); + let x99: u64 = ((x97 & (0x3ffffffffffffff as u128)) as u64); + let x100: u64 = (x98 + x75); + let x101: fiat_p521_u1 = ((x100 >> 58) as fiat_p521_u1); + let x102: u64 = (x100 & 0x3ffffffffffffff); + let x103: u64 = ((x101 as u64) + x78); + out1[0] = x99; + out1[1] = x102; + out1[2] = x103; + out1[3] = x81; + out1[4] = x84; + out1[5] = x87; + out1[6] = x90; + out1[7] = x93; + out1[8] = x96; +} + +/// The function fiat_p521_carry reduces a field element. +/// +/// Postconditions: +/// eval out1 mod m = eval arg1 mod m +/// +#[inline] +pub fn fiat_p521_carry(out1: &mut fiat_p521_tight_field_element, arg1: &fiat_p521_loose_field_element) -> () { + let x1: u64 = (arg1[0]); + let x2: u64 = ((x1 >> 58) + (arg1[1])); + let x3: u64 = ((x2 >> 58) + (arg1[2])); + let x4: u64 = ((x3 >> 58) + (arg1[3])); + let x5: u64 = ((x4 >> 58) + (arg1[4])); + let x6: u64 = ((x5 >> 58) + (arg1[5])); + let x7: u64 = ((x6 >> 58) + (arg1[6])); + let x8: u64 = ((x7 >> 58) + (arg1[7])); + let x9: u64 = ((x8 >> 58) + (arg1[8])); + let x10: u64 = ((x1 & 0x3ffffffffffffff) + (x9 >> 57)); + let x11: u64 = ((((x10 >> 58) as fiat_p521_u1) as u64) + (x2 & 0x3ffffffffffffff)); + let x12: u64 = (x10 & 0x3ffffffffffffff); + let x13: u64 = (x11 & 0x3ffffffffffffff); + let x14: u64 = ((((x11 >> 58) as fiat_p521_u1) as u64) + (x3 & 0x3ffffffffffffff)); + let x15: u64 = (x4 & 0x3ffffffffffffff); + let x16: u64 = (x5 & 0x3ffffffffffffff); + let x17: u64 = (x6 & 0x3ffffffffffffff); + let x18: u64 = (x7 & 0x3ffffffffffffff); + let x19: u64 = (x8 & 0x3ffffffffffffff); + let x20: u64 = (x9 & 0x1ffffffffffffff); + out1[0] = x12; + out1[1] = x13; + out1[2] = x14; + out1[3] = x15; + out1[4] = x16; + out1[5] = x17; + out1[6] = x18; + out1[7] = x19; + out1[8] = x20; +} + +/// The function fiat_p521_add adds two field elements. +/// +/// Postconditions: +/// eval out1 mod m = (eval arg1 + eval arg2) mod m +/// +#[inline] +pub fn fiat_p521_add(out1: &mut fiat_p521_loose_field_element, arg1: &fiat_p521_tight_field_element, arg2: &fiat_p521_tight_field_element) -> () { + let x1: u64 = ((arg1[0]) + (arg2[0])); + let x2: u64 = ((arg1[1]) + (arg2[1])); + let x3: u64 = ((arg1[2]) + (arg2[2])); + let x4: u64 = ((arg1[3]) + (arg2[3])); + let x5: u64 = ((arg1[4]) + (arg2[4])); + let x6: u64 = ((arg1[5]) + (arg2[5])); + let x7: u64 = ((arg1[6]) + (arg2[6])); + let x8: u64 = ((arg1[7]) + (arg2[7])); + let x9: u64 = ((arg1[8]) + (arg2[8])); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; + out1[3] = x4; + out1[4] = x5; + out1[5] = x6; + out1[6] = x7; + out1[7] = x8; + out1[8] = x9; +} + +/// The function fiat_p521_sub subtracts two field elements. +/// +/// Postconditions: +/// eval out1 mod m = (eval arg1 - eval arg2) mod m +/// +#[inline] +pub fn fiat_p521_sub(out1: &mut fiat_p521_loose_field_element, arg1: &fiat_p521_tight_field_element, arg2: &fiat_p521_tight_field_element) -> () { + let x1: u64 = ((0x7fffffffffffffe + (arg1[0])) - (arg2[0])); + let x2: u64 = ((0x7fffffffffffffe + (arg1[1])) - (arg2[1])); + let x3: u64 = ((0x7fffffffffffffe + (arg1[2])) - (arg2[2])); + let x4: u64 = ((0x7fffffffffffffe + (arg1[3])) - (arg2[3])); + let x5: u64 = ((0x7fffffffffffffe + (arg1[4])) - (arg2[4])); + let x6: u64 = ((0x7fffffffffffffe + (arg1[5])) - (arg2[5])); + let x7: u64 = ((0x7fffffffffffffe + (arg1[6])) - (arg2[6])); + let x8: u64 = ((0x7fffffffffffffe + (arg1[7])) - (arg2[7])); + let x9: u64 = ((0x3fffffffffffffe + (arg1[8])) - (arg2[8])); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; + out1[3] = x4; + out1[4] = x5; + out1[5] = x6; + out1[6] = x7; + out1[7] = x8; + out1[8] = x9; +} + +/// The function fiat_p521_opp negates a field element. +/// +/// Postconditions: +/// eval out1 mod m = -eval arg1 mod m +/// +#[inline] +pub fn fiat_p521_opp(out1: &mut fiat_p521_loose_field_element, arg1: &fiat_p521_tight_field_element) -> () { + let x1: u64 = (0x7fffffffffffffe - (arg1[0])); + let x2: u64 = (0x7fffffffffffffe - (arg1[1])); + let x3: u64 = (0x7fffffffffffffe - (arg1[2])); + let x4: u64 = (0x7fffffffffffffe - (arg1[3])); + let x5: u64 = (0x7fffffffffffffe - (arg1[4])); + let x6: u64 = (0x7fffffffffffffe - (arg1[5])); + let x7: u64 = (0x7fffffffffffffe - (arg1[6])); + let x8: u64 = (0x7fffffffffffffe - (arg1[7])); + let x9: u64 = (0x3fffffffffffffe - (arg1[8])); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; + out1[3] = x4; + out1[4] = x5; + out1[5] = x6; + out1[6] = x7; + out1[7] = x8; + out1[8] = x9; +} + +/// The function fiat_p521_selectznz is a multi-limb conditional select. +/// +/// Postconditions: +/// out1 = (if arg1 = 0 then arg2 else arg3) +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +#[inline] +pub fn fiat_p521_selectznz(out1: &mut [u64; 9], arg1: fiat_p521_u1, arg2: &[u64; 9], arg3: &[u64; 9]) -> () { + let mut x1: u64 = 0; + fiat_p521_cmovznz_u64(&mut x1, arg1, (arg2[0]), (arg3[0])); + let mut x2: u64 = 0; + fiat_p521_cmovznz_u64(&mut x2, arg1, (arg2[1]), (arg3[1])); + let mut x3: u64 = 0; + fiat_p521_cmovznz_u64(&mut x3, arg1, (arg2[2]), (arg3[2])); + let mut x4: u64 = 0; + fiat_p521_cmovznz_u64(&mut x4, arg1, (arg2[3]), (arg3[3])); + let mut x5: u64 = 0; + fiat_p521_cmovznz_u64(&mut x5, arg1, (arg2[4]), (arg3[4])); + let mut x6: u64 = 0; + fiat_p521_cmovznz_u64(&mut x6, arg1, (arg2[5]), (arg3[5])); + let mut x7: u64 = 0; + fiat_p521_cmovznz_u64(&mut x7, arg1, (arg2[6]), (arg3[6])); + let mut x8: u64 = 0; + fiat_p521_cmovznz_u64(&mut x8, arg1, (arg2[7]), (arg3[7])); + let mut x9: u64 = 0; + fiat_p521_cmovznz_u64(&mut x9, arg1, (arg2[8]), (arg3[8])); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; + out1[3] = x4; + out1[4] = x5; + out1[5] = x6; + out1[6] = x7; + out1[7] = x8; + out1[8] = x9; +} + +/// The function fiat_p521_to_bytes serializes a field element to bytes in little-endian order. +/// +/// Postconditions: +/// out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..65] +/// +/// Output Bounds: +/// out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0x1]] +#[inline] +pub fn fiat_p521_to_bytes(out1: &mut [u8; 66], arg1: &fiat_p521_tight_field_element) -> () { + let mut x1: u64 = 0; + let mut x2: fiat_p521_u1 = 0; + fiat_p521_subborrowx_u58(&mut x1, &mut x2, 0x0, (arg1[0]), 0x3ffffffffffffff); + let mut x3: u64 = 0; + let mut x4: fiat_p521_u1 = 0; + fiat_p521_subborrowx_u58(&mut x3, &mut x4, x2, (arg1[1]), 0x3ffffffffffffff); + let mut x5: u64 = 0; + let mut x6: fiat_p521_u1 = 0; + fiat_p521_subborrowx_u58(&mut x5, &mut x6, x4, (arg1[2]), 0x3ffffffffffffff); + let mut x7: u64 = 0; + let mut x8: fiat_p521_u1 = 0; + fiat_p521_subborrowx_u58(&mut x7, &mut x8, x6, (arg1[3]), 0x3ffffffffffffff); + let mut x9: u64 = 0; + let mut x10: fiat_p521_u1 = 0; + fiat_p521_subborrowx_u58(&mut x9, &mut x10, x8, (arg1[4]), 0x3ffffffffffffff); + let mut x11: u64 = 0; + let mut x12: fiat_p521_u1 = 0; + fiat_p521_subborrowx_u58(&mut x11, &mut x12, x10, (arg1[5]), 0x3ffffffffffffff); + let mut x13: u64 = 0; + let mut x14: fiat_p521_u1 = 0; + fiat_p521_subborrowx_u58(&mut x13, &mut x14, x12, (arg1[6]), 0x3ffffffffffffff); + let mut x15: u64 = 0; + let mut x16: fiat_p521_u1 = 0; + fiat_p521_subborrowx_u58(&mut x15, &mut x16, x14, (arg1[7]), 0x3ffffffffffffff); + let mut x17: u64 = 0; + let mut x18: fiat_p521_u1 = 0; + fiat_p521_subborrowx_u57(&mut x17, &mut x18, x16, (arg1[8]), 0x1ffffffffffffff); + let mut x19: u64 = 0; + fiat_p521_cmovznz_u64(&mut x19, x18, (0x0 as u64), 0xffffffffffffffff); + let mut x20: u64 = 0; + let mut x21: fiat_p521_u1 = 0; + fiat_p521_addcarryx_u58(&mut x20, &mut x21, 0x0, x1, (x19 & 0x3ffffffffffffff)); + let mut x22: u64 = 0; + let mut x23: fiat_p521_u1 = 0; + fiat_p521_addcarryx_u58(&mut x22, &mut x23, x21, x3, (x19 & 0x3ffffffffffffff)); + let mut x24: u64 = 0; + let mut x25: fiat_p521_u1 = 0; + fiat_p521_addcarryx_u58(&mut x24, &mut x25, x23, x5, (x19 & 0x3ffffffffffffff)); + let mut x26: u64 = 0; + let mut x27: fiat_p521_u1 = 0; + fiat_p521_addcarryx_u58(&mut x26, &mut x27, x25, x7, (x19 & 0x3ffffffffffffff)); + let mut x28: u64 = 0; + let mut x29: fiat_p521_u1 = 0; + fiat_p521_addcarryx_u58(&mut x28, &mut x29, x27, x9, (x19 & 0x3ffffffffffffff)); + let mut x30: u64 = 0; + let mut x31: fiat_p521_u1 = 0; + fiat_p521_addcarryx_u58(&mut x30, &mut x31, x29, x11, (x19 & 0x3ffffffffffffff)); + let mut x32: u64 = 0; + let mut x33: fiat_p521_u1 = 0; + fiat_p521_addcarryx_u58(&mut x32, &mut x33, x31, x13, (x19 & 0x3ffffffffffffff)); + let mut x34: u64 = 0; + let mut x35: fiat_p521_u1 = 0; + fiat_p521_addcarryx_u58(&mut x34, &mut x35, x33, x15, (x19 & 0x3ffffffffffffff)); + let mut x36: u64 = 0; + let mut x37: fiat_p521_u1 = 0; + fiat_p521_addcarryx_u57(&mut x36, &mut x37, x35, x17, (x19 & 0x1ffffffffffffff)); + let x38: u64 = (x34 << 6); + let x39: u64 = (x32 << 4); + let x40: u64 = (x30 << 2); + let x41: u64 = (x26 << 6); + let x42: u64 = (x24 << 4); + let x43: u64 = (x22 << 2); + let x44: u8 = ((x20 & (0xff as u64)) as u8); + let x45: u64 = (x20 >> 8); + let x46: u8 = ((x45 & (0xff as u64)) as u8); + let x47: u64 = (x45 >> 8); + let x48: u8 = ((x47 & (0xff as u64)) as u8); + let x49: u64 = (x47 >> 8); + let x50: u8 = ((x49 & (0xff as u64)) as u8); + let x51: u64 = (x49 >> 8); + let x52: u8 = ((x51 & (0xff as u64)) as u8); + let x53: u64 = (x51 >> 8); + let x54: u8 = ((x53 & (0xff as u64)) as u8); + let x55: u64 = (x53 >> 8); + let x56: u8 = ((x55 & (0xff as u64)) as u8); + let x57: u8 = ((x55 >> 8) as u8); + let x58: u64 = (x43 + (x57 as u64)); + let x59: u8 = ((x58 & (0xff as u64)) as u8); + let x60: u64 = (x58 >> 8); + let x61: u8 = ((x60 & (0xff as u64)) as u8); + let x62: u64 = (x60 >> 8); + let x63: u8 = ((x62 & (0xff as u64)) as u8); + let x64: u64 = (x62 >> 8); + let x65: u8 = ((x64 & (0xff as u64)) as u8); + let x66: u64 = (x64 >> 8); + let x67: u8 = ((x66 & (0xff as u64)) as u8); + let x68: u64 = (x66 >> 8); + let x69: u8 = ((x68 & (0xff as u64)) as u8); + let x70: u64 = (x68 >> 8); + let x71: u8 = ((x70 & (0xff as u64)) as u8); + let x72: u8 = ((x70 >> 8) as u8); + let x73: u64 = (x42 + (x72 as u64)); + let x74: u8 = ((x73 & (0xff as u64)) as u8); + let x75: u64 = (x73 >> 8); + let x76: u8 = ((x75 & (0xff as u64)) as u8); + let x77: u64 = (x75 >> 8); + let x78: u8 = ((x77 & (0xff as u64)) as u8); + let x79: u64 = (x77 >> 8); + let x80: u8 = ((x79 & (0xff as u64)) as u8); + let x81: u64 = (x79 >> 8); + let x82: u8 = ((x81 & (0xff as u64)) as u8); + let x83: u64 = (x81 >> 8); + let x84: u8 = ((x83 & (0xff as u64)) as u8); + let x85: u64 = (x83 >> 8); + let x86: u8 = ((x85 & (0xff as u64)) as u8); + let x87: u8 = ((x85 >> 8) as u8); + let x88: u64 = (x41 + (x87 as u64)); + let x89: u8 = ((x88 & (0xff as u64)) as u8); + let x90: u64 = (x88 >> 8); + let x91: u8 = ((x90 & (0xff as u64)) as u8); + let x92: u64 = (x90 >> 8); + let x93: u8 = ((x92 & (0xff as u64)) as u8); + let x94: u64 = (x92 >> 8); + let x95: u8 = ((x94 & (0xff as u64)) as u8); + let x96: u64 = (x94 >> 8); + let x97: u8 = ((x96 & (0xff as u64)) as u8); + let x98: u64 = (x96 >> 8); + let x99: u8 = ((x98 & (0xff as u64)) as u8); + let x100: u64 = (x98 >> 8); + let x101: u8 = ((x100 & (0xff as u64)) as u8); + let x102: u8 = ((x100 >> 8) as u8); + let x103: u8 = ((x28 & (0xff as u64)) as u8); + let x104: u64 = (x28 >> 8); + let x105: u8 = ((x104 & (0xff as u64)) as u8); + let x106: u64 = (x104 >> 8); + let x107: u8 = ((x106 & (0xff as u64)) as u8); + let x108: u64 = (x106 >> 8); + let x109: u8 = ((x108 & (0xff as u64)) as u8); + let x110: u64 = (x108 >> 8); + let x111: u8 = ((x110 & (0xff as u64)) as u8); + let x112: u64 = (x110 >> 8); + let x113: u8 = ((x112 & (0xff as u64)) as u8); + let x114: u64 = (x112 >> 8); + let x115: u8 = ((x114 & (0xff as u64)) as u8); + let x116: u8 = ((x114 >> 8) as u8); + let x117: u64 = (x40 + (x116 as u64)); + let x118: u8 = ((x117 & (0xff as u64)) as u8); + let x119: u64 = (x117 >> 8); + let x120: u8 = ((x119 & (0xff as u64)) as u8); + let x121: u64 = (x119 >> 8); + let x122: u8 = ((x121 & (0xff as u64)) as u8); + let x123: u64 = (x121 >> 8); + let x124: u8 = ((x123 & (0xff as u64)) as u8); + let x125: u64 = (x123 >> 8); + let x126: u8 = ((x125 & (0xff as u64)) as u8); + let x127: u64 = (x125 >> 8); + let x128: u8 = ((x127 & (0xff as u64)) as u8); + let x129: u64 = (x127 >> 8); + let x130: u8 = ((x129 & (0xff as u64)) as u8); + let x131: u8 = ((x129 >> 8) as u8); + let x132: u64 = (x39 + (x131 as u64)); + let x133: u8 = ((x132 & (0xff as u64)) as u8); + let x134: u64 = (x132 >> 8); + let x135: u8 = ((x134 & (0xff as u64)) as u8); + let x136: u64 = (x134 >> 8); + let x137: u8 = ((x136 & (0xff as u64)) as u8); + let x138: u64 = (x136 >> 8); + let x139: u8 = ((x138 & (0xff as u64)) as u8); + let x140: u64 = (x138 >> 8); + let x141: u8 = ((x140 & (0xff as u64)) as u8); + let x142: u64 = (x140 >> 8); + let x143: u8 = ((x142 & (0xff as u64)) as u8); + let x144: u64 = (x142 >> 8); + let x145: u8 = ((x144 & (0xff as u64)) as u8); + let x146: u8 = ((x144 >> 8) as u8); + let x147: u64 = (x38 + (x146 as u64)); + let x148: u8 = ((x147 & (0xff as u64)) as u8); + let x149: u64 = (x147 >> 8); + let x150: u8 = ((x149 & (0xff as u64)) as u8); + let x151: u64 = (x149 >> 8); + let x152: u8 = ((x151 & (0xff as u64)) as u8); + let x153: u64 = (x151 >> 8); + let x154: u8 = ((x153 & (0xff as u64)) as u8); + let x155: u64 = (x153 >> 8); + let x156: u8 = ((x155 & (0xff as u64)) as u8); + let x157: u64 = (x155 >> 8); + let x158: u8 = ((x157 & (0xff as u64)) as u8); + let x159: u64 = (x157 >> 8); + let x160: u8 = ((x159 & (0xff as u64)) as u8); + let x161: u8 = ((x159 >> 8) as u8); + let x162: u8 = ((x36 & (0xff as u64)) as u8); + let x163: u64 = (x36 >> 8); + let x164: u8 = ((x163 & (0xff as u64)) as u8); + let x165: u64 = (x163 >> 8); + let x166: u8 = ((x165 & (0xff as u64)) as u8); + let x167: u64 = (x165 >> 8); + let x168: u8 = ((x167 & (0xff as u64)) as u8); + let x169: u64 = (x167 >> 8); + let x170: u8 = ((x169 & (0xff as u64)) as u8); + let x171: u64 = (x169 >> 8); + let x172: u8 = ((x171 & (0xff as u64)) as u8); + let x173: u64 = (x171 >> 8); + let x174: u8 = ((x173 & (0xff as u64)) as u8); + let x175: fiat_p521_u1 = ((x173 >> 8) as fiat_p521_u1); + out1[0] = x44; + out1[1] = x46; + out1[2] = x48; + out1[3] = x50; + out1[4] = x52; + out1[5] = x54; + out1[6] = x56; + out1[7] = x59; + out1[8] = x61; + out1[9] = x63; + out1[10] = x65; + out1[11] = x67; + out1[12] = x69; + out1[13] = x71; + out1[14] = x74; + out1[15] = x76; + out1[16] = x78; + out1[17] = x80; + out1[18] = x82; + out1[19] = x84; + out1[20] = x86; + out1[21] = x89; + out1[22] = x91; + out1[23] = x93; + out1[24] = x95; + out1[25] = x97; + out1[26] = x99; + out1[27] = x101; + out1[28] = x102; + out1[29] = x103; + out1[30] = x105; + out1[31] = x107; + out1[32] = x109; + out1[33] = x111; + out1[34] = x113; + out1[35] = x115; + out1[36] = x118; + out1[37] = x120; + out1[38] = x122; + out1[39] = x124; + out1[40] = x126; + out1[41] = x128; + out1[42] = x130; + out1[43] = x133; + out1[44] = x135; + out1[45] = x137; + out1[46] = x139; + out1[47] = x141; + out1[48] = x143; + out1[49] = x145; + out1[50] = x148; + out1[51] = x150; + out1[52] = x152; + out1[53] = x154; + out1[54] = x156; + out1[55] = x158; + out1[56] = x160; + out1[57] = x161; + out1[58] = x162; + out1[59] = x164; + out1[60] = x166; + out1[61] = x168; + out1[62] = x170; + out1[63] = x172; + out1[64] = x174; + out1[65] = (x175 as u8); +} + +/// The function fiat_p521_from_bytes deserializes a field element from bytes in little-endian order. +/// +/// Postconditions: +/// eval out1 mod m = bytes_eval arg1 mod m +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0x1]] +#[inline] +pub fn fiat_p521_from_bytes(out1: &mut fiat_p521_tight_field_element, arg1: &[u8; 66]) -> () { + let x1: u64 = ((((arg1[65]) as fiat_p521_u1) as u64) << 56); + let x2: u64 = (((arg1[64]) as u64) << 48); + let x3: u64 = (((arg1[63]) as u64) << 40); + let x4: u64 = (((arg1[62]) as u64) << 32); + let x5: u64 = (((arg1[61]) as u64) << 24); + let x6: u64 = (((arg1[60]) as u64) << 16); + let x7: u64 = (((arg1[59]) as u64) << 8); + let x8: u8 = (arg1[58]); + let x9: u64 = (((arg1[57]) as u64) << 50); + let x10: u64 = (((arg1[56]) as u64) << 42); + let x11: u64 = (((arg1[55]) as u64) << 34); + let x12: u64 = (((arg1[54]) as u64) << 26); + let x13: u64 = (((arg1[53]) as u64) << 18); + let x14: u64 = (((arg1[52]) as u64) << 10); + let x15: u64 = (((arg1[51]) as u64) << 2); + let x16: u64 = (((arg1[50]) as u64) << 52); + let x17: u64 = (((arg1[49]) as u64) << 44); + let x18: u64 = (((arg1[48]) as u64) << 36); + let x19: u64 = (((arg1[47]) as u64) << 28); + let x20: u64 = (((arg1[46]) as u64) << 20); + let x21: u64 = (((arg1[45]) as u64) << 12); + let x22: u64 = (((arg1[44]) as u64) << 4); + let x23: u64 = (((arg1[43]) as u64) << 54); + let x24: u64 = (((arg1[42]) as u64) << 46); + let x25: u64 = (((arg1[41]) as u64) << 38); + let x26: u64 = (((arg1[40]) as u64) << 30); + let x27: u64 = (((arg1[39]) as u64) << 22); + let x28: u64 = (((arg1[38]) as u64) << 14); + let x29: u64 = (((arg1[37]) as u64) << 6); + let x30: u64 = (((arg1[36]) as u64) << 56); + let x31: u64 = (((arg1[35]) as u64) << 48); + let x32: u64 = (((arg1[34]) as u64) << 40); + let x33: u64 = (((arg1[33]) as u64) << 32); + let x34: u64 = (((arg1[32]) as u64) << 24); + let x35: u64 = (((arg1[31]) as u64) << 16); + let x36: u64 = (((arg1[30]) as u64) << 8); + let x37: u8 = (arg1[29]); + let x38: u64 = (((arg1[28]) as u64) << 50); + let x39: u64 = (((arg1[27]) as u64) << 42); + let x40: u64 = (((arg1[26]) as u64) << 34); + let x41: u64 = (((arg1[25]) as u64) << 26); + let x42: u64 = (((arg1[24]) as u64) << 18); + let x43: u64 = (((arg1[23]) as u64) << 10); + let x44: u64 = (((arg1[22]) as u64) << 2); + let x45: u64 = (((arg1[21]) as u64) << 52); + let x46: u64 = (((arg1[20]) as u64) << 44); + let x47: u64 = (((arg1[19]) as u64) << 36); + let x48: u64 = (((arg1[18]) as u64) << 28); + let x49: u64 = (((arg1[17]) as u64) << 20); + let x50: u64 = (((arg1[16]) as u64) << 12); + let x51: u64 = (((arg1[15]) as u64) << 4); + let x52: u64 = (((arg1[14]) as u64) << 54); + let x53: u64 = (((arg1[13]) as u64) << 46); + let x54: u64 = (((arg1[12]) as u64) << 38); + let x55: u64 = (((arg1[11]) as u64) << 30); + let x56: u64 = (((arg1[10]) as u64) << 22); + let x57: u64 = (((arg1[9]) as u64) << 14); + let x58: u64 = (((arg1[8]) as u64) << 6); + let x59: u64 = (((arg1[7]) as u64) << 56); + let x60: u64 = (((arg1[6]) as u64) << 48); + let x61: u64 = (((arg1[5]) as u64) << 40); + let x62: u64 = (((arg1[4]) as u64) << 32); + let x63: u64 = (((arg1[3]) as u64) << 24); + let x64: u64 = (((arg1[2]) as u64) << 16); + let x65: u64 = (((arg1[1]) as u64) << 8); + let x66: u8 = (arg1[0]); + let x67: u64 = (x65 + (x66 as u64)); + let x68: u64 = (x64 + x67); + let x69: u64 = (x63 + x68); + let x70: u64 = (x62 + x69); + let x71: u64 = (x61 + x70); + let x72: u64 = (x60 + x71); + let x73: u64 = (x59 + x72); + let x74: u64 = (x73 & 0x3ffffffffffffff); + let x75: u8 = ((x73 >> 58) as u8); + let x76: u64 = (x58 + (x75 as u64)); + let x77: u64 = (x57 + x76); + let x78: u64 = (x56 + x77); + let x79: u64 = (x55 + x78); + let x80: u64 = (x54 + x79); + let x81: u64 = (x53 + x80); + let x82: u64 = (x52 + x81); + let x83: u64 = (x82 & 0x3ffffffffffffff); + let x84: u8 = ((x82 >> 58) as u8); + let x85: u64 = (x51 + (x84 as u64)); + let x86: u64 = (x50 + x85); + let x87: u64 = (x49 + x86); + let x88: u64 = (x48 + x87); + let x89: u64 = (x47 + x88); + let x90: u64 = (x46 + x89); + let x91: u64 = (x45 + x90); + let x92: u64 = (x91 & 0x3ffffffffffffff); + let x93: u8 = ((x91 >> 58) as u8); + let x94: u64 = (x44 + (x93 as u64)); + let x95: u64 = (x43 + x94); + let x96: u64 = (x42 + x95); + let x97: u64 = (x41 + x96); + let x98: u64 = (x40 + x97); + let x99: u64 = (x39 + x98); + let x100: u64 = (x38 + x99); + let x101: u64 = (x36 + (x37 as u64)); + let x102: u64 = (x35 + x101); + let x103: u64 = (x34 + x102); + let x104: u64 = (x33 + x103); + let x105: u64 = (x32 + x104); + let x106: u64 = (x31 + x105); + let x107: u64 = (x30 + x106); + let x108: u64 = (x107 & 0x3ffffffffffffff); + let x109: u8 = ((x107 >> 58) as u8); + let x110: u64 = (x29 + (x109 as u64)); + let x111: u64 = (x28 + x110); + let x112: u64 = (x27 + x111); + let x113: u64 = (x26 + x112); + let x114: u64 = (x25 + x113); + let x115: u64 = (x24 + x114); + let x116: u64 = (x23 + x115); + let x117: u64 = (x116 & 0x3ffffffffffffff); + let x118: u8 = ((x116 >> 58) as u8); + let x119: u64 = (x22 + (x118 as u64)); + let x120: u64 = (x21 + x119); + let x121: u64 = (x20 + x120); + let x122: u64 = (x19 + x121); + let x123: u64 = (x18 + x122); + let x124: u64 = (x17 + x123); + let x125: u64 = (x16 + x124); + let x126: u64 = (x125 & 0x3ffffffffffffff); + let x127: u8 = ((x125 >> 58) as u8); + let x128: u64 = (x15 + (x127 as u64)); + let x129: u64 = (x14 + x128); + let x130: u64 = (x13 + x129); + let x131: u64 = (x12 + x130); + let x132: u64 = (x11 + x131); + let x133: u64 = (x10 + x132); + let x134: u64 = (x9 + x133); + let x135: u64 = (x7 + (x8 as u64)); + let x136: u64 = (x6 + x135); + let x137: u64 = (x5 + x136); + let x138: u64 = (x4 + x137); + let x139: u64 = (x3 + x138); + let x140: u64 = (x2 + x139); + let x141: u64 = (x1 + x140); + out1[0] = x74; + out1[1] = x83; + out1[2] = x92; + out1[3] = x100; + out1[4] = x108; + out1[5] = x117; + out1[6] = x126; + out1[7] = x134; + out1[8] = x141; +} + +/// The function fiat_p521_relax is the identity function converting from tight field elements to loose field elements. +/// +/// Postconditions: +/// out1 = arg1 +/// +#[inline] +pub fn fiat_p521_relax(out1: &mut fiat_p521_loose_field_element, arg1: &fiat_p521_tight_field_element) -> () { + let x1: u64 = (arg1[0]); + let x2: u64 = (arg1[1]); + let x3: u64 = (arg1[2]); + let x4: u64 = (arg1[3]); + let x5: u64 = (arg1[4]); + let x6: u64 = (arg1[5]); + let x7: u64 = (arg1[6]); + let x8: u64 = (arg1[7]); + let x9: u64 = (arg1[8]); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; + out1[3] = x4; + out1[4] = x5; + out1[5] = x6; + out1[6] = x7; + out1[7] = x8; + out1[8] = x9; +} diff --git a/vendor/fiat-crypto/src/poly1305_32.rs b/vendor/fiat-crypto/src/poly1305_32.rs new file mode 100644 index 000000000..19a167a4e --- /dev/null +++ b/vendor/fiat-crypto/src/poly1305_32.rs @@ -0,0 +1,505 @@ +//! Autogenerated: 'src/ExtractionOCaml/unsaturated_solinas' --lang Rust --inline poly1305 32 '(auto)' '2^130 - 5' carry_mul carry_square carry add sub opp selectznz to_bytes from_bytes relax +//! curve description: poly1305 +//! machine_wordsize = 32 (from "32") +//! requested operations: carry_mul, carry_square, carry, add, sub, opp, selectznz, to_bytes, from_bytes, relax +//! n = 5 (from "(auto)") +//! s-c = 2^130 - [(1, 5)] (from "2^130 - 5") +//! tight_bounds_multiplier = 1 (from "") +//! +//! Computed values: +//! carry_chain = [0, 1, 2, 3, 4, 0, 1] +//! eval z = z[0] + (z[1] << 26) + (z[2] << 52) + (z[3] << 78) + (z[4] << 104) +//! bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) +//! balance = [0x7fffff6, 0x7fffffe, 0x7fffffe, 0x7fffffe, 0x7fffffe] + +#![allow(unused_parens)] +#![allow(non_camel_case_types)] + +pub type fiat_poly1305_u1 = u8; +pub type fiat_poly1305_i1 = i8; +pub type fiat_poly1305_u2 = u8; +pub type fiat_poly1305_i2 = i8; + +/* The type fiat_poly1305_loose_field_element is a field element with loose bounds. */ +/* Bounds: [[0x0 ~> 0xc000000], [0x0 ~> 0xc000000], [0x0 ~> 0xc000000], [0x0 ~> 0xc000000], [0x0 ~> 0xc000000]] */ +pub type fiat_poly1305_loose_field_element = [u32; 5]; + +/* The type fiat_poly1305_tight_field_element is a field element with tight bounds. */ +/* Bounds: [[0x0 ~> 0x4000000], [0x0 ~> 0x4000000], [0x0 ~> 0x4000000], [0x0 ~> 0x4000000], [0x0 ~> 0x4000000]] */ +pub type fiat_poly1305_tight_field_element = [u32; 5]; + + +/// The function fiat_poly1305_addcarryx_u26 is an addition with carry. +/// +/// Postconditions: +/// out1 = (arg1 + arg2 + arg3) mod 2^26 +/// out2 = ⌊(arg1 + arg2 + arg3) / 2^26⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0x3ffffff] +/// arg3: [0x0 ~> 0x3ffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0x3ffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_poly1305_addcarryx_u26(out1: &mut u32, out2: &mut fiat_poly1305_u1, arg1: fiat_poly1305_u1, arg2: u32, arg3: u32) -> () { + let x1: u32 = (((arg1 as u32) + arg2) + arg3); + let x2: u32 = (x1 & 0x3ffffff); + let x3: fiat_poly1305_u1 = ((x1 >> 26) as fiat_poly1305_u1); + *out1 = x2; + *out2 = x3; +} + +/// The function fiat_poly1305_subborrowx_u26 is a subtraction with borrow. +/// +/// Postconditions: +/// out1 = (-arg1 + arg2 + -arg3) mod 2^26 +/// out2 = -⌊(-arg1 + arg2 + -arg3) / 2^26⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0x3ffffff] +/// arg3: [0x0 ~> 0x3ffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0x3ffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_poly1305_subborrowx_u26(out1: &mut u32, out2: &mut fiat_poly1305_u1, arg1: fiat_poly1305_u1, arg2: u32, arg3: u32) -> () { + let x1: i32 = ((((((arg2 as i64) - (arg1 as i64)) as i32) as i64) - (arg3 as i64)) as i32); + let x2: fiat_poly1305_i1 = ((x1 >> 26) as fiat_poly1305_i1); + let x3: u32 = (((x1 as i64) & (0x3ffffff as i64)) as u32); + *out1 = x3; + *out2 = (((0x0 as fiat_poly1305_i2) - (x2 as fiat_poly1305_i2)) as fiat_poly1305_u1); +} + +/// The function fiat_poly1305_cmovznz_u32 is a single-word conditional move. +/// +/// Postconditions: +/// out1 = (if arg1 = 0 then arg2 else arg3) +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffff] +/// arg3: [0x0 ~> 0xffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +#[inline] +pub fn fiat_poly1305_cmovznz_u32(out1: &mut u32, arg1: fiat_poly1305_u1, arg2: u32, arg3: u32) -> () { + let x1: fiat_poly1305_u1 = (!(!arg1)); + let x2: u32 = ((((((0x0 as fiat_poly1305_i2) - (x1 as fiat_poly1305_i2)) as fiat_poly1305_i1) as i64) & (0xffffffff as i64)) as u32); + let x3: u32 = ((x2 & arg3) | ((!x2) & arg2)); + *out1 = x3; +} + +/// The function fiat_poly1305_carry_mul multiplies two field elements and reduces the result. +/// +/// Postconditions: +/// eval out1 mod m = (eval arg1 * eval arg2) mod m +/// +#[inline] +pub fn fiat_poly1305_carry_mul(out1: &mut fiat_poly1305_tight_field_element, arg1: &fiat_poly1305_loose_field_element, arg2: &fiat_poly1305_loose_field_element) -> () { + let x1: u64 = (((arg1[4]) as u64) * (((arg2[4]) * 0x5) as u64)); + let x2: u64 = (((arg1[4]) as u64) * (((arg2[3]) * 0x5) as u64)); + let x3: u64 = (((arg1[4]) as u64) * (((arg2[2]) * 0x5) as u64)); + let x4: u64 = (((arg1[4]) as u64) * (((arg2[1]) * 0x5) as u64)); + let x5: u64 = (((arg1[3]) as u64) * (((arg2[4]) * 0x5) as u64)); + let x6: u64 = (((arg1[3]) as u64) * (((arg2[3]) * 0x5) as u64)); + let x7: u64 = (((arg1[3]) as u64) * (((arg2[2]) * 0x5) as u64)); + let x8: u64 = (((arg1[2]) as u64) * (((arg2[4]) * 0x5) as u64)); + let x9: u64 = (((arg1[2]) as u64) * (((arg2[3]) * 0x5) as u64)); + let x10: u64 = (((arg1[1]) as u64) * (((arg2[4]) * 0x5) as u64)); + let x11: u64 = (((arg1[4]) as u64) * ((arg2[0]) as u64)); + let x12: u64 = (((arg1[3]) as u64) * ((arg2[1]) as u64)); + let x13: u64 = (((arg1[3]) as u64) * ((arg2[0]) as u64)); + let x14: u64 = (((arg1[2]) as u64) * ((arg2[2]) as u64)); + let x15: u64 = (((arg1[2]) as u64) * ((arg2[1]) as u64)); + let x16: u64 = (((arg1[2]) as u64) * ((arg2[0]) as u64)); + let x17: u64 = (((arg1[1]) as u64) * ((arg2[3]) as u64)); + let x18: u64 = (((arg1[1]) as u64) * ((arg2[2]) as u64)); + let x19: u64 = (((arg1[1]) as u64) * ((arg2[1]) as u64)); + let x20: u64 = (((arg1[1]) as u64) * ((arg2[0]) as u64)); + let x21: u64 = (((arg1[0]) as u64) * ((arg2[4]) as u64)); + let x22: u64 = (((arg1[0]) as u64) * ((arg2[3]) as u64)); + let x23: u64 = (((arg1[0]) as u64) * ((arg2[2]) as u64)); + let x24: u64 = (((arg1[0]) as u64) * ((arg2[1]) as u64)); + let x25: u64 = (((arg1[0]) as u64) * ((arg2[0]) as u64)); + let x26: u64 = (x25 + (x10 + (x9 + (x7 + x4)))); + let x27: u64 = (x26 >> 26); + let x28: u32 = ((x26 & (0x3ffffff as u64)) as u32); + let x29: u64 = (x21 + (x17 + (x14 + (x12 + x11)))); + let x30: u64 = (x22 + (x18 + (x15 + (x13 + x1)))); + let x31: u64 = (x23 + (x19 + (x16 + (x5 + x2)))); + let x32: u64 = (x24 + (x20 + (x8 + (x6 + x3)))); + let x33: u64 = (x27 + x32); + let x34: u64 = (x33 >> 26); + let x35: u32 = ((x33 & (0x3ffffff as u64)) as u32); + let x36: u64 = (x34 + x31); + let x37: u64 = (x36 >> 26); + let x38: u32 = ((x36 & (0x3ffffff as u64)) as u32); + let x39: u64 = (x37 + x30); + let x40: u64 = (x39 >> 26); + let x41: u32 = ((x39 & (0x3ffffff as u64)) as u32); + let x42: u64 = (x40 + x29); + let x43: u32 = ((x42 >> 26) as u32); + let x44: u32 = ((x42 & (0x3ffffff as u64)) as u32); + let x45: u64 = ((x43 as u64) * (0x5 as u64)); + let x46: u64 = ((x28 as u64) + x45); + let x47: u32 = ((x46 >> 26) as u32); + let x48: u32 = ((x46 & (0x3ffffff as u64)) as u32); + let x49: u32 = (x47 + x35); + let x50: fiat_poly1305_u1 = ((x49 >> 26) as fiat_poly1305_u1); + let x51: u32 = (x49 & 0x3ffffff); + let x52: u32 = ((x50 as u32) + x38); + out1[0] = x48; + out1[1] = x51; + out1[2] = x52; + out1[3] = x41; + out1[4] = x44; +} + +/// The function fiat_poly1305_carry_square squares a field element and reduces the result. +/// +/// Postconditions: +/// eval out1 mod m = (eval arg1 * eval arg1) mod m +/// +#[inline] +pub fn fiat_poly1305_carry_square(out1: &mut fiat_poly1305_tight_field_element, arg1: &fiat_poly1305_loose_field_element) -> () { + let x1: u32 = ((arg1[4]) * 0x5); + let x2: u32 = (x1 * 0x2); + let x3: u32 = ((arg1[4]) * 0x2); + let x4: u32 = ((arg1[3]) * 0x5); + let x5: u32 = (x4 * 0x2); + let x6: u32 = ((arg1[3]) * 0x2); + let x7: u32 = ((arg1[2]) * 0x2); + let x8: u32 = ((arg1[1]) * 0x2); + let x9: u64 = (((arg1[4]) as u64) * (x1 as u64)); + let x10: u64 = (((arg1[3]) as u64) * (x2 as u64)); + let x11: u64 = (((arg1[3]) as u64) * (x4 as u64)); + let x12: u64 = (((arg1[2]) as u64) * (x2 as u64)); + let x13: u64 = (((arg1[2]) as u64) * (x5 as u64)); + let x14: u64 = (((arg1[2]) as u64) * ((arg1[2]) as u64)); + let x15: u64 = (((arg1[1]) as u64) * (x2 as u64)); + let x16: u64 = (((arg1[1]) as u64) * (x6 as u64)); + let x17: u64 = (((arg1[1]) as u64) * (x7 as u64)); + let x18: u64 = (((arg1[1]) as u64) * ((arg1[1]) as u64)); + let x19: u64 = (((arg1[0]) as u64) * (x3 as u64)); + let x20: u64 = (((arg1[0]) as u64) * (x6 as u64)); + let x21: u64 = (((arg1[0]) as u64) * (x7 as u64)); + let x22: u64 = (((arg1[0]) as u64) * (x8 as u64)); + let x23: u64 = (((arg1[0]) as u64) * ((arg1[0]) as u64)); + let x24: u64 = (x23 + (x15 + x13)); + let x25: u64 = (x24 >> 26); + let x26: u32 = ((x24 & (0x3ffffff as u64)) as u32); + let x27: u64 = (x19 + (x16 + x14)); + let x28: u64 = (x20 + (x17 + x9)); + let x29: u64 = (x21 + (x18 + x10)); + let x30: u64 = (x22 + (x12 + x11)); + let x31: u64 = (x25 + x30); + let x32: u64 = (x31 >> 26); + let x33: u32 = ((x31 & (0x3ffffff as u64)) as u32); + let x34: u64 = (x32 + x29); + let x35: u64 = (x34 >> 26); + let x36: u32 = ((x34 & (0x3ffffff as u64)) as u32); + let x37: u64 = (x35 + x28); + let x38: u64 = (x37 >> 26); + let x39: u32 = ((x37 & (0x3ffffff as u64)) as u32); + let x40: u64 = (x38 + x27); + let x41: u32 = ((x40 >> 26) as u32); + let x42: u32 = ((x40 & (0x3ffffff as u64)) as u32); + let x43: u64 = ((x41 as u64) * (0x5 as u64)); + let x44: u64 = ((x26 as u64) + x43); + let x45: u32 = ((x44 >> 26) as u32); + let x46: u32 = ((x44 & (0x3ffffff as u64)) as u32); + let x47: u32 = (x45 + x33); + let x48: fiat_poly1305_u1 = ((x47 >> 26) as fiat_poly1305_u1); + let x49: u32 = (x47 & 0x3ffffff); + let x50: u32 = ((x48 as u32) + x36); + out1[0] = x46; + out1[1] = x49; + out1[2] = x50; + out1[3] = x39; + out1[4] = x42; +} + +/// The function fiat_poly1305_carry reduces a field element. +/// +/// Postconditions: +/// eval out1 mod m = eval arg1 mod m +/// +#[inline] +pub fn fiat_poly1305_carry(out1: &mut fiat_poly1305_tight_field_element, arg1: &fiat_poly1305_loose_field_element) -> () { + let x1: u32 = (arg1[0]); + let x2: u32 = ((x1 >> 26) + (arg1[1])); + let x3: u32 = ((x2 >> 26) + (arg1[2])); + let x4: u32 = ((x3 >> 26) + (arg1[3])); + let x5: u32 = ((x4 >> 26) + (arg1[4])); + let x6: u32 = ((x1 & 0x3ffffff) + ((x5 >> 26) * 0x5)); + let x7: u32 = ((((x6 >> 26) as fiat_poly1305_u1) as u32) + (x2 & 0x3ffffff)); + let x8: u32 = (x6 & 0x3ffffff); + let x9: u32 = (x7 & 0x3ffffff); + let x10: u32 = ((((x7 >> 26) as fiat_poly1305_u1) as u32) + (x3 & 0x3ffffff)); + let x11: u32 = (x4 & 0x3ffffff); + let x12: u32 = (x5 & 0x3ffffff); + out1[0] = x8; + out1[1] = x9; + out1[2] = x10; + out1[3] = x11; + out1[4] = x12; +} + +/// The function fiat_poly1305_add adds two field elements. +/// +/// Postconditions: +/// eval out1 mod m = (eval arg1 + eval arg2) mod m +/// +#[inline] +pub fn fiat_poly1305_add(out1: &mut fiat_poly1305_loose_field_element, arg1: &fiat_poly1305_tight_field_element, arg2: &fiat_poly1305_tight_field_element) -> () { + let x1: u32 = ((arg1[0]) + (arg2[0])); + let x2: u32 = ((arg1[1]) + (arg2[1])); + let x3: u32 = ((arg1[2]) + (arg2[2])); + let x4: u32 = ((arg1[3]) + (arg2[3])); + let x5: u32 = ((arg1[4]) + (arg2[4])); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; + out1[3] = x4; + out1[4] = x5; +} + +/// The function fiat_poly1305_sub subtracts two field elements. +/// +/// Postconditions: +/// eval out1 mod m = (eval arg1 - eval arg2) mod m +/// +#[inline] +pub fn fiat_poly1305_sub(out1: &mut fiat_poly1305_loose_field_element, arg1: &fiat_poly1305_tight_field_element, arg2: &fiat_poly1305_tight_field_element) -> () { + let x1: u32 = ((0x7fffff6 + (arg1[0])) - (arg2[0])); + let x2: u32 = ((0x7fffffe + (arg1[1])) - (arg2[1])); + let x3: u32 = ((0x7fffffe + (arg1[2])) - (arg2[2])); + let x4: u32 = ((0x7fffffe + (arg1[3])) - (arg2[3])); + let x5: u32 = ((0x7fffffe + (arg1[4])) - (arg2[4])); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; + out1[3] = x4; + out1[4] = x5; +} + +/// The function fiat_poly1305_opp negates a field element. +/// +/// Postconditions: +/// eval out1 mod m = -eval arg1 mod m +/// +#[inline] +pub fn fiat_poly1305_opp(out1: &mut fiat_poly1305_loose_field_element, arg1: &fiat_poly1305_tight_field_element) -> () { + let x1: u32 = (0x7fffff6 - (arg1[0])); + let x2: u32 = (0x7fffffe - (arg1[1])); + let x3: u32 = (0x7fffffe - (arg1[2])); + let x4: u32 = (0x7fffffe - (arg1[3])); + let x5: u32 = (0x7fffffe - (arg1[4])); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; + out1[3] = x4; + out1[4] = x5; +} + +/// The function fiat_poly1305_selectznz is a multi-limb conditional select. +/// +/// Postconditions: +/// out1 = (if arg1 = 0 then arg2 else arg3) +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// arg3: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +#[inline] +pub fn fiat_poly1305_selectznz(out1: &mut [u32; 5], arg1: fiat_poly1305_u1, arg2: &[u32; 5], arg3: &[u32; 5]) -> () { + let mut x1: u32 = 0; + fiat_poly1305_cmovznz_u32(&mut x1, arg1, (arg2[0]), (arg3[0])); + let mut x2: u32 = 0; + fiat_poly1305_cmovznz_u32(&mut x2, arg1, (arg2[1]), (arg3[1])); + let mut x3: u32 = 0; + fiat_poly1305_cmovznz_u32(&mut x3, arg1, (arg2[2]), (arg3[2])); + let mut x4: u32 = 0; + fiat_poly1305_cmovznz_u32(&mut x4, arg1, (arg2[3]), (arg3[3])); + let mut x5: u32 = 0; + fiat_poly1305_cmovznz_u32(&mut x5, arg1, (arg2[4]), (arg3[4])); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; + out1[3] = x4; + out1[4] = x5; +} + +/// The function fiat_poly1305_to_bytes serializes a field element to bytes in little-endian order. +/// +/// Postconditions: +/// out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..16] +/// +/// Output Bounds: +/// out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0x3]] +#[inline] +pub fn fiat_poly1305_to_bytes(out1: &mut [u8; 17], arg1: &fiat_poly1305_tight_field_element) -> () { + let mut x1: u32 = 0; + let mut x2: fiat_poly1305_u1 = 0; + fiat_poly1305_subborrowx_u26(&mut x1, &mut x2, 0x0, (arg1[0]), 0x3fffffb); + let mut x3: u32 = 0; + let mut x4: fiat_poly1305_u1 = 0; + fiat_poly1305_subborrowx_u26(&mut x3, &mut x4, x2, (arg1[1]), 0x3ffffff); + let mut x5: u32 = 0; + let mut x6: fiat_poly1305_u1 = 0; + fiat_poly1305_subborrowx_u26(&mut x5, &mut x6, x4, (arg1[2]), 0x3ffffff); + let mut x7: u32 = 0; + let mut x8: fiat_poly1305_u1 = 0; + fiat_poly1305_subborrowx_u26(&mut x7, &mut x8, x6, (arg1[3]), 0x3ffffff); + let mut x9: u32 = 0; + let mut x10: fiat_poly1305_u1 = 0; + fiat_poly1305_subborrowx_u26(&mut x9, &mut x10, x8, (arg1[4]), 0x3ffffff); + let mut x11: u32 = 0; + fiat_poly1305_cmovznz_u32(&mut x11, x10, (0x0 as u32), 0xffffffff); + let mut x12: u32 = 0; + let mut x13: fiat_poly1305_u1 = 0; + fiat_poly1305_addcarryx_u26(&mut x12, &mut x13, 0x0, x1, (x11 & 0x3fffffb)); + let mut x14: u32 = 0; + let mut x15: fiat_poly1305_u1 = 0; + fiat_poly1305_addcarryx_u26(&mut x14, &mut x15, x13, x3, (x11 & 0x3ffffff)); + let mut x16: u32 = 0; + let mut x17: fiat_poly1305_u1 = 0; + fiat_poly1305_addcarryx_u26(&mut x16, &mut x17, x15, x5, (x11 & 0x3ffffff)); + let mut x18: u32 = 0; + let mut x19: fiat_poly1305_u1 = 0; + fiat_poly1305_addcarryx_u26(&mut x18, &mut x19, x17, x7, (x11 & 0x3ffffff)); + let mut x20: u32 = 0; + let mut x21: fiat_poly1305_u1 = 0; + fiat_poly1305_addcarryx_u26(&mut x20, &mut x21, x19, x9, (x11 & 0x3ffffff)); + let x22: u32 = (x18 << 6); + let x23: u32 = (x16 << 4); + let x24: u32 = (x14 << 2); + let x25: u8 = ((x12 & (0xff as u32)) as u8); + let x26: u32 = (x12 >> 8); + let x27: u8 = ((x26 & (0xff as u32)) as u8); + let x28: u32 = (x26 >> 8); + let x29: u8 = ((x28 & (0xff as u32)) as u8); + let x30: u8 = ((x28 >> 8) as u8); + let x31: u32 = (x24 + (x30 as u32)); + let x32: u8 = ((x31 & (0xff as u32)) as u8); + let x33: u32 = (x31 >> 8); + let x34: u8 = ((x33 & (0xff as u32)) as u8); + let x35: u32 = (x33 >> 8); + let x36: u8 = ((x35 & (0xff as u32)) as u8); + let x37: u8 = ((x35 >> 8) as u8); + let x38: u32 = (x23 + (x37 as u32)); + let x39: u8 = ((x38 & (0xff as u32)) as u8); + let x40: u32 = (x38 >> 8); + let x41: u8 = ((x40 & (0xff as u32)) as u8); + let x42: u32 = (x40 >> 8); + let x43: u8 = ((x42 & (0xff as u32)) as u8); + let x44: u8 = ((x42 >> 8) as u8); + let x45: u32 = (x22 + (x44 as u32)); + let x46: u8 = ((x45 & (0xff as u32)) as u8); + let x47: u32 = (x45 >> 8); + let x48: u8 = ((x47 & (0xff as u32)) as u8); + let x49: u32 = (x47 >> 8); + let x50: u8 = ((x49 & (0xff as u32)) as u8); + let x51: u8 = ((x49 >> 8) as u8); + let x52: u8 = ((x20 & (0xff as u32)) as u8); + let x53: u32 = (x20 >> 8); + let x54: u8 = ((x53 & (0xff as u32)) as u8); + let x55: u32 = (x53 >> 8); + let x56: u8 = ((x55 & (0xff as u32)) as u8); + let x57: u8 = ((x55 >> 8) as u8); + out1[0] = x25; + out1[1] = x27; + out1[2] = x29; + out1[3] = x32; + out1[4] = x34; + out1[5] = x36; + out1[6] = x39; + out1[7] = x41; + out1[8] = x43; + out1[9] = x46; + out1[10] = x48; + out1[11] = x50; + out1[12] = x51; + out1[13] = x52; + out1[14] = x54; + out1[15] = x56; + out1[16] = x57; +} + +/// The function fiat_poly1305_from_bytes deserializes a field element from bytes in little-endian order. +/// +/// Postconditions: +/// eval out1 mod m = bytes_eval arg1 mod m +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0x3]] +#[inline] +pub fn fiat_poly1305_from_bytes(out1: &mut fiat_poly1305_tight_field_element, arg1: &[u8; 17]) -> () { + let x1: u32 = (((arg1[16]) as u32) << 24); + let x2: u32 = (((arg1[15]) as u32) << 16); + let x3: u32 = (((arg1[14]) as u32) << 8); + let x4: u8 = (arg1[13]); + let x5: u32 = (((arg1[12]) as u32) << 18); + let x6: u32 = (((arg1[11]) as u32) << 10); + let x7: u32 = (((arg1[10]) as u32) << 2); + let x8: u32 = (((arg1[9]) as u32) << 20); + let x9: u32 = (((arg1[8]) as u32) << 12); + let x10: u32 = (((arg1[7]) as u32) << 4); + let x11: u32 = (((arg1[6]) as u32) << 22); + let x12: u32 = (((arg1[5]) as u32) << 14); + let x13: u32 = (((arg1[4]) as u32) << 6); + let x14: u32 = (((arg1[3]) as u32) << 24); + let x15: u32 = (((arg1[2]) as u32) << 16); + let x16: u32 = (((arg1[1]) as u32) << 8); + let x17: u8 = (arg1[0]); + let x18: u32 = (x16 + (x17 as u32)); + let x19: u32 = (x15 + x18); + let x20: u32 = (x14 + x19); + let x21: u32 = (x20 & 0x3ffffff); + let x22: u8 = ((x20 >> 26) as u8); + let x23: u32 = (x13 + (x22 as u32)); + let x24: u32 = (x12 + x23); + let x25: u32 = (x11 + x24); + let x26: u32 = (x25 & 0x3ffffff); + let x27: u8 = ((x25 >> 26) as u8); + let x28: u32 = (x10 + (x27 as u32)); + let x29: u32 = (x9 + x28); + let x30: u32 = (x8 + x29); + let x31: u32 = (x30 & 0x3ffffff); + let x32: u8 = ((x30 >> 26) as u8); + let x33: u32 = (x7 + (x32 as u32)); + let x34: u32 = (x6 + x33); + let x35: u32 = (x5 + x34); + let x36: u32 = (x3 + (x4 as u32)); + let x37: u32 = (x2 + x36); + let x38: u32 = (x1 + x37); + out1[0] = x21; + out1[1] = x26; + out1[2] = x31; + out1[3] = x35; + out1[4] = x38; +} + +/// The function fiat_poly1305_relax is the identity function converting from tight field elements to loose field elements. +/// +/// Postconditions: +/// out1 = arg1 +/// +#[inline] +pub fn fiat_poly1305_relax(out1: &mut fiat_poly1305_loose_field_element, arg1: &fiat_poly1305_tight_field_element) -> () { + let x1: u32 = (arg1[0]); + let x2: u32 = (arg1[1]); + let x3: u32 = (arg1[2]); + let x4: u32 = (arg1[3]); + let x5: u32 = (arg1[4]); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; + out1[3] = x4; + out1[4] = x5; +} diff --git a/vendor/fiat-crypto/src/poly1305_64.rs b/vendor/fiat-crypto/src/poly1305_64.rs new file mode 100644 index 000000000..05c51c821 --- /dev/null +++ b/vendor/fiat-crypto/src/poly1305_64.rs @@ -0,0 +1,457 @@ +//! Autogenerated: 'src/ExtractionOCaml/unsaturated_solinas' --lang Rust --inline poly1305 64 3 '2^130 - 5' carry_mul carry_square carry add sub opp selectznz to_bytes from_bytes relax +//! curve description: poly1305 +//! machine_wordsize = 64 (from "64") +//! requested operations: carry_mul, carry_square, carry, add, sub, opp, selectznz, to_bytes, from_bytes, relax +//! n = 3 (from "3") +//! s-c = 2^130 - [(1, 5)] (from "2^130 - 5") +//! tight_bounds_multiplier = 1 (from "") +//! +//! Computed values: +//! carry_chain = [0, 1, 2, 0, 1] +//! eval z = z[0] + (z[1] << 44) + (z[2] << 87) +//! bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) +//! balance = [0x1ffffffffff6, 0xffffffffffe, 0xffffffffffe] + +#![allow(unused_parens)] +#![allow(non_camel_case_types)] + +pub type fiat_poly1305_u1 = u8; +pub type fiat_poly1305_i1 = i8; +pub type fiat_poly1305_u2 = u8; +pub type fiat_poly1305_i2 = i8; + +/* The type fiat_poly1305_loose_field_element is a field element with loose bounds. */ +/* Bounds: [[0x0 ~> 0x300000000000], [0x0 ~> 0x180000000000], [0x0 ~> 0x180000000000]] */ +pub type fiat_poly1305_loose_field_element = [u64; 3]; + +/* The type fiat_poly1305_tight_field_element is a field element with tight bounds. */ +/* Bounds: [[0x0 ~> 0x100000000000], [0x0 ~> 0x80000000000], [0x0 ~> 0x80000000000]] */ +pub type fiat_poly1305_tight_field_element = [u64; 3]; + + +/// The function fiat_poly1305_addcarryx_u44 is an addition with carry. +/// +/// Postconditions: +/// out1 = (arg1 + arg2 + arg3) mod 2^44 +/// out2 = ⌊(arg1 + arg2 + arg3) / 2^44⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xfffffffffff] +/// arg3: [0x0 ~> 0xfffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xfffffffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_poly1305_addcarryx_u44(out1: &mut u64, out2: &mut fiat_poly1305_u1, arg1: fiat_poly1305_u1, arg2: u64, arg3: u64) -> () { + let x1: u64 = (((arg1 as u64) + arg2) + arg3); + let x2: u64 = (x1 & 0xfffffffffff); + let x3: fiat_poly1305_u1 = ((x1 >> 44) as fiat_poly1305_u1); + *out1 = x2; + *out2 = x3; +} + +/// The function fiat_poly1305_subborrowx_u44 is a subtraction with borrow. +/// +/// Postconditions: +/// out1 = (-arg1 + arg2 + -arg3) mod 2^44 +/// out2 = -⌊(-arg1 + arg2 + -arg3) / 2^44⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xfffffffffff] +/// arg3: [0x0 ~> 0xfffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xfffffffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_poly1305_subborrowx_u44(out1: &mut u64, out2: &mut fiat_poly1305_u1, arg1: fiat_poly1305_u1, arg2: u64, arg3: u64) -> () { + let x1: i64 = ((((((arg2 as i128) - (arg1 as i128)) as i64) as i128) - (arg3 as i128)) as i64); + let x2: fiat_poly1305_i1 = ((x1 >> 44) as fiat_poly1305_i1); + let x3: u64 = (((x1 as i128) & (0xfffffffffff as i128)) as u64); + *out1 = x3; + *out2 = (((0x0 as fiat_poly1305_i2) - (x2 as fiat_poly1305_i2)) as fiat_poly1305_u1); +} + +/// The function fiat_poly1305_addcarryx_u43 is an addition with carry. +/// +/// Postconditions: +/// out1 = (arg1 + arg2 + arg3) mod 2^43 +/// out2 = ⌊(arg1 + arg2 + arg3) / 2^43⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0x7ffffffffff] +/// arg3: [0x0 ~> 0x7ffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0x7ffffffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_poly1305_addcarryx_u43(out1: &mut u64, out2: &mut fiat_poly1305_u1, arg1: fiat_poly1305_u1, arg2: u64, arg3: u64) -> () { + let x1: u64 = (((arg1 as u64) + arg2) + arg3); + let x2: u64 = (x1 & 0x7ffffffffff); + let x3: fiat_poly1305_u1 = ((x1 >> 43) as fiat_poly1305_u1); + *out1 = x2; + *out2 = x3; +} + +/// The function fiat_poly1305_subborrowx_u43 is a subtraction with borrow. +/// +/// Postconditions: +/// out1 = (-arg1 + arg2 + -arg3) mod 2^43 +/// out2 = -⌊(-arg1 + arg2 + -arg3) / 2^43⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0x7ffffffffff] +/// arg3: [0x0 ~> 0x7ffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0x7ffffffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_poly1305_subborrowx_u43(out1: &mut u64, out2: &mut fiat_poly1305_u1, arg1: fiat_poly1305_u1, arg2: u64, arg3: u64) -> () { + let x1: i64 = ((((((arg2 as i128) - (arg1 as i128)) as i64) as i128) - (arg3 as i128)) as i64); + let x2: fiat_poly1305_i1 = ((x1 >> 43) as fiat_poly1305_i1); + let x3: u64 = (((x1 as i128) & (0x7ffffffffff as i128)) as u64); + *out1 = x3; + *out2 = (((0x0 as fiat_poly1305_i2) - (x2 as fiat_poly1305_i2)) as fiat_poly1305_u1); +} + +/// The function fiat_poly1305_cmovznz_u64 is a single-word conditional move. +/// +/// Postconditions: +/// out1 = (if arg1 = 0 then arg2 else arg3) +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffffffffffff] +/// arg3: [0x0 ~> 0xffffffffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +#[inline] +pub fn fiat_poly1305_cmovznz_u64(out1: &mut u64, arg1: fiat_poly1305_u1, arg2: u64, arg3: u64) -> () { + let x1: fiat_poly1305_u1 = (!(!arg1)); + let x2: u64 = ((((((0x0 as fiat_poly1305_i2) - (x1 as fiat_poly1305_i2)) as fiat_poly1305_i1) as i128) & (0xffffffffffffffff as i128)) as u64); + let x3: u64 = ((x2 & arg3) | ((!x2) & arg2)); + *out1 = x3; +} + +/// The function fiat_poly1305_carry_mul multiplies two field elements and reduces the result. +/// +/// Postconditions: +/// eval out1 mod m = (eval arg1 * eval arg2) mod m +/// +#[inline] +pub fn fiat_poly1305_carry_mul(out1: &mut fiat_poly1305_tight_field_element, arg1: &fiat_poly1305_loose_field_element, arg2: &fiat_poly1305_loose_field_element) -> () { + let x1: u128 = (((arg1[2]) as u128) * (((arg2[2]) * 0x5) as u128)); + let x2: u128 = (((arg1[2]) as u128) * (((arg2[1]) * 0xa) as u128)); + let x3: u128 = (((arg1[1]) as u128) * (((arg2[2]) * 0xa) as u128)); + let x4: u128 = (((arg1[2]) as u128) * ((arg2[0]) as u128)); + let x5: u128 = (((arg1[1]) as u128) * (((arg2[1]) * 0x2) as u128)); + let x6: u128 = (((arg1[1]) as u128) * ((arg2[0]) as u128)); + let x7: u128 = (((arg1[0]) as u128) * ((arg2[2]) as u128)); + let x8: u128 = (((arg1[0]) as u128) * ((arg2[1]) as u128)); + let x9: u128 = (((arg1[0]) as u128) * ((arg2[0]) as u128)); + let x10: u128 = (x9 + (x3 + x2)); + let x11: u64 = ((x10 >> 44) as u64); + let x12: u64 = ((x10 & (0xfffffffffff as u128)) as u64); + let x13: u128 = (x7 + (x5 + x4)); + let x14: u128 = (x8 + (x6 + x1)); + let x15: u128 = ((x11 as u128) + x14); + let x16: u64 = ((x15 >> 43) as u64); + let x17: u64 = ((x15 & (0x7ffffffffff as u128)) as u64); + let x18: u128 = ((x16 as u128) + x13); + let x19: u64 = ((x18 >> 43) as u64); + let x20: u64 = ((x18 & (0x7ffffffffff as u128)) as u64); + let x21: u64 = (x19 * 0x5); + let x22: u64 = (x12 + x21); + let x23: u64 = (x22 >> 44); + let x24: u64 = (x22 & 0xfffffffffff); + let x25: u64 = (x23 + x17); + let x26: fiat_poly1305_u1 = ((x25 >> 43) as fiat_poly1305_u1); + let x27: u64 = (x25 & 0x7ffffffffff); + let x28: u64 = ((x26 as u64) + x20); + out1[0] = x24; + out1[1] = x27; + out1[2] = x28; +} + +/// The function fiat_poly1305_carry_square squares a field element and reduces the result. +/// +/// Postconditions: +/// eval out1 mod m = (eval arg1 * eval arg1) mod m +/// +#[inline] +pub fn fiat_poly1305_carry_square(out1: &mut fiat_poly1305_tight_field_element, arg1: &fiat_poly1305_loose_field_element) -> () { + let x1: u64 = ((arg1[2]) * 0x5); + let x2: u64 = (x1 * 0x2); + let x3: u64 = ((arg1[2]) * 0x2); + let x4: u64 = ((arg1[1]) * 0x2); + let x5: u128 = (((arg1[2]) as u128) * (x1 as u128)); + let x6: u128 = (((arg1[1]) as u128) * ((x2 * 0x2) as u128)); + let x7: u128 = (((arg1[1]) as u128) * (((arg1[1]) * 0x2) as u128)); + let x8: u128 = (((arg1[0]) as u128) * (x3 as u128)); + let x9: u128 = (((arg1[0]) as u128) * (x4 as u128)); + let x10: u128 = (((arg1[0]) as u128) * ((arg1[0]) as u128)); + let x11: u128 = (x10 + x6); + let x12: u64 = ((x11 >> 44) as u64); + let x13: u64 = ((x11 & (0xfffffffffff as u128)) as u64); + let x14: u128 = (x8 + x7); + let x15: u128 = (x9 + x5); + let x16: u128 = ((x12 as u128) + x15); + let x17: u64 = ((x16 >> 43) as u64); + let x18: u64 = ((x16 & (0x7ffffffffff as u128)) as u64); + let x19: u128 = ((x17 as u128) + x14); + let x20: u64 = ((x19 >> 43) as u64); + let x21: u64 = ((x19 & (0x7ffffffffff as u128)) as u64); + let x22: u64 = (x20 * 0x5); + let x23: u64 = (x13 + x22); + let x24: u64 = (x23 >> 44); + let x25: u64 = (x23 & 0xfffffffffff); + let x26: u64 = (x24 + x18); + let x27: fiat_poly1305_u1 = ((x26 >> 43) as fiat_poly1305_u1); + let x28: u64 = (x26 & 0x7ffffffffff); + let x29: u64 = ((x27 as u64) + x21); + out1[0] = x25; + out1[1] = x28; + out1[2] = x29; +} + +/// The function fiat_poly1305_carry reduces a field element. +/// +/// Postconditions: +/// eval out1 mod m = eval arg1 mod m +/// +#[inline] +pub fn fiat_poly1305_carry(out1: &mut fiat_poly1305_tight_field_element, arg1: &fiat_poly1305_loose_field_element) -> () { + let x1: u64 = (arg1[0]); + let x2: u64 = ((x1 >> 44) + (arg1[1])); + let x3: u64 = ((x2 >> 43) + (arg1[2])); + let x4: u64 = ((x1 & 0xfffffffffff) + ((x3 >> 43) * 0x5)); + let x5: u64 = ((((x4 >> 44) as fiat_poly1305_u1) as u64) + (x2 & 0x7ffffffffff)); + let x6: u64 = (x4 & 0xfffffffffff); + let x7: u64 = (x5 & 0x7ffffffffff); + let x8: u64 = ((((x5 >> 43) as fiat_poly1305_u1) as u64) + (x3 & 0x7ffffffffff)); + out1[0] = x6; + out1[1] = x7; + out1[2] = x8; +} + +/// The function fiat_poly1305_add adds two field elements. +/// +/// Postconditions: +/// eval out1 mod m = (eval arg1 + eval arg2) mod m +/// +#[inline] +pub fn fiat_poly1305_add(out1: &mut fiat_poly1305_loose_field_element, arg1: &fiat_poly1305_tight_field_element, arg2: &fiat_poly1305_tight_field_element) -> () { + let x1: u64 = ((arg1[0]) + (arg2[0])); + let x2: u64 = ((arg1[1]) + (arg2[1])); + let x3: u64 = ((arg1[2]) + (arg2[2])); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; +} + +/// The function fiat_poly1305_sub subtracts two field elements. +/// +/// Postconditions: +/// eval out1 mod m = (eval arg1 - eval arg2) mod m +/// +#[inline] +pub fn fiat_poly1305_sub(out1: &mut fiat_poly1305_loose_field_element, arg1: &fiat_poly1305_tight_field_element, arg2: &fiat_poly1305_tight_field_element) -> () { + let x1: u64 = ((0x1ffffffffff6 + (arg1[0])) - (arg2[0])); + let x2: u64 = ((0xffffffffffe + (arg1[1])) - (arg2[1])); + let x3: u64 = ((0xffffffffffe + (arg1[2])) - (arg2[2])); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; +} + +/// The function fiat_poly1305_opp negates a field element. +/// +/// Postconditions: +/// eval out1 mod m = -eval arg1 mod m +/// +#[inline] +pub fn fiat_poly1305_opp(out1: &mut fiat_poly1305_loose_field_element, arg1: &fiat_poly1305_tight_field_element) -> () { + let x1: u64 = (0x1ffffffffff6 - (arg1[0])); + let x2: u64 = (0xffffffffffe - (arg1[1])); + let x3: u64 = (0xffffffffffe - (arg1[2])); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; +} + +/// The function fiat_poly1305_selectznz is a multi-limb conditional select. +/// +/// Postconditions: +/// out1 = (if arg1 = 0 then arg2 else arg3) +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +#[inline] +pub fn fiat_poly1305_selectznz(out1: &mut [u64; 3], arg1: fiat_poly1305_u1, arg2: &[u64; 3], arg3: &[u64; 3]) -> () { + let mut x1: u64 = 0; + fiat_poly1305_cmovznz_u64(&mut x1, arg1, (arg2[0]), (arg3[0])); + let mut x2: u64 = 0; + fiat_poly1305_cmovznz_u64(&mut x2, arg1, (arg2[1]), (arg3[1])); + let mut x3: u64 = 0; + fiat_poly1305_cmovznz_u64(&mut x3, arg1, (arg2[2]), (arg3[2])); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; +} + +/// The function fiat_poly1305_to_bytes serializes a field element to bytes in little-endian order. +/// +/// Postconditions: +/// out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..16] +/// +/// Output Bounds: +/// out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0x3]] +#[inline] +pub fn fiat_poly1305_to_bytes(out1: &mut [u8; 17], arg1: &fiat_poly1305_tight_field_element) -> () { + let mut x1: u64 = 0; + let mut x2: fiat_poly1305_u1 = 0; + fiat_poly1305_subborrowx_u44(&mut x1, &mut x2, 0x0, (arg1[0]), 0xffffffffffb); + let mut x3: u64 = 0; + let mut x4: fiat_poly1305_u1 = 0; + fiat_poly1305_subborrowx_u43(&mut x3, &mut x4, x2, (arg1[1]), 0x7ffffffffff); + let mut x5: u64 = 0; + let mut x6: fiat_poly1305_u1 = 0; + fiat_poly1305_subborrowx_u43(&mut x5, &mut x6, x4, (arg1[2]), 0x7ffffffffff); + let mut x7: u64 = 0; + fiat_poly1305_cmovznz_u64(&mut x7, x6, (0x0 as u64), 0xffffffffffffffff); + let mut x8: u64 = 0; + let mut x9: fiat_poly1305_u1 = 0; + fiat_poly1305_addcarryx_u44(&mut x8, &mut x9, 0x0, x1, (x7 & 0xffffffffffb)); + let mut x10: u64 = 0; + let mut x11: fiat_poly1305_u1 = 0; + fiat_poly1305_addcarryx_u43(&mut x10, &mut x11, x9, x3, (x7 & 0x7ffffffffff)); + let mut x12: u64 = 0; + let mut x13: fiat_poly1305_u1 = 0; + fiat_poly1305_addcarryx_u43(&mut x12, &mut x13, x11, x5, (x7 & 0x7ffffffffff)); + let x14: u64 = (x12 << 7); + let x15: u64 = (x10 << 4); + let x16: u8 = ((x8 & (0xff as u64)) as u8); + let x17: u64 = (x8 >> 8); + let x18: u8 = ((x17 & (0xff as u64)) as u8); + let x19: u64 = (x17 >> 8); + let x20: u8 = ((x19 & (0xff as u64)) as u8); + let x21: u64 = (x19 >> 8); + let x22: u8 = ((x21 & (0xff as u64)) as u8); + let x23: u64 = (x21 >> 8); + let x24: u8 = ((x23 & (0xff as u64)) as u8); + let x25: u8 = ((x23 >> 8) as u8); + let x26: u64 = (x15 + (x25 as u64)); + let x27: u8 = ((x26 & (0xff as u64)) as u8); + let x28: u64 = (x26 >> 8); + let x29: u8 = ((x28 & (0xff as u64)) as u8); + let x30: u64 = (x28 >> 8); + let x31: u8 = ((x30 & (0xff as u64)) as u8); + let x32: u64 = (x30 >> 8); + let x33: u8 = ((x32 & (0xff as u64)) as u8); + let x34: u64 = (x32 >> 8); + let x35: u8 = ((x34 & (0xff as u64)) as u8); + let x36: u8 = ((x34 >> 8) as u8); + let x37: u64 = (x14 + (x36 as u64)); + let x38: u8 = ((x37 & (0xff as u64)) as u8); + let x39: u64 = (x37 >> 8); + let x40: u8 = ((x39 & (0xff as u64)) as u8); + let x41: u64 = (x39 >> 8); + let x42: u8 = ((x41 & (0xff as u64)) as u8); + let x43: u64 = (x41 >> 8); + let x44: u8 = ((x43 & (0xff as u64)) as u8); + let x45: u64 = (x43 >> 8); + let x46: u8 = ((x45 & (0xff as u64)) as u8); + let x47: u64 = (x45 >> 8); + let x48: u8 = ((x47 & (0xff as u64)) as u8); + let x49: u8 = ((x47 >> 8) as u8); + out1[0] = x16; + out1[1] = x18; + out1[2] = x20; + out1[3] = x22; + out1[4] = x24; + out1[5] = x27; + out1[6] = x29; + out1[7] = x31; + out1[8] = x33; + out1[9] = x35; + out1[10] = x38; + out1[11] = x40; + out1[12] = x42; + out1[13] = x44; + out1[14] = x46; + out1[15] = x48; + out1[16] = x49; +} + +/// The function fiat_poly1305_from_bytes deserializes a field element from bytes in little-endian order. +/// +/// Postconditions: +/// eval out1 mod m = bytes_eval arg1 mod m +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0x3]] +#[inline] +pub fn fiat_poly1305_from_bytes(out1: &mut fiat_poly1305_tight_field_element, arg1: &[u8; 17]) -> () { + let x1: u64 = (((arg1[16]) as u64) << 41); + let x2: u64 = (((arg1[15]) as u64) << 33); + let x3: u64 = (((arg1[14]) as u64) << 25); + let x4: u64 = (((arg1[13]) as u64) << 17); + let x5: u64 = (((arg1[12]) as u64) << 9); + let x6: u64 = (((arg1[11]) as u64) * (0x2 as u64)); + let x7: u64 = (((arg1[10]) as u64) << 36); + let x8: u64 = (((arg1[9]) as u64) << 28); + let x9: u64 = (((arg1[8]) as u64) << 20); + let x10: u64 = (((arg1[7]) as u64) << 12); + let x11: u64 = (((arg1[6]) as u64) << 4); + let x12: u64 = (((arg1[5]) as u64) << 40); + let x13: u64 = (((arg1[4]) as u64) << 32); + let x14: u64 = (((arg1[3]) as u64) << 24); + let x15: u64 = (((arg1[2]) as u64) << 16); + let x16: u64 = (((arg1[1]) as u64) << 8); + let x17: u8 = (arg1[0]); + let x18: u64 = (x16 + (x17 as u64)); + let x19: u64 = (x15 + x18); + let x20: u64 = (x14 + x19); + let x21: u64 = (x13 + x20); + let x22: u64 = (x12 + x21); + let x23: u64 = (x22 & 0xfffffffffff); + let x24: u8 = ((x22 >> 44) as u8); + let x25: u64 = (x11 + (x24 as u64)); + let x26: u64 = (x10 + x25); + let x27: u64 = (x9 + x26); + let x28: u64 = (x8 + x27); + let x29: u64 = (x7 + x28); + let x30: u64 = (x29 & 0x7ffffffffff); + let x31: fiat_poly1305_u1 = ((x29 >> 43) as fiat_poly1305_u1); + let x32: u64 = (x6 + (x31 as u64)); + let x33: u64 = (x5 + x32); + let x34: u64 = (x4 + x33); + let x35: u64 = (x3 + x34); + let x36: u64 = (x2 + x35); + let x37: u64 = (x1 + x36); + out1[0] = x23; + out1[1] = x30; + out1[2] = x37; +} + +/// The function fiat_poly1305_relax is the identity function converting from tight field elements to loose field elements. +/// +/// Postconditions: +/// out1 = arg1 +/// +#[inline] +pub fn fiat_poly1305_relax(out1: &mut fiat_poly1305_loose_field_element, arg1: &fiat_poly1305_tight_field_element) -> () { + let x1: u64 = (arg1[0]); + let x2: u64 = (arg1[1]); + let x3: u64 = (arg1[2]); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; +} diff --git a/vendor/fiat-crypto/src/secp256k1_32.rs b/vendor/fiat-crypto/src/secp256k1_32.rs new file mode 100644 index 000000000..13919a10d --- /dev/null +++ b/vendor/fiat-crypto/src/secp256k1_32.rs @@ -0,0 +1,5337 @@ +//! Autogenerated: 'src/ExtractionOCaml/word_by_word_montgomery' --lang Rust --inline secp256k1 32 '2^256 - 2^32 - 977' mul square add sub opp from_montgomery to_montgomery nonzero selectznz to_bytes from_bytes one msat divstep divstep_precomp +//! curve description: secp256k1 +//! machine_wordsize = 32 (from "32") +//! requested operations: mul, square, add, sub, opp, from_montgomery, to_montgomery, nonzero, selectznz, to_bytes, from_bytes, one, msat, divstep, divstep_precomp +//! m = 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f (from "2^256 - 2^32 - 977") +//! +//! NOTE: In addition to the bounds specified above each function, all +//! functions synthesized for this Montgomery arithmetic require the +//! input to be strictly less than the prime modulus (m), and also +//! require the input to be in the unique saturated representation. +//! All functions also ensure that these two properties are true of +//! return values. +//! +//! Computed values: +//! eval z = z[0] + (z[1] << 32) + (z[2] << 64) + (z[3] << 96) + (z[4] << 128) + (z[5] << 160) + (z[6] << 192) + (z[7] << 224) +//! bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248) +//! twos_complement_eval z = let x1 := z[0] + (z[1] << 32) + (z[2] << 64) + (z[3] << 96) + (z[4] << 128) + (z[5] << 160) + (z[6] << 192) + (z[7] << 224) in +//! if x1 & (2^256-1) < 2^255 then x1 & (2^256-1) else (x1 & (2^256-1)) - 2^256 + +#![allow(unused_parens)] +#![allow(non_camel_case_types)] + +pub type fiat_secp256k1_u1 = u8; +pub type fiat_secp256k1_i1 = i8; +pub type fiat_secp256k1_u2 = u8; +pub type fiat_secp256k1_i2 = i8; + +/* The type fiat_secp256k1_montgomery_domain_field_element is a field element in the Montgomery domain. */ +/* Bounds: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] */ +pub type fiat_secp256k1_montgomery_domain_field_element = [u32; 8]; + +/* The type fiat_secp256k1_non_montgomery_domain_field_element is a field element NOT in the Montgomery domain. */ +/* Bounds: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] */ +pub type fiat_secp256k1_non_montgomery_domain_field_element = [u32; 8]; + + +/// The function fiat_secp256k1_addcarryx_u32 is an addition with carry. +/// +/// Postconditions: +/// out1 = (arg1 + arg2 + arg3) mod 2^32 +/// out2 = ⌊(arg1 + arg2 + arg3) / 2^32⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffff] +/// arg3: [0x0 ~> 0xffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_secp256k1_addcarryx_u32(out1: &mut u32, out2: &mut fiat_secp256k1_u1, arg1: fiat_secp256k1_u1, arg2: u32, arg3: u32) -> () { + let x1: u64 = (((arg1 as u64) + (arg2 as u64)) + (arg3 as u64)); + let x2: u32 = ((x1 & (0xffffffff as u64)) as u32); + let x3: fiat_secp256k1_u1 = ((x1 >> 32) as fiat_secp256k1_u1); + *out1 = x2; + *out2 = x3; +} + +/// The function fiat_secp256k1_subborrowx_u32 is a subtraction with borrow. +/// +/// Postconditions: +/// out1 = (-arg1 + arg2 + -arg3) mod 2^32 +/// out2 = -⌊(-arg1 + arg2 + -arg3) / 2^32⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffff] +/// arg3: [0x0 ~> 0xffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_secp256k1_subborrowx_u32(out1: &mut u32, out2: &mut fiat_secp256k1_u1, arg1: fiat_secp256k1_u1, arg2: u32, arg3: u32) -> () { + let x1: i64 = (((arg2 as i64) - (arg1 as i64)) - (arg3 as i64)); + let x2: fiat_secp256k1_i1 = ((x1 >> 32) as fiat_secp256k1_i1); + let x3: u32 = ((x1 & (0xffffffff as i64)) as u32); + *out1 = x3; + *out2 = (((0x0 as fiat_secp256k1_i2) - (x2 as fiat_secp256k1_i2)) as fiat_secp256k1_u1); +} + +/// The function fiat_secp256k1_mulx_u32 is a multiplication, returning the full double-width result. +/// +/// Postconditions: +/// out1 = (arg1 * arg2) mod 2^32 +/// out2 = ⌊arg1 * arg2 / 2^32⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0xffffffff] +/// arg2: [0x0 ~> 0xffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +/// out2: [0x0 ~> 0xffffffff] +#[inline] +pub fn fiat_secp256k1_mulx_u32(out1: &mut u32, out2: &mut u32, arg1: u32, arg2: u32) -> () { + let x1: u64 = ((arg1 as u64) * (arg2 as u64)); + let x2: u32 = ((x1 & (0xffffffff as u64)) as u32); + let x3: u32 = ((x1 >> 32) as u32); + *out1 = x2; + *out2 = x3; +} + +/// The function fiat_secp256k1_cmovznz_u32 is a single-word conditional move. +/// +/// Postconditions: +/// out1 = (if arg1 = 0 then arg2 else arg3) +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffff] +/// arg3: [0x0 ~> 0xffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +#[inline] +pub fn fiat_secp256k1_cmovznz_u32(out1: &mut u32, arg1: fiat_secp256k1_u1, arg2: u32, arg3: u32) -> () { + let x1: fiat_secp256k1_u1 = (!(!arg1)); + let x2: u32 = ((((((0x0 as fiat_secp256k1_i2) - (x1 as fiat_secp256k1_i2)) as fiat_secp256k1_i1) as i64) & (0xffffffff as i64)) as u32); + let x3: u32 = ((x2 & arg3) | ((!x2) & arg2)); + *out1 = x3; +} + +/// The function fiat_secp256k1_mul multiplies two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_secp256k1_mul(out1: &mut fiat_secp256k1_montgomery_domain_field_element, arg1: &fiat_secp256k1_montgomery_domain_field_element, arg2: &fiat_secp256k1_montgomery_domain_field_element) -> () { + let x1: u32 = (arg1[1]); + let x2: u32 = (arg1[2]); + let x3: u32 = (arg1[3]); + let x4: u32 = (arg1[4]); + let x5: u32 = (arg1[5]); + let x6: u32 = (arg1[6]); + let x7: u32 = (arg1[7]); + let x8: u32 = (arg1[0]); + let mut x9: u32 = 0; + let mut x10: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x9, &mut x10, x8, (arg2[7])); + let mut x11: u32 = 0; + let mut x12: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x11, &mut x12, x8, (arg2[6])); + let mut x13: u32 = 0; + let mut x14: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x13, &mut x14, x8, (arg2[5])); + let mut x15: u32 = 0; + let mut x16: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x15, &mut x16, x8, (arg2[4])); + let mut x17: u32 = 0; + let mut x18: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x17, &mut x18, x8, (arg2[3])); + let mut x19: u32 = 0; + let mut x20: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x19, &mut x20, x8, (arg2[2])); + let mut x21: u32 = 0; + let mut x22: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x21, &mut x22, x8, (arg2[1])); + let mut x23: u32 = 0; + let mut x24: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x23, &mut x24, x8, (arg2[0])); + let mut x25: u32 = 0; + let mut x26: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x25, &mut x26, 0x0, x24, x21); + let mut x27: u32 = 0; + let mut x28: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x27, &mut x28, x26, x22, x19); + let mut x29: u32 = 0; + let mut x30: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x29, &mut x30, x28, x20, x17); + let mut x31: u32 = 0; + let mut x32: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x31, &mut x32, x30, x18, x15); + let mut x33: u32 = 0; + let mut x34: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x33, &mut x34, x32, x16, x13); + let mut x35: u32 = 0; + let mut x36: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x35, &mut x36, x34, x14, x11); + let mut x37: u32 = 0; + let mut x38: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x37, &mut x38, x36, x12, x9); + let x39: u32 = ((x38 as u32) + x10); + let mut x40: u32 = 0; + let mut x41: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x40, &mut x41, x23, 0xd2253531); + let mut x42: u32 = 0; + let mut x43: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x42, &mut x43, x40, 0xffffffff); + let mut x44: u32 = 0; + let mut x45: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x44, &mut x45, x40, 0xffffffff); + let mut x46: u32 = 0; + let mut x47: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x46, &mut x47, x40, 0xffffffff); + let mut x48: u32 = 0; + let mut x49: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x48, &mut x49, x40, 0xffffffff); + let mut x50: u32 = 0; + let mut x51: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x50, &mut x51, x40, 0xffffffff); + let mut x52: u32 = 0; + let mut x53: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x52, &mut x53, x40, 0xffffffff); + let mut x54: u32 = 0; + let mut x55: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x54, &mut x55, x40, 0xfffffffe); + let mut x56: u32 = 0; + let mut x57: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x56, &mut x57, x40, 0xfffffc2f); + let mut x58: u32 = 0; + let mut x59: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x58, &mut x59, 0x0, x57, x54); + let mut x60: u32 = 0; + let mut x61: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x60, &mut x61, x59, x55, x52); + let mut x62: u32 = 0; + let mut x63: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x62, &mut x63, x61, x53, x50); + let mut x64: u32 = 0; + let mut x65: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x64, &mut x65, x63, x51, x48); + let mut x66: u32 = 0; + let mut x67: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x66, &mut x67, x65, x49, x46); + let mut x68: u32 = 0; + let mut x69: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x68, &mut x69, x67, x47, x44); + let mut x70: u32 = 0; + let mut x71: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x70, &mut x71, x69, x45, x42); + let x72: u32 = ((x71 as u32) + x43); + let mut x73: u32 = 0; + let mut x74: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x73, &mut x74, 0x0, x23, x56); + let mut x75: u32 = 0; + let mut x76: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x75, &mut x76, x74, x25, x58); + let mut x77: u32 = 0; + let mut x78: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x77, &mut x78, x76, x27, x60); + let mut x79: u32 = 0; + let mut x80: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x79, &mut x80, x78, x29, x62); + let mut x81: u32 = 0; + let mut x82: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x81, &mut x82, x80, x31, x64); + let mut x83: u32 = 0; + let mut x84: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x83, &mut x84, x82, x33, x66); + let mut x85: u32 = 0; + let mut x86: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x85, &mut x86, x84, x35, x68); + let mut x87: u32 = 0; + let mut x88: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x87, &mut x88, x86, x37, x70); + let mut x89: u32 = 0; + let mut x90: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x89, &mut x90, x88, x39, x72); + let mut x91: u32 = 0; + let mut x92: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x91, &mut x92, x1, (arg2[7])); + let mut x93: u32 = 0; + let mut x94: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x93, &mut x94, x1, (arg2[6])); + let mut x95: u32 = 0; + let mut x96: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x95, &mut x96, x1, (arg2[5])); + let mut x97: u32 = 0; + let mut x98: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x97, &mut x98, x1, (arg2[4])); + let mut x99: u32 = 0; + let mut x100: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x99, &mut x100, x1, (arg2[3])); + let mut x101: u32 = 0; + let mut x102: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x101, &mut x102, x1, (arg2[2])); + let mut x103: u32 = 0; + let mut x104: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x103, &mut x104, x1, (arg2[1])); + let mut x105: u32 = 0; + let mut x106: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x105, &mut x106, x1, (arg2[0])); + let mut x107: u32 = 0; + let mut x108: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x107, &mut x108, 0x0, x106, x103); + let mut x109: u32 = 0; + let mut x110: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x109, &mut x110, x108, x104, x101); + let mut x111: u32 = 0; + let mut x112: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x111, &mut x112, x110, x102, x99); + let mut x113: u32 = 0; + let mut x114: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x113, &mut x114, x112, x100, x97); + let mut x115: u32 = 0; + let mut x116: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x115, &mut x116, x114, x98, x95); + let mut x117: u32 = 0; + let mut x118: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x117, &mut x118, x116, x96, x93); + let mut x119: u32 = 0; + let mut x120: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x119, &mut x120, x118, x94, x91); + let x121: u32 = ((x120 as u32) + x92); + let mut x122: u32 = 0; + let mut x123: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x122, &mut x123, 0x0, x75, x105); + let mut x124: u32 = 0; + let mut x125: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x124, &mut x125, x123, x77, x107); + let mut x126: u32 = 0; + let mut x127: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x126, &mut x127, x125, x79, x109); + let mut x128: u32 = 0; + let mut x129: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x128, &mut x129, x127, x81, x111); + let mut x130: u32 = 0; + let mut x131: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x130, &mut x131, x129, x83, x113); + let mut x132: u32 = 0; + let mut x133: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x132, &mut x133, x131, x85, x115); + let mut x134: u32 = 0; + let mut x135: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x134, &mut x135, x133, x87, x117); + let mut x136: u32 = 0; + let mut x137: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x136, &mut x137, x135, x89, x119); + let mut x138: u32 = 0; + let mut x139: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x138, &mut x139, x137, (x90 as u32), x121); + let mut x140: u32 = 0; + let mut x141: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x140, &mut x141, x122, 0xd2253531); + let mut x142: u32 = 0; + let mut x143: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x142, &mut x143, x140, 0xffffffff); + let mut x144: u32 = 0; + let mut x145: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x144, &mut x145, x140, 0xffffffff); + let mut x146: u32 = 0; + let mut x147: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x146, &mut x147, x140, 0xffffffff); + let mut x148: u32 = 0; + let mut x149: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x148, &mut x149, x140, 0xffffffff); + let mut x150: u32 = 0; + let mut x151: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x150, &mut x151, x140, 0xffffffff); + let mut x152: u32 = 0; + let mut x153: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x152, &mut x153, x140, 0xffffffff); + let mut x154: u32 = 0; + let mut x155: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x154, &mut x155, x140, 0xfffffffe); + let mut x156: u32 = 0; + let mut x157: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x156, &mut x157, x140, 0xfffffc2f); + let mut x158: u32 = 0; + let mut x159: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x158, &mut x159, 0x0, x157, x154); + let mut x160: u32 = 0; + let mut x161: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x160, &mut x161, x159, x155, x152); + let mut x162: u32 = 0; + let mut x163: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x162, &mut x163, x161, x153, x150); + let mut x164: u32 = 0; + let mut x165: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x164, &mut x165, x163, x151, x148); + let mut x166: u32 = 0; + let mut x167: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x166, &mut x167, x165, x149, x146); + let mut x168: u32 = 0; + let mut x169: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x168, &mut x169, x167, x147, x144); + let mut x170: u32 = 0; + let mut x171: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x170, &mut x171, x169, x145, x142); + let x172: u32 = ((x171 as u32) + x143); + let mut x173: u32 = 0; + let mut x174: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x173, &mut x174, 0x0, x122, x156); + let mut x175: u32 = 0; + let mut x176: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x175, &mut x176, x174, x124, x158); + let mut x177: u32 = 0; + let mut x178: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x177, &mut x178, x176, x126, x160); + let mut x179: u32 = 0; + let mut x180: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x179, &mut x180, x178, x128, x162); + let mut x181: u32 = 0; + let mut x182: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x181, &mut x182, x180, x130, x164); + let mut x183: u32 = 0; + let mut x184: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x183, &mut x184, x182, x132, x166); + let mut x185: u32 = 0; + let mut x186: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x185, &mut x186, x184, x134, x168); + let mut x187: u32 = 0; + let mut x188: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x187, &mut x188, x186, x136, x170); + let mut x189: u32 = 0; + let mut x190: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x189, &mut x190, x188, x138, x172); + let x191: u32 = ((x190 as u32) + (x139 as u32)); + let mut x192: u32 = 0; + let mut x193: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x192, &mut x193, x2, (arg2[7])); + let mut x194: u32 = 0; + let mut x195: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x194, &mut x195, x2, (arg2[6])); + let mut x196: u32 = 0; + let mut x197: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x196, &mut x197, x2, (arg2[5])); + let mut x198: u32 = 0; + let mut x199: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x198, &mut x199, x2, (arg2[4])); + let mut x200: u32 = 0; + let mut x201: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x200, &mut x201, x2, (arg2[3])); + let mut x202: u32 = 0; + let mut x203: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x202, &mut x203, x2, (arg2[2])); + let mut x204: u32 = 0; + let mut x205: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x204, &mut x205, x2, (arg2[1])); + let mut x206: u32 = 0; + let mut x207: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x206, &mut x207, x2, (arg2[0])); + let mut x208: u32 = 0; + let mut x209: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x208, &mut x209, 0x0, x207, x204); + let mut x210: u32 = 0; + let mut x211: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x210, &mut x211, x209, x205, x202); + let mut x212: u32 = 0; + let mut x213: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x212, &mut x213, x211, x203, x200); + let mut x214: u32 = 0; + let mut x215: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x214, &mut x215, x213, x201, x198); + let mut x216: u32 = 0; + let mut x217: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x216, &mut x217, x215, x199, x196); + let mut x218: u32 = 0; + let mut x219: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x218, &mut x219, x217, x197, x194); + let mut x220: u32 = 0; + let mut x221: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x220, &mut x221, x219, x195, x192); + let x222: u32 = ((x221 as u32) + x193); + let mut x223: u32 = 0; + let mut x224: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x223, &mut x224, 0x0, x175, x206); + let mut x225: u32 = 0; + let mut x226: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x225, &mut x226, x224, x177, x208); + let mut x227: u32 = 0; + let mut x228: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x227, &mut x228, x226, x179, x210); + let mut x229: u32 = 0; + let mut x230: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x229, &mut x230, x228, x181, x212); + let mut x231: u32 = 0; + let mut x232: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x231, &mut x232, x230, x183, x214); + let mut x233: u32 = 0; + let mut x234: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x233, &mut x234, x232, x185, x216); + let mut x235: u32 = 0; + let mut x236: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x235, &mut x236, x234, x187, x218); + let mut x237: u32 = 0; + let mut x238: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x237, &mut x238, x236, x189, x220); + let mut x239: u32 = 0; + let mut x240: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x239, &mut x240, x238, x191, x222); + let mut x241: u32 = 0; + let mut x242: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x241, &mut x242, x223, 0xd2253531); + let mut x243: u32 = 0; + let mut x244: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x243, &mut x244, x241, 0xffffffff); + let mut x245: u32 = 0; + let mut x246: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x245, &mut x246, x241, 0xffffffff); + let mut x247: u32 = 0; + let mut x248: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x247, &mut x248, x241, 0xffffffff); + let mut x249: u32 = 0; + let mut x250: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x249, &mut x250, x241, 0xffffffff); + let mut x251: u32 = 0; + let mut x252: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x251, &mut x252, x241, 0xffffffff); + let mut x253: u32 = 0; + let mut x254: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x253, &mut x254, x241, 0xffffffff); + let mut x255: u32 = 0; + let mut x256: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x255, &mut x256, x241, 0xfffffffe); + let mut x257: u32 = 0; + let mut x258: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x257, &mut x258, x241, 0xfffffc2f); + let mut x259: u32 = 0; + let mut x260: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x259, &mut x260, 0x0, x258, x255); + let mut x261: u32 = 0; + let mut x262: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x261, &mut x262, x260, x256, x253); + let mut x263: u32 = 0; + let mut x264: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x263, &mut x264, x262, x254, x251); + let mut x265: u32 = 0; + let mut x266: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x265, &mut x266, x264, x252, x249); + let mut x267: u32 = 0; + let mut x268: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x267, &mut x268, x266, x250, x247); + let mut x269: u32 = 0; + let mut x270: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x269, &mut x270, x268, x248, x245); + let mut x271: u32 = 0; + let mut x272: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x271, &mut x272, x270, x246, x243); + let x273: u32 = ((x272 as u32) + x244); + let mut x274: u32 = 0; + let mut x275: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x274, &mut x275, 0x0, x223, x257); + let mut x276: u32 = 0; + let mut x277: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x276, &mut x277, x275, x225, x259); + let mut x278: u32 = 0; + let mut x279: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x278, &mut x279, x277, x227, x261); + let mut x280: u32 = 0; + let mut x281: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x280, &mut x281, x279, x229, x263); + let mut x282: u32 = 0; + let mut x283: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x282, &mut x283, x281, x231, x265); + let mut x284: u32 = 0; + let mut x285: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x284, &mut x285, x283, x233, x267); + let mut x286: u32 = 0; + let mut x287: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x286, &mut x287, x285, x235, x269); + let mut x288: u32 = 0; + let mut x289: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x288, &mut x289, x287, x237, x271); + let mut x290: u32 = 0; + let mut x291: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x290, &mut x291, x289, x239, x273); + let x292: u32 = ((x291 as u32) + (x240 as u32)); + let mut x293: u32 = 0; + let mut x294: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x293, &mut x294, x3, (arg2[7])); + let mut x295: u32 = 0; + let mut x296: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x295, &mut x296, x3, (arg2[6])); + let mut x297: u32 = 0; + let mut x298: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x297, &mut x298, x3, (arg2[5])); + let mut x299: u32 = 0; + let mut x300: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x299, &mut x300, x3, (arg2[4])); + let mut x301: u32 = 0; + let mut x302: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x301, &mut x302, x3, (arg2[3])); + let mut x303: u32 = 0; + let mut x304: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x303, &mut x304, x3, (arg2[2])); + let mut x305: u32 = 0; + let mut x306: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x305, &mut x306, x3, (arg2[1])); + let mut x307: u32 = 0; + let mut x308: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x307, &mut x308, x3, (arg2[0])); + let mut x309: u32 = 0; + let mut x310: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x309, &mut x310, 0x0, x308, x305); + let mut x311: u32 = 0; + let mut x312: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x311, &mut x312, x310, x306, x303); + let mut x313: u32 = 0; + let mut x314: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x313, &mut x314, x312, x304, x301); + let mut x315: u32 = 0; + let mut x316: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x315, &mut x316, x314, x302, x299); + let mut x317: u32 = 0; + let mut x318: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x317, &mut x318, x316, x300, x297); + let mut x319: u32 = 0; + let mut x320: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x319, &mut x320, x318, x298, x295); + let mut x321: u32 = 0; + let mut x322: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x321, &mut x322, x320, x296, x293); + let x323: u32 = ((x322 as u32) + x294); + let mut x324: u32 = 0; + let mut x325: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x324, &mut x325, 0x0, x276, x307); + let mut x326: u32 = 0; + let mut x327: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x326, &mut x327, x325, x278, x309); + let mut x328: u32 = 0; + let mut x329: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x328, &mut x329, x327, x280, x311); + let mut x330: u32 = 0; + let mut x331: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x330, &mut x331, x329, x282, x313); + let mut x332: u32 = 0; + let mut x333: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x332, &mut x333, x331, x284, x315); + let mut x334: u32 = 0; + let mut x335: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x334, &mut x335, x333, x286, x317); + let mut x336: u32 = 0; + let mut x337: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x336, &mut x337, x335, x288, x319); + let mut x338: u32 = 0; + let mut x339: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x338, &mut x339, x337, x290, x321); + let mut x340: u32 = 0; + let mut x341: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x340, &mut x341, x339, x292, x323); + let mut x342: u32 = 0; + let mut x343: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x342, &mut x343, x324, 0xd2253531); + let mut x344: u32 = 0; + let mut x345: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x344, &mut x345, x342, 0xffffffff); + let mut x346: u32 = 0; + let mut x347: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x346, &mut x347, x342, 0xffffffff); + let mut x348: u32 = 0; + let mut x349: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x348, &mut x349, x342, 0xffffffff); + let mut x350: u32 = 0; + let mut x351: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x350, &mut x351, x342, 0xffffffff); + let mut x352: u32 = 0; + let mut x353: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x352, &mut x353, x342, 0xffffffff); + let mut x354: u32 = 0; + let mut x355: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x354, &mut x355, x342, 0xffffffff); + let mut x356: u32 = 0; + let mut x357: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x356, &mut x357, x342, 0xfffffffe); + let mut x358: u32 = 0; + let mut x359: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x358, &mut x359, x342, 0xfffffc2f); + let mut x360: u32 = 0; + let mut x361: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x360, &mut x361, 0x0, x359, x356); + let mut x362: u32 = 0; + let mut x363: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x362, &mut x363, x361, x357, x354); + let mut x364: u32 = 0; + let mut x365: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x364, &mut x365, x363, x355, x352); + let mut x366: u32 = 0; + let mut x367: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x366, &mut x367, x365, x353, x350); + let mut x368: u32 = 0; + let mut x369: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x368, &mut x369, x367, x351, x348); + let mut x370: u32 = 0; + let mut x371: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x370, &mut x371, x369, x349, x346); + let mut x372: u32 = 0; + let mut x373: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x372, &mut x373, x371, x347, x344); + let x374: u32 = ((x373 as u32) + x345); + let mut x375: u32 = 0; + let mut x376: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x375, &mut x376, 0x0, x324, x358); + let mut x377: u32 = 0; + let mut x378: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x377, &mut x378, x376, x326, x360); + let mut x379: u32 = 0; + let mut x380: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x379, &mut x380, x378, x328, x362); + let mut x381: u32 = 0; + let mut x382: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x381, &mut x382, x380, x330, x364); + let mut x383: u32 = 0; + let mut x384: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x383, &mut x384, x382, x332, x366); + let mut x385: u32 = 0; + let mut x386: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x385, &mut x386, x384, x334, x368); + let mut x387: u32 = 0; + let mut x388: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x387, &mut x388, x386, x336, x370); + let mut x389: u32 = 0; + let mut x390: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x389, &mut x390, x388, x338, x372); + let mut x391: u32 = 0; + let mut x392: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x391, &mut x392, x390, x340, x374); + let x393: u32 = ((x392 as u32) + (x341 as u32)); + let mut x394: u32 = 0; + let mut x395: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x394, &mut x395, x4, (arg2[7])); + let mut x396: u32 = 0; + let mut x397: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x396, &mut x397, x4, (arg2[6])); + let mut x398: u32 = 0; + let mut x399: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x398, &mut x399, x4, (arg2[5])); + let mut x400: u32 = 0; + let mut x401: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x400, &mut x401, x4, (arg2[4])); + let mut x402: u32 = 0; + let mut x403: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x402, &mut x403, x4, (arg2[3])); + let mut x404: u32 = 0; + let mut x405: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x404, &mut x405, x4, (arg2[2])); + let mut x406: u32 = 0; + let mut x407: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x406, &mut x407, x4, (arg2[1])); + let mut x408: u32 = 0; + let mut x409: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x408, &mut x409, x4, (arg2[0])); + let mut x410: u32 = 0; + let mut x411: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x410, &mut x411, 0x0, x409, x406); + let mut x412: u32 = 0; + let mut x413: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x412, &mut x413, x411, x407, x404); + let mut x414: u32 = 0; + let mut x415: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x414, &mut x415, x413, x405, x402); + let mut x416: u32 = 0; + let mut x417: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x416, &mut x417, x415, x403, x400); + let mut x418: u32 = 0; + let mut x419: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x418, &mut x419, x417, x401, x398); + let mut x420: u32 = 0; + let mut x421: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x420, &mut x421, x419, x399, x396); + let mut x422: u32 = 0; + let mut x423: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x422, &mut x423, x421, x397, x394); + let x424: u32 = ((x423 as u32) + x395); + let mut x425: u32 = 0; + let mut x426: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x425, &mut x426, 0x0, x377, x408); + let mut x427: u32 = 0; + let mut x428: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x427, &mut x428, x426, x379, x410); + let mut x429: u32 = 0; + let mut x430: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x429, &mut x430, x428, x381, x412); + let mut x431: u32 = 0; + let mut x432: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x431, &mut x432, x430, x383, x414); + let mut x433: u32 = 0; + let mut x434: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x433, &mut x434, x432, x385, x416); + let mut x435: u32 = 0; + let mut x436: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x435, &mut x436, x434, x387, x418); + let mut x437: u32 = 0; + let mut x438: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x437, &mut x438, x436, x389, x420); + let mut x439: u32 = 0; + let mut x440: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x439, &mut x440, x438, x391, x422); + let mut x441: u32 = 0; + let mut x442: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x441, &mut x442, x440, x393, x424); + let mut x443: u32 = 0; + let mut x444: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x443, &mut x444, x425, 0xd2253531); + let mut x445: u32 = 0; + let mut x446: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x445, &mut x446, x443, 0xffffffff); + let mut x447: u32 = 0; + let mut x448: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x447, &mut x448, x443, 0xffffffff); + let mut x449: u32 = 0; + let mut x450: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x449, &mut x450, x443, 0xffffffff); + let mut x451: u32 = 0; + let mut x452: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x451, &mut x452, x443, 0xffffffff); + let mut x453: u32 = 0; + let mut x454: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x453, &mut x454, x443, 0xffffffff); + let mut x455: u32 = 0; + let mut x456: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x455, &mut x456, x443, 0xffffffff); + let mut x457: u32 = 0; + let mut x458: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x457, &mut x458, x443, 0xfffffffe); + let mut x459: u32 = 0; + let mut x460: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x459, &mut x460, x443, 0xfffffc2f); + let mut x461: u32 = 0; + let mut x462: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x461, &mut x462, 0x0, x460, x457); + let mut x463: u32 = 0; + let mut x464: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x463, &mut x464, x462, x458, x455); + let mut x465: u32 = 0; + let mut x466: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x465, &mut x466, x464, x456, x453); + let mut x467: u32 = 0; + let mut x468: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x467, &mut x468, x466, x454, x451); + let mut x469: u32 = 0; + let mut x470: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x469, &mut x470, x468, x452, x449); + let mut x471: u32 = 0; + let mut x472: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x471, &mut x472, x470, x450, x447); + let mut x473: u32 = 0; + let mut x474: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x473, &mut x474, x472, x448, x445); + let x475: u32 = ((x474 as u32) + x446); + let mut x476: u32 = 0; + let mut x477: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x476, &mut x477, 0x0, x425, x459); + let mut x478: u32 = 0; + let mut x479: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x478, &mut x479, x477, x427, x461); + let mut x480: u32 = 0; + let mut x481: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x480, &mut x481, x479, x429, x463); + let mut x482: u32 = 0; + let mut x483: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x482, &mut x483, x481, x431, x465); + let mut x484: u32 = 0; + let mut x485: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x484, &mut x485, x483, x433, x467); + let mut x486: u32 = 0; + let mut x487: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x486, &mut x487, x485, x435, x469); + let mut x488: u32 = 0; + let mut x489: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x488, &mut x489, x487, x437, x471); + let mut x490: u32 = 0; + let mut x491: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x490, &mut x491, x489, x439, x473); + let mut x492: u32 = 0; + let mut x493: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x492, &mut x493, x491, x441, x475); + let x494: u32 = ((x493 as u32) + (x442 as u32)); + let mut x495: u32 = 0; + let mut x496: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x495, &mut x496, x5, (arg2[7])); + let mut x497: u32 = 0; + let mut x498: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x497, &mut x498, x5, (arg2[6])); + let mut x499: u32 = 0; + let mut x500: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x499, &mut x500, x5, (arg2[5])); + let mut x501: u32 = 0; + let mut x502: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x501, &mut x502, x5, (arg2[4])); + let mut x503: u32 = 0; + let mut x504: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x503, &mut x504, x5, (arg2[3])); + let mut x505: u32 = 0; + let mut x506: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x505, &mut x506, x5, (arg2[2])); + let mut x507: u32 = 0; + let mut x508: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x507, &mut x508, x5, (arg2[1])); + let mut x509: u32 = 0; + let mut x510: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x509, &mut x510, x5, (arg2[0])); + let mut x511: u32 = 0; + let mut x512: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x511, &mut x512, 0x0, x510, x507); + let mut x513: u32 = 0; + let mut x514: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x513, &mut x514, x512, x508, x505); + let mut x515: u32 = 0; + let mut x516: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x515, &mut x516, x514, x506, x503); + let mut x517: u32 = 0; + let mut x518: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x517, &mut x518, x516, x504, x501); + let mut x519: u32 = 0; + let mut x520: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x519, &mut x520, x518, x502, x499); + let mut x521: u32 = 0; + let mut x522: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x521, &mut x522, x520, x500, x497); + let mut x523: u32 = 0; + let mut x524: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x523, &mut x524, x522, x498, x495); + let x525: u32 = ((x524 as u32) + x496); + let mut x526: u32 = 0; + let mut x527: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x526, &mut x527, 0x0, x478, x509); + let mut x528: u32 = 0; + let mut x529: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x528, &mut x529, x527, x480, x511); + let mut x530: u32 = 0; + let mut x531: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x530, &mut x531, x529, x482, x513); + let mut x532: u32 = 0; + let mut x533: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x532, &mut x533, x531, x484, x515); + let mut x534: u32 = 0; + let mut x535: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x534, &mut x535, x533, x486, x517); + let mut x536: u32 = 0; + let mut x537: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x536, &mut x537, x535, x488, x519); + let mut x538: u32 = 0; + let mut x539: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x538, &mut x539, x537, x490, x521); + let mut x540: u32 = 0; + let mut x541: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x540, &mut x541, x539, x492, x523); + let mut x542: u32 = 0; + let mut x543: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x542, &mut x543, x541, x494, x525); + let mut x544: u32 = 0; + let mut x545: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x544, &mut x545, x526, 0xd2253531); + let mut x546: u32 = 0; + let mut x547: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x546, &mut x547, x544, 0xffffffff); + let mut x548: u32 = 0; + let mut x549: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x548, &mut x549, x544, 0xffffffff); + let mut x550: u32 = 0; + let mut x551: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x550, &mut x551, x544, 0xffffffff); + let mut x552: u32 = 0; + let mut x553: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x552, &mut x553, x544, 0xffffffff); + let mut x554: u32 = 0; + let mut x555: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x554, &mut x555, x544, 0xffffffff); + let mut x556: u32 = 0; + let mut x557: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x556, &mut x557, x544, 0xffffffff); + let mut x558: u32 = 0; + let mut x559: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x558, &mut x559, x544, 0xfffffffe); + let mut x560: u32 = 0; + let mut x561: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x560, &mut x561, x544, 0xfffffc2f); + let mut x562: u32 = 0; + let mut x563: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x562, &mut x563, 0x0, x561, x558); + let mut x564: u32 = 0; + let mut x565: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x564, &mut x565, x563, x559, x556); + let mut x566: u32 = 0; + let mut x567: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x566, &mut x567, x565, x557, x554); + let mut x568: u32 = 0; + let mut x569: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x568, &mut x569, x567, x555, x552); + let mut x570: u32 = 0; + let mut x571: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x570, &mut x571, x569, x553, x550); + let mut x572: u32 = 0; + let mut x573: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x572, &mut x573, x571, x551, x548); + let mut x574: u32 = 0; + let mut x575: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x574, &mut x575, x573, x549, x546); + let x576: u32 = ((x575 as u32) + x547); + let mut x577: u32 = 0; + let mut x578: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x577, &mut x578, 0x0, x526, x560); + let mut x579: u32 = 0; + let mut x580: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x579, &mut x580, x578, x528, x562); + let mut x581: u32 = 0; + let mut x582: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x581, &mut x582, x580, x530, x564); + let mut x583: u32 = 0; + let mut x584: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x583, &mut x584, x582, x532, x566); + let mut x585: u32 = 0; + let mut x586: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x585, &mut x586, x584, x534, x568); + let mut x587: u32 = 0; + let mut x588: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x587, &mut x588, x586, x536, x570); + let mut x589: u32 = 0; + let mut x590: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x589, &mut x590, x588, x538, x572); + let mut x591: u32 = 0; + let mut x592: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x591, &mut x592, x590, x540, x574); + let mut x593: u32 = 0; + let mut x594: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x593, &mut x594, x592, x542, x576); + let x595: u32 = ((x594 as u32) + (x543 as u32)); + let mut x596: u32 = 0; + let mut x597: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x596, &mut x597, x6, (arg2[7])); + let mut x598: u32 = 0; + let mut x599: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x598, &mut x599, x6, (arg2[6])); + let mut x600: u32 = 0; + let mut x601: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x600, &mut x601, x6, (arg2[5])); + let mut x602: u32 = 0; + let mut x603: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x602, &mut x603, x6, (arg2[4])); + let mut x604: u32 = 0; + let mut x605: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x604, &mut x605, x6, (arg2[3])); + let mut x606: u32 = 0; + let mut x607: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x606, &mut x607, x6, (arg2[2])); + let mut x608: u32 = 0; + let mut x609: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x608, &mut x609, x6, (arg2[1])); + let mut x610: u32 = 0; + let mut x611: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x610, &mut x611, x6, (arg2[0])); + let mut x612: u32 = 0; + let mut x613: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x612, &mut x613, 0x0, x611, x608); + let mut x614: u32 = 0; + let mut x615: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x614, &mut x615, x613, x609, x606); + let mut x616: u32 = 0; + let mut x617: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x616, &mut x617, x615, x607, x604); + let mut x618: u32 = 0; + let mut x619: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x618, &mut x619, x617, x605, x602); + let mut x620: u32 = 0; + let mut x621: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x620, &mut x621, x619, x603, x600); + let mut x622: u32 = 0; + let mut x623: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x622, &mut x623, x621, x601, x598); + let mut x624: u32 = 0; + let mut x625: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x624, &mut x625, x623, x599, x596); + let x626: u32 = ((x625 as u32) + x597); + let mut x627: u32 = 0; + let mut x628: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x627, &mut x628, 0x0, x579, x610); + let mut x629: u32 = 0; + let mut x630: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x629, &mut x630, x628, x581, x612); + let mut x631: u32 = 0; + let mut x632: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x631, &mut x632, x630, x583, x614); + let mut x633: u32 = 0; + let mut x634: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x633, &mut x634, x632, x585, x616); + let mut x635: u32 = 0; + let mut x636: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x635, &mut x636, x634, x587, x618); + let mut x637: u32 = 0; + let mut x638: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x637, &mut x638, x636, x589, x620); + let mut x639: u32 = 0; + let mut x640: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x639, &mut x640, x638, x591, x622); + let mut x641: u32 = 0; + let mut x642: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x641, &mut x642, x640, x593, x624); + let mut x643: u32 = 0; + let mut x644: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x643, &mut x644, x642, x595, x626); + let mut x645: u32 = 0; + let mut x646: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x645, &mut x646, x627, 0xd2253531); + let mut x647: u32 = 0; + let mut x648: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x647, &mut x648, x645, 0xffffffff); + let mut x649: u32 = 0; + let mut x650: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x649, &mut x650, x645, 0xffffffff); + let mut x651: u32 = 0; + let mut x652: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x651, &mut x652, x645, 0xffffffff); + let mut x653: u32 = 0; + let mut x654: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x653, &mut x654, x645, 0xffffffff); + let mut x655: u32 = 0; + let mut x656: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x655, &mut x656, x645, 0xffffffff); + let mut x657: u32 = 0; + let mut x658: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x657, &mut x658, x645, 0xffffffff); + let mut x659: u32 = 0; + let mut x660: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x659, &mut x660, x645, 0xfffffffe); + let mut x661: u32 = 0; + let mut x662: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x661, &mut x662, x645, 0xfffffc2f); + let mut x663: u32 = 0; + let mut x664: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x663, &mut x664, 0x0, x662, x659); + let mut x665: u32 = 0; + let mut x666: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x665, &mut x666, x664, x660, x657); + let mut x667: u32 = 0; + let mut x668: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x667, &mut x668, x666, x658, x655); + let mut x669: u32 = 0; + let mut x670: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x669, &mut x670, x668, x656, x653); + let mut x671: u32 = 0; + let mut x672: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x671, &mut x672, x670, x654, x651); + let mut x673: u32 = 0; + let mut x674: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x673, &mut x674, x672, x652, x649); + let mut x675: u32 = 0; + let mut x676: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x675, &mut x676, x674, x650, x647); + let x677: u32 = ((x676 as u32) + x648); + let mut x678: u32 = 0; + let mut x679: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x678, &mut x679, 0x0, x627, x661); + let mut x680: u32 = 0; + let mut x681: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x680, &mut x681, x679, x629, x663); + let mut x682: u32 = 0; + let mut x683: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x682, &mut x683, x681, x631, x665); + let mut x684: u32 = 0; + let mut x685: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x684, &mut x685, x683, x633, x667); + let mut x686: u32 = 0; + let mut x687: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x686, &mut x687, x685, x635, x669); + let mut x688: u32 = 0; + let mut x689: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x688, &mut x689, x687, x637, x671); + let mut x690: u32 = 0; + let mut x691: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x690, &mut x691, x689, x639, x673); + let mut x692: u32 = 0; + let mut x693: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x692, &mut x693, x691, x641, x675); + let mut x694: u32 = 0; + let mut x695: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x694, &mut x695, x693, x643, x677); + let x696: u32 = ((x695 as u32) + (x644 as u32)); + let mut x697: u32 = 0; + let mut x698: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x697, &mut x698, x7, (arg2[7])); + let mut x699: u32 = 0; + let mut x700: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x699, &mut x700, x7, (arg2[6])); + let mut x701: u32 = 0; + let mut x702: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x701, &mut x702, x7, (arg2[5])); + let mut x703: u32 = 0; + let mut x704: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x703, &mut x704, x7, (arg2[4])); + let mut x705: u32 = 0; + let mut x706: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x705, &mut x706, x7, (arg2[3])); + let mut x707: u32 = 0; + let mut x708: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x707, &mut x708, x7, (arg2[2])); + let mut x709: u32 = 0; + let mut x710: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x709, &mut x710, x7, (arg2[1])); + let mut x711: u32 = 0; + let mut x712: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x711, &mut x712, x7, (arg2[0])); + let mut x713: u32 = 0; + let mut x714: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x713, &mut x714, 0x0, x712, x709); + let mut x715: u32 = 0; + let mut x716: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x715, &mut x716, x714, x710, x707); + let mut x717: u32 = 0; + let mut x718: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x717, &mut x718, x716, x708, x705); + let mut x719: u32 = 0; + let mut x720: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x719, &mut x720, x718, x706, x703); + let mut x721: u32 = 0; + let mut x722: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x721, &mut x722, x720, x704, x701); + let mut x723: u32 = 0; + let mut x724: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x723, &mut x724, x722, x702, x699); + let mut x725: u32 = 0; + let mut x726: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x725, &mut x726, x724, x700, x697); + let x727: u32 = ((x726 as u32) + x698); + let mut x728: u32 = 0; + let mut x729: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x728, &mut x729, 0x0, x680, x711); + let mut x730: u32 = 0; + let mut x731: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x730, &mut x731, x729, x682, x713); + let mut x732: u32 = 0; + let mut x733: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x732, &mut x733, x731, x684, x715); + let mut x734: u32 = 0; + let mut x735: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x734, &mut x735, x733, x686, x717); + let mut x736: u32 = 0; + let mut x737: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x736, &mut x737, x735, x688, x719); + let mut x738: u32 = 0; + let mut x739: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x738, &mut x739, x737, x690, x721); + let mut x740: u32 = 0; + let mut x741: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x740, &mut x741, x739, x692, x723); + let mut x742: u32 = 0; + let mut x743: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x742, &mut x743, x741, x694, x725); + let mut x744: u32 = 0; + let mut x745: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x744, &mut x745, x743, x696, x727); + let mut x746: u32 = 0; + let mut x747: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x746, &mut x747, x728, 0xd2253531); + let mut x748: u32 = 0; + let mut x749: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x748, &mut x749, x746, 0xffffffff); + let mut x750: u32 = 0; + let mut x751: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x750, &mut x751, x746, 0xffffffff); + let mut x752: u32 = 0; + let mut x753: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x752, &mut x753, x746, 0xffffffff); + let mut x754: u32 = 0; + let mut x755: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x754, &mut x755, x746, 0xffffffff); + let mut x756: u32 = 0; + let mut x757: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x756, &mut x757, x746, 0xffffffff); + let mut x758: u32 = 0; + let mut x759: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x758, &mut x759, x746, 0xffffffff); + let mut x760: u32 = 0; + let mut x761: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x760, &mut x761, x746, 0xfffffffe); + let mut x762: u32 = 0; + let mut x763: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x762, &mut x763, x746, 0xfffffc2f); + let mut x764: u32 = 0; + let mut x765: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x764, &mut x765, 0x0, x763, x760); + let mut x766: u32 = 0; + let mut x767: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x766, &mut x767, x765, x761, x758); + let mut x768: u32 = 0; + let mut x769: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x768, &mut x769, x767, x759, x756); + let mut x770: u32 = 0; + let mut x771: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x770, &mut x771, x769, x757, x754); + let mut x772: u32 = 0; + let mut x773: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x772, &mut x773, x771, x755, x752); + let mut x774: u32 = 0; + let mut x775: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x774, &mut x775, x773, x753, x750); + let mut x776: u32 = 0; + let mut x777: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x776, &mut x777, x775, x751, x748); + let x778: u32 = ((x777 as u32) + x749); + let mut x779: u32 = 0; + let mut x780: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x779, &mut x780, 0x0, x728, x762); + let mut x781: u32 = 0; + let mut x782: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x781, &mut x782, x780, x730, x764); + let mut x783: u32 = 0; + let mut x784: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x783, &mut x784, x782, x732, x766); + let mut x785: u32 = 0; + let mut x786: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x785, &mut x786, x784, x734, x768); + let mut x787: u32 = 0; + let mut x788: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x787, &mut x788, x786, x736, x770); + let mut x789: u32 = 0; + let mut x790: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x789, &mut x790, x788, x738, x772); + let mut x791: u32 = 0; + let mut x792: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x791, &mut x792, x790, x740, x774); + let mut x793: u32 = 0; + let mut x794: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x793, &mut x794, x792, x742, x776); + let mut x795: u32 = 0; + let mut x796: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x795, &mut x796, x794, x744, x778); + let x797: u32 = ((x796 as u32) + (x745 as u32)); + let mut x798: u32 = 0; + let mut x799: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x798, &mut x799, 0x0, x781, 0xfffffc2f); + let mut x800: u32 = 0; + let mut x801: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x800, &mut x801, x799, x783, 0xfffffffe); + let mut x802: u32 = 0; + let mut x803: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x802, &mut x803, x801, x785, 0xffffffff); + let mut x804: u32 = 0; + let mut x805: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x804, &mut x805, x803, x787, 0xffffffff); + let mut x806: u32 = 0; + let mut x807: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x806, &mut x807, x805, x789, 0xffffffff); + let mut x808: u32 = 0; + let mut x809: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x808, &mut x809, x807, x791, 0xffffffff); + let mut x810: u32 = 0; + let mut x811: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x810, &mut x811, x809, x793, 0xffffffff); + let mut x812: u32 = 0; + let mut x813: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x812, &mut x813, x811, x795, 0xffffffff); + let mut x814: u32 = 0; + let mut x815: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x814, &mut x815, x813, x797, (0x0 as u32)); + let mut x816: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x816, x815, x798, x781); + let mut x817: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x817, x815, x800, x783); + let mut x818: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x818, x815, x802, x785); + let mut x819: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x819, x815, x804, x787); + let mut x820: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x820, x815, x806, x789); + let mut x821: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x821, x815, x808, x791); + let mut x822: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x822, x815, x810, x793); + let mut x823: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x823, x815, x812, x795); + out1[0] = x816; + out1[1] = x817; + out1[2] = x818; + out1[3] = x819; + out1[4] = x820; + out1[5] = x821; + out1[6] = x822; + out1[7] = x823; +} + +/// The function fiat_secp256k1_square squares a field element in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg1)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_secp256k1_square(out1: &mut fiat_secp256k1_montgomery_domain_field_element, arg1: &fiat_secp256k1_montgomery_domain_field_element) -> () { + let x1: u32 = (arg1[1]); + let x2: u32 = (arg1[2]); + let x3: u32 = (arg1[3]); + let x4: u32 = (arg1[4]); + let x5: u32 = (arg1[5]); + let x6: u32 = (arg1[6]); + let x7: u32 = (arg1[7]); + let x8: u32 = (arg1[0]); + let mut x9: u32 = 0; + let mut x10: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x9, &mut x10, x8, (arg1[7])); + let mut x11: u32 = 0; + let mut x12: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x11, &mut x12, x8, (arg1[6])); + let mut x13: u32 = 0; + let mut x14: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x13, &mut x14, x8, (arg1[5])); + let mut x15: u32 = 0; + let mut x16: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x15, &mut x16, x8, (arg1[4])); + let mut x17: u32 = 0; + let mut x18: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x17, &mut x18, x8, (arg1[3])); + let mut x19: u32 = 0; + let mut x20: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x19, &mut x20, x8, (arg1[2])); + let mut x21: u32 = 0; + let mut x22: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x21, &mut x22, x8, (arg1[1])); + let mut x23: u32 = 0; + let mut x24: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x23, &mut x24, x8, (arg1[0])); + let mut x25: u32 = 0; + let mut x26: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x25, &mut x26, 0x0, x24, x21); + let mut x27: u32 = 0; + let mut x28: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x27, &mut x28, x26, x22, x19); + let mut x29: u32 = 0; + let mut x30: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x29, &mut x30, x28, x20, x17); + let mut x31: u32 = 0; + let mut x32: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x31, &mut x32, x30, x18, x15); + let mut x33: u32 = 0; + let mut x34: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x33, &mut x34, x32, x16, x13); + let mut x35: u32 = 0; + let mut x36: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x35, &mut x36, x34, x14, x11); + let mut x37: u32 = 0; + let mut x38: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x37, &mut x38, x36, x12, x9); + let x39: u32 = ((x38 as u32) + x10); + let mut x40: u32 = 0; + let mut x41: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x40, &mut x41, x23, 0xd2253531); + let mut x42: u32 = 0; + let mut x43: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x42, &mut x43, x40, 0xffffffff); + let mut x44: u32 = 0; + let mut x45: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x44, &mut x45, x40, 0xffffffff); + let mut x46: u32 = 0; + let mut x47: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x46, &mut x47, x40, 0xffffffff); + let mut x48: u32 = 0; + let mut x49: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x48, &mut x49, x40, 0xffffffff); + let mut x50: u32 = 0; + let mut x51: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x50, &mut x51, x40, 0xffffffff); + let mut x52: u32 = 0; + let mut x53: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x52, &mut x53, x40, 0xffffffff); + let mut x54: u32 = 0; + let mut x55: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x54, &mut x55, x40, 0xfffffffe); + let mut x56: u32 = 0; + let mut x57: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x56, &mut x57, x40, 0xfffffc2f); + let mut x58: u32 = 0; + let mut x59: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x58, &mut x59, 0x0, x57, x54); + let mut x60: u32 = 0; + let mut x61: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x60, &mut x61, x59, x55, x52); + let mut x62: u32 = 0; + let mut x63: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x62, &mut x63, x61, x53, x50); + let mut x64: u32 = 0; + let mut x65: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x64, &mut x65, x63, x51, x48); + let mut x66: u32 = 0; + let mut x67: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x66, &mut x67, x65, x49, x46); + let mut x68: u32 = 0; + let mut x69: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x68, &mut x69, x67, x47, x44); + let mut x70: u32 = 0; + let mut x71: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x70, &mut x71, x69, x45, x42); + let x72: u32 = ((x71 as u32) + x43); + let mut x73: u32 = 0; + let mut x74: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x73, &mut x74, 0x0, x23, x56); + let mut x75: u32 = 0; + let mut x76: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x75, &mut x76, x74, x25, x58); + let mut x77: u32 = 0; + let mut x78: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x77, &mut x78, x76, x27, x60); + let mut x79: u32 = 0; + let mut x80: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x79, &mut x80, x78, x29, x62); + let mut x81: u32 = 0; + let mut x82: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x81, &mut x82, x80, x31, x64); + let mut x83: u32 = 0; + let mut x84: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x83, &mut x84, x82, x33, x66); + let mut x85: u32 = 0; + let mut x86: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x85, &mut x86, x84, x35, x68); + let mut x87: u32 = 0; + let mut x88: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x87, &mut x88, x86, x37, x70); + let mut x89: u32 = 0; + let mut x90: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x89, &mut x90, x88, x39, x72); + let mut x91: u32 = 0; + let mut x92: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x91, &mut x92, x1, (arg1[7])); + let mut x93: u32 = 0; + let mut x94: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x93, &mut x94, x1, (arg1[6])); + let mut x95: u32 = 0; + let mut x96: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x95, &mut x96, x1, (arg1[5])); + let mut x97: u32 = 0; + let mut x98: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x97, &mut x98, x1, (arg1[4])); + let mut x99: u32 = 0; + let mut x100: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x99, &mut x100, x1, (arg1[3])); + let mut x101: u32 = 0; + let mut x102: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x101, &mut x102, x1, (arg1[2])); + let mut x103: u32 = 0; + let mut x104: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x103, &mut x104, x1, (arg1[1])); + let mut x105: u32 = 0; + let mut x106: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x105, &mut x106, x1, (arg1[0])); + let mut x107: u32 = 0; + let mut x108: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x107, &mut x108, 0x0, x106, x103); + let mut x109: u32 = 0; + let mut x110: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x109, &mut x110, x108, x104, x101); + let mut x111: u32 = 0; + let mut x112: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x111, &mut x112, x110, x102, x99); + let mut x113: u32 = 0; + let mut x114: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x113, &mut x114, x112, x100, x97); + let mut x115: u32 = 0; + let mut x116: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x115, &mut x116, x114, x98, x95); + let mut x117: u32 = 0; + let mut x118: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x117, &mut x118, x116, x96, x93); + let mut x119: u32 = 0; + let mut x120: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x119, &mut x120, x118, x94, x91); + let x121: u32 = ((x120 as u32) + x92); + let mut x122: u32 = 0; + let mut x123: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x122, &mut x123, 0x0, x75, x105); + let mut x124: u32 = 0; + let mut x125: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x124, &mut x125, x123, x77, x107); + let mut x126: u32 = 0; + let mut x127: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x126, &mut x127, x125, x79, x109); + let mut x128: u32 = 0; + let mut x129: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x128, &mut x129, x127, x81, x111); + let mut x130: u32 = 0; + let mut x131: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x130, &mut x131, x129, x83, x113); + let mut x132: u32 = 0; + let mut x133: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x132, &mut x133, x131, x85, x115); + let mut x134: u32 = 0; + let mut x135: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x134, &mut x135, x133, x87, x117); + let mut x136: u32 = 0; + let mut x137: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x136, &mut x137, x135, x89, x119); + let mut x138: u32 = 0; + let mut x139: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x138, &mut x139, x137, (x90 as u32), x121); + let mut x140: u32 = 0; + let mut x141: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x140, &mut x141, x122, 0xd2253531); + let mut x142: u32 = 0; + let mut x143: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x142, &mut x143, x140, 0xffffffff); + let mut x144: u32 = 0; + let mut x145: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x144, &mut x145, x140, 0xffffffff); + let mut x146: u32 = 0; + let mut x147: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x146, &mut x147, x140, 0xffffffff); + let mut x148: u32 = 0; + let mut x149: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x148, &mut x149, x140, 0xffffffff); + let mut x150: u32 = 0; + let mut x151: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x150, &mut x151, x140, 0xffffffff); + let mut x152: u32 = 0; + let mut x153: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x152, &mut x153, x140, 0xffffffff); + let mut x154: u32 = 0; + let mut x155: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x154, &mut x155, x140, 0xfffffffe); + let mut x156: u32 = 0; + let mut x157: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x156, &mut x157, x140, 0xfffffc2f); + let mut x158: u32 = 0; + let mut x159: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x158, &mut x159, 0x0, x157, x154); + let mut x160: u32 = 0; + let mut x161: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x160, &mut x161, x159, x155, x152); + let mut x162: u32 = 0; + let mut x163: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x162, &mut x163, x161, x153, x150); + let mut x164: u32 = 0; + let mut x165: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x164, &mut x165, x163, x151, x148); + let mut x166: u32 = 0; + let mut x167: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x166, &mut x167, x165, x149, x146); + let mut x168: u32 = 0; + let mut x169: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x168, &mut x169, x167, x147, x144); + let mut x170: u32 = 0; + let mut x171: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x170, &mut x171, x169, x145, x142); + let x172: u32 = ((x171 as u32) + x143); + let mut x173: u32 = 0; + let mut x174: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x173, &mut x174, 0x0, x122, x156); + let mut x175: u32 = 0; + let mut x176: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x175, &mut x176, x174, x124, x158); + let mut x177: u32 = 0; + let mut x178: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x177, &mut x178, x176, x126, x160); + let mut x179: u32 = 0; + let mut x180: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x179, &mut x180, x178, x128, x162); + let mut x181: u32 = 0; + let mut x182: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x181, &mut x182, x180, x130, x164); + let mut x183: u32 = 0; + let mut x184: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x183, &mut x184, x182, x132, x166); + let mut x185: u32 = 0; + let mut x186: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x185, &mut x186, x184, x134, x168); + let mut x187: u32 = 0; + let mut x188: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x187, &mut x188, x186, x136, x170); + let mut x189: u32 = 0; + let mut x190: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x189, &mut x190, x188, x138, x172); + let x191: u32 = ((x190 as u32) + (x139 as u32)); + let mut x192: u32 = 0; + let mut x193: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x192, &mut x193, x2, (arg1[7])); + let mut x194: u32 = 0; + let mut x195: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x194, &mut x195, x2, (arg1[6])); + let mut x196: u32 = 0; + let mut x197: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x196, &mut x197, x2, (arg1[5])); + let mut x198: u32 = 0; + let mut x199: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x198, &mut x199, x2, (arg1[4])); + let mut x200: u32 = 0; + let mut x201: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x200, &mut x201, x2, (arg1[3])); + let mut x202: u32 = 0; + let mut x203: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x202, &mut x203, x2, (arg1[2])); + let mut x204: u32 = 0; + let mut x205: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x204, &mut x205, x2, (arg1[1])); + let mut x206: u32 = 0; + let mut x207: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x206, &mut x207, x2, (arg1[0])); + let mut x208: u32 = 0; + let mut x209: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x208, &mut x209, 0x0, x207, x204); + let mut x210: u32 = 0; + let mut x211: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x210, &mut x211, x209, x205, x202); + let mut x212: u32 = 0; + let mut x213: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x212, &mut x213, x211, x203, x200); + let mut x214: u32 = 0; + let mut x215: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x214, &mut x215, x213, x201, x198); + let mut x216: u32 = 0; + let mut x217: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x216, &mut x217, x215, x199, x196); + let mut x218: u32 = 0; + let mut x219: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x218, &mut x219, x217, x197, x194); + let mut x220: u32 = 0; + let mut x221: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x220, &mut x221, x219, x195, x192); + let x222: u32 = ((x221 as u32) + x193); + let mut x223: u32 = 0; + let mut x224: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x223, &mut x224, 0x0, x175, x206); + let mut x225: u32 = 0; + let mut x226: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x225, &mut x226, x224, x177, x208); + let mut x227: u32 = 0; + let mut x228: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x227, &mut x228, x226, x179, x210); + let mut x229: u32 = 0; + let mut x230: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x229, &mut x230, x228, x181, x212); + let mut x231: u32 = 0; + let mut x232: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x231, &mut x232, x230, x183, x214); + let mut x233: u32 = 0; + let mut x234: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x233, &mut x234, x232, x185, x216); + let mut x235: u32 = 0; + let mut x236: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x235, &mut x236, x234, x187, x218); + let mut x237: u32 = 0; + let mut x238: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x237, &mut x238, x236, x189, x220); + let mut x239: u32 = 0; + let mut x240: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x239, &mut x240, x238, x191, x222); + let mut x241: u32 = 0; + let mut x242: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x241, &mut x242, x223, 0xd2253531); + let mut x243: u32 = 0; + let mut x244: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x243, &mut x244, x241, 0xffffffff); + let mut x245: u32 = 0; + let mut x246: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x245, &mut x246, x241, 0xffffffff); + let mut x247: u32 = 0; + let mut x248: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x247, &mut x248, x241, 0xffffffff); + let mut x249: u32 = 0; + let mut x250: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x249, &mut x250, x241, 0xffffffff); + let mut x251: u32 = 0; + let mut x252: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x251, &mut x252, x241, 0xffffffff); + let mut x253: u32 = 0; + let mut x254: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x253, &mut x254, x241, 0xffffffff); + let mut x255: u32 = 0; + let mut x256: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x255, &mut x256, x241, 0xfffffffe); + let mut x257: u32 = 0; + let mut x258: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x257, &mut x258, x241, 0xfffffc2f); + let mut x259: u32 = 0; + let mut x260: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x259, &mut x260, 0x0, x258, x255); + let mut x261: u32 = 0; + let mut x262: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x261, &mut x262, x260, x256, x253); + let mut x263: u32 = 0; + let mut x264: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x263, &mut x264, x262, x254, x251); + let mut x265: u32 = 0; + let mut x266: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x265, &mut x266, x264, x252, x249); + let mut x267: u32 = 0; + let mut x268: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x267, &mut x268, x266, x250, x247); + let mut x269: u32 = 0; + let mut x270: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x269, &mut x270, x268, x248, x245); + let mut x271: u32 = 0; + let mut x272: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x271, &mut x272, x270, x246, x243); + let x273: u32 = ((x272 as u32) + x244); + let mut x274: u32 = 0; + let mut x275: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x274, &mut x275, 0x0, x223, x257); + let mut x276: u32 = 0; + let mut x277: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x276, &mut x277, x275, x225, x259); + let mut x278: u32 = 0; + let mut x279: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x278, &mut x279, x277, x227, x261); + let mut x280: u32 = 0; + let mut x281: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x280, &mut x281, x279, x229, x263); + let mut x282: u32 = 0; + let mut x283: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x282, &mut x283, x281, x231, x265); + let mut x284: u32 = 0; + let mut x285: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x284, &mut x285, x283, x233, x267); + let mut x286: u32 = 0; + let mut x287: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x286, &mut x287, x285, x235, x269); + let mut x288: u32 = 0; + let mut x289: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x288, &mut x289, x287, x237, x271); + let mut x290: u32 = 0; + let mut x291: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x290, &mut x291, x289, x239, x273); + let x292: u32 = ((x291 as u32) + (x240 as u32)); + let mut x293: u32 = 0; + let mut x294: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x293, &mut x294, x3, (arg1[7])); + let mut x295: u32 = 0; + let mut x296: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x295, &mut x296, x3, (arg1[6])); + let mut x297: u32 = 0; + let mut x298: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x297, &mut x298, x3, (arg1[5])); + let mut x299: u32 = 0; + let mut x300: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x299, &mut x300, x3, (arg1[4])); + let mut x301: u32 = 0; + let mut x302: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x301, &mut x302, x3, (arg1[3])); + let mut x303: u32 = 0; + let mut x304: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x303, &mut x304, x3, (arg1[2])); + let mut x305: u32 = 0; + let mut x306: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x305, &mut x306, x3, (arg1[1])); + let mut x307: u32 = 0; + let mut x308: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x307, &mut x308, x3, (arg1[0])); + let mut x309: u32 = 0; + let mut x310: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x309, &mut x310, 0x0, x308, x305); + let mut x311: u32 = 0; + let mut x312: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x311, &mut x312, x310, x306, x303); + let mut x313: u32 = 0; + let mut x314: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x313, &mut x314, x312, x304, x301); + let mut x315: u32 = 0; + let mut x316: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x315, &mut x316, x314, x302, x299); + let mut x317: u32 = 0; + let mut x318: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x317, &mut x318, x316, x300, x297); + let mut x319: u32 = 0; + let mut x320: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x319, &mut x320, x318, x298, x295); + let mut x321: u32 = 0; + let mut x322: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x321, &mut x322, x320, x296, x293); + let x323: u32 = ((x322 as u32) + x294); + let mut x324: u32 = 0; + let mut x325: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x324, &mut x325, 0x0, x276, x307); + let mut x326: u32 = 0; + let mut x327: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x326, &mut x327, x325, x278, x309); + let mut x328: u32 = 0; + let mut x329: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x328, &mut x329, x327, x280, x311); + let mut x330: u32 = 0; + let mut x331: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x330, &mut x331, x329, x282, x313); + let mut x332: u32 = 0; + let mut x333: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x332, &mut x333, x331, x284, x315); + let mut x334: u32 = 0; + let mut x335: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x334, &mut x335, x333, x286, x317); + let mut x336: u32 = 0; + let mut x337: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x336, &mut x337, x335, x288, x319); + let mut x338: u32 = 0; + let mut x339: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x338, &mut x339, x337, x290, x321); + let mut x340: u32 = 0; + let mut x341: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x340, &mut x341, x339, x292, x323); + let mut x342: u32 = 0; + let mut x343: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x342, &mut x343, x324, 0xd2253531); + let mut x344: u32 = 0; + let mut x345: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x344, &mut x345, x342, 0xffffffff); + let mut x346: u32 = 0; + let mut x347: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x346, &mut x347, x342, 0xffffffff); + let mut x348: u32 = 0; + let mut x349: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x348, &mut x349, x342, 0xffffffff); + let mut x350: u32 = 0; + let mut x351: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x350, &mut x351, x342, 0xffffffff); + let mut x352: u32 = 0; + let mut x353: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x352, &mut x353, x342, 0xffffffff); + let mut x354: u32 = 0; + let mut x355: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x354, &mut x355, x342, 0xffffffff); + let mut x356: u32 = 0; + let mut x357: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x356, &mut x357, x342, 0xfffffffe); + let mut x358: u32 = 0; + let mut x359: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x358, &mut x359, x342, 0xfffffc2f); + let mut x360: u32 = 0; + let mut x361: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x360, &mut x361, 0x0, x359, x356); + let mut x362: u32 = 0; + let mut x363: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x362, &mut x363, x361, x357, x354); + let mut x364: u32 = 0; + let mut x365: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x364, &mut x365, x363, x355, x352); + let mut x366: u32 = 0; + let mut x367: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x366, &mut x367, x365, x353, x350); + let mut x368: u32 = 0; + let mut x369: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x368, &mut x369, x367, x351, x348); + let mut x370: u32 = 0; + let mut x371: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x370, &mut x371, x369, x349, x346); + let mut x372: u32 = 0; + let mut x373: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x372, &mut x373, x371, x347, x344); + let x374: u32 = ((x373 as u32) + x345); + let mut x375: u32 = 0; + let mut x376: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x375, &mut x376, 0x0, x324, x358); + let mut x377: u32 = 0; + let mut x378: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x377, &mut x378, x376, x326, x360); + let mut x379: u32 = 0; + let mut x380: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x379, &mut x380, x378, x328, x362); + let mut x381: u32 = 0; + let mut x382: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x381, &mut x382, x380, x330, x364); + let mut x383: u32 = 0; + let mut x384: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x383, &mut x384, x382, x332, x366); + let mut x385: u32 = 0; + let mut x386: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x385, &mut x386, x384, x334, x368); + let mut x387: u32 = 0; + let mut x388: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x387, &mut x388, x386, x336, x370); + let mut x389: u32 = 0; + let mut x390: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x389, &mut x390, x388, x338, x372); + let mut x391: u32 = 0; + let mut x392: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x391, &mut x392, x390, x340, x374); + let x393: u32 = ((x392 as u32) + (x341 as u32)); + let mut x394: u32 = 0; + let mut x395: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x394, &mut x395, x4, (arg1[7])); + let mut x396: u32 = 0; + let mut x397: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x396, &mut x397, x4, (arg1[6])); + let mut x398: u32 = 0; + let mut x399: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x398, &mut x399, x4, (arg1[5])); + let mut x400: u32 = 0; + let mut x401: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x400, &mut x401, x4, (arg1[4])); + let mut x402: u32 = 0; + let mut x403: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x402, &mut x403, x4, (arg1[3])); + let mut x404: u32 = 0; + let mut x405: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x404, &mut x405, x4, (arg1[2])); + let mut x406: u32 = 0; + let mut x407: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x406, &mut x407, x4, (arg1[1])); + let mut x408: u32 = 0; + let mut x409: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x408, &mut x409, x4, (arg1[0])); + let mut x410: u32 = 0; + let mut x411: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x410, &mut x411, 0x0, x409, x406); + let mut x412: u32 = 0; + let mut x413: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x412, &mut x413, x411, x407, x404); + let mut x414: u32 = 0; + let mut x415: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x414, &mut x415, x413, x405, x402); + let mut x416: u32 = 0; + let mut x417: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x416, &mut x417, x415, x403, x400); + let mut x418: u32 = 0; + let mut x419: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x418, &mut x419, x417, x401, x398); + let mut x420: u32 = 0; + let mut x421: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x420, &mut x421, x419, x399, x396); + let mut x422: u32 = 0; + let mut x423: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x422, &mut x423, x421, x397, x394); + let x424: u32 = ((x423 as u32) + x395); + let mut x425: u32 = 0; + let mut x426: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x425, &mut x426, 0x0, x377, x408); + let mut x427: u32 = 0; + let mut x428: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x427, &mut x428, x426, x379, x410); + let mut x429: u32 = 0; + let mut x430: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x429, &mut x430, x428, x381, x412); + let mut x431: u32 = 0; + let mut x432: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x431, &mut x432, x430, x383, x414); + let mut x433: u32 = 0; + let mut x434: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x433, &mut x434, x432, x385, x416); + let mut x435: u32 = 0; + let mut x436: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x435, &mut x436, x434, x387, x418); + let mut x437: u32 = 0; + let mut x438: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x437, &mut x438, x436, x389, x420); + let mut x439: u32 = 0; + let mut x440: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x439, &mut x440, x438, x391, x422); + let mut x441: u32 = 0; + let mut x442: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x441, &mut x442, x440, x393, x424); + let mut x443: u32 = 0; + let mut x444: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x443, &mut x444, x425, 0xd2253531); + let mut x445: u32 = 0; + let mut x446: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x445, &mut x446, x443, 0xffffffff); + let mut x447: u32 = 0; + let mut x448: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x447, &mut x448, x443, 0xffffffff); + let mut x449: u32 = 0; + let mut x450: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x449, &mut x450, x443, 0xffffffff); + let mut x451: u32 = 0; + let mut x452: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x451, &mut x452, x443, 0xffffffff); + let mut x453: u32 = 0; + let mut x454: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x453, &mut x454, x443, 0xffffffff); + let mut x455: u32 = 0; + let mut x456: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x455, &mut x456, x443, 0xffffffff); + let mut x457: u32 = 0; + let mut x458: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x457, &mut x458, x443, 0xfffffffe); + let mut x459: u32 = 0; + let mut x460: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x459, &mut x460, x443, 0xfffffc2f); + let mut x461: u32 = 0; + let mut x462: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x461, &mut x462, 0x0, x460, x457); + let mut x463: u32 = 0; + let mut x464: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x463, &mut x464, x462, x458, x455); + let mut x465: u32 = 0; + let mut x466: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x465, &mut x466, x464, x456, x453); + let mut x467: u32 = 0; + let mut x468: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x467, &mut x468, x466, x454, x451); + let mut x469: u32 = 0; + let mut x470: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x469, &mut x470, x468, x452, x449); + let mut x471: u32 = 0; + let mut x472: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x471, &mut x472, x470, x450, x447); + let mut x473: u32 = 0; + let mut x474: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x473, &mut x474, x472, x448, x445); + let x475: u32 = ((x474 as u32) + x446); + let mut x476: u32 = 0; + let mut x477: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x476, &mut x477, 0x0, x425, x459); + let mut x478: u32 = 0; + let mut x479: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x478, &mut x479, x477, x427, x461); + let mut x480: u32 = 0; + let mut x481: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x480, &mut x481, x479, x429, x463); + let mut x482: u32 = 0; + let mut x483: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x482, &mut x483, x481, x431, x465); + let mut x484: u32 = 0; + let mut x485: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x484, &mut x485, x483, x433, x467); + let mut x486: u32 = 0; + let mut x487: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x486, &mut x487, x485, x435, x469); + let mut x488: u32 = 0; + let mut x489: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x488, &mut x489, x487, x437, x471); + let mut x490: u32 = 0; + let mut x491: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x490, &mut x491, x489, x439, x473); + let mut x492: u32 = 0; + let mut x493: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x492, &mut x493, x491, x441, x475); + let x494: u32 = ((x493 as u32) + (x442 as u32)); + let mut x495: u32 = 0; + let mut x496: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x495, &mut x496, x5, (arg1[7])); + let mut x497: u32 = 0; + let mut x498: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x497, &mut x498, x5, (arg1[6])); + let mut x499: u32 = 0; + let mut x500: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x499, &mut x500, x5, (arg1[5])); + let mut x501: u32 = 0; + let mut x502: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x501, &mut x502, x5, (arg1[4])); + let mut x503: u32 = 0; + let mut x504: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x503, &mut x504, x5, (arg1[3])); + let mut x505: u32 = 0; + let mut x506: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x505, &mut x506, x5, (arg1[2])); + let mut x507: u32 = 0; + let mut x508: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x507, &mut x508, x5, (arg1[1])); + let mut x509: u32 = 0; + let mut x510: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x509, &mut x510, x5, (arg1[0])); + let mut x511: u32 = 0; + let mut x512: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x511, &mut x512, 0x0, x510, x507); + let mut x513: u32 = 0; + let mut x514: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x513, &mut x514, x512, x508, x505); + let mut x515: u32 = 0; + let mut x516: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x515, &mut x516, x514, x506, x503); + let mut x517: u32 = 0; + let mut x518: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x517, &mut x518, x516, x504, x501); + let mut x519: u32 = 0; + let mut x520: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x519, &mut x520, x518, x502, x499); + let mut x521: u32 = 0; + let mut x522: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x521, &mut x522, x520, x500, x497); + let mut x523: u32 = 0; + let mut x524: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x523, &mut x524, x522, x498, x495); + let x525: u32 = ((x524 as u32) + x496); + let mut x526: u32 = 0; + let mut x527: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x526, &mut x527, 0x0, x478, x509); + let mut x528: u32 = 0; + let mut x529: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x528, &mut x529, x527, x480, x511); + let mut x530: u32 = 0; + let mut x531: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x530, &mut x531, x529, x482, x513); + let mut x532: u32 = 0; + let mut x533: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x532, &mut x533, x531, x484, x515); + let mut x534: u32 = 0; + let mut x535: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x534, &mut x535, x533, x486, x517); + let mut x536: u32 = 0; + let mut x537: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x536, &mut x537, x535, x488, x519); + let mut x538: u32 = 0; + let mut x539: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x538, &mut x539, x537, x490, x521); + let mut x540: u32 = 0; + let mut x541: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x540, &mut x541, x539, x492, x523); + let mut x542: u32 = 0; + let mut x543: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x542, &mut x543, x541, x494, x525); + let mut x544: u32 = 0; + let mut x545: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x544, &mut x545, x526, 0xd2253531); + let mut x546: u32 = 0; + let mut x547: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x546, &mut x547, x544, 0xffffffff); + let mut x548: u32 = 0; + let mut x549: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x548, &mut x549, x544, 0xffffffff); + let mut x550: u32 = 0; + let mut x551: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x550, &mut x551, x544, 0xffffffff); + let mut x552: u32 = 0; + let mut x553: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x552, &mut x553, x544, 0xffffffff); + let mut x554: u32 = 0; + let mut x555: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x554, &mut x555, x544, 0xffffffff); + let mut x556: u32 = 0; + let mut x557: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x556, &mut x557, x544, 0xffffffff); + let mut x558: u32 = 0; + let mut x559: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x558, &mut x559, x544, 0xfffffffe); + let mut x560: u32 = 0; + let mut x561: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x560, &mut x561, x544, 0xfffffc2f); + let mut x562: u32 = 0; + let mut x563: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x562, &mut x563, 0x0, x561, x558); + let mut x564: u32 = 0; + let mut x565: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x564, &mut x565, x563, x559, x556); + let mut x566: u32 = 0; + let mut x567: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x566, &mut x567, x565, x557, x554); + let mut x568: u32 = 0; + let mut x569: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x568, &mut x569, x567, x555, x552); + let mut x570: u32 = 0; + let mut x571: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x570, &mut x571, x569, x553, x550); + let mut x572: u32 = 0; + let mut x573: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x572, &mut x573, x571, x551, x548); + let mut x574: u32 = 0; + let mut x575: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x574, &mut x575, x573, x549, x546); + let x576: u32 = ((x575 as u32) + x547); + let mut x577: u32 = 0; + let mut x578: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x577, &mut x578, 0x0, x526, x560); + let mut x579: u32 = 0; + let mut x580: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x579, &mut x580, x578, x528, x562); + let mut x581: u32 = 0; + let mut x582: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x581, &mut x582, x580, x530, x564); + let mut x583: u32 = 0; + let mut x584: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x583, &mut x584, x582, x532, x566); + let mut x585: u32 = 0; + let mut x586: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x585, &mut x586, x584, x534, x568); + let mut x587: u32 = 0; + let mut x588: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x587, &mut x588, x586, x536, x570); + let mut x589: u32 = 0; + let mut x590: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x589, &mut x590, x588, x538, x572); + let mut x591: u32 = 0; + let mut x592: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x591, &mut x592, x590, x540, x574); + let mut x593: u32 = 0; + let mut x594: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x593, &mut x594, x592, x542, x576); + let x595: u32 = ((x594 as u32) + (x543 as u32)); + let mut x596: u32 = 0; + let mut x597: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x596, &mut x597, x6, (arg1[7])); + let mut x598: u32 = 0; + let mut x599: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x598, &mut x599, x6, (arg1[6])); + let mut x600: u32 = 0; + let mut x601: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x600, &mut x601, x6, (arg1[5])); + let mut x602: u32 = 0; + let mut x603: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x602, &mut x603, x6, (arg1[4])); + let mut x604: u32 = 0; + let mut x605: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x604, &mut x605, x6, (arg1[3])); + let mut x606: u32 = 0; + let mut x607: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x606, &mut x607, x6, (arg1[2])); + let mut x608: u32 = 0; + let mut x609: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x608, &mut x609, x6, (arg1[1])); + let mut x610: u32 = 0; + let mut x611: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x610, &mut x611, x6, (arg1[0])); + let mut x612: u32 = 0; + let mut x613: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x612, &mut x613, 0x0, x611, x608); + let mut x614: u32 = 0; + let mut x615: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x614, &mut x615, x613, x609, x606); + let mut x616: u32 = 0; + let mut x617: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x616, &mut x617, x615, x607, x604); + let mut x618: u32 = 0; + let mut x619: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x618, &mut x619, x617, x605, x602); + let mut x620: u32 = 0; + let mut x621: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x620, &mut x621, x619, x603, x600); + let mut x622: u32 = 0; + let mut x623: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x622, &mut x623, x621, x601, x598); + let mut x624: u32 = 0; + let mut x625: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x624, &mut x625, x623, x599, x596); + let x626: u32 = ((x625 as u32) + x597); + let mut x627: u32 = 0; + let mut x628: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x627, &mut x628, 0x0, x579, x610); + let mut x629: u32 = 0; + let mut x630: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x629, &mut x630, x628, x581, x612); + let mut x631: u32 = 0; + let mut x632: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x631, &mut x632, x630, x583, x614); + let mut x633: u32 = 0; + let mut x634: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x633, &mut x634, x632, x585, x616); + let mut x635: u32 = 0; + let mut x636: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x635, &mut x636, x634, x587, x618); + let mut x637: u32 = 0; + let mut x638: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x637, &mut x638, x636, x589, x620); + let mut x639: u32 = 0; + let mut x640: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x639, &mut x640, x638, x591, x622); + let mut x641: u32 = 0; + let mut x642: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x641, &mut x642, x640, x593, x624); + let mut x643: u32 = 0; + let mut x644: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x643, &mut x644, x642, x595, x626); + let mut x645: u32 = 0; + let mut x646: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x645, &mut x646, x627, 0xd2253531); + let mut x647: u32 = 0; + let mut x648: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x647, &mut x648, x645, 0xffffffff); + let mut x649: u32 = 0; + let mut x650: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x649, &mut x650, x645, 0xffffffff); + let mut x651: u32 = 0; + let mut x652: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x651, &mut x652, x645, 0xffffffff); + let mut x653: u32 = 0; + let mut x654: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x653, &mut x654, x645, 0xffffffff); + let mut x655: u32 = 0; + let mut x656: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x655, &mut x656, x645, 0xffffffff); + let mut x657: u32 = 0; + let mut x658: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x657, &mut x658, x645, 0xffffffff); + let mut x659: u32 = 0; + let mut x660: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x659, &mut x660, x645, 0xfffffffe); + let mut x661: u32 = 0; + let mut x662: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x661, &mut x662, x645, 0xfffffc2f); + let mut x663: u32 = 0; + let mut x664: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x663, &mut x664, 0x0, x662, x659); + let mut x665: u32 = 0; + let mut x666: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x665, &mut x666, x664, x660, x657); + let mut x667: u32 = 0; + let mut x668: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x667, &mut x668, x666, x658, x655); + let mut x669: u32 = 0; + let mut x670: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x669, &mut x670, x668, x656, x653); + let mut x671: u32 = 0; + let mut x672: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x671, &mut x672, x670, x654, x651); + let mut x673: u32 = 0; + let mut x674: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x673, &mut x674, x672, x652, x649); + let mut x675: u32 = 0; + let mut x676: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x675, &mut x676, x674, x650, x647); + let x677: u32 = ((x676 as u32) + x648); + let mut x678: u32 = 0; + let mut x679: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x678, &mut x679, 0x0, x627, x661); + let mut x680: u32 = 0; + let mut x681: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x680, &mut x681, x679, x629, x663); + let mut x682: u32 = 0; + let mut x683: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x682, &mut x683, x681, x631, x665); + let mut x684: u32 = 0; + let mut x685: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x684, &mut x685, x683, x633, x667); + let mut x686: u32 = 0; + let mut x687: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x686, &mut x687, x685, x635, x669); + let mut x688: u32 = 0; + let mut x689: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x688, &mut x689, x687, x637, x671); + let mut x690: u32 = 0; + let mut x691: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x690, &mut x691, x689, x639, x673); + let mut x692: u32 = 0; + let mut x693: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x692, &mut x693, x691, x641, x675); + let mut x694: u32 = 0; + let mut x695: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x694, &mut x695, x693, x643, x677); + let x696: u32 = ((x695 as u32) + (x644 as u32)); + let mut x697: u32 = 0; + let mut x698: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x697, &mut x698, x7, (arg1[7])); + let mut x699: u32 = 0; + let mut x700: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x699, &mut x700, x7, (arg1[6])); + let mut x701: u32 = 0; + let mut x702: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x701, &mut x702, x7, (arg1[5])); + let mut x703: u32 = 0; + let mut x704: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x703, &mut x704, x7, (arg1[4])); + let mut x705: u32 = 0; + let mut x706: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x705, &mut x706, x7, (arg1[3])); + let mut x707: u32 = 0; + let mut x708: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x707, &mut x708, x7, (arg1[2])); + let mut x709: u32 = 0; + let mut x710: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x709, &mut x710, x7, (arg1[1])); + let mut x711: u32 = 0; + let mut x712: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x711, &mut x712, x7, (arg1[0])); + let mut x713: u32 = 0; + let mut x714: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x713, &mut x714, 0x0, x712, x709); + let mut x715: u32 = 0; + let mut x716: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x715, &mut x716, x714, x710, x707); + let mut x717: u32 = 0; + let mut x718: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x717, &mut x718, x716, x708, x705); + let mut x719: u32 = 0; + let mut x720: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x719, &mut x720, x718, x706, x703); + let mut x721: u32 = 0; + let mut x722: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x721, &mut x722, x720, x704, x701); + let mut x723: u32 = 0; + let mut x724: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x723, &mut x724, x722, x702, x699); + let mut x725: u32 = 0; + let mut x726: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x725, &mut x726, x724, x700, x697); + let x727: u32 = ((x726 as u32) + x698); + let mut x728: u32 = 0; + let mut x729: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x728, &mut x729, 0x0, x680, x711); + let mut x730: u32 = 0; + let mut x731: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x730, &mut x731, x729, x682, x713); + let mut x732: u32 = 0; + let mut x733: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x732, &mut x733, x731, x684, x715); + let mut x734: u32 = 0; + let mut x735: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x734, &mut x735, x733, x686, x717); + let mut x736: u32 = 0; + let mut x737: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x736, &mut x737, x735, x688, x719); + let mut x738: u32 = 0; + let mut x739: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x738, &mut x739, x737, x690, x721); + let mut x740: u32 = 0; + let mut x741: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x740, &mut x741, x739, x692, x723); + let mut x742: u32 = 0; + let mut x743: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x742, &mut x743, x741, x694, x725); + let mut x744: u32 = 0; + let mut x745: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x744, &mut x745, x743, x696, x727); + let mut x746: u32 = 0; + let mut x747: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x746, &mut x747, x728, 0xd2253531); + let mut x748: u32 = 0; + let mut x749: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x748, &mut x749, x746, 0xffffffff); + let mut x750: u32 = 0; + let mut x751: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x750, &mut x751, x746, 0xffffffff); + let mut x752: u32 = 0; + let mut x753: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x752, &mut x753, x746, 0xffffffff); + let mut x754: u32 = 0; + let mut x755: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x754, &mut x755, x746, 0xffffffff); + let mut x756: u32 = 0; + let mut x757: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x756, &mut x757, x746, 0xffffffff); + let mut x758: u32 = 0; + let mut x759: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x758, &mut x759, x746, 0xffffffff); + let mut x760: u32 = 0; + let mut x761: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x760, &mut x761, x746, 0xfffffffe); + let mut x762: u32 = 0; + let mut x763: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x762, &mut x763, x746, 0xfffffc2f); + let mut x764: u32 = 0; + let mut x765: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x764, &mut x765, 0x0, x763, x760); + let mut x766: u32 = 0; + let mut x767: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x766, &mut x767, x765, x761, x758); + let mut x768: u32 = 0; + let mut x769: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x768, &mut x769, x767, x759, x756); + let mut x770: u32 = 0; + let mut x771: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x770, &mut x771, x769, x757, x754); + let mut x772: u32 = 0; + let mut x773: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x772, &mut x773, x771, x755, x752); + let mut x774: u32 = 0; + let mut x775: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x774, &mut x775, x773, x753, x750); + let mut x776: u32 = 0; + let mut x777: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x776, &mut x777, x775, x751, x748); + let x778: u32 = ((x777 as u32) + x749); + let mut x779: u32 = 0; + let mut x780: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x779, &mut x780, 0x0, x728, x762); + let mut x781: u32 = 0; + let mut x782: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x781, &mut x782, x780, x730, x764); + let mut x783: u32 = 0; + let mut x784: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x783, &mut x784, x782, x732, x766); + let mut x785: u32 = 0; + let mut x786: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x785, &mut x786, x784, x734, x768); + let mut x787: u32 = 0; + let mut x788: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x787, &mut x788, x786, x736, x770); + let mut x789: u32 = 0; + let mut x790: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x789, &mut x790, x788, x738, x772); + let mut x791: u32 = 0; + let mut x792: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x791, &mut x792, x790, x740, x774); + let mut x793: u32 = 0; + let mut x794: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x793, &mut x794, x792, x742, x776); + let mut x795: u32 = 0; + let mut x796: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x795, &mut x796, x794, x744, x778); + let x797: u32 = ((x796 as u32) + (x745 as u32)); + let mut x798: u32 = 0; + let mut x799: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x798, &mut x799, 0x0, x781, 0xfffffc2f); + let mut x800: u32 = 0; + let mut x801: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x800, &mut x801, x799, x783, 0xfffffffe); + let mut x802: u32 = 0; + let mut x803: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x802, &mut x803, x801, x785, 0xffffffff); + let mut x804: u32 = 0; + let mut x805: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x804, &mut x805, x803, x787, 0xffffffff); + let mut x806: u32 = 0; + let mut x807: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x806, &mut x807, x805, x789, 0xffffffff); + let mut x808: u32 = 0; + let mut x809: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x808, &mut x809, x807, x791, 0xffffffff); + let mut x810: u32 = 0; + let mut x811: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x810, &mut x811, x809, x793, 0xffffffff); + let mut x812: u32 = 0; + let mut x813: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x812, &mut x813, x811, x795, 0xffffffff); + let mut x814: u32 = 0; + let mut x815: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x814, &mut x815, x813, x797, (0x0 as u32)); + let mut x816: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x816, x815, x798, x781); + let mut x817: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x817, x815, x800, x783); + let mut x818: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x818, x815, x802, x785); + let mut x819: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x819, x815, x804, x787); + let mut x820: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x820, x815, x806, x789); + let mut x821: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x821, x815, x808, x791); + let mut x822: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x822, x815, x810, x793); + let mut x823: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x823, x815, x812, x795); + out1[0] = x816; + out1[1] = x817; + out1[2] = x818; + out1[3] = x819; + out1[4] = x820; + out1[5] = x821; + out1[6] = x822; + out1[7] = x823; +} + +/// The function fiat_secp256k1_add adds two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) + eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_secp256k1_add(out1: &mut fiat_secp256k1_montgomery_domain_field_element, arg1: &fiat_secp256k1_montgomery_domain_field_element, arg2: &fiat_secp256k1_montgomery_domain_field_element) -> () { + let mut x1: u32 = 0; + let mut x2: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x1, &mut x2, 0x0, (arg1[0]), (arg2[0])); + let mut x3: u32 = 0; + let mut x4: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x3, &mut x4, x2, (arg1[1]), (arg2[1])); + let mut x5: u32 = 0; + let mut x6: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x5, &mut x6, x4, (arg1[2]), (arg2[2])); + let mut x7: u32 = 0; + let mut x8: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x7, &mut x8, x6, (arg1[3]), (arg2[3])); + let mut x9: u32 = 0; + let mut x10: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x9, &mut x10, x8, (arg1[4]), (arg2[4])); + let mut x11: u32 = 0; + let mut x12: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x11, &mut x12, x10, (arg1[5]), (arg2[5])); + let mut x13: u32 = 0; + let mut x14: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x13, &mut x14, x12, (arg1[6]), (arg2[6])); + let mut x15: u32 = 0; + let mut x16: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x15, &mut x16, x14, (arg1[7]), (arg2[7])); + let mut x17: u32 = 0; + let mut x18: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x17, &mut x18, 0x0, x1, 0xfffffc2f); + let mut x19: u32 = 0; + let mut x20: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x19, &mut x20, x18, x3, 0xfffffffe); + let mut x21: u32 = 0; + let mut x22: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x21, &mut x22, x20, x5, 0xffffffff); + let mut x23: u32 = 0; + let mut x24: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x23, &mut x24, x22, x7, 0xffffffff); + let mut x25: u32 = 0; + let mut x26: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x25, &mut x26, x24, x9, 0xffffffff); + let mut x27: u32 = 0; + let mut x28: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x27, &mut x28, x26, x11, 0xffffffff); + let mut x29: u32 = 0; + let mut x30: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x29, &mut x30, x28, x13, 0xffffffff); + let mut x31: u32 = 0; + let mut x32: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x31, &mut x32, x30, x15, 0xffffffff); + let mut x33: u32 = 0; + let mut x34: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x33, &mut x34, x32, (x16 as u32), (0x0 as u32)); + let mut x35: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x35, x34, x17, x1); + let mut x36: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x36, x34, x19, x3); + let mut x37: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x37, x34, x21, x5); + let mut x38: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x38, x34, x23, x7); + let mut x39: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x39, x34, x25, x9); + let mut x40: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x40, x34, x27, x11); + let mut x41: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x41, x34, x29, x13); + let mut x42: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x42, x34, x31, x15); + out1[0] = x35; + out1[1] = x36; + out1[2] = x37; + out1[3] = x38; + out1[4] = x39; + out1[5] = x40; + out1[6] = x41; + out1[7] = x42; +} + +/// The function fiat_secp256k1_sub subtracts two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) - eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_secp256k1_sub(out1: &mut fiat_secp256k1_montgomery_domain_field_element, arg1: &fiat_secp256k1_montgomery_domain_field_element, arg2: &fiat_secp256k1_montgomery_domain_field_element) -> () { + let mut x1: u32 = 0; + let mut x2: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x1, &mut x2, 0x0, (arg1[0]), (arg2[0])); + let mut x3: u32 = 0; + let mut x4: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x3, &mut x4, x2, (arg1[1]), (arg2[1])); + let mut x5: u32 = 0; + let mut x6: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x5, &mut x6, x4, (arg1[2]), (arg2[2])); + let mut x7: u32 = 0; + let mut x8: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x7, &mut x8, x6, (arg1[3]), (arg2[3])); + let mut x9: u32 = 0; + let mut x10: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x9, &mut x10, x8, (arg1[4]), (arg2[4])); + let mut x11: u32 = 0; + let mut x12: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x11, &mut x12, x10, (arg1[5]), (arg2[5])); + let mut x13: u32 = 0; + let mut x14: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x13, &mut x14, x12, (arg1[6]), (arg2[6])); + let mut x15: u32 = 0; + let mut x16: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x15, &mut x16, x14, (arg1[7]), (arg2[7])); + let mut x17: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x17, x16, (0x0 as u32), 0xffffffff); + let mut x18: u32 = 0; + let mut x19: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x18, &mut x19, 0x0, x1, (x17 & 0xfffffc2f)); + let mut x20: u32 = 0; + let mut x21: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x20, &mut x21, x19, x3, (x17 & 0xfffffffe)); + let mut x22: u32 = 0; + let mut x23: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x22, &mut x23, x21, x5, x17); + let mut x24: u32 = 0; + let mut x25: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x24, &mut x25, x23, x7, x17); + let mut x26: u32 = 0; + let mut x27: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x26, &mut x27, x25, x9, x17); + let mut x28: u32 = 0; + let mut x29: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x28, &mut x29, x27, x11, x17); + let mut x30: u32 = 0; + let mut x31: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x30, &mut x31, x29, x13, x17); + let mut x32: u32 = 0; + let mut x33: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x32, &mut x33, x31, x15, x17); + out1[0] = x18; + out1[1] = x20; + out1[2] = x22; + out1[3] = x24; + out1[4] = x26; + out1[5] = x28; + out1[6] = x30; + out1[7] = x32; +} + +/// The function fiat_secp256k1_opp negates a field element in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = -eval (from_montgomery arg1) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_secp256k1_opp(out1: &mut fiat_secp256k1_montgomery_domain_field_element, arg1: &fiat_secp256k1_montgomery_domain_field_element) -> () { + let mut x1: u32 = 0; + let mut x2: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x1, &mut x2, 0x0, (0x0 as u32), (arg1[0])); + let mut x3: u32 = 0; + let mut x4: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x3, &mut x4, x2, (0x0 as u32), (arg1[1])); + let mut x5: u32 = 0; + let mut x6: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x5, &mut x6, x4, (0x0 as u32), (arg1[2])); + let mut x7: u32 = 0; + let mut x8: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x7, &mut x8, x6, (0x0 as u32), (arg1[3])); + let mut x9: u32 = 0; + let mut x10: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x9, &mut x10, x8, (0x0 as u32), (arg1[4])); + let mut x11: u32 = 0; + let mut x12: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x11, &mut x12, x10, (0x0 as u32), (arg1[5])); + let mut x13: u32 = 0; + let mut x14: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x13, &mut x14, x12, (0x0 as u32), (arg1[6])); + let mut x15: u32 = 0; + let mut x16: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x15, &mut x16, x14, (0x0 as u32), (arg1[7])); + let mut x17: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x17, x16, (0x0 as u32), 0xffffffff); + let mut x18: u32 = 0; + let mut x19: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x18, &mut x19, 0x0, x1, (x17 & 0xfffffc2f)); + let mut x20: u32 = 0; + let mut x21: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x20, &mut x21, x19, x3, (x17 & 0xfffffffe)); + let mut x22: u32 = 0; + let mut x23: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x22, &mut x23, x21, x5, x17); + let mut x24: u32 = 0; + let mut x25: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x24, &mut x25, x23, x7, x17); + let mut x26: u32 = 0; + let mut x27: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x26, &mut x27, x25, x9, x17); + let mut x28: u32 = 0; + let mut x29: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x28, &mut x29, x27, x11, x17); + let mut x30: u32 = 0; + let mut x31: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x30, &mut x31, x29, x13, x17); + let mut x32: u32 = 0; + let mut x33: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x32, &mut x33, x31, x15, x17); + out1[0] = x18; + out1[1] = x20; + out1[2] = x22; + out1[3] = x24; + out1[4] = x26; + out1[5] = x28; + out1[6] = x30; + out1[7] = x32; +} + +/// The function fiat_secp256k1_from_montgomery translates a field element out of the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval out1 mod m = (eval arg1 * ((2^32)⁻¹ mod m)^8) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_secp256k1_from_montgomery(out1: &mut fiat_secp256k1_non_montgomery_domain_field_element, arg1: &fiat_secp256k1_montgomery_domain_field_element) -> () { + let x1: u32 = (arg1[0]); + let mut x2: u32 = 0; + let mut x3: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x2, &mut x3, x1, 0xd2253531); + let mut x4: u32 = 0; + let mut x5: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x4, &mut x5, x2, 0xffffffff); + let mut x6: u32 = 0; + let mut x7: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x6, &mut x7, x2, 0xffffffff); + let mut x8: u32 = 0; + let mut x9: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x8, &mut x9, x2, 0xffffffff); + let mut x10: u32 = 0; + let mut x11: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x10, &mut x11, x2, 0xffffffff); + let mut x12: u32 = 0; + let mut x13: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x12, &mut x13, x2, 0xffffffff); + let mut x14: u32 = 0; + let mut x15: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x14, &mut x15, x2, 0xffffffff); + let mut x16: u32 = 0; + let mut x17: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x16, &mut x17, x2, 0xfffffffe); + let mut x18: u32 = 0; + let mut x19: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x18, &mut x19, x2, 0xfffffc2f); + let mut x20: u32 = 0; + let mut x21: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x20, &mut x21, 0x0, x19, x16); + let mut x22: u32 = 0; + let mut x23: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x22, &mut x23, x21, x17, x14); + let mut x24: u32 = 0; + let mut x25: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x24, &mut x25, x23, x15, x12); + let mut x26: u32 = 0; + let mut x27: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x26, &mut x27, x25, x13, x10); + let mut x28: u32 = 0; + let mut x29: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x28, &mut x29, x27, x11, x8); + let mut x30: u32 = 0; + let mut x31: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x30, &mut x31, x29, x9, x6); + let mut x32: u32 = 0; + let mut x33: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x32, &mut x33, x31, x7, x4); + let mut x34: u32 = 0; + let mut x35: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x34, &mut x35, 0x0, x1, x18); + let mut x36: u32 = 0; + let mut x37: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x36, &mut x37, x35, (0x0 as u32), x20); + let mut x38: u32 = 0; + let mut x39: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x38, &mut x39, x37, (0x0 as u32), x22); + let mut x40: u32 = 0; + let mut x41: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x40, &mut x41, x39, (0x0 as u32), x24); + let mut x42: u32 = 0; + let mut x43: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x42, &mut x43, x41, (0x0 as u32), x26); + let mut x44: u32 = 0; + let mut x45: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x44, &mut x45, x43, (0x0 as u32), x28); + let mut x46: u32 = 0; + let mut x47: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x46, &mut x47, x45, (0x0 as u32), x30); + let mut x48: u32 = 0; + let mut x49: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x48, &mut x49, x47, (0x0 as u32), x32); + let mut x50: u32 = 0; + let mut x51: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x50, &mut x51, x49, (0x0 as u32), ((x33 as u32) + x5)); + let mut x52: u32 = 0; + let mut x53: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x52, &mut x53, 0x0, x36, (arg1[1])); + let mut x54: u32 = 0; + let mut x55: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x54, &mut x55, x53, x38, (0x0 as u32)); + let mut x56: u32 = 0; + let mut x57: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x56, &mut x57, x55, x40, (0x0 as u32)); + let mut x58: u32 = 0; + let mut x59: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x58, &mut x59, x57, x42, (0x0 as u32)); + let mut x60: u32 = 0; + let mut x61: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x60, &mut x61, x59, x44, (0x0 as u32)); + let mut x62: u32 = 0; + let mut x63: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x62, &mut x63, x61, x46, (0x0 as u32)); + let mut x64: u32 = 0; + let mut x65: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x64, &mut x65, x63, x48, (0x0 as u32)); + let mut x66: u32 = 0; + let mut x67: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x66, &mut x67, x65, x50, (0x0 as u32)); + let mut x68: u32 = 0; + let mut x69: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x68, &mut x69, x52, 0xd2253531); + let mut x70: u32 = 0; + let mut x71: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x70, &mut x71, x68, 0xffffffff); + let mut x72: u32 = 0; + let mut x73: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x72, &mut x73, x68, 0xffffffff); + let mut x74: u32 = 0; + let mut x75: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x74, &mut x75, x68, 0xffffffff); + let mut x76: u32 = 0; + let mut x77: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x76, &mut x77, x68, 0xffffffff); + let mut x78: u32 = 0; + let mut x79: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x78, &mut x79, x68, 0xffffffff); + let mut x80: u32 = 0; + let mut x81: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x80, &mut x81, x68, 0xffffffff); + let mut x82: u32 = 0; + let mut x83: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x82, &mut x83, x68, 0xfffffffe); + let mut x84: u32 = 0; + let mut x85: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x84, &mut x85, x68, 0xfffffc2f); + let mut x86: u32 = 0; + let mut x87: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x86, &mut x87, 0x0, x85, x82); + let mut x88: u32 = 0; + let mut x89: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x88, &mut x89, x87, x83, x80); + let mut x90: u32 = 0; + let mut x91: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x90, &mut x91, x89, x81, x78); + let mut x92: u32 = 0; + let mut x93: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x92, &mut x93, x91, x79, x76); + let mut x94: u32 = 0; + let mut x95: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x94, &mut x95, x93, x77, x74); + let mut x96: u32 = 0; + let mut x97: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x96, &mut x97, x95, x75, x72); + let mut x98: u32 = 0; + let mut x99: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x98, &mut x99, x97, x73, x70); + let mut x100: u32 = 0; + let mut x101: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x100, &mut x101, 0x0, x52, x84); + let mut x102: u32 = 0; + let mut x103: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x102, &mut x103, x101, x54, x86); + let mut x104: u32 = 0; + let mut x105: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x104, &mut x105, x103, x56, x88); + let mut x106: u32 = 0; + let mut x107: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x106, &mut x107, x105, x58, x90); + let mut x108: u32 = 0; + let mut x109: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x108, &mut x109, x107, x60, x92); + let mut x110: u32 = 0; + let mut x111: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x110, &mut x111, x109, x62, x94); + let mut x112: u32 = 0; + let mut x113: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x112, &mut x113, x111, x64, x96); + let mut x114: u32 = 0; + let mut x115: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x114, &mut x115, x113, x66, x98); + let mut x116: u32 = 0; + let mut x117: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x116, &mut x117, x115, ((x67 as u32) + (x51 as u32)), ((x99 as u32) + x71)); + let mut x118: u32 = 0; + let mut x119: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x118, &mut x119, 0x0, x102, (arg1[2])); + let mut x120: u32 = 0; + let mut x121: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x120, &mut x121, x119, x104, (0x0 as u32)); + let mut x122: u32 = 0; + let mut x123: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x122, &mut x123, x121, x106, (0x0 as u32)); + let mut x124: u32 = 0; + let mut x125: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x124, &mut x125, x123, x108, (0x0 as u32)); + let mut x126: u32 = 0; + let mut x127: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x126, &mut x127, x125, x110, (0x0 as u32)); + let mut x128: u32 = 0; + let mut x129: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x128, &mut x129, x127, x112, (0x0 as u32)); + let mut x130: u32 = 0; + let mut x131: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x130, &mut x131, x129, x114, (0x0 as u32)); + let mut x132: u32 = 0; + let mut x133: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x132, &mut x133, x131, x116, (0x0 as u32)); + let mut x134: u32 = 0; + let mut x135: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x134, &mut x135, x118, 0xd2253531); + let mut x136: u32 = 0; + let mut x137: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x136, &mut x137, x134, 0xffffffff); + let mut x138: u32 = 0; + let mut x139: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x138, &mut x139, x134, 0xffffffff); + let mut x140: u32 = 0; + let mut x141: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x140, &mut x141, x134, 0xffffffff); + let mut x142: u32 = 0; + let mut x143: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x142, &mut x143, x134, 0xffffffff); + let mut x144: u32 = 0; + let mut x145: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x144, &mut x145, x134, 0xffffffff); + let mut x146: u32 = 0; + let mut x147: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x146, &mut x147, x134, 0xffffffff); + let mut x148: u32 = 0; + let mut x149: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x148, &mut x149, x134, 0xfffffffe); + let mut x150: u32 = 0; + let mut x151: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x150, &mut x151, x134, 0xfffffc2f); + let mut x152: u32 = 0; + let mut x153: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x152, &mut x153, 0x0, x151, x148); + let mut x154: u32 = 0; + let mut x155: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x154, &mut x155, x153, x149, x146); + let mut x156: u32 = 0; + let mut x157: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x156, &mut x157, x155, x147, x144); + let mut x158: u32 = 0; + let mut x159: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x158, &mut x159, x157, x145, x142); + let mut x160: u32 = 0; + let mut x161: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x160, &mut x161, x159, x143, x140); + let mut x162: u32 = 0; + let mut x163: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x162, &mut x163, x161, x141, x138); + let mut x164: u32 = 0; + let mut x165: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x164, &mut x165, x163, x139, x136); + let mut x166: u32 = 0; + let mut x167: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x166, &mut x167, 0x0, x118, x150); + let mut x168: u32 = 0; + let mut x169: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x168, &mut x169, x167, x120, x152); + let mut x170: u32 = 0; + let mut x171: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x170, &mut x171, x169, x122, x154); + let mut x172: u32 = 0; + let mut x173: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x172, &mut x173, x171, x124, x156); + let mut x174: u32 = 0; + let mut x175: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x174, &mut x175, x173, x126, x158); + let mut x176: u32 = 0; + let mut x177: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x176, &mut x177, x175, x128, x160); + let mut x178: u32 = 0; + let mut x179: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x178, &mut x179, x177, x130, x162); + let mut x180: u32 = 0; + let mut x181: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x180, &mut x181, x179, x132, x164); + let mut x182: u32 = 0; + let mut x183: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x182, &mut x183, x181, ((x133 as u32) + (x117 as u32)), ((x165 as u32) + x137)); + let mut x184: u32 = 0; + let mut x185: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x184, &mut x185, 0x0, x168, (arg1[3])); + let mut x186: u32 = 0; + let mut x187: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x186, &mut x187, x185, x170, (0x0 as u32)); + let mut x188: u32 = 0; + let mut x189: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x188, &mut x189, x187, x172, (0x0 as u32)); + let mut x190: u32 = 0; + let mut x191: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x190, &mut x191, x189, x174, (0x0 as u32)); + let mut x192: u32 = 0; + let mut x193: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x192, &mut x193, x191, x176, (0x0 as u32)); + let mut x194: u32 = 0; + let mut x195: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x194, &mut x195, x193, x178, (0x0 as u32)); + let mut x196: u32 = 0; + let mut x197: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x196, &mut x197, x195, x180, (0x0 as u32)); + let mut x198: u32 = 0; + let mut x199: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x198, &mut x199, x197, x182, (0x0 as u32)); + let mut x200: u32 = 0; + let mut x201: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x200, &mut x201, x184, 0xd2253531); + let mut x202: u32 = 0; + let mut x203: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x202, &mut x203, x200, 0xffffffff); + let mut x204: u32 = 0; + let mut x205: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x204, &mut x205, x200, 0xffffffff); + let mut x206: u32 = 0; + let mut x207: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x206, &mut x207, x200, 0xffffffff); + let mut x208: u32 = 0; + let mut x209: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x208, &mut x209, x200, 0xffffffff); + let mut x210: u32 = 0; + let mut x211: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x210, &mut x211, x200, 0xffffffff); + let mut x212: u32 = 0; + let mut x213: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x212, &mut x213, x200, 0xffffffff); + let mut x214: u32 = 0; + let mut x215: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x214, &mut x215, x200, 0xfffffffe); + let mut x216: u32 = 0; + let mut x217: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x216, &mut x217, x200, 0xfffffc2f); + let mut x218: u32 = 0; + let mut x219: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x218, &mut x219, 0x0, x217, x214); + let mut x220: u32 = 0; + let mut x221: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x220, &mut x221, x219, x215, x212); + let mut x222: u32 = 0; + let mut x223: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x222, &mut x223, x221, x213, x210); + let mut x224: u32 = 0; + let mut x225: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x224, &mut x225, x223, x211, x208); + let mut x226: u32 = 0; + let mut x227: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x226, &mut x227, x225, x209, x206); + let mut x228: u32 = 0; + let mut x229: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x228, &mut x229, x227, x207, x204); + let mut x230: u32 = 0; + let mut x231: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x230, &mut x231, x229, x205, x202); + let mut x232: u32 = 0; + let mut x233: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x232, &mut x233, 0x0, x184, x216); + let mut x234: u32 = 0; + let mut x235: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x234, &mut x235, x233, x186, x218); + let mut x236: u32 = 0; + let mut x237: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x236, &mut x237, x235, x188, x220); + let mut x238: u32 = 0; + let mut x239: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x238, &mut x239, x237, x190, x222); + let mut x240: u32 = 0; + let mut x241: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x240, &mut x241, x239, x192, x224); + let mut x242: u32 = 0; + let mut x243: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x242, &mut x243, x241, x194, x226); + let mut x244: u32 = 0; + let mut x245: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x244, &mut x245, x243, x196, x228); + let mut x246: u32 = 0; + let mut x247: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x246, &mut x247, x245, x198, x230); + let mut x248: u32 = 0; + let mut x249: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x248, &mut x249, x247, ((x199 as u32) + (x183 as u32)), ((x231 as u32) + x203)); + let mut x250: u32 = 0; + let mut x251: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x250, &mut x251, 0x0, x234, (arg1[4])); + let mut x252: u32 = 0; + let mut x253: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x252, &mut x253, x251, x236, (0x0 as u32)); + let mut x254: u32 = 0; + let mut x255: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x254, &mut x255, x253, x238, (0x0 as u32)); + let mut x256: u32 = 0; + let mut x257: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x256, &mut x257, x255, x240, (0x0 as u32)); + let mut x258: u32 = 0; + let mut x259: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x258, &mut x259, x257, x242, (0x0 as u32)); + let mut x260: u32 = 0; + let mut x261: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x260, &mut x261, x259, x244, (0x0 as u32)); + let mut x262: u32 = 0; + let mut x263: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x262, &mut x263, x261, x246, (0x0 as u32)); + let mut x264: u32 = 0; + let mut x265: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x264, &mut x265, x263, x248, (0x0 as u32)); + let mut x266: u32 = 0; + let mut x267: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x266, &mut x267, x250, 0xd2253531); + let mut x268: u32 = 0; + let mut x269: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x268, &mut x269, x266, 0xffffffff); + let mut x270: u32 = 0; + let mut x271: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x270, &mut x271, x266, 0xffffffff); + let mut x272: u32 = 0; + let mut x273: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x272, &mut x273, x266, 0xffffffff); + let mut x274: u32 = 0; + let mut x275: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x274, &mut x275, x266, 0xffffffff); + let mut x276: u32 = 0; + let mut x277: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x276, &mut x277, x266, 0xffffffff); + let mut x278: u32 = 0; + let mut x279: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x278, &mut x279, x266, 0xffffffff); + let mut x280: u32 = 0; + let mut x281: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x280, &mut x281, x266, 0xfffffffe); + let mut x282: u32 = 0; + let mut x283: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x282, &mut x283, x266, 0xfffffc2f); + let mut x284: u32 = 0; + let mut x285: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x284, &mut x285, 0x0, x283, x280); + let mut x286: u32 = 0; + let mut x287: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x286, &mut x287, x285, x281, x278); + let mut x288: u32 = 0; + let mut x289: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x288, &mut x289, x287, x279, x276); + let mut x290: u32 = 0; + let mut x291: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x290, &mut x291, x289, x277, x274); + let mut x292: u32 = 0; + let mut x293: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x292, &mut x293, x291, x275, x272); + let mut x294: u32 = 0; + let mut x295: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x294, &mut x295, x293, x273, x270); + let mut x296: u32 = 0; + let mut x297: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x296, &mut x297, x295, x271, x268); + let mut x298: u32 = 0; + let mut x299: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x298, &mut x299, 0x0, x250, x282); + let mut x300: u32 = 0; + let mut x301: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x300, &mut x301, x299, x252, x284); + let mut x302: u32 = 0; + let mut x303: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x302, &mut x303, x301, x254, x286); + let mut x304: u32 = 0; + let mut x305: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x304, &mut x305, x303, x256, x288); + let mut x306: u32 = 0; + let mut x307: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x306, &mut x307, x305, x258, x290); + let mut x308: u32 = 0; + let mut x309: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x308, &mut x309, x307, x260, x292); + let mut x310: u32 = 0; + let mut x311: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x310, &mut x311, x309, x262, x294); + let mut x312: u32 = 0; + let mut x313: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x312, &mut x313, x311, x264, x296); + let mut x314: u32 = 0; + let mut x315: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x314, &mut x315, x313, ((x265 as u32) + (x249 as u32)), ((x297 as u32) + x269)); + let mut x316: u32 = 0; + let mut x317: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x316, &mut x317, 0x0, x300, (arg1[5])); + let mut x318: u32 = 0; + let mut x319: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x318, &mut x319, x317, x302, (0x0 as u32)); + let mut x320: u32 = 0; + let mut x321: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x320, &mut x321, x319, x304, (0x0 as u32)); + let mut x322: u32 = 0; + let mut x323: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x322, &mut x323, x321, x306, (0x0 as u32)); + let mut x324: u32 = 0; + let mut x325: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x324, &mut x325, x323, x308, (0x0 as u32)); + let mut x326: u32 = 0; + let mut x327: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x326, &mut x327, x325, x310, (0x0 as u32)); + let mut x328: u32 = 0; + let mut x329: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x328, &mut x329, x327, x312, (0x0 as u32)); + let mut x330: u32 = 0; + let mut x331: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x330, &mut x331, x329, x314, (0x0 as u32)); + let mut x332: u32 = 0; + let mut x333: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x332, &mut x333, x316, 0xd2253531); + let mut x334: u32 = 0; + let mut x335: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x334, &mut x335, x332, 0xffffffff); + let mut x336: u32 = 0; + let mut x337: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x336, &mut x337, x332, 0xffffffff); + let mut x338: u32 = 0; + let mut x339: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x338, &mut x339, x332, 0xffffffff); + let mut x340: u32 = 0; + let mut x341: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x340, &mut x341, x332, 0xffffffff); + let mut x342: u32 = 0; + let mut x343: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x342, &mut x343, x332, 0xffffffff); + let mut x344: u32 = 0; + let mut x345: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x344, &mut x345, x332, 0xffffffff); + let mut x346: u32 = 0; + let mut x347: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x346, &mut x347, x332, 0xfffffffe); + let mut x348: u32 = 0; + let mut x349: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x348, &mut x349, x332, 0xfffffc2f); + let mut x350: u32 = 0; + let mut x351: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x350, &mut x351, 0x0, x349, x346); + let mut x352: u32 = 0; + let mut x353: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x352, &mut x353, x351, x347, x344); + let mut x354: u32 = 0; + let mut x355: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x354, &mut x355, x353, x345, x342); + let mut x356: u32 = 0; + let mut x357: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x356, &mut x357, x355, x343, x340); + let mut x358: u32 = 0; + let mut x359: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x358, &mut x359, x357, x341, x338); + let mut x360: u32 = 0; + let mut x361: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x360, &mut x361, x359, x339, x336); + let mut x362: u32 = 0; + let mut x363: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x362, &mut x363, x361, x337, x334); + let mut x364: u32 = 0; + let mut x365: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x364, &mut x365, 0x0, x316, x348); + let mut x366: u32 = 0; + let mut x367: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x366, &mut x367, x365, x318, x350); + let mut x368: u32 = 0; + let mut x369: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x368, &mut x369, x367, x320, x352); + let mut x370: u32 = 0; + let mut x371: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x370, &mut x371, x369, x322, x354); + let mut x372: u32 = 0; + let mut x373: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x372, &mut x373, x371, x324, x356); + let mut x374: u32 = 0; + let mut x375: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x374, &mut x375, x373, x326, x358); + let mut x376: u32 = 0; + let mut x377: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x376, &mut x377, x375, x328, x360); + let mut x378: u32 = 0; + let mut x379: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x378, &mut x379, x377, x330, x362); + let mut x380: u32 = 0; + let mut x381: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x380, &mut x381, x379, ((x331 as u32) + (x315 as u32)), ((x363 as u32) + x335)); + let mut x382: u32 = 0; + let mut x383: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x382, &mut x383, 0x0, x366, (arg1[6])); + let mut x384: u32 = 0; + let mut x385: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x384, &mut x385, x383, x368, (0x0 as u32)); + let mut x386: u32 = 0; + let mut x387: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x386, &mut x387, x385, x370, (0x0 as u32)); + let mut x388: u32 = 0; + let mut x389: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x388, &mut x389, x387, x372, (0x0 as u32)); + let mut x390: u32 = 0; + let mut x391: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x390, &mut x391, x389, x374, (0x0 as u32)); + let mut x392: u32 = 0; + let mut x393: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x392, &mut x393, x391, x376, (0x0 as u32)); + let mut x394: u32 = 0; + let mut x395: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x394, &mut x395, x393, x378, (0x0 as u32)); + let mut x396: u32 = 0; + let mut x397: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x396, &mut x397, x395, x380, (0x0 as u32)); + let mut x398: u32 = 0; + let mut x399: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x398, &mut x399, x382, 0xd2253531); + let mut x400: u32 = 0; + let mut x401: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x400, &mut x401, x398, 0xffffffff); + let mut x402: u32 = 0; + let mut x403: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x402, &mut x403, x398, 0xffffffff); + let mut x404: u32 = 0; + let mut x405: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x404, &mut x405, x398, 0xffffffff); + let mut x406: u32 = 0; + let mut x407: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x406, &mut x407, x398, 0xffffffff); + let mut x408: u32 = 0; + let mut x409: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x408, &mut x409, x398, 0xffffffff); + let mut x410: u32 = 0; + let mut x411: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x410, &mut x411, x398, 0xffffffff); + let mut x412: u32 = 0; + let mut x413: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x412, &mut x413, x398, 0xfffffffe); + let mut x414: u32 = 0; + let mut x415: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x414, &mut x415, x398, 0xfffffc2f); + let mut x416: u32 = 0; + let mut x417: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x416, &mut x417, 0x0, x415, x412); + let mut x418: u32 = 0; + let mut x419: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x418, &mut x419, x417, x413, x410); + let mut x420: u32 = 0; + let mut x421: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x420, &mut x421, x419, x411, x408); + let mut x422: u32 = 0; + let mut x423: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x422, &mut x423, x421, x409, x406); + let mut x424: u32 = 0; + let mut x425: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x424, &mut x425, x423, x407, x404); + let mut x426: u32 = 0; + let mut x427: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x426, &mut x427, x425, x405, x402); + let mut x428: u32 = 0; + let mut x429: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x428, &mut x429, x427, x403, x400); + let mut x430: u32 = 0; + let mut x431: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x430, &mut x431, 0x0, x382, x414); + let mut x432: u32 = 0; + let mut x433: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x432, &mut x433, x431, x384, x416); + let mut x434: u32 = 0; + let mut x435: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x434, &mut x435, x433, x386, x418); + let mut x436: u32 = 0; + let mut x437: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x436, &mut x437, x435, x388, x420); + let mut x438: u32 = 0; + let mut x439: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x438, &mut x439, x437, x390, x422); + let mut x440: u32 = 0; + let mut x441: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x440, &mut x441, x439, x392, x424); + let mut x442: u32 = 0; + let mut x443: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x442, &mut x443, x441, x394, x426); + let mut x444: u32 = 0; + let mut x445: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x444, &mut x445, x443, x396, x428); + let mut x446: u32 = 0; + let mut x447: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x446, &mut x447, x445, ((x397 as u32) + (x381 as u32)), ((x429 as u32) + x401)); + let mut x448: u32 = 0; + let mut x449: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x448, &mut x449, 0x0, x432, (arg1[7])); + let mut x450: u32 = 0; + let mut x451: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x450, &mut x451, x449, x434, (0x0 as u32)); + let mut x452: u32 = 0; + let mut x453: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x452, &mut x453, x451, x436, (0x0 as u32)); + let mut x454: u32 = 0; + let mut x455: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x454, &mut x455, x453, x438, (0x0 as u32)); + let mut x456: u32 = 0; + let mut x457: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x456, &mut x457, x455, x440, (0x0 as u32)); + let mut x458: u32 = 0; + let mut x459: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x458, &mut x459, x457, x442, (0x0 as u32)); + let mut x460: u32 = 0; + let mut x461: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x460, &mut x461, x459, x444, (0x0 as u32)); + let mut x462: u32 = 0; + let mut x463: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x462, &mut x463, x461, x446, (0x0 as u32)); + let mut x464: u32 = 0; + let mut x465: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x464, &mut x465, x448, 0xd2253531); + let mut x466: u32 = 0; + let mut x467: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x466, &mut x467, x464, 0xffffffff); + let mut x468: u32 = 0; + let mut x469: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x468, &mut x469, x464, 0xffffffff); + let mut x470: u32 = 0; + let mut x471: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x470, &mut x471, x464, 0xffffffff); + let mut x472: u32 = 0; + let mut x473: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x472, &mut x473, x464, 0xffffffff); + let mut x474: u32 = 0; + let mut x475: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x474, &mut x475, x464, 0xffffffff); + let mut x476: u32 = 0; + let mut x477: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x476, &mut x477, x464, 0xffffffff); + let mut x478: u32 = 0; + let mut x479: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x478, &mut x479, x464, 0xfffffffe); + let mut x480: u32 = 0; + let mut x481: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x480, &mut x481, x464, 0xfffffc2f); + let mut x482: u32 = 0; + let mut x483: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x482, &mut x483, 0x0, x481, x478); + let mut x484: u32 = 0; + let mut x485: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x484, &mut x485, x483, x479, x476); + let mut x486: u32 = 0; + let mut x487: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x486, &mut x487, x485, x477, x474); + let mut x488: u32 = 0; + let mut x489: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x488, &mut x489, x487, x475, x472); + let mut x490: u32 = 0; + let mut x491: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x490, &mut x491, x489, x473, x470); + let mut x492: u32 = 0; + let mut x493: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x492, &mut x493, x491, x471, x468); + let mut x494: u32 = 0; + let mut x495: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x494, &mut x495, x493, x469, x466); + let mut x496: u32 = 0; + let mut x497: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x496, &mut x497, 0x0, x448, x480); + let mut x498: u32 = 0; + let mut x499: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x498, &mut x499, x497, x450, x482); + let mut x500: u32 = 0; + let mut x501: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x500, &mut x501, x499, x452, x484); + let mut x502: u32 = 0; + let mut x503: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x502, &mut x503, x501, x454, x486); + let mut x504: u32 = 0; + let mut x505: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x504, &mut x505, x503, x456, x488); + let mut x506: u32 = 0; + let mut x507: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x506, &mut x507, x505, x458, x490); + let mut x508: u32 = 0; + let mut x509: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x508, &mut x509, x507, x460, x492); + let mut x510: u32 = 0; + let mut x511: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x510, &mut x511, x509, x462, x494); + let mut x512: u32 = 0; + let mut x513: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x512, &mut x513, x511, ((x463 as u32) + (x447 as u32)), ((x495 as u32) + x467)); + let mut x514: u32 = 0; + let mut x515: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x514, &mut x515, 0x0, x498, 0xfffffc2f); + let mut x516: u32 = 0; + let mut x517: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x516, &mut x517, x515, x500, 0xfffffffe); + let mut x518: u32 = 0; + let mut x519: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x518, &mut x519, x517, x502, 0xffffffff); + let mut x520: u32 = 0; + let mut x521: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x520, &mut x521, x519, x504, 0xffffffff); + let mut x522: u32 = 0; + let mut x523: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x522, &mut x523, x521, x506, 0xffffffff); + let mut x524: u32 = 0; + let mut x525: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x524, &mut x525, x523, x508, 0xffffffff); + let mut x526: u32 = 0; + let mut x527: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x526, &mut x527, x525, x510, 0xffffffff); + let mut x528: u32 = 0; + let mut x529: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x528, &mut x529, x527, x512, 0xffffffff); + let mut x530: u32 = 0; + let mut x531: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x530, &mut x531, x529, (x513 as u32), (0x0 as u32)); + let mut x532: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x532, x531, x514, x498); + let mut x533: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x533, x531, x516, x500); + let mut x534: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x534, x531, x518, x502); + let mut x535: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x535, x531, x520, x504); + let mut x536: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x536, x531, x522, x506); + let mut x537: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x537, x531, x524, x508); + let mut x538: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x538, x531, x526, x510); + let mut x539: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x539, x531, x528, x512); + out1[0] = x532; + out1[1] = x533; + out1[2] = x534; + out1[3] = x535; + out1[4] = x536; + out1[5] = x537; + out1[6] = x538; + out1[7] = x539; +} + +/// The function fiat_secp256k1_to_montgomery translates a field element into the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = eval arg1 mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_secp256k1_to_montgomery(out1: &mut fiat_secp256k1_montgomery_domain_field_element, arg1: &fiat_secp256k1_non_montgomery_domain_field_element) -> () { + let x1: u32 = (arg1[1]); + let x2: u32 = (arg1[2]); + let x3: u32 = (arg1[3]); + let x4: u32 = (arg1[4]); + let x5: u32 = (arg1[5]); + let x6: u32 = (arg1[6]); + let x7: u32 = (arg1[7]); + let x8: u32 = (arg1[0]); + let mut x9: u32 = 0; + let mut x10: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x9, &mut x10, x8, 0x7a2); + let mut x11: u32 = 0; + let mut x12: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x11, &mut x12, x8, 0xe90a1); + let mut x13: u32 = 0; + let mut x14: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x13, &mut x14, 0x0, x12, x9); + let mut x15: u32 = 0; + let mut x16: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x15, &mut x16, x14, x10, x8); + let mut x17: u32 = 0; + let mut x18: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x17, &mut x18, x11, 0xd2253531); + let mut x19: u32 = 0; + let mut x20: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x19, &mut x20, x17, 0xffffffff); + let mut x21: u32 = 0; + let mut x22: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x21, &mut x22, x17, 0xffffffff); + let mut x23: u32 = 0; + let mut x24: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x23, &mut x24, x17, 0xffffffff); + let mut x25: u32 = 0; + let mut x26: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x25, &mut x26, x17, 0xffffffff); + let mut x27: u32 = 0; + let mut x28: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x27, &mut x28, x17, 0xffffffff); + let mut x29: u32 = 0; + let mut x30: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x29, &mut x30, x17, 0xffffffff); + let mut x31: u32 = 0; + let mut x32: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x31, &mut x32, x17, 0xfffffffe); + let mut x33: u32 = 0; + let mut x34: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x33, &mut x34, x17, 0xfffffc2f); + let mut x35: u32 = 0; + let mut x36: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x35, &mut x36, 0x0, x34, x31); + let mut x37: u32 = 0; + let mut x38: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x37, &mut x38, x36, x32, x29); + let mut x39: u32 = 0; + let mut x40: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x39, &mut x40, x38, x30, x27); + let mut x41: u32 = 0; + let mut x42: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x41, &mut x42, x40, x28, x25); + let mut x43: u32 = 0; + let mut x44: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x43, &mut x44, x42, x26, x23); + let mut x45: u32 = 0; + let mut x46: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x45, &mut x46, x44, x24, x21); + let mut x47: u32 = 0; + let mut x48: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x47, &mut x48, x46, x22, x19); + let mut x49: u32 = 0; + let mut x50: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x49, &mut x50, 0x0, x11, x33); + let mut x51: u32 = 0; + let mut x52: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x51, &mut x52, x50, x13, x35); + let mut x53: u32 = 0; + let mut x54: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x53, &mut x54, x52, x15, x37); + let mut x55: u32 = 0; + let mut x56: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x55, &mut x56, x54, (x16 as u32), x39); + let mut x57: u32 = 0; + let mut x58: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x57, &mut x58, x56, (0x0 as u32), x41); + let mut x59: u32 = 0; + let mut x60: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x59, &mut x60, x58, (0x0 as u32), x43); + let mut x61: u32 = 0; + let mut x62: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x61, &mut x62, x60, (0x0 as u32), x45); + let mut x63: u32 = 0; + let mut x64: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x63, &mut x64, x62, (0x0 as u32), x47); + let mut x65: u32 = 0; + let mut x66: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x65, &mut x66, x64, (0x0 as u32), ((x48 as u32) + x20)); + let mut x67: u32 = 0; + let mut x68: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x67, &mut x68, x1, 0x7a2); + let mut x69: u32 = 0; + let mut x70: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x69, &mut x70, x1, 0xe90a1); + let mut x71: u32 = 0; + let mut x72: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x71, &mut x72, 0x0, x70, x67); + let mut x73: u32 = 0; + let mut x74: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x73, &mut x74, x72, x68, x1); + let mut x75: u32 = 0; + let mut x76: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x75, &mut x76, 0x0, x51, x69); + let mut x77: u32 = 0; + let mut x78: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x77, &mut x78, x76, x53, x71); + let mut x79: u32 = 0; + let mut x80: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x79, &mut x80, x78, x55, x73); + let mut x81: u32 = 0; + let mut x82: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x81, &mut x82, x80, x57, (x74 as u32)); + let mut x83: u32 = 0; + let mut x84: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x83, &mut x84, x82, x59, (0x0 as u32)); + let mut x85: u32 = 0; + let mut x86: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x85, &mut x86, x84, x61, (0x0 as u32)); + let mut x87: u32 = 0; + let mut x88: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x87, &mut x88, x86, x63, (0x0 as u32)); + let mut x89: u32 = 0; + let mut x90: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x89, &mut x90, x88, x65, (0x0 as u32)); + let mut x91: u32 = 0; + let mut x92: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x91, &mut x92, x75, 0xd2253531); + let mut x93: u32 = 0; + let mut x94: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x93, &mut x94, x91, 0xffffffff); + let mut x95: u32 = 0; + let mut x96: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x95, &mut x96, x91, 0xffffffff); + let mut x97: u32 = 0; + let mut x98: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x97, &mut x98, x91, 0xffffffff); + let mut x99: u32 = 0; + let mut x100: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x99, &mut x100, x91, 0xffffffff); + let mut x101: u32 = 0; + let mut x102: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x101, &mut x102, x91, 0xffffffff); + let mut x103: u32 = 0; + let mut x104: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x103, &mut x104, x91, 0xffffffff); + let mut x105: u32 = 0; + let mut x106: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x105, &mut x106, x91, 0xfffffffe); + let mut x107: u32 = 0; + let mut x108: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x107, &mut x108, x91, 0xfffffc2f); + let mut x109: u32 = 0; + let mut x110: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x109, &mut x110, 0x0, x108, x105); + let mut x111: u32 = 0; + let mut x112: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x111, &mut x112, x110, x106, x103); + let mut x113: u32 = 0; + let mut x114: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x113, &mut x114, x112, x104, x101); + let mut x115: u32 = 0; + let mut x116: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x115, &mut x116, x114, x102, x99); + let mut x117: u32 = 0; + let mut x118: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x117, &mut x118, x116, x100, x97); + let mut x119: u32 = 0; + let mut x120: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x119, &mut x120, x118, x98, x95); + let mut x121: u32 = 0; + let mut x122: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x121, &mut x122, x120, x96, x93); + let mut x123: u32 = 0; + let mut x124: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x123, &mut x124, 0x0, x75, x107); + let mut x125: u32 = 0; + let mut x126: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x125, &mut x126, x124, x77, x109); + let mut x127: u32 = 0; + let mut x128: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x127, &mut x128, x126, x79, x111); + let mut x129: u32 = 0; + let mut x130: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x129, &mut x130, x128, x81, x113); + let mut x131: u32 = 0; + let mut x132: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x131, &mut x132, x130, x83, x115); + let mut x133: u32 = 0; + let mut x134: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x133, &mut x134, x132, x85, x117); + let mut x135: u32 = 0; + let mut x136: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x135, &mut x136, x134, x87, x119); + let mut x137: u32 = 0; + let mut x138: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x137, &mut x138, x136, x89, x121); + let mut x139: u32 = 0; + let mut x140: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x139, &mut x140, x138, ((x90 as u32) + (x66 as u32)), ((x122 as u32) + x94)); + let mut x141: u32 = 0; + let mut x142: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x141, &mut x142, x2, 0x7a2); + let mut x143: u32 = 0; + let mut x144: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x143, &mut x144, x2, 0xe90a1); + let mut x145: u32 = 0; + let mut x146: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x145, &mut x146, 0x0, x144, x141); + let mut x147: u32 = 0; + let mut x148: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x147, &mut x148, x146, x142, x2); + let mut x149: u32 = 0; + let mut x150: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x149, &mut x150, 0x0, x125, x143); + let mut x151: u32 = 0; + let mut x152: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x151, &mut x152, x150, x127, x145); + let mut x153: u32 = 0; + let mut x154: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x153, &mut x154, x152, x129, x147); + let mut x155: u32 = 0; + let mut x156: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x155, &mut x156, x154, x131, (x148 as u32)); + let mut x157: u32 = 0; + let mut x158: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x157, &mut x158, x156, x133, (0x0 as u32)); + let mut x159: u32 = 0; + let mut x160: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x159, &mut x160, x158, x135, (0x0 as u32)); + let mut x161: u32 = 0; + let mut x162: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x161, &mut x162, x160, x137, (0x0 as u32)); + let mut x163: u32 = 0; + let mut x164: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x163, &mut x164, x162, x139, (0x0 as u32)); + let mut x165: u32 = 0; + let mut x166: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x165, &mut x166, x149, 0xd2253531); + let mut x167: u32 = 0; + let mut x168: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x167, &mut x168, x165, 0xffffffff); + let mut x169: u32 = 0; + let mut x170: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x169, &mut x170, x165, 0xffffffff); + let mut x171: u32 = 0; + let mut x172: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x171, &mut x172, x165, 0xffffffff); + let mut x173: u32 = 0; + let mut x174: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x173, &mut x174, x165, 0xffffffff); + let mut x175: u32 = 0; + let mut x176: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x175, &mut x176, x165, 0xffffffff); + let mut x177: u32 = 0; + let mut x178: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x177, &mut x178, x165, 0xffffffff); + let mut x179: u32 = 0; + let mut x180: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x179, &mut x180, x165, 0xfffffffe); + let mut x181: u32 = 0; + let mut x182: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x181, &mut x182, x165, 0xfffffc2f); + let mut x183: u32 = 0; + let mut x184: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x183, &mut x184, 0x0, x182, x179); + let mut x185: u32 = 0; + let mut x186: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x185, &mut x186, x184, x180, x177); + let mut x187: u32 = 0; + let mut x188: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x187, &mut x188, x186, x178, x175); + let mut x189: u32 = 0; + let mut x190: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x189, &mut x190, x188, x176, x173); + let mut x191: u32 = 0; + let mut x192: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x191, &mut x192, x190, x174, x171); + let mut x193: u32 = 0; + let mut x194: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x193, &mut x194, x192, x172, x169); + let mut x195: u32 = 0; + let mut x196: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x195, &mut x196, x194, x170, x167); + let mut x197: u32 = 0; + let mut x198: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x197, &mut x198, 0x0, x149, x181); + let mut x199: u32 = 0; + let mut x200: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x199, &mut x200, x198, x151, x183); + let mut x201: u32 = 0; + let mut x202: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x201, &mut x202, x200, x153, x185); + let mut x203: u32 = 0; + let mut x204: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x203, &mut x204, x202, x155, x187); + let mut x205: u32 = 0; + let mut x206: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x205, &mut x206, x204, x157, x189); + let mut x207: u32 = 0; + let mut x208: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x207, &mut x208, x206, x159, x191); + let mut x209: u32 = 0; + let mut x210: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x209, &mut x210, x208, x161, x193); + let mut x211: u32 = 0; + let mut x212: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x211, &mut x212, x210, x163, x195); + let mut x213: u32 = 0; + let mut x214: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x213, &mut x214, x212, ((x164 as u32) + (x140 as u32)), ((x196 as u32) + x168)); + let mut x215: u32 = 0; + let mut x216: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x215, &mut x216, x3, 0x7a2); + let mut x217: u32 = 0; + let mut x218: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x217, &mut x218, x3, 0xe90a1); + let mut x219: u32 = 0; + let mut x220: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x219, &mut x220, 0x0, x218, x215); + let mut x221: u32 = 0; + let mut x222: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x221, &mut x222, x220, x216, x3); + let mut x223: u32 = 0; + let mut x224: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x223, &mut x224, 0x0, x199, x217); + let mut x225: u32 = 0; + let mut x226: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x225, &mut x226, x224, x201, x219); + let mut x227: u32 = 0; + let mut x228: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x227, &mut x228, x226, x203, x221); + let mut x229: u32 = 0; + let mut x230: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x229, &mut x230, x228, x205, (x222 as u32)); + let mut x231: u32 = 0; + let mut x232: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x231, &mut x232, x230, x207, (0x0 as u32)); + let mut x233: u32 = 0; + let mut x234: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x233, &mut x234, x232, x209, (0x0 as u32)); + let mut x235: u32 = 0; + let mut x236: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x235, &mut x236, x234, x211, (0x0 as u32)); + let mut x237: u32 = 0; + let mut x238: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x237, &mut x238, x236, x213, (0x0 as u32)); + let mut x239: u32 = 0; + let mut x240: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x239, &mut x240, x223, 0xd2253531); + let mut x241: u32 = 0; + let mut x242: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x241, &mut x242, x239, 0xffffffff); + let mut x243: u32 = 0; + let mut x244: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x243, &mut x244, x239, 0xffffffff); + let mut x245: u32 = 0; + let mut x246: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x245, &mut x246, x239, 0xffffffff); + let mut x247: u32 = 0; + let mut x248: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x247, &mut x248, x239, 0xffffffff); + let mut x249: u32 = 0; + let mut x250: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x249, &mut x250, x239, 0xffffffff); + let mut x251: u32 = 0; + let mut x252: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x251, &mut x252, x239, 0xffffffff); + let mut x253: u32 = 0; + let mut x254: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x253, &mut x254, x239, 0xfffffffe); + let mut x255: u32 = 0; + let mut x256: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x255, &mut x256, x239, 0xfffffc2f); + let mut x257: u32 = 0; + let mut x258: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x257, &mut x258, 0x0, x256, x253); + let mut x259: u32 = 0; + let mut x260: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x259, &mut x260, x258, x254, x251); + let mut x261: u32 = 0; + let mut x262: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x261, &mut x262, x260, x252, x249); + let mut x263: u32 = 0; + let mut x264: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x263, &mut x264, x262, x250, x247); + let mut x265: u32 = 0; + let mut x266: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x265, &mut x266, x264, x248, x245); + let mut x267: u32 = 0; + let mut x268: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x267, &mut x268, x266, x246, x243); + let mut x269: u32 = 0; + let mut x270: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x269, &mut x270, x268, x244, x241); + let mut x271: u32 = 0; + let mut x272: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x271, &mut x272, 0x0, x223, x255); + let mut x273: u32 = 0; + let mut x274: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x273, &mut x274, x272, x225, x257); + let mut x275: u32 = 0; + let mut x276: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x275, &mut x276, x274, x227, x259); + let mut x277: u32 = 0; + let mut x278: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x277, &mut x278, x276, x229, x261); + let mut x279: u32 = 0; + let mut x280: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x279, &mut x280, x278, x231, x263); + let mut x281: u32 = 0; + let mut x282: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x281, &mut x282, x280, x233, x265); + let mut x283: u32 = 0; + let mut x284: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x283, &mut x284, x282, x235, x267); + let mut x285: u32 = 0; + let mut x286: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x285, &mut x286, x284, x237, x269); + let mut x287: u32 = 0; + let mut x288: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x287, &mut x288, x286, ((x238 as u32) + (x214 as u32)), ((x270 as u32) + x242)); + let mut x289: u32 = 0; + let mut x290: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x289, &mut x290, x4, 0x7a2); + let mut x291: u32 = 0; + let mut x292: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x291, &mut x292, x4, 0xe90a1); + let mut x293: u32 = 0; + let mut x294: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x293, &mut x294, 0x0, x292, x289); + let mut x295: u32 = 0; + let mut x296: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x295, &mut x296, x294, x290, x4); + let mut x297: u32 = 0; + let mut x298: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x297, &mut x298, 0x0, x273, x291); + let mut x299: u32 = 0; + let mut x300: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x299, &mut x300, x298, x275, x293); + let mut x301: u32 = 0; + let mut x302: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x301, &mut x302, x300, x277, x295); + let mut x303: u32 = 0; + let mut x304: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x303, &mut x304, x302, x279, (x296 as u32)); + let mut x305: u32 = 0; + let mut x306: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x305, &mut x306, x304, x281, (0x0 as u32)); + let mut x307: u32 = 0; + let mut x308: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x307, &mut x308, x306, x283, (0x0 as u32)); + let mut x309: u32 = 0; + let mut x310: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x309, &mut x310, x308, x285, (0x0 as u32)); + let mut x311: u32 = 0; + let mut x312: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x311, &mut x312, x310, x287, (0x0 as u32)); + let mut x313: u32 = 0; + let mut x314: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x313, &mut x314, x297, 0xd2253531); + let mut x315: u32 = 0; + let mut x316: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x315, &mut x316, x313, 0xffffffff); + let mut x317: u32 = 0; + let mut x318: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x317, &mut x318, x313, 0xffffffff); + let mut x319: u32 = 0; + let mut x320: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x319, &mut x320, x313, 0xffffffff); + let mut x321: u32 = 0; + let mut x322: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x321, &mut x322, x313, 0xffffffff); + let mut x323: u32 = 0; + let mut x324: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x323, &mut x324, x313, 0xffffffff); + let mut x325: u32 = 0; + let mut x326: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x325, &mut x326, x313, 0xffffffff); + let mut x327: u32 = 0; + let mut x328: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x327, &mut x328, x313, 0xfffffffe); + let mut x329: u32 = 0; + let mut x330: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x329, &mut x330, x313, 0xfffffc2f); + let mut x331: u32 = 0; + let mut x332: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x331, &mut x332, 0x0, x330, x327); + let mut x333: u32 = 0; + let mut x334: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x333, &mut x334, x332, x328, x325); + let mut x335: u32 = 0; + let mut x336: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x335, &mut x336, x334, x326, x323); + let mut x337: u32 = 0; + let mut x338: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x337, &mut x338, x336, x324, x321); + let mut x339: u32 = 0; + let mut x340: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x339, &mut x340, x338, x322, x319); + let mut x341: u32 = 0; + let mut x342: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x341, &mut x342, x340, x320, x317); + let mut x343: u32 = 0; + let mut x344: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x343, &mut x344, x342, x318, x315); + let mut x345: u32 = 0; + let mut x346: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x345, &mut x346, 0x0, x297, x329); + let mut x347: u32 = 0; + let mut x348: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x347, &mut x348, x346, x299, x331); + let mut x349: u32 = 0; + let mut x350: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x349, &mut x350, x348, x301, x333); + let mut x351: u32 = 0; + let mut x352: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x351, &mut x352, x350, x303, x335); + let mut x353: u32 = 0; + let mut x354: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x353, &mut x354, x352, x305, x337); + let mut x355: u32 = 0; + let mut x356: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x355, &mut x356, x354, x307, x339); + let mut x357: u32 = 0; + let mut x358: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x357, &mut x358, x356, x309, x341); + let mut x359: u32 = 0; + let mut x360: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x359, &mut x360, x358, x311, x343); + let mut x361: u32 = 0; + let mut x362: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x361, &mut x362, x360, ((x312 as u32) + (x288 as u32)), ((x344 as u32) + x316)); + let mut x363: u32 = 0; + let mut x364: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x363, &mut x364, x5, 0x7a2); + let mut x365: u32 = 0; + let mut x366: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x365, &mut x366, x5, 0xe90a1); + let mut x367: u32 = 0; + let mut x368: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x367, &mut x368, 0x0, x366, x363); + let mut x369: u32 = 0; + let mut x370: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x369, &mut x370, x368, x364, x5); + let mut x371: u32 = 0; + let mut x372: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x371, &mut x372, 0x0, x347, x365); + let mut x373: u32 = 0; + let mut x374: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x373, &mut x374, x372, x349, x367); + let mut x375: u32 = 0; + let mut x376: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x375, &mut x376, x374, x351, x369); + let mut x377: u32 = 0; + let mut x378: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x377, &mut x378, x376, x353, (x370 as u32)); + let mut x379: u32 = 0; + let mut x380: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x379, &mut x380, x378, x355, (0x0 as u32)); + let mut x381: u32 = 0; + let mut x382: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x381, &mut x382, x380, x357, (0x0 as u32)); + let mut x383: u32 = 0; + let mut x384: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x383, &mut x384, x382, x359, (0x0 as u32)); + let mut x385: u32 = 0; + let mut x386: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x385, &mut x386, x384, x361, (0x0 as u32)); + let mut x387: u32 = 0; + let mut x388: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x387, &mut x388, x371, 0xd2253531); + let mut x389: u32 = 0; + let mut x390: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x389, &mut x390, x387, 0xffffffff); + let mut x391: u32 = 0; + let mut x392: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x391, &mut x392, x387, 0xffffffff); + let mut x393: u32 = 0; + let mut x394: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x393, &mut x394, x387, 0xffffffff); + let mut x395: u32 = 0; + let mut x396: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x395, &mut x396, x387, 0xffffffff); + let mut x397: u32 = 0; + let mut x398: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x397, &mut x398, x387, 0xffffffff); + let mut x399: u32 = 0; + let mut x400: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x399, &mut x400, x387, 0xffffffff); + let mut x401: u32 = 0; + let mut x402: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x401, &mut x402, x387, 0xfffffffe); + let mut x403: u32 = 0; + let mut x404: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x403, &mut x404, x387, 0xfffffc2f); + let mut x405: u32 = 0; + let mut x406: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x405, &mut x406, 0x0, x404, x401); + let mut x407: u32 = 0; + let mut x408: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x407, &mut x408, x406, x402, x399); + let mut x409: u32 = 0; + let mut x410: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x409, &mut x410, x408, x400, x397); + let mut x411: u32 = 0; + let mut x412: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x411, &mut x412, x410, x398, x395); + let mut x413: u32 = 0; + let mut x414: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x413, &mut x414, x412, x396, x393); + let mut x415: u32 = 0; + let mut x416: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x415, &mut x416, x414, x394, x391); + let mut x417: u32 = 0; + let mut x418: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x417, &mut x418, x416, x392, x389); + let mut x419: u32 = 0; + let mut x420: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x419, &mut x420, 0x0, x371, x403); + let mut x421: u32 = 0; + let mut x422: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x421, &mut x422, x420, x373, x405); + let mut x423: u32 = 0; + let mut x424: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x423, &mut x424, x422, x375, x407); + let mut x425: u32 = 0; + let mut x426: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x425, &mut x426, x424, x377, x409); + let mut x427: u32 = 0; + let mut x428: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x427, &mut x428, x426, x379, x411); + let mut x429: u32 = 0; + let mut x430: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x429, &mut x430, x428, x381, x413); + let mut x431: u32 = 0; + let mut x432: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x431, &mut x432, x430, x383, x415); + let mut x433: u32 = 0; + let mut x434: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x433, &mut x434, x432, x385, x417); + let mut x435: u32 = 0; + let mut x436: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x435, &mut x436, x434, ((x386 as u32) + (x362 as u32)), ((x418 as u32) + x390)); + let mut x437: u32 = 0; + let mut x438: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x437, &mut x438, x6, 0x7a2); + let mut x439: u32 = 0; + let mut x440: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x439, &mut x440, x6, 0xe90a1); + let mut x441: u32 = 0; + let mut x442: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x441, &mut x442, 0x0, x440, x437); + let mut x443: u32 = 0; + let mut x444: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x443, &mut x444, x442, x438, x6); + let mut x445: u32 = 0; + let mut x446: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x445, &mut x446, 0x0, x421, x439); + let mut x447: u32 = 0; + let mut x448: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x447, &mut x448, x446, x423, x441); + let mut x449: u32 = 0; + let mut x450: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x449, &mut x450, x448, x425, x443); + let mut x451: u32 = 0; + let mut x452: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x451, &mut x452, x450, x427, (x444 as u32)); + let mut x453: u32 = 0; + let mut x454: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x453, &mut x454, x452, x429, (0x0 as u32)); + let mut x455: u32 = 0; + let mut x456: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x455, &mut x456, x454, x431, (0x0 as u32)); + let mut x457: u32 = 0; + let mut x458: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x457, &mut x458, x456, x433, (0x0 as u32)); + let mut x459: u32 = 0; + let mut x460: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x459, &mut x460, x458, x435, (0x0 as u32)); + let mut x461: u32 = 0; + let mut x462: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x461, &mut x462, x445, 0xd2253531); + let mut x463: u32 = 0; + let mut x464: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x463, &mut x464, x461, 0xffffffff); + let mut x465: u32 = 0; + let mut x466: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x465, &mut x466, x461, 0xffffffff); + let mut x467: u32 = 0; + let mut x468: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x467, &mut x468, x461, 0xffffffff); + let mut x469: u32 = 0; + let mut x470: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x469, &mut x470, x461, 0xffffffff); + let mut x471: u32 = 0; + let mut x472: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x471, &mut x472, x461, 0xffffffff); + let mut x473: u32 = 0; + let mut x474: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x473, &mut x474, x461, 0xffffffff); + let mut x475: u32 = 0; + let mut x476: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x475, &mut x476, x461, 0xfffffffe); + let mut x477: u32 = 0; + let mut x478: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x477, &mut x478, x461, 0xfffffc2f); + let mut x479: u32 = 0; + let mut x480: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x479, &mut x480, 0x0, x478, x475); + let mut x481: u32 = 0; + let mut x482: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x481, &mut x482, x480, x476, x473); + let mut x483: u32 = 0; + let mut x484: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x483, &mut x484, x482, x474, x471); + let mut x485: u32 = 0; + let mut x486: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x485, &mut x486, x484, x472, x469); + let mut x487: u32 = 0; + let mut x488: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x487, &mut x488, x486, x470, x467); + let mut x489: u32 = 0; + let mut x490: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x489, &mut x490, x488, x468, x465); + let mut x491: u32 = 0; + let mut x492: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x491, &mut x492, x490, x466, x463); + let mut x493: u32 = 0; + let mut x494: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x493, &mut x494, 0x0, x445, x477); + let mut x495: u32 = 0; + let mut x496: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x495, &mut x496, x494, x447, x479); + let mut x497: u32 = 0; + let mut x498: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x497, &mut x498, x496, x449, x481); + let mut x499: u32 = 0; + let mut x500: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x499, &mut x500, x498, x451, x483); + let mut x501: u32 = 0; + let mut x502: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x501, &mut x502, x500, x453, x485); + let mut x503: u32 = 0; + let mut x504: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x503, &mut x504, x502, x455, x487); + let mut x505: u32 = 0; + let mut x506: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x505, &mut x506, x504, x457, x489); + let mut x507: u32 = 0; + let mut x508: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x507, &mut x508, x506, x459, x491); + let mut x509: u32 = 0; + let mut x510: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x509, &mut x510, x508, ((x460 as u32) + (x436 as u32)), ((x492 as u32) + x464)); + let mut x511: u32 = 0; + let mut x512: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x511, &mut x512, x7, 0x7a2); + let mut x513: u32 = 0; + let mut x514: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x513, &mut x514, x7, 0xe90a1); + let mut x515: u32 = 0; + let mut x516: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x515, &mut x516, 0x0, x514, x511); + let mut x517: u32 = 0; + let mut x518: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x517, &mut x518, x516, x512, x7); + let mut x519: u32 = 0; + let mut x520: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x519, &mut x520, 0x0, x495, x513); + let mut x521: u32 = 0; + let mut x522: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x521, &mut x522, x520, x497, x515); + let mut x523: u32 = 0; + let mut x524: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x523, &mut x524, x522, x499, x517); + let mut x525: u32 = 0; + let mut x526: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x525, &mut x526, x524, x501, (x518 as u32)); + let mut x527: u32 = 0; + let mut x528: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x527, &mut x528, x526, x503, (0x0 as u32)); + let mut x529: u32 = 0; + let mut x530: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x529, &mut x530, x528, x505, (0x0 as u32)); + let mut x531: u32 = 0; + let mut x532: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x531, &mut x532, x530, x507, (0x0 as u32)); + let mut x533: u32 = 0; + let mut x534: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x533, &mut x534, x532, x509, (0x0 as u32)); + let mut x535: u32 = 0; + let mut x536: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x535, &mut x536, x519, 0xd2253531); + let mut x537: u32 = 0; + let mut x538: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x537, &mut x538, x535, 0xffffffff); + let mut x539: u32 = 0; + let mut x540: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x539, &mut x540, x535, 0xffffffff); + let mut x541: u32 = 0; + let mut x542: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x541, &mut x542, x535, 0xffffffff); + let mut x543: u32 = 0; + let mut x544: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x543, &mut x544, x535, 0xffffffff); + let mut x545: u32 = 0; + let mut x546: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x545, &mut x546, x535, 0xffffffff); + let mut x547: u32 = 0; + let mut x548: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x547, &mut x548, x535, 0xffffffff); + let mut x549: u32 = 0; + let mut x550: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x549, &mut x550, x535, 0xfffffffe); + let mut x551: u32 = 0; + let mut x552: u32 = 0; + fiat_secp256k1_mulx_u32(&mut x551, &mut x552, x535, 0xfffffc2f); + let mut x553: u32 = 0; + let mut x554: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x553, &mut x554, 0x0, x552, x549); + let mut x555: u32 = 0; + let mut x556: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x555, &mut x556, x554, x550, x547); + let mut x557: u32 = 0; + let mut x558: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x557, &mut x558, x556, x548, x545); + let mut x559: u32 = 0; + let mut x560: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x559, &mut x560, x558, x546, x543); + let mut x561: u32 = 0; + let mut x562: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x561, &mut x562, x560, x544, x541); + let mut x563: u32 = 0; + let mut x564: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x563, &mut x564, x562, x542, x539); + let mut x565: u32 = 0; + let mut x566: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x565, &mut x566, x564, x540, x537); + let mut x567: u32 = 0; + let mut x568: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x567, &mut x568, 0x0, x519, x551); + let mut x569: u32 = 0; + let mut x570: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x569, &mut x570, x568, x521, x553); + let mut x571: u32 = 0; + let mut x572: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x571, &mut x572, x570, x523, x555); + let mut x573: u32 = 0; + let mut x574: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x573, &mut x574, x572, x525, x557); + let mut x575: u32 = 0; + let mut x576: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x575, &mut x576, x574, x527, x559); + let mut x577: u32 = 0; + let mut x578: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x577, &mut x578, x576, x529, x561); + let mut x579: u32 = 0; + let mut x580: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x579, &mut x580, x578, x531, x563); + let mut x581: u32 = 0; + let mut x582: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x581, &mut x582, x580, x533, x565); + let mut x583: u32 = 0; + let mut x584: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x583, &mut x584, x582, ((x534 as u32) + (x510 as u32)), ((x566 as u32) + x538)); + let mut x585: u32 = 0; + let mut x586: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x585, &mut x586, 0x0, x569, 0xfffffc2f); + let mut x587: u32 = 0; + let mut x588: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x587, &mut x588, x586, x571, 0xfffffffe); + let mut x589: u32 = 0; + let mut x590: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x589, &mut x590, x588, x573, 0xffffffff); + let mut x591: u32 = 0; + let mut x592: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x591, &mut x592, x590, x575, 0xffffffff); + let mut x593: u32 = 0; + let mut x594: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x593, &mut x594, x592, x577, 0xffffffff); + let mut x595: u32 = 0; + let mut x596: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x595, &mut x596, x594, x579, 0xffffffff); + let mut x597: u32 = 0; + let mut x598: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x597, &mut x598, x596, x581, 0xffffffff); + let mut x599: u32 = 0; + let mut x600: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x599, &mut x600, x598, x583, 0xffffffff); + let mut x601: u32 = 0; + let mut x602: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x601, &mut x602, x600, (x584 as u32), (0x0 as u32)); + let mut x603: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x603, x602, x585, x569); + let mut x604: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x604, x602, x587, x571); + let mut x605: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x605, x602, x589, x573); + let mut x606: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x606, x602, x591, x575); + let mut x607: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x607, x602, x593, x577); + let mut x608: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x608, x602, x595, x579); + let mut x609: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x609, x602, x597, x581); + let mut x610: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x610, x602, x599, x583); + out1[0] = x603; + out1[1] = x604; + out1[2] = x605; + out1[3] = x606; + out1[4] = x607; + out1[5] = x608; + out1[6] = x609; + out1[7] = x610; +} + +/// The function fiat_secp256k1_nonzero outputs a single non-zero word if the input is non-zero and zero otherwise. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// out1 = 0 ↔ eval (from_montgomery arg1) mod m = 0 +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +#[inline] +pub fn fiat_secp256k1_nonzero(out1: &mut u32, arg1: &[u32; 8]) -> () { + let x1: u32 = ((arg1[0]) | ((arg1[1]) | ((arg1[2]) | ((arg1[3]) | ((arg1[4]) | ((arg1[5]) | ((arg1[6]) | (arg1[7])))))))); + *out1 = x1; +} + +/// The function fiat_secp256k1_selectznz is a multi-limb conditional select. +/// +/// Postconditions: +/// out1 = (if arg1 = 0 then arg2 else arg3) +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// arg3: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +#[inline] +pub fn fiat_secp256k1_selectznz(out1: &mut [u32; 8], arg1: fiat_secp256k1_u1, arg2: &[u32; 8], arg3: &[u32; 8]) -> () { + let mut x1: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x1, arg1, (arg2[0]), (arg3[0])); + let mut x2: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x2, arg1, (arg2[1]), (arg3[1])); + let mut x3: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x3, arg1, (arg2[2]), (arg3[2])); + let mut x4: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x4, arg1, (arg2[3]), (arg3[3])); + let mut x5: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x5, arg1, (arg2[4]), (arg3[4])); + let mut x6: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x6, arg1, (arg2[5]), (arg3[5])); + let mut x7: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x7, arg1, (arg2[6]), (arg3[6])); + let mut x8: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x8, arg1, (arg2[7]), (arg3[7])); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; + out1[3] = x4; + out1[4] = x5; + out1[5] = x6; + out1[6] = x7; + out1[7] = x8; +} + +/// The function fiat_secp256k1_to_bytes serializes a field element NOT in the Montgomery domain to bytes in little-endian order. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..31] +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] +#[inline] +pub fn fiat_secp256k1_to_bytes(out1: &mut [u8; 32], arg1: &[u32; 8]) -> () { + let x1: u32 = (arg1[7]); + let x2: u32 = (arg1[6]); + let x3: u32 = (arg1[5]); + let x4: u32 = (arg1[4]); + let x5: u32 = (arg1[3]); + let x6: u32 = (arg1[2]); + let x7: u32 = (arg1[1]); + let x8: u32 = (arg1[0]); + let x9: u8 = ((x8 & (0xff as u32)) as u8); + let x10: u32 = (x8 >> 8); + let x11: u8 = ((x10 & (0xff as u32)) as u8); + let x12: u32 = (x10 >> 8); + let x13: u8 = ((x12 & (0xff as u32)) as u8); + let x14: u8 = ((x12 >> 8) as u8); + let x15: u8 = ((x7 & (0xff as u32)) as u8); + let x16: u32 = (x7 >> 8); + let x17: u8 = ((x16 & (0xff as u32)) as u8); + let x18: u32 = (x16 >> 8); + let x19: u8 = ((x18 & (0xff as u32)) as u8); + let x20: u8 = ((x18 >> 8) as u8); + let x21: u8 = ((x6 & (0xff as u32)) as u8); + let x22: u32 = (x6 >> 8); + let x23: u8 = ((x22 & (0xff as u32)) as u8); + let x24: u32 = (x22 >> 8); + let x25: u8 = ((x24 & (0xff as u32)) as u8); + let x26: u8 = ((x24 >> 8) as u8); + let x27: u8 = ((x5 & (0xff as u32)) as u8); + let x28: u32 = (x5 >> 8); + let x29: u8 = ((x28 & (0xff as u32)) as u8); + let x30: u32 = (x28 >> 8); + let x31: u8 = ((x30 & (0xff as u32)) as u8); + let x32: u8 = ((x30 >> 8) as u8); + let x33: u8 = ((x4 & (0xff as u32)) as u8); + let x34: u32 = (x4 >> 8); + let x35: u8 = ((x34 & (0xff as u32)) as u8); + let x36: u32 = (x34 >> 8); + let x37: u8 = ((x36 & (0xff as u32)) as u8); + let x38: u8 = ((x36 >> 8) as u8); + let x39: u8 = ((x3 & (0xff as u32)) as u8); + let x40: u32 = (x3 >> 8); + let x41: u8 = ((x40 & (0xff as u32)) as u8); + let x42: u32 = (x40 >> 8); + let x43: u8 = ((x42 & (0xff as u32)) as u8); + let x44: u8 = ((x42 >> 8) as u8); + let x45: u8 = ((x2 & (0xff as u32)) as u8); + let x46: u32 = (x2 >> 8); + let x47: u8 = ((x46 & (0xff as u32)) as u8); + let x48: u32 = (x46 >> 8); + let x49: u8 = ((x48 & (0xff as u32)) as u8); + let x50: u8 = ((x48 >> 8) as u8); + let x51: u8 = ((x1 & (0xff as u32)) as u8); + let x52: u32 = (x1 >> 8); + let x53: u8 = ((x52 & (0xff as u32)) as u8); + let x54: u32 = (x52 >> 8); + let x55: u8 = ((x54 & (0xff as u32)) as u8); + let x56: u8 = ((x54 >> 8) as u8); + out1[0] = x9; + out1[1] = x11; + out1[2] = x13; + out1[3] = x14; + out1[4] = x15; + out1[5] = x17; + out1[6] = x19; + out1[7] = x20; + out1[8] = x21; + out1[9] = x23; + out1[10] = x25; + out1[11] = x26; + out1[12] = x27; + out1[13] = x29; + out1[14] = x31; + out1[15] = x32; + out1[16] = x33; + out1[17] = x35; + out1[18] = x37; + out1[19] = x38; + out1[20] = x39; + out1[21] = x41; + out1[22] = x43; + out1[23] = x44; + out1[24] = x45; + out1[25] = x47; + out1[26] = x49; + out1[27] = x50; + out1[28] = x51; + out1[29] = x53; + out1[30] = x55; + out1[31] = x56; +} + +/// The function fiat_secp256k1_from_bytes deserializes a field element NOT in the Montgomery domain from bytes in little-endian order. +/// +/// Preconditions: +/// 0 ≤ bytes_eval arg1 < m +/// Postconditions: +/// eval out1 mod m = bytes_eval arg1 mod m +/// 0 ≤ eval out1 < m +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +#[inline] +pub fn fiat_secp256k1_from_bytes(out1: &mut [u32; 8], arg1: &[u8; 32]) -> () { + let x1: u32 = (((arg1[31]) as u32) << 24); + let x2: u32 = (((arg1[30]) as u32) << 16); + let x3: u32 = (((arg1[29]) as u32) << 8); + let x4: u8 = (arg1[28]); + let x5: u32 = (((arg1[27]) as u32) << 24); + let x6: u32 = (((arg1[26]) as u32) << 16); + let x7: u32 = (((arg1[25]) as u32) << 8); + let x8: u8 = (arg1[24]); + let x9: u32 = (((arg1[23]) as u32) << 24); + let x10: u32 = (((arg1[22]) as u32) << 16); + let x11: u32 = (((arg1[21]) as u32) << 8); + let x12: u8 = (arg1[20]); + let x13: u32 = (((arg1[19]) as u32) << 24); + let x14: u32 = (((arg1[18]) as u32) << 16); + let x15: u32 = (((arg1[17]) as u32) << 8); + let x16: u8 = (arg1[16]); + let x17: u32 = (((arg1[15]) as u32) << 24); + let x18: u32 = (((arg1[14]) as u32) << 16); + let x19: u32 = (((arg1[13]) as u32) << 8); + let x20: u8 = (arg1[12]); + let x21: u32 = (((arg1[11]) as u32) << 24); + let x22: u32 = (((arg1[10]) as u32) << 16); + let x23: u32 = (((arg1[9]) as u32) << 8); + let x24: u8 = (arg1[8]); + let x25: u32 = (((arg1[7]) as u32) << 24); + let x26: u32 = (((arg1[6]) as u32) << 16); + let x27: u32 = (((arg1[5]) as u32) << 8); + let x28: u8 = (arg1[4]); + let x29: u32 = (((arg1[3]) as u32) << 24); + let x30: u32 = (((arg1[2]) as u32) << 16); + let x31: u32 = (((arg1[1]) as u32) << 8); + let x32: u8 = (arg1[0]); + let x33: u32 = (x31 + (x32 as u32)); + let x34: u32 = (x30 + x33); + let x35: u32 = (x29 + x34); + let x36: u32 = (x27 + (x28 as u32)); + let x37: u32 = (x26 + x36); + let x38: u32 = (x25 + x37); + let x39: u32 = (x23 + (x24 as u32)); + let x40: u32 = (x22 + x39); + let x41: u32 = (x21 + x40); + let x42: u32 = (x19 + (x20 as u32)); + let x43: u32 = (x18 + x42); + let x44: u32 = (x17 + x43); + let x45: u32 = (x15 + (x16 as u32)); + let x46: u32 = (x14 + x45); + let x47: u32 = (x13 + x46); + let x48: u32 = (x11 + (x12 as u32)); + let x49: u32 = (x10 + x48); + let x50: u32 = (x9 + x49); + let x51: u32 = (x7 + (x8 as u32)); + let x52: u32 = (x6 + x51); + let x53: u32 = (x5 + x52); + let x54: u32 = (x3 + (x4 as u32)); + let x55: u32 = (x2 + x54); + let x56: u32 = (x1 + x55); + out1[0] = x35; + out1[1] = x38; + out1[2] = x41; + out1[3] = x44; + out1[4] = x47; + out1[5] = x50; + out1[6] = x53; + out1[7] = x56; +} + +/// The function fiat_secp256k1_set_one returns the field element one in the Montgomery domain. +/// +/// Postconditions: +/// eval (from_montgomery out1) mod m = 1 mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_secp256k1_set_one(out1: &mut fiat_secp256k1_montgomery_domain_field_element) -> () { + out1[0] = 0x3d1; + out1[1] = (0x1 as u32); + out1[2] = (0x0 as u32); + out1[3] = (0x0 as u32); + out1[4] = (0x0 as u32); + out1[5] = (0x0 as u32); + out1[6] = (0x0 as u32); + out1[7] = (0x0 as u32); +} + +/// The function fiat_secp256k1_msat returns the saturated representation of the prime modulus. +/// +/// Postconditions: +/// twos_complement_eval out1 = m +/// 0 ≤ eval out1 < m +/// +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +#[inline] +pub fn fiat_secp256k1_msat(out1: &mut [u32; 9]) -> () { + out1[0] = 0xfffffc2f; + out1[1] = 0xfffffffe; + out1[2] = 0xffffffff; + out1[3] = 0xffffffff; + out1[4] = 0xffffffff; + out1[5] = 0xffffffff; + out1[6] = 0xffffffff; + out1[7] = 0xffffffff; + out1[8] = (0x0 as u32); +} + +/// The function fiat_secp256k1_divstep computes a divstep. +/// +/// Preconditions: +/// 0 ≤ eval arg4 < m +/// 0 ≤ eval arg5 < m +/// Postconditions: +/// out1 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then 1 - arg1 else 1 + arg1) +/// twos_complement_eval out2 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then twos_complement_eval arg3 else twos_complement_eval arg2) +/// twos_complement_eval out3 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then ⌊(twos_complement_eval arg3 - twos_complement_eval arg2) / 2⌋ else ⌊(twos_complement_eval arg3 + (twos_complement_eval arg3 mod 2) * twos_complement_eval arg2) / 2⌋) +/// eval (from_montgomery out4) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (2 * eval (from_montgomery arg5)) mod m else (2 * eval (from_montgomery arg4)) mod m) +/// eval (from_montgomery out5) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (eval (from_montgomery arg4) - eval (from_montgomery arg4)) mod m else (eval (from_montgomery arg5) + (twos_complement_eval arg3 mod 2) * eval (from_montgomery arg4)) mod m) +/// 0 ≤ eval out5 < m +/// 0 ≤ eval out5 < m +/// 0 ≤ eval out2 < m +/// 0 ≤ eval out3 < m +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0xffffffff] +/// arg2: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// arg3: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// arg4: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// arg5: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +/// out2: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// out3: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// out4: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// out5: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +#[inline] +pub fn fiat_secp256k1_divstep(out1: &mut u32, out2: &mut [u32; 9], out3: &mut [u32; 9], out4: &mut [u32; 8], out5: &mut [u32; 8], arg1: u32, arg2: &[u32; 9], arg3: &[u32; 9], arg4: &[u32; 8], arg5: &[u32; 8]) -> () { + let mut x1: u32 = 0; + let mut x2: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x1, &mut x2, 0x0, (!arg1), (0x1 as u32)); + let x3: fiat_secp256k1_u1 = (((x1 >> 31) as fiat_secp256k1_u1) & (((arg3[0]) & (0x1 as u32)) as fiat_secp256k1_u1)); + let mut x4: u32 = 0; + let mut x5: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x4, &mut x5, 0x0, (!arg1), (0x1 as u32)); + let mut x6: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x6, x3, arg1, x4); + let mut x7: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x7, x3, (arg2[0]), (arg3[0])); + let mut x8: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x8, x3, (arg2[1]), (arg3[1])); + let mut x9: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x9, x3, (arg2[2]), (arg3[2])); + let mut x10: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x10, x3, (arg2[3]), (arg3[3])); + let mut x11: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x11, x3, (arg2[4]), (arg3[4])); + let mut x12: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x12, x3, (arg2[5]), (arg3[5])); + let mut x13: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x13, x3, (arg2[6]), (arg3[6])); + let mut x14: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x14, x3, (arg2[7]), (arg3[7])); + let mut x15: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x15, x3, (arg2[8]), (arg3[8])); + let mut x16: u32 = 0; + let mut x17: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x16, &mut x17, 0x0, (0x1 as u32), (!(arg2[0]))); + let mut x18: u32 = 0; + let mut x19: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x18, &mut x19, x17, (0x0 as u32), (!(arg2[1]))); + let mut x20: u32 = 0; + let mut x21: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x20, &mut x21, x19, (0x0 as u32), (!(arg2[2]))); + let mut x22: u32 = 0; + let mut x23: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x22, &mut x23, x21, (0x0 as u32), (!(arg2[3]))); + let mut x24: u32 = 0; + let mut x25: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x24, &mut x25, x23, (0x0 as u32), (!(arg2[4]))); + let mut x26: u32 = 0; + let mut x27: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x26, &mut x27, x25, (0x0 as u32), (!(arg2[5]))); + let mut x28: u32 = 0; + let mut x29: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x28, &mut x29, x27, (0x0 as u32), (!(arg2[6]))); + let mut x30: u32 = 0; + let mut x31: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x30, &mut x31, x29, (0x0 as u32), (!(arg2[7]))); + let mut x32: u32 = 0; + let mut x33: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x32, &mut x33, x31, (0x0 as u32), (!(arg2[8]))); + let mut x34: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x34, x3, (arg3[0]), x16); + let mut x35: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x35, x3, (arg3[1]), x18); + let mut x36: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x36, x3, (arg3[2]), x20); + let mut x37: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x37, x3, (arg3[3]), x22); + let mut x38: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x38, x3, (arg3[4]), x24); + let mut x39: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x39, x3, (arg3[5]), x26); + let mut x40: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x40, x3, (arg3[6]), x28); + let mut x41: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x41, x3, (arg3[7]), x30); + let mut x42: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x42, x3, (arg3[8]), x32); + let mut x43: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x43, x3, (arg4[0]), (arg5[0])); + let mut x44: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x44, x3, (arg4[1]), (arg5[1])); + let mut x45: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x45, x3, (arg4[2]), (arg5[2])); + let mut x46: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x46, x3, (arg4[3]), (arg5[3])); + let mut x47: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x47, x3, (arg4[4]), (arg5[4])); + let mut x48: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x48, x3, (arg4[5]), (arg5[5])); + let mut x49: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x49, x3, (arg4[6]), (arg5[6])); + let mut x50: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x50, x3, (arg4[7]), (arg5[7])); + let mut x51: u32 = 0; + let mut x52: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x51, &mut x52, 0x0, x43, x43); + let mut x53: u32 = 0; + let mut x54: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x53, &mut x54, x52, x44, x44); + let mut x55: u32 = 0; + let mut x56: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x55, &mut x56, x54, x45, x45); + let mut x57: u32 = 0; + let mut x58: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x57, &mut x58, x56, x46, x46); + let mut x59: u32 = 0; + let mut x60: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x59, &mut x60, x58, x47, x47); + let mut x61: u32 = 0; + let mut x62: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x61, &mut x62, x60, x48, x48); + let mut x63: u32 = 0; + let mut x64: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x63, &mut x64, x62, x49, x49); + let mut x65: u32 = 0; + let mut x66: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x65, &mut x66, x64, x50, x50); + let mut x67: u32 = 0; + let mut x68: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x67, &mut x68, 0x0, x51, 0xfffffc2f); + let mut x69: u32 = 0; + let mut x70: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x69, &mut x70, x68, x53, 0xfffffffe); + let mut x71: u32 = 0; + let mut x72: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x71, &mut x72, x70, x55, 0xffffffff); + let mut x73: u32 = 0; + let mut x74: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x73, &mut x74, x72, x57, 0xffffffff); + let mut x75: u32 = 0; + let mut x76: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x75, &mut x76, x74, x59, 0xffffffff); + let mut x77: u32 = 0; + let mut x78: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x77, &mut x78, x76, x61, 0xffffffff); + let mut x79: u32 = 0; + let mut x80: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x79, &mut x80, x78, x63, 0xffffffff); + let mut x81: u32 = 0; + let mut x82: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x81, &mut x82, x80, x65, 0xffffffff); + let mut x83: u32 = 0; + let mut x84: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x83, &mut x84, x82, (x66 as u32), (0x0 as u32)); + let x85: u32 = (arg4[7]); + let x86: u32 = (arg4[6]); + let x87: u32 = (arg4[5]); + let x88: u32 = (arg4[4]); + let x89: u32 = (arg4[3]); + let x90: u32 = (arg4[2]); + let x91: u32 = (arg4[1]); + let x92: u32 = (arg4[0]); + let mut x93: u32 = 0; + let mut x94: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x93, &mut x94, 0x0, (0x0 as u32), x92); + let mut x95: u32 = 0; + let mut x96: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x95, &mut x96, x94, (0x0 as u32), x91); + let mut x97: u32 = 0; + let mut x98: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x97, &mut x98, x96, (0x0 as u32), x90); + let mut x99: u32 = 0; + let mut x100: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x99, &mut x100, x98, (0x0 as u32), x89); + let mut x101: u32 = 0; + let mut x102: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x101, &mut x102, x100, (0x0 as u32), x88); + let mut x103: u32 = 0; + let mut x104: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x103, &mut x104, x102, (0x0 as u32), x87); + let mut x105: u32 = 0; + let mut x106: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x105, &mut x106, x104, (0x0 as u32), x86); + let mut x107: u32 = 0; + let mut x108: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x107, &mut x108, x106, (0x0 as u32), x85); + let mut x109: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x109, x108, (0x0 as u32), 0xffffffff); + let mut x110: u32 = 0; + let mut x111: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x110, &mut x111, 0x0, x93, (x109 & 0xfffffc2f)); + let mut x112: u32 = 0; + let mut x113: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x112, &mut x113, x111, x95, (x109 & 0xfffffffe)); + let mut x114: u32 = 0; + let mut x115: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x114, &mut x115, x113, x97, x109); + let mut x116: u32 = 0; + let mut x117: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x116, &mut x117, x115, x99, x109); + let mut x118: u32 = 0; + let mut x119: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x118, &mut x119, x117, x101, x109); + let mut x120: u32 = 0; + let mut x121: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x120, &mut x121, x119, x103, x109); + let mut x122: u32 = 0; + let mut x123: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x122, &mut x123, x121, x105, x109); + let mut x124: u32 = 0; + let mut x125: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x124, &mut x125, x123, x107, x109); + let mut x126: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x126, x3, (arg5[0]), x110); + let mut x127: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x127, x3, (arg5[1]), x112); + let mut x128: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x128, x3, (arg5[2]), x114); + let mut x129: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x129, x3, (arg5[3]), x116); + let mut x130: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x130, x3, (arg5[4]), x118); + let mut x131: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x131, x3, (arg5[5]), x120); + let mut x132: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x132, x3, (arg5[6]), x122); + let mut x133: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x133, x3, (arg5[7]), x124); + let x134: fiat_secp256k1_u1 = ((x34 & (0x1 as u32)) as fiat_secp256k1_u1); + let mut x135: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x135, x134, (0x0 as u32), x7); + let mut x136: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x136, x134, (0x0 as u32), x8); + let mut x137: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x137, x134, (0x0 as u32), x9); + let mut x138: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x138, x134, (0x0 as u32), x10); + let mut x139: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x139, x134, (0x0 as u32), x11); + let mut x140: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x140, x134, (0x0 as u32), x12); + let mut x141: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x141, x134, (0x0 as u32), x13); + let mut x142: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x142, x134, (0x0 as u32), x14); + let mut x143: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x143, x134, (0x0 as u32), x15); + let mut x144: u32 = 0; + let mut x145: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x144, &mut x145, 0x0, x34, x135); + let mut x146: u32 = 0; + let mut x147: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x146, &mut x147, x145, x35, x136); + let mut x148: u32 = 0; + let mut x149: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x148, &mut x149, x147, x36, x137); + let mut x150: u32 = 0; + let mut x151: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x150, &mut x151, x149, x37, x138); + let mut x152: u32 = 0; + let mut x153: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x152, &mut x153, x151, x38, x139); + let mut x154: u32 = 0; + let mut x155: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x154, &mut x155, x153, x39, x140); + let mut x156: u32 = 0; + let mut x157: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x156, &mut x157, x155, x40, x141); + let mut x158: u32 = 0; + let mut x159: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x158, &mut x159, x157, x41, x142); + let mut x160: u32 = 0; + let mut x161: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x160, &mut x161, x159, x42, x143); + let mut x162: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x162, x134, (0x0 as u32), x43); + let mut x163: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x163, x134, (0x0 as u32), x44); + let mut x164: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x164, x134, (0x0 as u32), x45); + let mut x165: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x165, x134, (0x0 as u32), x46); + let mut x166: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x166, x134, (0x0 as u32), x47); + let mut x167: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x167, x134, (0x0 as u32), x48); + let mut x168: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x168, x134, (0x0 as u32), x49); + let mut x169: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x169, x134, (0x0 as u32), x50); + let mut x170: u32 = 0; + let mut x171: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x170, &mut x171, 0x0, x126, x162); + let mut x172: u32 = 0; + let mut x173: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x172, &mut x173, x171, x127, x163); + let mut x174: u32 = 0; + let mut x175: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x174, &mut x175, x173, x128, x164); + let mut x176: u32 = 0; + let mut x177: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x176, &mut x177, x175, x129, x165); + let mut x178: u32 = 0; + let mut x179: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x178, &mut x179, x177, x130, x166); + let mut x180: u32 = 0; + let mut x181: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x180, &mut x181, x179, x131, x167); + let mut x182: u32 = 0; + let mut x183: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x182, &mut x183, x181, x132, x168); + let mut x184: u32 = 0; + let mut x185: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x184, &mut x185, x183, x133, x169); + let mut x186: u32 = 0; + let mut x187: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x186, &mut x187, 0x0, x170, 0xfffffc2f); + let mut x188: u32 = 0; + let mut x189: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x188, &mut x189, x187, x172, 0xfffffffe); + let mut x190: u32 = 0; + let mut x191: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x190, &mut x191, x189, x174, 0xffffffff); + let mut x192: u32 = 0; + let mut x193: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x192, &mut x193, x191, x176, 0xffffffff); + let mut x194: u32 = 0; + let mut x195: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x194, &mut x195, x193, x178, 0xffffffff); + let mut x196: u32 = 0; + let mut x197: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x196, &mut x197, x195, x180, 0xffffffff); + let mut x198: u32 = 0; + let mut x199: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x198, &mut x199, x197, x182, 0xffffffff); + let mut x200: u32 = 0; + let mut x201: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x200, &mut x201, x199, x184, 0xffffffff); + let mut x202: u32 = 0; + let mut x203: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u32(&mut x202, &mut x203, x201, (x185 as u32), (0x0 as u32)); + let mut x204: u32 = 0; + let mut x205: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u32(&mut x204, &mut x205, 0x0, x6, (0x1 as u32)); + let x206: u32 = ((x144 >> 1) | ((x146 << 31) & 0xffffffff)); + let x207: u32 = ((x146 >> 1) | ((x148 << 31) & 0xffffffff)); + let x208: u32 = ((x148 >> 1) | ((x150 << 31) & 0xffffffff)); + let x209: u32 = ((x150 >> 1) | ((x152 << 31) & 0xffffffff)); + let x210: u32 = ((x152 >> 1) | ((x154 << 31) & 0xffffffff)); + let x211: u32 = ((x154 >> 1) | ((x156 << 31) & 0xffffffff)); + let x212: u32 = ((x156 >> 1) | ((x158 << 31) & 0xffffffff)); + let x213: u32 = ((x158 >> 1) | ((x160 << 31) & 0xffffffff)); + let x214: u32 = ((x160 & 0x80000000) | (x160 >> 1)); + let mut x215: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x215, x84, x67, x51); + let mut x216: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x216, x84, x69, x53); + let mut x217: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x217, x84, x71, x55); + let mut x218: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x218, x84, x73, x57); + let mut x219: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x219, x84, x75, x59); + let mut x220: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x220, x84, x77, x61); + let mut x221: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x221, x84, x79, x63); + let mut x222: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x222, x84, x81, x65); + let mut x223: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x223, x203, x186, x170); + let mut x224: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x224, x203, x188, x172); + let mut x225: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x225, x203, x190, x174); + let mut x226: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x226, x203, x192, x176); + let mut x227: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x227, x203, x194, x178); + let mut x228: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x228, x203, x196, x180); + let mut x229: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x229, x203, x198, x182); + let mut x230: u32 = 0; + fiat_secp256k1_cmovznz_u32(&mut x230, x203, x200, x184); + *out1 = x204; + out2[0] = x7; + out2[1] = x8; + out2[2] = x9; + out2[3] = x10; + out2[4] = x11; + out2[5] = x12; + out2[6] = x13; + out2[7] = x14; + out2[8] = x15; + out3[0] = x206; + out3[1] = x207; + out3[2] = x208; + out3[3] = x209; + out3[4] = x210; + out3[5] = x211; + out3[6] = x212; + out3[7] = x213; + out3[8] = x214; + out4[0] = x215; + out4[1] = x216; + out4[2] = x217; + out4[3] = x218; + out4[4] = x219; + out4[5] = x220; + out4[6] = x221; + out4[7] = x222; + out5[0] = x223; + out5[1] = x224; + out5[2] = x225; + out5[3] = x226; + out5[4] = x227; + out5[5] = x228; + out5[6] = x229; + out5[7] = x230; +} + +/// The function fiat_secp256k1_divstep_precomp returns the precomputed value for Bernstein-Yang-inversion (in montgomery form). +/// +/// Postconditions: +/// eval (from_montgomery out1) = ⌊(m - 1) / 2⌋^(if ⌊log2 m⌋ + 1 < 46 then ⌊(49 * (⌊log2 m⌋ + 1) + 80) / 17⌋ else ⌊(49 * (⌊log2 m⌋ + 1) + 57) / 17⌋) +/// 0 ≤ eval out1 < m +/// +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +#[inline] +pub fn fiat_secp256k1_divstep_precomp(out1: &mut [u32; 8]) -> () { + out1[0] = 0x31525e0a; + out1[1] = 0xf201a418; + out1[2] = 0xcd648d85; + out1[3] = 0x9953f9dd; + out1[4] = 0x3db210a9; + out1[5] = 0xe8602946; + out1[6] = 0x4b03709; + out1[7] = 0x24fb8a31; +} diff --git a/vendor/fiat-crypto/src/secp256k1_64.rs b/vendor/fiat-crypto/src/secp256k1_64.rs new file mode 100644 index 000000000..46eb1160c --- /dev/null +++ b/vendor/fiat-crypto/src/secp256k1_64.rs @@ -0,0 +1,1957 @@ +//! Autogenerated: 'src/ExtractionOCaml/word_by_word_montgomery' --lang Rust --inline secp256k1 64 '2^256 - 2^32 - 977' mul square add sub opp from_montgomery to_montgomery nonzero selectznz to_bytes from_bytes one msat divstep divstep_precomp +//! curve description: secp256k1 +//! machine_wordsize = 64 (from "64") +//! requested operations: mul, square, add, sub, opp, from_montgomery, to_montgomery, nonzero, selectznz, to_bytes, from_bytes, one, msat, divstep, divstep_precomp +//! m = 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f (from "2^256 - 2^32 - 977") +//! +//! NOTE: In addition to the bounds specified above each function, all +//! functions synthesized for this Montgomery arithmetic require the +//! input to be strictly less than the prime modulus (m), and also +//! require the input to be in the unique saturated representation. +//! All functions also ensure that these two properties are true of +//! return values. +//! +//! Computed values: +//! eval z = z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) +//! bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248) +//! twos_complement_eval z = let x1 := z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) in +//! if x1 & (2^256-1) < 2^255 then x1 & (2^256-1) else (x1 & (2^256-1)) - 2^256 + +#![allow(unused_parens)] +#![allow(non_camel_case_types)] + +pub type fiat_secp256k1_u1 = u8; +pub type fiat_secp256k1_i1 = i8; +pub type fiat_secp256k1_u2 = u8; +pub type fiat_secp256k1_i2 = i8; + +/* The type fiat_secp256k1_montgomery_domain_field_element is a field element in the Montgomery domain. */ +/* Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] */ +pub type fiat_secp256k1_montgomery_domain_field_element = [u64; 4]; + +/* The type fiat_secp256k1_non_montgomery_domain_field_element is a field element NOT in the Montgomery domain. */ +/* Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] */ +pub type fiat_secp256k1_non_montgomery_domain_field_element = [u64; 4]; + + +/// The function fiat_secp256k1_addcarryx_u64 is an addition with carry. +/// +/// Postconditions: +/// out1 = (arg1 + arg2 + arg3) mod 2^64 +/// out2 = ⌊(arg1 + arg2 + arg3) / 2^64⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffffffffffff] +/// arg3: [0x0 ~> 0xffffffffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_secp256k1_addcarryx_u64(out1: &mut u64, out2: &mut fiat_secp256k1_u1, arg1: fiat_secp256k1_u1, arg2: u64, arg3: u64) -> () { + let x1: u128 = (((arg1 as u128) + (arg2 as u128)) + (arg3 as u128)); + let x2: u64 = ((x1 & (0xffffffffffffffff as u128)) as u64); + let x3: fiat_secp256k1_u1 = ((x1 >> 64) as fiat_secp256k1_u1); + *out1 = x2; + *out2 = x3; +} + +/// The function fiat_secp256k1_subborrowx_u64 is a subtraction with borrow. +/// +/// Postconditions: +/// out1 = (-arg1 + arg2 + -arg3) mod 2^64 +/// out2 = -⌊(-arg1 + arg2 + -arg3) / 2^64⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffffffffffff] +/// arg3: [0x0 ~> 0xffffffffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_secp256k1_subborrowx_u64(out1: &mut u64, out2: &mut fiat_secp256k1_u1, arg1: fiat_secp256k1_u1, arg2: u64, arg3: u64) -> () { + let x1: i128 = (((arg2 as i128) - (arg1 as i128)) - (arg3 as i128)); + let x2: fiat_secp256k1_i1 = ((x1 >> 64) as fiat_secp256k1_i1); + let x3: u64 = ((x1 & (0xffffffffffffffff as i128)) as u64); + *out1 = x3; + *out2 = (((0x0 as fiat_secp256k1_i2) - (x2 as fiat_secp256k1_i2)) as fiat_secp256k1_u1); +} + +/// The function fiat_secp256k1_mulx_u64 is a multiplication, returning the full double-width result. +/// +/// Postconditions: +/// out1 = (arg1 * arg2) mod 2^64 +/// out2 = ⌊arg1 * arg2 / 2^64⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0xffffffffffffffff] +/// arg2: [0x0 ~> 0xffffffffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +/// out2: [0x0 ~> 0xffffffffffffffff] +#[inline] +pub fn fiat_secp256k1_mulx_u64(out1: &mut u64, out2: &mut u64, arg1: u64, arg2: u64) -> () { + let x1: u128 = ((arg1 as u128) * (arg2 as u128)); + let x2: u64 = ((x1 & (0xffffffffffffffff as u128)) as u64); + let x3: u64 = ((x1 >> 64) as u64); + *out1 = x2; + *out2 = x3; +} + +/// The function fiat_secp256k1_cmovznz_u64 is a single-word conditional move. +/// +/// Postconditions: +/// out1 = (if arg1 = 0 then arg2 else arg3) +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffffffffffff] +/// arg3: [0x0 ~> 0xffffffffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +#[inline] +pub fn fiat_secp256k1_cmovznz_u64(out1: &mut u64, arg1: fiat_secp256k1_u1, arg2: u64, arg3: u64) -> () { + let x1: fiat_secp256k1_u1 = (!(!arg1)); + let x2: u64 = ((((((0x0 as fiat_secp256k1_i2) - (x1 as fiat_secp256k1_i2)) as fiat_secp256k1_i1) as i128) & (0xffffffffffffffff as i128)) as u64); + let x3: u64 = ((x2 & arg3) | ((!x2) & arg2)); + *out1 = x3; +} + +/// The function fiat_secp256k1_mul multiplies two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_secp256k1_mul(out1: &mut fiat_secp256k1_montgomery_domain_field_element, arg1: &fiat_secp256k1_montgomery_domain_field_element, arg2: &fiat_secp256k1_montgomery_domain_field_element) -> () { + let x1: u64 = (arg1[1]); + let x2: u64 = (arg1[2]); + let x3: u64 = (arg1[3]); + let x4: u64 = (arg1[0]); + let mut x5: u64 = 0; + let mut x6: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x5, &mut x6, x4, (arg2[3])); + let mut x7: u64 = 0; + let mut x8: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x7, &mut x8, x4, (arg2[2])); + let mut x9: u64 = 0; + let mut x10: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x9, &mut x10, x4, (arg2[1])); + let mut x11: u64 = 0; + let mut x12: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x11, &mut x12, x4, (arg2[0])); + let mut x13: u64 = 0; + let mut x14: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x13, &mut x14, 0x0, x12, x9); + let mut x15: u64 = 0; + let mut x16: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x15, &mut x16, x14, x10, x7); + let mut x17: u64 = 0; + let mut x18: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x17, &mut x18, x16, x8, x5); + let x19: u64 = ((x18 as u64) + x6); + let mut x20: u64 = 0; + let mut x21: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x20, &mut x21, x11, 0xd838091dd2253531); + let mut x22: u64 = 0; + let mut x23: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x22, &mut x23, x20, 0xffffffffffffffff); + let mut x24: u64 = 0; + let mut x25: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x24, &mut x25, x20, 0xffffffffffffffff); + let mut x26: u64 = 0; + let mut x27: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x26, &mut x27, x20, 0xffffffffffffffff); + let mut x28: u64 = 0; + let mut x29: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x28, &mut x29, x20, 0xfffffffefffffc2f); + let mut x30: u64 = 0; + let mut x31: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x30, &mut x31, 0x0, x29, x26); + let mut x32: u64 = 0; + let mut x33: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x32, &mut x33, x31, x27, x24); + let mut x34: u64 = 0; + let mut x35: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x34, &mut x35, x33, x25, x22); + let x36: u64 = ((x35 as u64) + x23); + let mut x37: u64 = 0; + let mut x38: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x37, &mut x38, 0x0, x11, x28); + let mut x39: u64 = 0; + let mut x40: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x39, &mut x40, x38, x13, x30); + let mut x41: u64 = 0; + let mut x42: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x41, &mut x42, x40, x15, x32); + let mut x43: u64 = 0; + let mut x44: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x43, &mut x44, x42, x17, x34); + let mut x45: u64 = 0; + let mut x46: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x45, &mut x46, x44, x19, x36); + let mut x47: u64 = 0; + let mut x48: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x47, &mut x48, x1, (arg2[3])); + let mut x49: u64 = 0; + let mut x50: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x49, &mut x50, x1, (arg2[2])); + let mut x51: u64 = 0; + let mut x52: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x51, &mut x52, x1, (arg2[1])); + let mut x53: u64 = 0; + let mut x54: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x53, &mut x54, x1, (arg2[0])); + let mut x55: u64 = 0; + let mut x56: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x55, &mut x56, 0x0, x54, x51); + let mut x57: u64 = 0; + let mut x58: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x57, &mut x58, x56, x52, x49); + let mut x59: u64 = 0; + let mut x60: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x59, &mut x60, x58, x50, x47); + let x61: u64 = ((x60 as u64) + x48); + let mut x62: u64 = 0; + let mut x63: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x62, &mut x63, 0x0, x39, x53); + let mut x64: u64 = 0; + let mut x65: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x64, &mut x65, x63, x41, x55); + let mut x66: u64 = 0; + let mut x67: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x66, &mut x67, x65, x43, x57); + let mut x68: u64 = 0; + let mut x69: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x68, &mut x69, x67, x45, x59); + let mut x70: u64 = 0; + let mut x71: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x70, &mut x71, x69, (x46 as u64), x61); + let mut x72: u64 = 0; + let mut x73: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x72, &mut x73, x62, 0xd838091dd2253531); + let mut x74: u64 = 0; + let mut x75: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x74, &mut x75, x72, 0xffffffffffffffff); + let mut x76: u64 = 0; + let mut x77: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x76, &mut x77, x72, 0xffffffffffffffff); + let mut x78: u64 = 0; + let mut x79: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x78, &mut x79, x72, 0xffffffffffffffff); + let mut x80: u64 = 0; + let mut x81: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x80, &mut x81, x72, 0xfffffffefffffc2f); + let mut x82: u64 = 0; + let mut x83: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x82, &mut x83, 0x0, x81, x78); + let mut x84: u64 = 0; + let mut x85: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x84, &mut x85, x83, x79, x76); + let mut x86: u64 = 0; + let mut x87: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x86, &mut x87, x85, x77, x74); + let x88: u64 = ((x87 as u64) + x75); + let mut x89: u64 = 0; + let mut x90: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x89, &mut x90, 0x0, x62, x80); + let mut x91: u64 = 0; + let mut x92: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x91, &mut x92, x90, x64, x82); + let mut x93: u64 = 0; + let mut x94: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x93, &mut x94, x92, x66, x84); + let mut x95: u64 = 0; + let mut x96: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x95, &mut x96, x94, x68, x86); + let mut x97: u64 = 0; + let mut x98: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x97, &mut x98, x96, x70, x88); + let x99: u64 = ((x98 as u64) + (x71 as u64)); + let mut x100: u64 = 0; + let mut x101: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x100, &mut x101, x2, (arg2[3])); + let mut x102: u64 = 0; + let mut x103: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x102, &mut x103, x2, (arg2[2])); + let mut x104: u64 = 0; + let mut x105: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x104, &mut x105, x2, (arg2[1])); + let mut x106: u64 = 0; + let mut x107: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x106, &mut x107, x2, (arg2[0])); + let mut x108: u64 = 0; + let mut x109: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x108, &mut x109, 0x0, x107, x104); + let mut x110: u64 = 0; + let mut x111: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x110, &mut x111, x109, x105, x102); + let mut x112: u64 = 0; + let mut x113: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x112, &mut x113, x111, x103, x100); + let x114: u64 = ((x113 as u64) + x101); + let mut x115: u64 = 0; + let mut x116: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x115, &mut x116, 0x0, x91, x106); + let mut x117: u64 = 0; + let mut x118: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x117, &mut x118, x116, x93, x108); + let mut x119: u64 = 0; + let mut x120: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x119, &mut x120, x118, x95, x110); + let mut x121: u64 = 0; + let mut x122: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x121, &mut x122, x120, x97, x112); + let mut x123: u64 = 0; + let mut x124: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x123, &mut x124, x122, x99, x114); + let mut x125: u64 = 0; + let mut x126: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x125, &mut x126, x115, 0xd838091dd2253531); + let mut x127: u64 = 0; + let mut x128: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x127, &mut x128, x125, 0xffffffffffffffff); + let mut x129: u64 = 0; + let mut x130: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x129, &mut x130, x125, 0xffffffffffffffff); + let mut x131: u64 = 0; + let mut x132: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x131, &mut x132, x125, 0xffffffffffffffff); + let mut x133: u64 = 0; + let mut x134: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x133, &mut x134, x125, 0xfffffffefffffc2f); + let mut x135: u64 = 0; + let mut x136: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x135, &mut x136, 0x0, x134, x131); + let mut x137: u64 = 0; + let mut x138: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x137, &mut x138, x136, x132, x129); + let mut x139: u64 = 0; + let mut x140: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x139, &mut x140, x138, x130, x127); + let x141: u64 = ((x140 as u64) + x128); + let mut x142: u64 = 0; + let mut x143: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x142, &mut x143, 0x0, x115, x133); + let mut x144: u64 = 0; + let mut x145: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x144, &mut x145, x143, x117, x135); + let mut x146: u64 = 0; + let mut x147: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x146, &mut x147, x145, x119, x137); + let mut x148: u64 = 0; + let mut x149: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x148, &mut x149, x147, x121, x139); + let mut x150: u64 = 0; + let mut x151: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x150, &mut x151, x149, x123, x141); + let x152: u64 = ((x151 as u64) + (x124 as u64)); + let mut x153: u64 = 0; + let mut x154: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x153, &mut x154, x3, (arg2[3])); + let mut x155: u64 = 0; + let mut x156: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x155, &mut x156, x3, (arg2[2])); + let mut x157: u64 = 0; + let mut x158: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x157, &mut x158, x3, (arg2[1])); + let mut x159: u64 = 0; + let mut x160: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x159, &mut x160, x3, (arg2[0])); + let mut x161: u64 = 0; + let mut x162: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x161, &mut x162, 0x0, x160, x157); + let mut x163: u64 = 0; + let mut x164: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x163, &mut x164, x162, x158, x155); + let mut x165: u64 = 0; + let mut x166: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x165, &mut x166, x164, x156, x153); + let x167: u64 = ((x166 as u64) + x154); + let mut x168: u64 = 0; + let mut x169: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x168, &mut x169, 0x0, x144, x159); + let mut x170: u64 = 0; + let mut x171: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x170, &mut x171, x169, x146, x161); + let mut x172: u64 = 0; + let mut x173: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x172, &mut x173, x171, x148, x163); + let mut x174: u64 = 0; + let mut x175: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x174, &mut x175, x173, x150, x165); + let mut x176: u64 = 0; + let mut x177: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x176, &mut x177, x175, x152, x167); + let mut x178: u64 = 0; + let mut x179: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x178, &mut x179, x168, 0xd838091dd2253531); + let mut x180: u64 = 0; + let mut x181: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x180, &mut x181, x178, 0xffffffffffffffff); + let mut x182: u64 = 0; + let mut x183: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x182, &mut x183, x178, 0xffffffffffffffff); + let mut x184: u64 = 0; + let mut x185: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x184, &mut x185, x178, 0xffffffffffffffff); + let mut x186: u64 = 0; + let mut x187: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x186, &mut x187, x178, 0xfffffffefffffc2f); + let mut x188: u64 = 0; + let mut x189: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x188, &mut x189, 0x0, x187, x184); + let mut x190: u64 = 0; + let mut x191: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x190, &mut x191, x189, x185, x182); + let mut x192: u64 = 0; + let mut x193: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x192, &mut x193, x191, x183, x180); + let x194: u64 = ((x193 as u64) + x181); + let mut x195: u64 = 0; + let mut x196: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x195, &mut x196, 0x0, x168, x186); + let mut x197: u64 = 0; + let mut x198: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x197, &mut x198, x196, x170, x188); + let mut x199: u64 = 0; + let mut x200: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x199, &mut x200, x198, x172, x190); + let mut x201: u64 = 0; + let mut x202: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x201, &mut x202, x200, x174, x192); + let mut x203: u64 = 0; + let mut x204: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x203, &mut x204, x202, x176, x194); + let x205: u64 = ((x204 as u64) + (x177 as u64)); + let mut x206: u64 = 0; + let mut x207: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u64(&mut x206, &mut x207, 0x0, x197, 0xfffffffefffffc2f); + let mut x208: u64 = 0; + let mut x209: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u64(&mut x208, &mut x209, x207, x199, 0xffffffffffffffff); + let mut x210: u64 = 0; + let mut x211: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u64(&mut x210, &mut x211, x209, x201, 0xffffffffffffffff); + let mut x212: u64 = 0; + let mut x213: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u64(&mut x212, &mut x213, x211, x203, 0xffffffffffffffff); + let mut x214: u64 = 0; + let mut x215: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u64(&mut x214, &mut x215, x213, x205, (0x0 as u64)); + let mut x216: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x216, x215, x206, x197); + let mut x217: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x217, x215, x208, x199); + let mut x218: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x218, x215, x210, x201); + let mut x219: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x219, x215, x212, x203); + out1[0] = x216; + out1[1] = x217; + out1[2] = x218; + out1[3] = x219; +} + +/// The function fiat_secp256k1_square squares a field element in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg1)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_secp256k1_square(out1: &mut fiat_secp256k1_montgomery_domain_field_element, arg1: &fiat_secp256k1_montgomery_domain_field_element) -> () { + let x1: u64 = (arg1[1]); + let x2: u64 = (arg1[2]); + let x3: u64 = (arg1[3]); + let x4: u64 = (arg1[0]); + let mut x5: u64 = 0; + let mut x6: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x5, &mut x6, x4, (arg1[3])); + let mut x7: u64 = 0; + let mut x8: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x7, &mut x8, x4, (arg1[2])); + let mut x9: u64 = 0; + let mut x10: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x9, &mut x10, x4, (arg1[1])); + let mut x11: u64 = 0; + let mut x12: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x11, &mut x12, x4, (arg1[0])); + let mut x13: u64 = 0; + let mut x14: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x13, &mut x14, 0x0, x12, x9); + let mut x15: u64 = 0; + let mut x16: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x15, &mut x16, x14, x10, x7); + let mut x17: u64 = 0; + let mut x18: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x17, &mut x18, x16, x8, x5); + let x19: u64 = ((x18 as u64) + x6); + let mut x20: u64 = 0; + let mut x21: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x20, &mut x21, x11, 0xd838091dd2253531); + let mut x22: u64 = 0; + let mut x23: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x22, &mut x23, x20, 0xffffffffffffffff); + let mut x24: u64 = 0; + let mut x25: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x24, &mut x25, x20, 0xffffffffffffffff); + let mut x26: u64 = 0; + let mut x27: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x26, &mut x27, x20, 0xffffffffffffffff); + let mut x28: u64 = 0; + let mut x29: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x28, &mut x29, x20, 0xfffffffefffffc2f); + let mut x30: u64 = 0; + let mut x31: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x30, &mut x31, 0x0, x29, x26); + let mut x32: u64 = 0; + let mut x33: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x32, &mut x33, x31, x27, x24); + let mut x34: u64 = 0; + let mut x35: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x34, &mut x35, x33, x25, x22); + let x36: u64 = ((x35 as u64) + x23); + let mut x37: u64 = 0; + let mut x38: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x37, &mut x38, 0x0, x11, x28); + let mut x39: u64 = 0; + let mut x40: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x39, &mut x40, x38, x13, x30); + let mut x41: u64 = 0; + let mut x42: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x41, &mut x42, x40, x15, x32); + let mut x43: u64 = 0; + let mut x44: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x43, &mut x44, x42, x17, x34); + let mut x45: u64 = 0; + let mut x46: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x45, &mut x46, x44, x19, x36); + let mut x47: u64 = 0; + let mut x48: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x47, &mut x48, x1, (arg1[3])); + let mut x49: u64 = 0; + let mut x50: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x49, &mut x50, x1, (arg1[2])); + let mut x51: u64 = 0; + let mut x52: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x51, &mut x52, x1, (arg1[1])); + let mut x53: u64 = 0; + let mut x54: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x53, &mut x54, x1, (arg1[0])); + let mut x55: u64 = 0; + let mut x56: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x55, &mut x56, 0x0, x54, x51); + let mut x57: u64 = 0; + let mut x58: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x57, &mut x58, x56, x52, x49); + let mut x59: u64 = 0; + let mut x60: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x59, &mut x60, x58, x50, x47); + let x61: u64 = ((x60 as u64) + x48); + let mut x62: u64 = 0; + let mut x63: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x62, &mut x63, 0x0, x39, x53); + let mut x64: u64 = 0; + let mut x65: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x64, &mut x65, x63, x41, x55); + let mut x66: u64 = 0; + let mut x67: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x66, &mut x67, x65, x43, x57); + let mut x68: u64 = 0; + let mut x69: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x68, &mut x69, x67, x45, x59); + let mut x70: u64 = 0; + let mut x71: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x70, &mut x71, x69, (x46 as u64), x61); + let mut x72: u64 = 0; + let mut x73: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x72, &mut x73, x62, 0xd838091dd2253531); + let mut x74: u64 = 0; + let mut x75: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x74, &mut x75, x72, 0xffffffffffffffff); + let mut x76: u64 = 0; + let mut x77: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x76, &mut x77, x72, 0xffffffffffffffff); + let mut x78: u64 = 0; + let mut x79: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x78, &mut x79, x72, 0xffffffffffffffff); + let mut x80: u64 = 0; + let mut x81: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x80, &mut x81, x72, 0xfffffffefffffc2f); + let mut x82: u64 = 0; + let mut x83: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x82, &mut x83, 0x0, x81, x78); + let mut x84: u64 = 0; + let mut x85: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x84, &mut x85, x83, x79, x76); + let mut x86: u64 = 0; + let mut x87: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x86, &mut x87, x85, x77, x74); + let x88: u64 = ((x87 as u64) + x75); + let mut x89: u64 = 0; + let mut x90: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x89, &mut x90, 0x0, x62, x80); + let mut x91: u64 = 0; + let mut x92: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x91, &mut x92, x90, x64, x82); + let mut x93: u64 = 0; + let mut x94: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x93, &mut x94, x92, x66, x84); + let mut x95: u64 = 0; + let mut x96: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x95, &mut x96, x94, x68, x86); + let mut x97: u64 = 0; + let mut x98: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x97, &mut x98, x96, x70, x88); + let x99: u64 = ((x98 as u64) + (x71 as u64)); + let mut x100: u64 = 0; + let mut x101: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x100, &mut x101, x2, (arg1[3])); + let mut x102: u64 = 0; + let mut x103: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x102, &mut x103, x2, (arg1[2])); + let mut x104: u64 = 0; + let mut x105: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x104, &mut x105, x2, (arg1[1])); + let mut x106: u64 = 0; + let mut x107: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x106, &mut x107, x2, (arg1[0])); + let mut x108: u64 = 0; + let mut x109: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x108, &mut x109, 0x0, x107, x104); + let mut x110: u64 = 0; + let mut x111: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x110, &mut x111, x109, x105, x102); + let mut x112: u64 = 0; + let mut x113: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x112, &mut x113, x111, x103, x100); + let x114: u64 = ((x113 as u64) + x101); + let mut x115: u64 = 0; + let mut x116: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x115, &mut x116, 0x0, x91, x106); + let mut x117: u64 = 0; + let mut x118: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x117, &mut x118, x116, x93, x108); + let mut x119: u64 = 0; + let mut x120: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x119, &mut x120, x118, x95, x110); + let mut x121: u64 = 0; + let mut x122: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x121, &mut x122, x120, x97, x112); + let mut x123: u64 = 0; + let mut x124: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x123, &mut x124, x122, x99, x114); + let mut x125: u64 = 0; + let mut x126: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x125, &mut x126, x115, 0xd838091dd2253531); + let mut x127: u64 = 0; + let mut x128: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x127, &mut x128, x125, 0xffffffffffffffff); + let mut x129: u64 = 0; + let mut x130: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x129, &mut x130, x125, 0xffffffffffffffff); + let mut x131: u64 = 0; + let mut x132: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x131, &mut x132, x125, 0xffffffffffffffff); + let mut x133: u64 = 0; + let mut x134: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x133, &mut x134, x125, 0xfffffffefffffc2f); + let mut x135: u64 = 0; + let mut x136: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x135, &mut x136, 0x0, x134, x131); + let mut x137: u64 = 0; + let mut x138: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x137, &mut x138, x136, x132, x129); + let mut x139: u64 = 0; + let mut x140: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x139, &mut x140, x138, x130, x127); + let x141: u64 = ((x140 as u64) + x128); + let mut x142: u64 = 0; + let mut x143: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x142, &mut x143, 0x0, x115, x133); + let mut x144: u64 = 0; + let mut x145: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x144, &mut x145, x143, x117, x135); + let mut x146: u64 = 0; + let mut x147: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x146, &mut x147, x145, x119, x137); + let mut x148: u64 = 0; + let mut x149: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x148, &mut x149, x147, x121, x139); + let mut x150: u64 = 0; + let mut x151: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x150, &mut x151, x149, x123, x141); + let x152: u64 = ((x151 as u64) + (x124 as u64)); + let mut x153: u64 = 0; + let mut x154: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x153, &mut x154, x3, (arg1[3])); + let mut x155: u64 = 0; + let mut x156: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x155, &mut x156, x3, (arg1[2])); + let mut x157: u64 = 0; + let mut x158: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x157, &mut x158, x3, (arg1[1])); + let mut x159: u64 = 0; + let mut x160: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x159, &mut x160, x3, (arg1[0])); + let mut x161: u64 = 0; + let mut x162: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x161, &mut x162, 0x0, x160, x157); + let mut x163: u64 = 0; + let mut x164: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x163, &mut x164, x162, x158, x155); + let mut x165: u64 = 0; + let mut x166: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x165, &mut x166, x164, x156, x153); + let x167: u64 = ((x166 as u64) + x154); + let mut x168: u64 = 0; + let mut x169: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x168, &mut x169, 0x0, x144, x159); + let mut x170: u64 = 0; + let mut x171: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x170, &mut x171, x169, x146, x161); + let mut x172: u64 = 0; + let mut x173: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x172, &mut x173, x171, x148, x163); + let mut x174: u64 = 0; + let mut x175: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x174, &mut x175, x173, x150, x165); + let mut x176: u64 = 0; + let mut x177: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x176, &mut x177, x175, x152, x167); + let mut x178: u64 = 0; + let mut x179: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x178, &mut x179, x168, 0xd838091dd2253531); + let mut x180: u64 = 0; + let mut x181: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x180, &mut x181, x178, 0xffffffffffffffff); + let mut x182: u64 = 0; + let mut x183: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x182, &mut x183, x178, 0xffffffffffffffff); + let mut x184: u64 = 0; + let mut x185: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x184, &mut x185, x178, 0xffffffffffffffff); + let mut x186: u64 = 0; + let mut x187: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x186, &mut x187, x178, 0xfffffffefffffc2f); + let mut x188: u64 = 0; + let mut x189: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x188, &mut x189, 0x0, x187, x184); + let mut x190: u64 = 0; + let mut x191: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x190, &mut x191, x189, x185, x182); + let mut x192: u64 = 0; + let mut x193: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x192, &mut x193, x191, x183, x180); + let x194: u64 = ((x193 as u64) + x181); + let mut x195: u64 = 0; + let mut x196: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x195, &mut x196, 0x0, x168, x186); + let mut x197: u64 = 0; + let mut x198: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x197, &mut x198, x196, x170, x188); + let mut x199: u64 = 0; + let mut x200: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x199, &mut x200, x198, x172, x190); + let mut x201: u64 = 0; + let mut x202: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x201, &mut x202, x200, x174, x192); + let mut x203: u64 = 0; + let mut x204: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x203, &mut x204, x202, x176, x194); + let x205: u64 = ((x204 as u64) + (x177 as u64)); + let mut x206: u64 = 0; + let mut x207: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u64(&mut x206, &mut x207, 0x0, x197, 0xfffffffefffffc2f); + let mut x208: u64 = 0; + let mut x209: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u64(&mut x208, &mut x209, x207, x199, 0xffffffffffffffff); + let mut x210: u64 = 0; + let mut x211: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u64(&mut x210, &mut x211, x209, x201, 0xffffffffffffffff); + let mut x212: u64 = 0; + let mut x213: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u64(&mut x212, &mut x213, x211, x203, 0xffffffffffffffff); + let mut x214: u64 = 0; + let mut x215: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u64(&mut x214, &mut x215, x213, x205, (0x0 as u64)); + let mut x216: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x216, x215, x206, x197); + let mut x217: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x217, x215, x208, x199); + let mut x218: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x218, x215, x210, x201); + let mut x219: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x219, x215, x212, x203); + out1[0] = x216; + out1[1] = x217; + out1[2] = x218; + out1[3] = x219; +} + +/// The function fiat_secp256k1_add adds two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) + eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_secp256k1_add(out1: &mut fiat_secp256k1_montgomery_domain_field_element, arg1: &fiat_secp256k1_montgomery_domain_field_element, arg2: &fiat_secp256k1_montgomery_domain_field_element) -> () { + let mut x1: u64 = 0; + let mut x2: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x1, &mut x2, 0x0, (arg1[0]), (arg2[0])); + let mut x3: u64 = 0; + let mut x4: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x3, &mut x4, x2, (arg1[1]), (arg2[1])); + let mut x5: u64 = 0; + let mut x6: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x5, &mut x6, x4, (arg1[2]), (arg2[2])); + let mut x7: u64 = 0; + let mut x8: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x7, &mut x8, x6, (arg1[3]), (arg2[3])); + let mut x9: u64 = 0; + let mut x10: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u64(&mut x9, &mut x10, 0x0, x1, 0xfffffffefffffc2f); + let mut x11: u64 = 0; + let mut x12: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u64(&mut x11, &mut x12, x10, x3, 0xffffffffffffffff); + let mut x13: u64 = 0; + let mut x14: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u64(&mut x13, &mut x14, x12, x5, 0xffffffffffffffff); + let mut x15: u64 = 0; + let mut x16: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u64(&mut x15, &mut x16, x14, x7, 0xffffffffffffffff); + let mut x17: u64 = 0; + let mut x18: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u64(&mut x17, &mut x18, x16, (x8 as u64), (0x0 as u64)); + let mut x19: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x19, x18, x9, x1); + let mut x20: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x20, x18, x11, x3); + let mut x21: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x21, x18, x13, x5); + let mut x22: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x22, x18, x15, x7); + out1[0] = x19; + out1[1] = x20; + out1[2] = x21; + out1[3] = x22; +} + +/// The function fiat_secp256k1_sub subtracts two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) - eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_secp256k1_sub(out1: &mut fiat_secp256k1_montgomery_domain_field_element, arg1: &fiat_secp256k1_montgomery_domain_field_element, arg2: &fiat_secp256k1_montgomery_domain_field_element) -> () { + let mut x1: u64 = 0; + let mut x2: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u64(&mut x1, &mut x2, 0x0, (arg1[0]), (arg2[0])); + let mut x3: u64 = 0; + let mut x4: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u64(&mut x3, &mut x4, x2, (arg1[1]), (arg2[1])); + let mut x5: u64 = 0; + let mut x6: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u64(&mut x5, &mut x6, x4, (arg1[2]), (arg2[2])); + let mut x7: u64 = 0; + let mut x8: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u64(&mut x7, &mut x8, x6, (arg1[3]), (arg2[3])); + let mut x9: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x9, x8, (0x0 as u64), 0xffffffffffffffff); + let mut x10: u64 = 0; + let mut x11: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x10, &mut x11, 0x0, x1, (x9 & 0xfffffffefffffc2f)); + let mut x12: u64 = 0; + let mut x13: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x12, &mut x13, x11, x3, x9); + let mut x14: u64 = 0; + let mut x15: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x14, &mut x15, x13, x5, x9); + let mut x16: u64 = 0; + let mut x17: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x16, &mut x17, x15, x7, x9); + out1[0] = x10; + out1[1] = x12; + out1[2] = x14; + out1[3] = x16; +} + +/// The function fiat_secp256k1_opp negates a field element in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = -eval (from_montgomery arg1) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_secp256k1_opp(out1: &mut fiat_secp256k1_montgomery_domain_field_element, arg1: &fiat_secp256k1_montgomery_domain_field_element) -> () { + let mut x1: u64 = 0; + let mut x2: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u64(&mut x1, &mut x2, 0x0, (0x0 as u64), (arg1[0])); + let mut x3: u64 = 0; + let mut x4: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u64(&mut x3, &mut x4, x2, (0x0 as u64), (arg1[1])); + let mut x5: u64 = 0; + let mut x6: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u64(&mut x5, &mut x6, x4, (0x0 as u64), (arg1[2])); + let mut x7: u64 = 0; + let mut x8: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u64(&mut x7, &mut x8, x6, (0x0 as u64), (arg1[3])); + let mut x9: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x9, x8, (0x0 as u64), 0xffffffffffffffff); + let mut x10: u64 = 0; + let mut x11: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x10, &mut x11, 0x0, x1, (x9 & 0xfffffffefffffc2f)); + let mut x12: u64 = 0; + let mut x13: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x12, &mut x13, x11, x3, x9); + let mut x14: u64 = 0; + let mut x15: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x14, &mut x15, x13, x5, x9); + let mut x16: u64 = 0; + let mut x17: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x16, &mut x17, x15, x7, x9); + out1[0] = x10; + out1[1] = x12; + out1[2] = x14; + out1[3] = x16; +} + +/// The function fiat_secp256k1_from_montgomery translates a field element out of the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval out1 mod m = (eval arg1 * ((2^64)⁻¹ mod m)^4) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_secp256k1_from_montgomery(out1: &mut fiat_secp256k1_non_montgomery_domain_field_element, arg1: &fiat_secp256k1_montgomery_domain_field_element) -> () { + let x1: u64 = (arg1[0]); + let mut x2: u64 = 0; + let mut x3: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x2, &mut x3, x1, 0xd838091dd2253531); + let mut x4: u64 = 0; + let mut x5: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x4, &mut x5, x2, 0xffffffffffffffff); + let mut x6: u64 = 0; + let mut x7: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x6, &mut x7, x2, 0xffffffffffffffff); + let mut x8: u64 = 0; + let mut x9: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x8, &mut x9, x2, 0xffffffffffffffff); + let mut x10: u64 = 0; + let mut x11: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x10, &mut x11, x2, 0xfffffffefffffc2f); + let mut x12: u64 = 0; + let mut x13: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x12, &mut x13, 0x0, x11, x8); + let mut x14: u64 = 0; + let mut x15: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x14, &mut x15, x13, x9, x6); + let mut x16: u64 = 0; + let mut x17: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x16, &mut x17, x15, x7, x4); + let mut x18: u64 = 0; + let mut x19: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x18, &mut x19, 0x0, x1, x10); + let mut x20: u64 = 0; + let mut x21: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x20, &mut x21, x19, (0x0 as u64), x12); + let mut x22: u64 = 0; + let mut x23: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x22, &mut x23, x21, (0x0 as u64), x14); + let mut x24: u64 = 0; + let mut x25: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x24, &mut x25, x23, (0x0 as u64), x16); + let mut x26: u64 = 0; + let mut x27: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x26, &mut x27, x25, (0x0 as u64), ((x17 as u64) + x5)); + let mut x28: u64 = 0; + let mut x29: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x28, &mut x29, 0x0, x20, (arg1[1])); + let mut x30: u64 = 0; + let mut x31: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x30, &mut x31, x29, x22, (0x0 as u64)); + let mut x32: u64 = 0; + let mut x33: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x32, &mut x33, x31, x24, (0x0 as u64)); + let mut x34: u64 = 0; + let mut x35: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x34, &mut x35, x33, x26, (0x0 as u64)); + let mut x36: u64 = 0; + let mut x37: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x36, &mut x37, x28, 0xd838091dd2253531); + let mut x38: u64 = 0; + let mut x39: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x38, &mut x39, x36, 0xffffffffffffffff); + let mut x40: u64 = 0; + let mut x41: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x40, &mut x41, x36, 0xffffffffffffffff); + let mut x42: u64 = 0; + let mut x43: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x42, &mut x43, x36, 0xffffffffffffffff); + let mut x44: u64 = 0; + let mut x45: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x44, &mut x45, x36, 0xfffffffefffffc2f); + let mut x46: u64 = 0; + let mut x47: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x46, &mut x47, 0x0, x45, x42); + let mut x48: u64 = 0; + let mut x49: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x48, &mut x49, x47, x43, x40); + let mut x50: u64 = 0; + let mut x51: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x50, &mut x51, x49, x41, x38); + let mut x52: u64 = 0; + let mut x53: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x52, &mut x53, 0x0, x28, x44); + let mut x54: u64 = 0; + let mut x55: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x54, &mut x55, x53, x30, x46); + let mut x56: u64 = 0; + let mut x57: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x56, &mut x57, x55, x32, x48); + let mut x58: u64 = 0; + let mut x59: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x58, &mut x59, x57, x34, x50); + let mut x60: u64 = 0; + let mut x61: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x60, &mut x61, x59, ((x35 as u64) + (x27 as u64)), ((x51 as u64) + x39)); + let mut x62: u64 = 0; + let mut x63: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x62, &mut x63, 0x0, x54, (arg1[2])); + let mut x64: u64 = 0; + let mut x65: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x64, &mut x65, x63, x56, (0x0 as u64)); + let mut x66: u64 = 0; + let mut x67: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x66, &mut x67, x65, x58, (0x0 as u64)); + let mut x68: u64 = 0; + let mut x69: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x68, &mut x69, x67, x60, (0x0 as u64)); + let mut x70: u64 = 0; + let mut x71: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x70, &mut x71, x62, 0xd838091dd2253531); + let mut x72: u64 = 0; + let mut x73: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x72, &mut x73, x70, 0xffffffffffffffff); + let mut x74: u64 = 0; + let mut x75: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x74, &mut x75, x70, 0xffffffffffffffff); + let mut x76: u64 = 0; + let mut x77: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x76, &mut x77, x70, 0xffffffffffffffff); + let mut x78: u64 = 0; + let mut x79: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x78, &mut x79, x70, 0xfffffffefffffc2f); + let mut x80: u64 = 0; + let mut x81: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x80, &mut x81, 0x0, x79, x76); + let mut x82: u64 = 0; + let mut x83: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x82, &mut x83, x81, x77, x74); + let mut x84: u64 = 0; + let mut x85: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x84, &mut x85, x83, x75, x72); + let mut x86: u64 = 0; + let mut x87: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x86, &mut x87, 0x0, x62, x78); + let mut x88: u64 = 0; + let mut x89: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x88, &mut x89, x87, x64, x80); + let mut x90: u64 = 0; + let mut x91: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x90, &mut x91, x89, x66, x82); + let mut x92: u64 = 0; + let mut x93: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x92, &mut x93, x91, x68, x84); + let mut x94: u64 = 0; + let mut x95: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x94, &mut x95, x93, ((x69 as u64) + (x61 as u64)), ((x85 as u64) + x73)); + let mut x96: u64 = 0; + let mut x97: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x96, &mut x97, 0x0, x88, (arg1[3])); + let mut x98: u64 = 0; + let mut x99: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x98, &mut x99, x97, x90, (0x0 as u64)); + let mut x100: u64 = 0; + let mut x101: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x100, &mut x101, x99, x92, (0x0 as u64)); + let mut x102: u64 = 0; + let mut x103: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x102, &mut x103, x101, x94, (0x0 as u64)); + let mut x104: u64 = 0; + let mut x105: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x104, &mut x105, x96, 0xd838091dd2253531); + let mut x106: u64 = 0; + let mut x107: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x106, &mut x107, x104, 0xffffffffffffffff); + let mut x108: u64 = 0; + let mut x109: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x108, &mut x109, x104, 0xffffffffffffffff); + let mut x110: u64 = 0; + let mut x111: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x110, &mut x111, x104, 0xffffffffffffffff); + let mut x112: u64 = 0; + let mut x113: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x112, &mut x113, x104, 0xfffffffefffffc2f); + let mut x114: u64 = 0; + let mut x115: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x114, &mut x115, 0x0, x113, x110); + let mut x116: u64 = 0; + let mut x117: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x116, &mut x117, x115, x111, x108); + let mut x118: u64 = 0; + let mut x119: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x118, &mut x119, x117, x109, x106); + let mut x120: u64 = 0; + let mut x121: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x120, &mut x121, 0x0, x96, x112); + let mut x122: u64 = 0; + let mut x123: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x122, &mut x123, x121, x98, x114); + let mut x124: u64 = 0; + let mut x125: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x124, &mut x125, x123, x100, x116); + let mut x126: u64 = 0; + let mut x127: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x126, &mut x127, x125, x102, x118); + let mut x128: u64 = 0; + let mut x129: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x128, &mut x129, x127, ((x103 as u64) + (x95 as u64)), ((x119 as u64) + x107)); + let mut x130: u64 = 0; + let mut x131: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u64(&mut x130, &mut x131, 0x0, x122, 0xfffffffefffffc2f); + let mut x132: u64 = 0; + let mut x133: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u64(&mut x132, &mut x133, x131, x124, 0xffffffffffffffff); + let mut x134: u64 = 0; + let mut x135: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u64(&mut x134, &mut x135, x133, x126, 0xffffffffffffffff); + let mut x136: u64 = 0; + let mut x137: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u64(&mut x136, &mut x137, x135, x128, 0xffffffffffffffff); + let mut x138: u64 = 0; + let mut x139: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u64(&mut x138, &mut x139, x137, (x129 as u64), (0x0 as u64)); + let mut x140: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x140, x139, x130, x122); + let mut x141: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x141, x139, x132, x124); + let mut x142: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x142, x139, x134, x126); + let mut x143: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x143, x139, x136, x128); + out1[0] = x140; + out1[1] = x141; + out1[2] = x142; + out1[3] = x143; +} + +/// The function fiat_secp256k1_to_montgomery translates a field element into the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = eval arg1 mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_secp256k1_to_montgomery(out1: &mut fiat_secp256k1_montgomery_domain_field_element, arg1: &fiat_secp256k1_non_montgomery_domain_field_element) -> () { + let x1: u64 = (arg1[1]); + let x2: u64 = (arg1[2]); + let x3: u64 = (arg1[3]); + let x4: u64 = (arg1[0]); + let mut x5: u64 = 0; + let mut x6: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x5, &mut x6, x4, 0x7a2000e90a1); + let mut x7: u64 = 0; + let mut x8: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x7, &mut x8, 0x0, x6, x4); + let mut x9: u64 = 0; + let mut x10: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x9, &mut x10, x5, 0xd838091dd2253531); + let mut x11: u64 = 0; + let mut x12: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x11, &mut x12, x9, 0xffffffffffffffff); + let mut x13: u64 = 0; + let mut x14: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x13, &mut x14, x9, 0xffffffffffffffff); + let mut x15: u64 = 0; + let mut x16: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x15, &mut x16, x9, 0xffffffffffffffff); + let mut x17: u64 = 0; + let mut x18: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x17, &mut x18, x9, 0xfffffffefffffc2f); + let mut x19: u64 = 0; + let mut x20: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x19, &mut x20, 0x0, x18, x15); + let mut x21: u64 = 0; + let mut x22: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x21, &mut x22, x20, x16, x13); + let mut x23: u64 = 0; + let mut x24: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x23, &mut x24, x22, x14, x11); + let mut x25: u64 = 0; + let mut x26: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x25, &mut x26, 0x0, x5, x17); + let mut x27: u64 = 0; + let mut x28: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x27, &mut x28, x26, x7, x19); + let mut x29: u64 = 0; + let mut x30: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x29, &mut x30, x28, (x8 as u64), x21); + let mut x31: u64 = 0; + let mut x32: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x31, &mut x32, x30, (0x0 as u64), x23); + let mut x33: u64 = 0; + let mut x34: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x33, &mut x34, x32, (0x0 as u64), ((x24 as u64) + x12)); + let mut x35: u64 = 0; + let mut x36: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x35, &mut x36, x1, 0x7a2000e90a1); + let mut x37: u64 = 0; + let mut x38: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x37, &mut x38, 0x0, x36, x1); + let mut x39: u64 = 0; + let mut x40: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x39, &mut x40, 0x0, x27, x35); + let mut x41: u64 = 0; + let mut x42: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x41, &mut x42, x40, x29, x37); + let mut x43: u64 = 0; + let mut x44: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x43, &mut x44, x42, x31, (x38 as u64)); + let mut x45: u64 = 0; + let mut x46: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x45, &mut x46, x44, x33, (0x0 as u64)); + let mut x47: u64 = 0; + let mut x48: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x47, &mut x48, x39, 0xd838091dd2253531); + let mut x49: u64 = 0; + let mut x50: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x49, &mut x50, x47, 0xffffffffffffffff); + let mut x51: u64 = 0; + let mut x52: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x51, &mut x52, x47, 0xffffffffffffffff); + let mut x53: u64 = 0; + let mut x54: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x53, &mut x54, x47, 0xffffffffffffffff); + let mut x55: u64 = 0; + let mut x56: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x55, &mut x56, x47, 0xfffffffefffffc2f); + let mut x57: u64 = 0; + let mut x58: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x57, &mut x58, 0x0, x56, x53); + let mut x59: u64 = 0; + let mut x60: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x59, &mut x60, x58, x54, x51); + let mut x61: u64 = 0; + let mut x62: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x61, &mut x62, x60, x52, x49); + let mut x63: u64 = 0; + let mut x64: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x63, &mut x64, 0x0, x39, x55); + let mut x65: u64 = 0; + let mut x66: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x65, &mut x66, x64, x41, x57); + let mut x67: u64 = 0; + let mut x68: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x67, &mut x68, x66, x43, x59); + let mut x69: u64 = 0; + let mut x70: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x69, &mut x70, x68, x45, x61); + let mut x71: u64 = 0; + let mut x72: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x71, &mut x72, x70, ((x46 as u64) + (x34 as u64)), ((x62 as u64) + x50)); + let mut x73: u64 = 0; + let mut x74: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x73, &mut x74, x2, 0x7a2000e90a1); + let mut x75: u64 = 0; + let mut x76: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x75, &mut x76, 0x0, x74, x2); + let mut x77: u64 = 0; + let mut x78: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x77, &mut x78, 0x0, x65, x73); + let mut x79: u64 = 0; + let mut x80: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x79, &mut x80, x78, x67, x75); + let mut x81: u64 = 0; + let mut x82: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x81, &mut x82, x80, x69, (x76 as u64)); + let mut x83: u64 = 0; + let mut x84: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x83, &mut x84, x82, x71, (0x0 as u64)); + let mut x85: u64 = 0; + let mut x86: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x85, &mut x86, x77, 0xd838091dd2253531); + let mut x87: u64 = 0; + let mut x88: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x87, &mut x88, x85, 0xffffffffffffffff); + let mut x89: u64 = 0; + let mut x90: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x89, &mut x90, x85, 0xffffffffffffffff); + let mut x91: u64 = 0; + let mut x92: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x91, &mut x92, x85, 0xffffffffffffffff); + let mut x93: u64 = 0; + let mut x94: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x93, &mut x94, x85, 0xfffffffefffffc2f); + let mut x95: u64 = 0; + let mut x96: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x95, &mut x96, 0x0, x94, x91); + let mut x97: u64 = 0; + let mut x98: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x97, &mut x98, x96, x92, x89); + let mut x99: u64 = 0; + let mut x100: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x99, &mut x100, x98, x90, x87); + let mut x101: u64 = 0; + let mut x102: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x101, &mut x102, 0x0, x77, x93); + let mut x103: u64 = 0; + let mut x104: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x103, &mut x104, x102, x79, x95); + let mut x105: u64 = 0; + let mut x106: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x105, &mut x106, x104, x81, x97); + let mut x107: u64 = 0; + let mut x108: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x107, &mut x108, x106, x83, x99); + let mut x109: u64 = 0; + let mut x110: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x109, &mut x110, x108, ((x84 as u64) + (x72 as u64)), ((x100 as u64) + x88)); + let mut x111: u64 = 0; + let mut x112: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x111, &mut x112, x3, 0x7a2000e90a1); + let mut x113: u64 = 0; + let mut x114: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x113, &mut x114, 0x0, x112, x3); + let mut x115: u64 = 0; + let mut x116: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x115, &mut x116, 0x0, x103, x111); + let mut x117: u64 = 0; + let mut x118: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x117, &mut x118, x116, x105, x113); + let mut x119: u64 = 0; + let mut x120: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x119, &mut x120, x118, x107, (x114 as u64)); + let mut x121: u64 = 0; + let mut x122: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x121, &mut x122, x120, x109, (0x0 as u64)); + let mut x123: u64 = 0; + let mut x124: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x123, &mut x124, x115, 0xd838091dd2253531); + let mut x125: u64 = 0; + let mut x126: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x125, &mut x126, x123, 0xffffffffffffffff); + let mut x127: u64 = 0; + let mut x128: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x127, &mut x128, x123, 0xffffffffffffffff); + let mut x129: u64 = 0; + let mut x130: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x129, &mut x130, x123, 0xffffffffffffffff); + let mut x131: u64 = 0; + let mut x132: u64 = 0; + fiat_secp256k1_mulx_u64(&mut x131, &mut x132, x123, 0xfffffffefffffc2f); + let mut x133: u64 = 0; + let mut x134: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x133, &mut x134, 0x0, x132, x129); + let mut x135: u64 = 0; + let mut x136: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x135, &mut x136, x134, x130, x127); + let mut x137: u64 = 0; + let mut x138: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x137, &mut x138, x136, x128, x125); + let mut x139: u64 = 0; + let mut x140: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x139, &mut x140, 0x0, x115, x131); + let mut x141: u64 = 0; + let mut x142: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x141, &mut x142, x140, x117, x133); + let mut x143: u64 = 0; + let mut x144: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x143, &mut x144, x142, x119, x135); + let mut x145: u64 = 0; + let mut x146: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x145, &mut x146, x144, x121, x137); + let mut x147: u64 = 0; + let mut x148: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x147, &mut x148, x146, ((x122 as u64) + (x110 as u64)), ((x138 as u64) + x126)); + let mut x149: u64 = 0; + let mut x150: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u64(&mut x149, &mut x150, 0x0, x141, 0xfffffffefffffc2f); + let mut x151: u64 = 0; + let mut x152: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u64(&mut x151, &mut x152, x150, x143, 0xffffffffffffffff); + let mut x153: u64 = 0; + let mut x154: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u64(&mut x153, &mut x154, x152, x145, 0xffffffffffffffff); + let mut x155: u64 = 0; + let mut x156: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u64(&mut x155, &mut x156, x154, x147, 0xffffffffffffffff); + let mut x157: u64 = 0; + let mut x158: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u64(&mut x157, &mut x158, x156, (x148 as u64), (0x0 as u64)); + let mut x159: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x159, x158, x149, x141); + let mut x160: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x160, x158, x151, x143); + let mut x161: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x161, x158, x153, x145); + let mut x162: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x162, x158, x155, x147); + out1[0] = x159; + out1[1] = x160; + out1[2] = x161; + out1[3] = x162; +} + +/// The function fiat_secp256k1_nonzero outputs a single non-zero word if the input is non-zero and zero otherwise. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// out1 = 0 ↔ eval (from_montgomery arg1) mod m = 0 +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +#[inline] +pub fn fiat_secp256k1_nonzero(out1: &mut u64, arg1: &[u64; 4]) -> () { + let x1: u64 = ((arg1[0]) | ((arg1[1]) | ((arg1[2]) | (arg1[3])))); + *out1 = x1; +} + +/// The function fiat_secp256k1_selectznz is a multi-limb conditional select. +/// +/// Postconditions: +/// out1 = (if arg1 = 0 then arg2 else arg3) +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +#[inline] +pub fn fiat_secp256k1_selectznz(out1: &mut [u64; 4], arg1: fiat_secp256k1_u1, arg2: &[u64; 4], arg3: &[u64; 4]) -> () { + let mut x1: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x1, arg1, (arg2[0]), (arg3[0])); + let mut x2: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x2, arg1, (arg2[1]), (arg3[1])); + let mut x3: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x3, arg1, (arg2[2]), (arg3[2])); + let mut x4: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x4, arg1, (arg2[3]), (arg3[3])); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; + out1[3] = x4; +} + +/// The function fiat_secp256k1_to_bytes serializes a field element NOT in the Montgomery domain to bytes in little-endian order. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..31] +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] +#[inline] +pub fn fiat_secp256k1_to_bytes(out1: &mut [u8; 32], arg1: &[u64; 4]) -> () { + let x1: u64 = (arg1[3]); + let x2: u64 = (arg1[2]); + let x3: u64 = (arg1[1]); + let x4: u64 = (arg1[0]); + let x5: u8 = ((x4 & (0xff as u64)) as u8); + let x6: u64 = (x4 >> 8); + let x7: u8 = ((x6 & (0xff as u64)) as u8); + let x8: u64 = (x6 >> 8); + let x9: u8 = ((x8 & (0xff as u64)) as u8); + let x10: u64 = (x8 >> 8); + let x11: u8 = ((x10 & (0xff as u64)) as u8); + let x12: u64 = (x10 >> 8); + let x13: u8 = ((x12 & (0xff as u64)) as u8); + let x14: u64 = (x12 >> 8); + let x15: u8 = ((x14 & (0xff as u64)) as u8); + let x16: u64 = (x14 >> 8); + let x17: u8 = ((x16 & (0xff as u64)) as u8); + let x18: u8 = ((x16 >> 8) as u8); + let x19: u8 = ((x3 & (0xff as u64)) as u8); + let x20: u64 = (x3 >> 8); + let x21: u8 = ((x20 & (0xff as u64)) as u8); + let x22: u64 = (x20 >> 8); + let x23: u8 = ((x22 & (0xff as u64)) as u8); + let x24: u64 = (x22 >> 8); + let x25: u8 = ((x24 & (0xff as u64)) as u8); + let x26: u64 = (x24 >> 8); + let x27: u8 = ((x26 & (0xff as u64)) as u8); + let x28: u64 = (x26 >> 8); + let x29: u8 = ((x28 & (0xff as u64)) as u8); + let x30: u64 = (x28 >> 8); + let x31: u8 = ((x30 & (0xff as u64)) as u8); + let x32: u8 = ((x30 >> 8) as u8); + let x33: u8 = ((x2 & (0xff as u64)) as u8); + let x34: u64 = (x2 >> 8); + let x35: u8 = ((x34 & (0xff as u64)) as u8); + let x36: u64 = (x34 >> 8); + let x37: u8 = ((x36 & (0xff as u64)) as u8); + let x38: u64 = (x36 >> 8); + let x39: u8 = ((x38 & (0xff as u64)) as u8); + let x40: u64 = (x38 >> 8); + let x41: u8 = ((x40 & (0xff as u64)) as u8); + let x42: u64 = (x40 >> 8); + let x43: u8 = ((x42 & (0xff as u64)) as u8); + let x44: u64 = (x42 >> 8); + let x45: u8 = ((x44 & (0xff as u64)) as u8); + let x46: u8 = ((x44 >> 8) as u8); + let x47: u8 = ((x1 & (0xff as u64)) as u8); + let x48: u64 = (x1 >> 8); + let x49: u8 = ((x48 & (0xff as u64)) as u8); + let x50: u64 = (x48 >> 8); + let x51: u8 = ((x50 & (0xff as u64)) as u8); + let x52: u64 = (x50 >> 8); + let x53: u8 = ((x52 & (0xff as u64)) as u8); + let x54: u64 = (x52 >> 8); + let x55: u8 = ((x54 & (0xff as u64)) as u8); + let x56: u64 = (x54 >> 8); + let x57: u8 = ((x56 & (0xff as u64)) as u8); + let x58: u64 = (x56 >> 8); + let x59: u8 = ((x58 & (0xff as u64)) as u8); + let x60: u8 = ((x58 >> 8) as u8); + out1[0] = x5; + out1[1] = x7; + out1[2] = x9; + out1[3] = x11; + out1[4] = x13; + out1[5] = x15; + out1[6] = x17; + out1[7] = x18; + out1[8] = x19; + out1[9] = x21; + out1[10] = x23; + out1[11] = x25; + out1[12] = x27; + out1[13] = x29; + out1[14] = x31; + out1[15] = x32; + out1[16] = x33; + out1[17] = x35; + out1[18] = x37; + out1[19] = x39; + out1[20] = x41; + out1[21] = x43; + out1[22] = x45; + out1[23] = x46; + out1[24] = x47; + out1[25] = x49; + out1[26] = x51; + out1[27] = x53; + out1[28] = x55; + out1[29] = x57; + out1[30] = x59; + out1[31] = x60; +} + +/// The function fiat_secp256k1_from_bytes deserializes a field element NOT in the Montgomery domain from bytes in little-endian order. +/// +/// Preconditions: +/// 0 ≤ bytes_eval arg1 < m +/// Postconditions: +/// eval out1 mod m = bytes_eval arg1 mod m +/// 0 ≤ eval out1 < m +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +#[inline] +pub fn fiat_secp256k1_from_bytes(out1: &mut [u64; 4], arg1: &[u8; 32]) -> () { + let x1: u64 = (((arg1[31]) as u64) << 56); + let x2: u64 = (((arg1[30]) as u64) << 48); + let x3: u64 = (((arg1[29]) as u64) << 40); + let x4: u64 = (((arg1[28]) as u64) << 32); + let x5: u64 = (((arg1[27]) as u64) << 24); + let x6: u64 = (((arg1[26]) as u64) << 16); + let x7: u64 = (((arg1[25]) as u64) << 8); + let x8: u8 = (arg1[24]); + let x9: u64 = (((arg1[23]) as u64) << 56); + let x10: u64 = (((arg1[22]) as u64) << 48); + let x11: u64 = (((arg1[21]) as u64) << 40); + let x12: u64 = (((arg1[20]) as u64) << 32); + let x13: u64 = (((arg1[19]) as u64) << 24); + let x14: u64 = (((arg1[18]) as u64) << 16); + let x15: u64 = (((arg1[17]) as u64) << 8); + let x16: u8 = (arg1[16]); + let x17: u64 = (((arg1[15]) as u64) << 56); + let x18: u64 = (((arg1[14]) as u64) << 48); + let x19: u64 = (((arg1[13]) as u64) << 40); + let x20: u64 = (((arg1[12]) as u64) << 32); + let x21: u64 = (((arg1[11]) as u64) << 24); + let x22: u64 = (((arg1[10]) as u64) << 16); + let x23: u64 = (((arg1[9]) as u64) << 8); + let x24: u8 = (arg1[8]); + let x25: u64 = (((arg1[7]) as u64) << 56); + let x26: u64 = (((arg1[6]) as u64) << 48); + let x27: u64 = (((arg1[5]) as u64) << 40); + let x28: u64 = (((arg1[4]) as u64) << 32); + let x29: u64 = (((arg1[3]) as u64) << 24); + let x30: u64 = (((arg1[2]) as u64) << 16); + let x31: u64 = (((arg1[1]) as u64) << 8); + let x32: u8 = (arg1[0]); + let x33: u64 = (x31 + (x32 as u64)); + let x34: u64 = (x30 + x33); + let x35: u64 = (x29 + x34); + let x36: u64 = (x28 + x35); + let x37: u64 = (x27 + x36); + let x38: u64 = (x26 + x37); + let x39: u64 = (x25 + x38); + let x40: u64 = (x23 + (x24 as u64)); + let x41: u64 = (x22 + x40); + let x42: u64 = (x21 + x41); + let x43: u64 = (x20 + x42); + let x44: u64 = (x19 + x43); + let x45: u64 = (x18 + x44); + let x46: u64 = (x17 + x45); + let x47: u64 = (x15 + (x16 as u64)); + let x48: u64 = (x14 + x47); + let x49: u64 = (x13 + x48); + let x50: u64 = (x12 + x49); + let x51: u64 = (x11 + x50); + let x52: u64 = (x10 + x51); + let x53: u64 = (x9 + x52); + let x54: u64 = (x7 + (x8 as u64)); + let x55: u64 = (x6 + x54); + let x56: u64 = (x5 + x55); + let x57: u64 = (x4 + x56); + let x58: u64 = (x3 + x57); + let x59: u64 = (x2 + x58); + let x60: u64 = (x1 + x59); + out1[0] = x39; + out1[1] = x46; + out1[2] = x53; + out1[3] = x60; +} + +/// The function fiat_secp256k1_set_one returns the field element one in the Montgomery domain. +/// +/// Postconditions: +/// eval (from_montgomery out1) mod m = 1 mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_secp256k1_set_one(out1: &mut fiat_secp256k1_montgomery_domain_field_element) -> () { + out1[0] = 0x1000003d1; + out1[1] = (0x0 as u64); + out1[2] = (0x0 as u64); + out1[3] = (0x0 as u64); +} + +/// The function fiat_secp256k1_msat returns the saturated representation of the prime modulus. +/// +/// Postconditions: +/// twos_complement_eval out1 = m +/// 0 ≤ eval out1 < m +/// +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +#[inline] +pub fn fiat_secp256k1_msat(out1: &mut [u64; 5]) -> () { + out1[0] = 0xfffffffefffffc2f; + out1[1] = 0xffffffffffffffff; + out1[2] = 0xffffffffffffffff; + out1[3] = 0xffffffffffffffff; + out1[4] = (0x0 as u64); +} + +/// The function fiat_secp256k1_divstep computes a divstep. +/// +/// Preconditions: +/// 0 ≤ eval arg4 < m +/// 0 ≤ eval arg5 < m +/// Postconditions: +/// out1 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then 1 - arg1 else 1 + arg1) +/// twos_complement_eval out2 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then twos_complement_eval arg3 else twos_complement_eval arg2) +/// twos_complement_eval out3 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then ⌊(twos_complement_eval arg3 - twos_complement_eval arg2) / 2⌋ else ⌊(twos_complement_eval arg3 + (twos_complement_eval arg3 mod 2) * twos_complement_eval arg2) / 2⌋) +/// eval (from_montgomery out4) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (2 * eval (from_montgomery arg5)) mod m else (2 * eval (from_montgomery arg4)) mod m) +/// eval (from_montgomery out5) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (eval (from_montgomery arg4) - eval (from_montgomery arg4)) mod m else (eval (from_montgomery arg5) + (twos_complement_eval arg3 mod 2) * eval (from_montgomery arg4)) mod m) +/// 0 ≤ eval out5 < m +/// 0 ≤ eval out5 < m +/// 0 ≤ eval out2 < m +/// 0 ≤ eval out3 < m +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0xffffffffffffffff] +/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// arg4: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// arg5: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +/// out2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// out3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// out4: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// out5: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +#[inline] +pub fn fiat_secp256k1_divstep(out1: &mut u64, out2: &mut [u64; 5], out3: &mut [u64; 5], out4: &mut [u64; 4], out5: &mut [u64; 4], arg1: u64, arg2: &[u64; 5], arg3: &[u64; 5], arg4: &[u64; 4], arg5: &[u64; 4]) -> () { + let mut x1: u64 = 0; + let mut x2: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x1, &mut x2, 0x0, (!arg1), (0x1 as u64)); + let x3: fiat_secp256k1_u1 = (((x1 >> 63) as fiat_secp256k1_u1) & (((arg3[0]) & (0x1 as u64)) as fiat_secp256k1_u1)); + let mut x4: u64 = 0; + let mut x5: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x4, &mut x5, 0x0, (!arg1), (0x1 as u64)); + let mut x6: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x6, x3, arg1, x4); + let mut x7: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x7, x3, (arg2[0]), (arg3[0])); + let mut x8: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x8, x3, (arg2[1]), (arg3[1])); + let mut x9: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x9, x3, (arg2[2]), (arg3[2])); + let mut x10: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x10, x3, (arg2[3]), (arg3[3])); + let mut x11: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x11, x3, (arg2[4]), (arg3[4])); + let mut x12: u64 = 0; + let mut x13: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x12, &mut x13, 0x0, (0x1 as u64), (!(arg2[0]))); + let mut x14: u64 = 0; + let mut x15: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x14, &mut x15, x13, (0x0 as u64), (!(arg2[1]))); + let mut x16: u64 = 0; + let mut x17: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x16, &mut x17, x15, (0x0 as u64), (!(arg2[2]))); + let mut x18: u64 = 0; + let mut x19: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x18, &mut x19, x17, (0x0 as u64), (!(arg2[3]))); + let mut x20: u64 = 0; + let mut x21: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x20, &mut x21, x19, (0x0 as u64), (!(arg2[4]))); + let mut x22: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x22, x3, (arg3[0]), x12); + let mut x23: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x23, x3, (arg3[1]), x14); + let mut x24: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x24, x3, (arg3[2]), x16); + let mut x25: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x25, x3, (arg3[3]), x18); + let mut x26: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x26, x3, (arg3[4]), x20); + let mut x27: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x27, x3, (arg4[0]), (arg5[0])); + let mut x28: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x28, x3, (arg4[1]), (arg5[1])); + let mut x29: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x29, x3, (arg4[2]), (arg5[2])); + let mut x30: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x30, x3, (arg4[3]), (arg5[3])); + let mut x31: u64 = 0; + let mut x32: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x31, &mut x32, 0x0, x27, x27); + let mut x33: u64 = 0; + let mut x34: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x33, &mut x34, x32, x28, x28); + let mut x35: u64 = 0; + let mut x36: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x35, &mut x36, x34, x29, x29); + let mut x37: u64 = 0; + let mut x38: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x37, &mut x38, x36, x30, x30); + let mut x39: u64 = 0; + let mut x40: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u64(&mut x39, &mut x40, 0x0, x31, 0xfffffffefffffc2f); + let mut x41: u64 = 0; + let mut x42: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u64(&mut x41, &mut x42, x40, x33, 0xffffffffffffffff); + let mut x43: u64 = 0; + let mut x44: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u64(&mut x43, &mut x44, x42, x35, 0xffffffffffffffff); + let mut x45: u64 = 0; + let mut x46: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u64(&mut x45, &mut x46, x44, x37, 0xffffffffffffffff); + let mut x47: u64 = 0; + let mut x48: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u64(&mut x47, &mut x48, x46, (x38 as u64), (0x0 as u64)); + let x49: u64 = (arg4[3]); + let x50: u64 = (arg4[2]); + let x51: u64 = (arg4[1]); + let x52: u64 = (arg4[0]); + let mut x53: u64 = 0; + let mut x54: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u64(&mut x53, &mut x54, 0x0, (0x0 as u64), x52); + let mut x55: u64 = 0; + let mut x56: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u64(&mut x55, &mut x56, x54, (0x0 as u64), x51); + let mut x57: u64 = 0; + let mut x58: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u64(&mut x57, &mut x58, x56, (0x0 as u64), x50); + let mut x59: u64 = 0; + let mut x60: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u64(&mut x59, &mut x60, x58, (0x0 as u64), x49); + let mut x61: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x61, x60, (0x0 as u64), 0xffffffffffffffff); + let mut x62: u64 = 0; + let mut x63: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x62, &mut x63, 0x0, x53, (x61 & 0xfffffffefffffc2f)); + let mut x64: u64 = 0; + let mut x65: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x64, &mut x65, x63, x55, x61); + let mut x66: u64 = 0; + let mut x67: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x66, &mut x67, x65, x57, x61); + let mut x68: u64 = 0; + let mut x69: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x68, &mut x69, x67, x59, x61); + let mut x70: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x70, x3, (arg5[0]), x62); + let mut x71: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x71, x3, (arg5[1]), x64); + let mut x72: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x72, x3, (arg5[2]), x66); + let mut x73: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x73, x3, (arg5[3]), x68); + let x74: fiat_secp256k1_u1 = ((x22 & (0x1 as u64)) as fiat_secp256k1_u1); + let mut x75: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x75, x74, (0x0 as u64), x7); + let mut x76: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x76, x74, (0x0 as u64), x8); + let mut x77: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x77, x74, (0x0 as u64), x9); + let mut x78: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x78, x74, (0x0 as u64), x10); + let mut x79: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x79, x74, (0x0 as u64), x11); + let mut x80: u64 = 0; + let mut x81: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x80, &mut x81, 0x0, x22, x75); + let mut x82: u64 = 0; + let mut x83: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x82, &mut x83, x81, x23, x76); + let mut x84: u64 = 0; + let mut x85: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x84, &mut x85, x83, x24, x77); + let mut x86: u64 = 0; + let mut x87: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x86, &mut x87, x85, x25, x78); + let mut x88: u64 = 0; + let mut x89: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x88, &mut x89, x87, x26, x79); + let mut x90: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x90, x74, (0x0 as u64), x27); + let mut x91: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x91, x74, (0x0 as u64), x28); + let mut x92: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x92, x74, (0x0 as u64), x29); + let mut x93: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x93, x74, (0x0 as u64), x30); + let mut x94: u64 = 0; + let mut x95: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x94, &mut x95, 0x0, x70, x90); + let mut x96: u64 = 0; + let mut x97: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x96, &mut x97, x95, x71, x91); + let mut x98: u64 = 0; + let mut x99: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x98, &mut x99, x97, x72, x92); + let mut x100: u64 = 0; + let mut x101: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x100, &mut x101, x99, x73, x93); + let mut x102: u64 = 0; + let mut x103: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u64(&mut x102, &mut x103, 0x0, x94, 0xfffffffefffffc2f); + let mut x104: u64 = 0; + let mut x105: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u64(&mut x104, &mut x105, x103, x96, 0xffffffffffffffff); + let mut x106: u64 = 0; + let mut x107: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u64(&mut x106, &mut x107, x105, x98, 0xffffffffffffffff); + let mut x108: u64 = 0; + let mut x109: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u64(&mut x108, &mut x109, x107, x100, 0xffffffffffffffff); + let mut x110: u64 = 0; + let mut x111: fiat_secp256k1_u1 = 0; + fiat_secp256k1_subborrowx_u64(&mut x110, &mut x111, x109, (x101 as u64), (0x0 as u64)); + let mut x112: u64 = 0; + let mut x113: fiat_secp256k1_u1 = 0; + fiat_secp256k1_addcarryx_u64(&mut x112, &mut x113, 0x0, x6, (0x1 as u64)); + let x114: u64 = ((x80 >> 1) | ((x82 << 63) & 0xffffffffffffffff)); + let x115: u64 = ((x82 >> 1) | ((x84 << 63) & 0xffffffffffffffff)); + let x116: u64 = ((x84 >> 1) | ((x86 << 63) & 0xffffffffffffffff)); + let x117: u64 = ((x86 >> 1) | ((x88 << 63) & 0xffffffffffffffff)); + let x118: u64 = ((x88 & 0x8000000000000000) | (x88 >> 1)); + let mut x119: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x119, x48, x39, x31); + let mut x120: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x120, x48, x41, x33); + let mut x121: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x121, x48, x43, x35); + let mut x122: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x122, x48, x45, x37); + let mut x123: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x123, x111, x102, x94); + let mut x124: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x124, x111, x104, x96); + let mut x125: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x125, x111, x106, x98); + let mut x126: u64 = 0; + fiat_secp256k1_cmovznz_u64(&mut x126, x111, x108, x100); + *out1 = x112; + out2[0] = x7; + out2[1] = x8; + out2[2] = x9; + out2[3] = x10; + out2[4] = x11; + out3[0] = x114; + out3[1] = x115; + out3[2] = x116; + out3[3] = x117; + out3[4] = x118; + out4[0] = x119; + out4[1] = x120; + out4[2] = x121; + out4[3] = x122; + out5[0] = x123; + out5[1] = x124; + out5[2] = x125; + out5[3] = x126; +} + +/// The function fiat_secp256k1_divstep_precomp returns the precomputed value for Bernstein-Yang-inversion (in montgomery form). +/// +/// Postconditions: +/// eval (from_montgomery out1) = ⌊(m - 1) / 2⌋^(if ⌊log2 m⌋ + 1 < 46 then ⌊(49 * (⌊log2 m⌋ + 1) + 80) / 17⌋ else ⌊(49 * (⌊log2 m⌋ + 1) + 57) / 17⌋) +/// 0 ≤ eval out1 < m +/// +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +#[inline] +pub fn fiat_secp256k1_divstep_precomp(out1: &mut [u64; 4]) -> () { + out1[0] = 0xf201a41831525e0a; + out1[1] = 0x9953f9ddcd648d85; + out1[2] = 0xe86029463db210a9; + out1[3] = 0x24fb8a3104b03709; +} diff --git a/vendor/fiat-crypto/src/secp256k1_scalar_32.rs b/vendor/fiat-crypto/src/secp256k1_scalar_32.rs new file mode 100644 index 000000000..bbdc1e474 --- /dev/null +++ b/vendor/fiat-crypto/src/secp256k1_scalar_32.rs @@ -0,0 +1,5601 @@ +//! Autogenerated: 'src/ExtractionOCaml/word_by_word_montgomery' --lang Rust --inline secp256k1_scalar 32 '2^256 - 432420386565659656852420866394968145599' mul square add sub opp from_montgomery to_montgomery nonzero selectznz to_bytes from_bytes one msat divstep divstep_precomp +//! curve description: secp256k1_scalar +//! machine_wordsize = 32 (from "32") +//! requested operations: mul, square, add, sub, opp, from_montgomery, to_montgomery, nonzero, selectznz, to_bytes, from_bytes, one, msat, divstep, divstep_precomp +//! m = 0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141 (from "2^256 - 432420386565659656852420866394968145599") +//! +//! NOTE: In addition to the bounds specified above each function, all +//! functions synthesized for this Montgomery arithmetic require the +//! input to be strictly less than the prime modulus (m), and also +//! require the input to be in the unique saturated representation. +//! All functions also ensure that these two properties are true of +//! return values. +//! +//! Computed values: +//! eval z = z[0] + (z[1] << 32) + (z[2] << 64) + (z[3] << 96) + (z[4] << 128) + (z[5] << 160) + (z[6] << 192) + (z[7] << 224) +//! bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248) +//! twos_complement_eval z = let x1 := z[0] + (z[1] << 32) + (z[2] << 64) + (z[3] << 96) + (z[4] << 128) + (z[5] << 160) + (z[6] << 192) + (z[7] << 224) in +//! if x1 & (2^256-1) < 2^255 then x1 & (2^256-1) else (x1 & (2^256-1)) - 2^256 + +#![allow(unused_parens)] +#![allow(non_camel_case_types)] + +pub type fiat_secp256k1_scalar_u1 = u8; +pub type fiat_secp256k1_scalar_i1 = i8; +pub type fiat_secp256k1_scalar_u2 = u8; +pub type fiat_secp256k1_scalar_i2 = i8; + +/* The type fiat_secp256k1_scalar_montgomery_domain_field_element is a field element in the Montgomery domain. */ +/* Bounds: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] */ +pub type fiat_secp256k1_scalar_montgomery_domain_field_element = [u32; 8]; + +/* The type fiat_secp256k1_scalar_non_montgomery_domain_field_element is a field element NOT in the Montgomery domain. */ +/* Bounds: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] */ +pub type fiat_secp256k1_scalar_non_montgomery_domain_field_element = [u32; 8]; + + +/// The function fiat_secp256k1_scalar_addcarryx_u32 is an addition with carry. +/// +/// Postconditions: +/// out1 = (arg1 + arg2 + arg3) mod 2^32 +/// out2 = ⌊(arg1 + arg2 + arg3) / 2^32⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffff] +/// arg3: [0x0 ~> 0xffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_secp256k1_scalar_addcarryx_u32(out1: &mut u32, out2: &mut fiat_secp256k1_scalar_u1, arg1: fiat_secp256k1_scalar_u1, arg2: u32, arg3: u32) -> () { + let x1: u64 = (((arg1 as u64) + (arg2 as u64)) + (arg3 as u64)); + let x2: u32 = ((x1 & (0xffffffff as u64)) as u32); + let x3: fiat_secp256k1_scalar_u1 = ((x1 >> 32) as fiat_secp256k1_scalar_u1); + *out1 = x2; + *out2 = x3; +} + +/// The function fiat_secp256k1_scalar_subborrowx_u32 is a subtraction with borrow. +/// +/// Postconditions: +/// out1 = (-arg1 + arg2 + -arg3) mod 2^32 +/// out2 = -⌊(-arg1 + arg2 + -arg3) / 2^32⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffff] +/// arg3: [0x0 ~> 0xffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_secp256k1_scalar_subborrowx_u32(out1: &mut u32, out2: &mut fiat_secp256k1_scalar_u1, arg1: fiat_secp256k1_scalar_u1, arg2: u32, arg3: u32) -> () { + let x1: i64 = (((arg2 as i64) - (arg1 as i64)) - (arg3 as i64)); + let x2: fiat_secp256k1_scalar_i1 = ((x1 >> 32) as fiat_secp256k1_scalar_i1); + let x3: u32 = ((x1 & (0xffffffff as i64)) as u32); + *out1 = x3; + *out2 = (((0x0 as fiat_secp256k1_scalar_i2) - (x2 as fiat_secp256k1_scalar_i2)) as fiat_secp256k1_scalar_u1); +} + +/// The function fiat_secp256k1_scalar_mulx_u32 is a multiplication, returning the full double-width result. +/// +/// Postconditions: +/// out1 = (arg1 * arg2) mod 2^32 +/// out2 = ⌊arg1 * arg2 / 2^32⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0xffffffff] +/// arg2: [0x0 ~> 0xffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +/// out2: [0x0 ~> 0xffffffff] +#[inline] +pub fn fiat_secp256k1_scalar_mulx_u32(out1: &mut u32, out2: &mut u32, arg1: u32, arg2: u32) -> () { + let x1: u64 = ((arg1 as u64) * (arg2 as u64)); + let x2: u32 = ((x1 & (0xffffffff as u64)) as u32); + let x3: u32 = ((x1 >> 32) as u32); + *out1 = x2; + *out2 = x3; +} + +/// The function fiat_secp256k1_scalar_cmovznz_u32 is a single-word conditional move. +/// +/// Postconditions: +/// out1 = (if arg1 = 0 then arg2 else arg3) +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffff] +/// arg3: [0x0 ~> 0xffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +#[inline] +pub fn fiat_secp256k1_scalar_cmovznz_u32(out1: &mut u32, arg1: fiat_secp256k1_scalar_u1, arg2: u32, arg3: u32) -> () { + let x1: fiat_secp256k1_scalar_u1 = (!(!arg1)); + let x2: u32 = ((((((0x0 as fiat_secp256k1_scalar_i2) - (x1 as fiat_secp256k1_scalar_i2)) as fiat_secp256k1_scalar_i1) as i64) & (0xffffffff as i64)) as u32); + let x3: u32 = ((x2 & arg3) | ((!x2) & arg2)); + *out1 = x3; +} + +/// The function fiat_secp256k1_scalar_mul multiplies two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_secp256k1_scalar_mul(out1: &mut fiat_secp256k1_scalar_montgomery_domain_field_element, arg1: &fiat_secp256k1_scalar_montgomery_domain_field_element, arg2: &fiat_secp256k1_scalar_montgomery_domain_field_element) -> () { + let x1: u32 = (arg1[1]); + let x2: u32 = (arg1[2]); + let x3: u32 = (arg1[3]); + let x4: u32 = (arg1[4]); + let x5: u32 = (arg1[5]); + let x6: u32 = (arg1[6]); + let x7: u32 = (arg1[7]); + let x8: u32 = (arg1[0]); + let mut x9: u32 = 0; + let mut x10: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x9, &mut x10, x8, (arg2[7])); + let mut x11: u32 = 0; + let mut x12: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x11, &mut x12, x8, (arg2[6])); + let mut x13: u32 = 0; + let mut x14: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x13, &mut x14, x8, (arg2[5])); + let mut x15: u32 = 0; + let mut x16: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x15, &mut x16, x8, (arg2[4])); + let mut x17: u32 = 0; + let mut x18: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x17, &mut x18, x8, (arg2[3])); + let mut x19: u32 = 0; + let mut x20: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x19, &mut x20, x8, (arg2[2])); + let mut x21: u32 = 0; + let mut x22: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x21, &mut x22, x8, (arg2[1])); + let mut x23: u32 = 0; + let mut x24: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x23, &mut x24, x8, (arg2[0])); + let mut x25: u32 = 0; + let mut x26: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x25, &mut x26, 0x0, x24, x21); + let mut x27: u32 = 0; + let mut x28: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x27, &mut x28, x26, x22, x19); + let mut x29: u32 = 0; + let mut x30: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x29, &mut x30, x28, x20, x17); + let mut x31: u32 = 0; + let mut x32: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x31, &mut x32, x30, x18, x15); + let mut x33: u32 = 0; + let mut x34: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x33, &mut x34, x32, x16, x13); + let mut x35: u32 = 0; + let mut x36: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x35, &mut x36, x34, x14, x11); + let mut x37: u32 = 0; + let mut x38: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x37, &mut x38, x36, x12, x9); + let x39: u32 = ((x38 as u32) + x10); + let mut x40: u32 = 0; + let mut x41: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x40, &mut x41, x23, 0x5588b13f); + let mut x42: u32 = 0; + let mut x43: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x42, &mut x43, x40, 0xffffffff); + let mut x44: u32 = 0; + let mut x45: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x44, &mut x45, x40, 0xffffffff); + let mut x46: u32 = 0; + let mut x47: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x46, &mut x47, x40, 0xffffffff); + let mut x48: u32 = 0; + let mut x49: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x48, &mut x49, x40, 0xfffffffe); + let mut x50: u32 = 0; + let mut x51: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x50, &mut x51, x40, 0xbaaedce6); + let mut x52: u32 = 0; + let mut x53: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x52, &mut x53, x40, 0xaf48a03b); + let mut x54: u32 = 0; + let mut x55: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x54, &mut x55, x40, 0xbfd25e8c); + let mut x56: u32 = 0; + let mut x57: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x56, &mut x57, x40, 0xd0364141); + let mut x58: u32 = 0; + let mut x59: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x58, &mut x59, 0x0, x57, x54); + let mut x60: u32 = 0; + let mut x61: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x60, &mut x61, x59, x55, x52); + let mut x62: u32 = 0; + let mut x63: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x62, &mut x63, x61, x53, x50); + let mut x64: u32 = 0; + let mut x65: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x64, &mut x65, x63, x51, x48); + let mut x66: u32 = 0; + let mut x67: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x66, &mut x67, x65, x49, x46); + let mut x68: u32 = 0; + let mut x69: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x68, &mut x69, x67, x47, x44); + let mut x70: u32 = 0; + let mut x71: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x70, &mut x71, x69, x45, x42); + let x72: u32 = ((x71 as u32) + x43); + let mut x73: u32 = 0; + let mut x74: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x73, &mut x74, 0x0, x23, x56); + let mut x75: u32 = 0; + let mut x76: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x75, &mut x76, x74, x25, x58); + let mut x77: u32 = 0; + let mut x78: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x77, &mut x78, x76, x27, x60); + let mut x79: u32 = 0; + let mut x80: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x79, &mut x80, x78, x29, x62); + let mut x81: u32 = 0; + let mut x82: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x81, &mut x82, x80, x31, x64); + let mut x83: u32 = 0; + let mut x84: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x83, &mut x84, x82, x33, x66); + let mut x85: u32 = 0; + let mut x86: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x85, &mut x86, x84, x35, x68); + let mut x87: u32 = 0; + let mut x88: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x87, &mut x88, x86, x37, x70); + let mut x89: u32 = 0; + let mut x90: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x89, &mut x90, x88, x39, x72); + let mut x91: u32 = 0; + let mut x92: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x91, &mut x92, x1, (arg2[7])); + let mut x93: u32 = 0; + let mut x94: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x93, &mut x94, x1, (arg2[6])); + let mut x95: u32 = 0; + let mut x96: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x95, &mut x96, x1, (arg2[5])); + let mut x97: u32 = 0; + let mut x98: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x97, &mut x98, x1, (arg2[4])); + let mut x99: u32 = 0; + let mut x100: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x99, &mut x100, x1, (arg2[3])); + let mut x101: u32 = 0; + let mut x102: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x101, &mut x102, x1, (arg2[2])); + let mut x103: u32 = 0; + let mut x104: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x103, &mut x104, x1, (arg2[1])); + let mut x105: u32 = 0; + let mut x106: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x105, &mut x106, x1, (arg2[0])); + let mut x107: u32 = 0; + let mut x108: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x107, &mut x108, 0x0, x106, x103); + let mut x109: u32 = 0; + let mut x110: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x109, &mut x110, x108, x104, x101); + let mut x111: u32 = 0; + let mut x112: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x111, &mut x112, x110, x102, x99); + let mut x113: u32 = 0; + let mut x114: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x113, &mut x114, x112, x100, x97); + let mut x115: u32 = 0; + let mut x116: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x115, &mut x116, x114, x98, x95); + let mut x117: u32 = 0; + let mut x118: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x117, &mut x118, x116, x96, x93); + let mut x119: u32 = 0; + let mut x120: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x119, &mut x120, x118, x94, x91); + let x121: u32 = ((x120 as u32) + x92); + let mut x122: u32 = 0; + let mut x123: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x122, &mut x123, 0x0, x75, x105); + let mut x124: u32 = 0; + let mut x125: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x124, &mut x125, x123, x77, x107); + let mut x126: u32 = 0; + let mut x127: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x126, &mut x127, x125, x79, x109); + let mut x128: u32 = 0; + let mut x129: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x128, &mut x129, x127, x81, x111); + let mut x130: u32 = 0; + let mut x131: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x130, &mut x131, x129, x83, x113); + let mut x132: u32 = 0; + let mut x133: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x132, &mut x133, x131, x85, x115); + let mut x134: u32 = 0; + let mut x135: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x134, &mut x135, x133, x87, x117); + let mut x136: u32 = 0; + let mut x137: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x136, &mut x137, x135, x89, x119); + let mut x138: u32 = 0; + let mut x139: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x138, &mut x139, x137, (x90 as u32), x121); + let mut x140: u32 = 0; + let mut x141: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x140, &mut x141, x122, 0x5588b13f); + let mut x142: u32 = 0; + let mut x143: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x142, &mut x143, x140, 0xffffffff); + let mut x144: u32 = 0; + let mut x145: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x144, &mut x145, x140, 0xffffffff); + let mut x146: u32 = 0; + let mut x147: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x146, &mut x147, x140, 0xffffffff); + let mut x148: u32 = 0; + let mut x149: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x148, &mut x149, x140, 0xfffffffe); + let mut x150: u32 = 0; + let mut x151: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x150, &mut x151, x140, 0xbaaedce6); + let mut x152: u32 = 0; + let mut x153: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x152, &mut x153, x140, 0xaf48a03b); + let mut x154: u32 = 0; + let mut x155: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x154, &mut x155, x140, 0xbfd25e8c); + let mut x156: u32 = 0; + let mut x157: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x156, &mut x157, x140, 0xd0364141); + let mut x158: u32 = 0; + let mut x159: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x158, &mut x159, 0x0, x157, x154); + let mut x160: u32 = 0; + let mut x161: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x160, &mut x161, x159, x155, x152); + let mut x162: u32 = 0; + let mut x163: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x162, &mut x163, x161, x153, x150); + let mut x164: u32 = 0; + let mut x165: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x164, &mut x165, x163, x151, x148); + let mut x166: u32 = 0; + let mut x167: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x166, &mut x167, x165, x149, x146); + let mut x168: u32 = 0; + let mut x169: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x168, &mut x169, x167, x147, x144); + let mut x170: u32 = 0; + let mut x171: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x170, &mut x171, x169, x145, x142); + let x172: u32 = ((x171 as u32) + x143); + let mut x173: u32 = 0; + let mut x174: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x173, &mut x174, 0x0, x122, x156); + let mut x175: u32 = 0; + let mut x176: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x175, &mut x176, x174, x124, x158); + let mut x177: u32 = 0; + let mut x178: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x177, &mut x178, x176, x126, x160); + let mut x179: u32 = 0; + let mut x180: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x179, &mut x180, x178, x128, x162); + let mut x181: u32 = 0; + let mut x182: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x181, &mut x182, x180, x130, x164); + let mut x183: u32 = 0; + let mut x184: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x183, &mut x184, x182, x132, x166); + let mut x185: u32 = 0; + let mut x186: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x185, &mut x186, x184, x134, x168); + let mut x187: u32 = 0; + let mut x188: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x187, &mut x188, x186, x136, x170); + let mut x189: u32 = 0; + let mut x190: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x189, &mut x190, x188, x138, x172); + let x191: u32 = ((x190 as u32) + (x139 as u32)); + let mut x192: u32 = 0; + let mut x193: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x192, &mut x193, x2, (arg2[7])); + let mut x194: u32 = 0; + let mut x195: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x194, &mut x195, x2, (arg2[6])); + let mut x196: u32 = 0; + let mut x197: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x196, &mut x197, x2, (arg2[5])); + let mut x198: u32 = 0; + let mut x199: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x198, &mut x199, x2, (arg2[4])); + let mut x200: u32 = 0; + let mut x201: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x200, &mut x201, x2, (arg2[3])); + let mut x202: u32 = 0; + let mut x203: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x202, &mut x203, x2, (arg2[2])); + let mut x204: u32 = 0; + let mut x205: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x204, &mut x205, x2, (arg2[1])); + let mut x206: u32 = 0; + let mut x207: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x206, &mut x207, x2, (arg2[0])); + let mut x208: u32 = 0; + let mut x209: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x208, &mut x209, 0x0, x207, x204); + let mut x210: u32 = 0; + let mut x211: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x210, &mut x211, x209, x205, x202); + let mut x212: u32 = 0; + let mut x213: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x212, &mut x213, x211, x203, x200); + let mut x214: u32 = 0; + let mut x215: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x214, &mut x215, x213, x201, x198); + let mut x216: u32 = 0; + let mut x217: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x216, &mut x217, x215, x199, x196); + let mut x218: u32 = 0; + let mut x219: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x218, &mut x219, x217, x197, x194); + let mut x220: u32 = 0; + let mut x221: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x220, &mut x221, x219, x195, x192); + let x222: u32 = ((x221 as u32) + x193); + let mut x223: u32 = 0; + let mut x224: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x223, &mut x224, 0x0, x175, x206); + let mut x225: u32 = 0; + let mut x226: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x225, &mut x226, x224, x177, x208); + let mut x227: u32 = 0; + let mut x228: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x227, &mut x228, x226, x179, x210); + let mut x229: u32 = 0; + let mut x230: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x229, &mut x230, x228, x181, x212); + let mut x231: u32 = 0; + let mut x232: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x231, &mut x232, x230, x183, x214); + let mut x233: u32 = 0; + let mut x234: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x233, &mut x234, x232, x185, x216); + let mut x235: u32 = 0; + let mut x236: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x235, &mut x236, x234, x187, x218); + let mut x237: u32 = 0; + let mut x238: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x237, &mut x238, x236, x189, x220); + let mut x239: u32 = 0; + let mut x240: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x239, &mut x240, x238, x191, x222); + let mut x241: u32 = 0; + let mut x242: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x241, &mut x242, x223, 0x5588b13f); + let mut x243: u32 = 0; + let mut x244: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x243, &mut x244, x241, 0xffffffff); + let mut x245: u32 = 0; + let mut x246: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x245, &mut x246, x241, 0xffffffff); + let mut x247: u32 = 0; + let mut x248: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x247, &mut x248, x241, 0xffffffff); + let mut x249: u32 = 0; + let mut x250: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x249, &mut x250, x241, 0xfffffffe); + let mut x251: u32 = 0; + let mut x252: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x251, &mut x252, x241, 0xbaaedce6); + let mut x253: u32 = 0; + let mut x254: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x253, &mut x254, x241, 0xaf48a03b); + let mut x255: u32 = 0; + let mut x256: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x255, &mut x256, x241, 0xbfd25e8c); + let mut x257: u32 = 0; + let mut x258: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x257, &mut x258, x241, 0xd0364141); + let mut x259: u32 = 0; + let mut x260: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x259, &mut x260, 0x0, x258, x255); + let mut x261: u32 = 0; + let mut x262: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x261, &mut x262, x260, x256, x253); + let mut x263: u32 = 0; + let mut x264: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x263, &mut x264, x262, x254, x251); + let mut x265: u32 = 0; + let mut x266: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x265, &mut x266, x264, x252, x249); + let mut x267: u32 = 0; + let mut x268: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x267, &mut x268, x266, x250, x247); + let mut x269: u32 = 0; + let mut x270: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x269, &mut x270, x268, x248, x245); + let mut x271: u32 = 0; + let mut x272: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x271, &mut x272, x270, x246, x243); + let x273: u32 = ((x272 as u32) + x244); + let mut x274: u32 = 0; + let mut x275: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x274, &mut x275, 0x0, x223, x257); + let mut x276: u32 = 0; + let mut x277: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x276, &mut x277, x275, x225, x259); + let mut x278: u32 = 0; + let mut x279: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x278, &mut x279, x277, x227, x261); + let mut x280: u32 = 0; + let mut x281: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x280, &mut x281, x279, x229, x263); + let mut x282: u32 = 0; + let mut x283: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x282, &mut x283, x281, x231, x265); + let mut x284: u32 = 0; + let mut x285: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x284, &mut x285, x283, x233, x267); + let mut x286: u32 = 0; + let mut x287: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x286, &mut x287, x285, x235, x269); + let mut x288: u32 = 0; + let mut x289: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x288, &mut x289, x287, x237, x271); + let mut x290: u32 = 0; + let mut x291: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x290, &mut x291, x289, x239, x273); + let x292: u32 = ((x291 as u32) + (x240 as u32)); + let mut x293: u32 = 0; + let mut x294: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x293, &mut x294, x3, (arg2[7])); + let mut x295: u32 = 0; + let mut x296: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x295, &mut x296, x3, (arg2[6])); + let mut x297: u32 = 0; + let mut x298: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x297, &mut x298, x3, (arg2[5])); + let mut x299: u32 = 0; + let mut x300: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x299, &mut x300, x3, (arg2[4])); + let mut x301: u32 = 0; + let mut x302: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x301, &mut x302, x3, (arg2[3])); + let mut x303: u32 = 0; + let mut x304: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x303, &mut x304, x3, (arg2[2])); + let mut x305: u32 = 0; + let mut x306: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x305, &mut x306, x3, (arg2[1])); + let mut x307: u32 = 0; + let mut x308: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x307, &mut x308, x3, (arg2[0])); + let mut x309: u32 = 0; + let mut x310: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x309, &mut x310, 0x0, x308, x305); + let mut x311: u32 = 0; + let mut x312: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x311, &mut x312, x310, x306, x303); + let mut x313: u32 = 0; + let mut x314: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x313, &mut x314, x312, x304, x301); + let mut x315: u32 = 0; + let mut x316: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x315, &mut x316, x314, x302, x299); + let mut x317: u32 = 0; + let mut x318: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x317, &mut x318, x316, x300, x297); + let mut x319: u32 = 0; + let mut x320: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x319, &mut x320, x318, x298, x295); + let mut x321: u32 = 0; + let mut x322: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x321, &mut x322, x320, x296, x293); + let x323: u32 = ((x322 as u32) + x294); + let mut x324: u32 = 0; + let mut x325: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x324, &mut x325, 0x0, x276, x307); + let mut x326: u32 = 0; + let mut x327: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x326, &mut x327, x325, x278, x309); + let mut x328: u32 = 0; + let mut x329: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x328, &mut x329, x327, x280, x311); + let mut x330: u32 = 0; + let mut x331: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x330, &mut x331, x329, x282, x313); + let mut x332: u32 = 0; + let mut x333: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x332, &mut x333, x331, x284, x315); + let mut x334: u32 = 0; + let mut x335: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x334, &mut x335, x333, x286, x317); + let mut x336: u32 = 0; + let mut x337: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x336, &mut x337, x335, x288, x319); + let mut x338: u32 = 0; + let mut x339: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x338, &mut x339, x337, x290, x321); + let mut x340: u32 = 0; + let mut x341: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x340, &mut x341, x339, x292, x323); + let mut x342: u32 = 0; + let mut x343: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x342, &mut x343, x324, 0x5588b13f); + let mut x344: u32 = 0; + let mut x345: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x344, &mut x345, x342, 0xffffffff); + let mut x346: u32 = 0; + let mut x347: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x346, &mut x347, x342, 0xffffffff); + let mut x348: u32 = 0; + let mut x349: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x348, &mut x349, x342, 0xffffffff); + let mut x350: u32 = 0; + let mut x351: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x350, &mut x351, x342, 0xfffffffe); + let mut x352: u32 = 0; + let mut x353: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x352, &mut x353, x342, 0xbaaedce6); + let mut x354: u32 = 0; + let mut x355: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x354, &mut x355, x342, 0xaf48a03b); + let mut x356: u32 = 0; + let mut x357: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x356, &mut x357, x342, 0xbfd25e8c); + let mut x358: u32 = 0; + let mut x359: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x358, &mut x359, x342, 0xd0364141); + let mut x360: u32 = 0; + let mut x361: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x360, &mut x361, 0x0, x359, x356); + let mut x362: u32 = 0; + let mut x363: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x362, &mut x363, x361, x357, x354); + let mut x364: u32 = 0; + let mut x365: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x364, &mut x365, x363, x355, x352); + let mut x366: u32 = 0; + let mut x367: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x366, &mut x367, x365, x353, x350); + let mut x368: u32 = 0; + let mut x369: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x368, &mut x369, x367, x351, x348); + let mut x370: u32 = 0; + let mut x371: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x370, &mut x371, x369, x349, x346); + let mut x372: u32 = 0; + let mut x373: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x372, &mut x373, x371, x347, x344); + let x374: u32 = ((x373 as u32) + x345); + let mut x375: u32 = 0; + let mut x376: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x375, &mut x376, 0x0, x324, x358); + let mut x377: u32 = 0; + let mut x378: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x377, &mut x378, x376, x326, x360); + let mut x379: u32 = 0; + let mut x380: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x379, &mut x380, x378, x328, x362); + let mut x381: u32 = 0; + let mut x382: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x381, &mut x382, x380, x330, x364); + let mut x383: u32 = 0; + let mut x384: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x383, &mut x384, x382, x332, x366); + let mut x385: u32 = 0; + let mut x386: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x385, &mut x386, x384, x334, x368); + let mut x387: u32 = 0; + let mut x388: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x387, &mut x388, x386, x336, x370); + let mut x389: u32 = 0; + let mut x390: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x389, &mut x390, x388, x338, x372); + let mut x391: u32 = 0; + let mut x392: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x391, &mut x392, x390, x340, x374); + let x393: u32 = ((x392 as u32) + (x341 as u32)); + let mut x394: u32 = 0; + let mut x395: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x394, &mut x395, x4, (arg2[7])); + let mut x396: u32 = 0; + let mut x397: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x396, &mut x397, x4, (arg2[6])); + let mut x398: u32 = 0; + let mut x399: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x398, &mut x399, x4, (arg2[5])); + let mut x400: u32 = 0; + let mut x401: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x400, &mut x401, x4, (arg2[4])); + let mut x402: u32 = 0; + let mut x403: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x402, &mut x403, x4, (arg2[3])); + let mut x404: u32 = 0; + let mut x405: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x404, &mut x405, x4, (arg2[2])); + let mut x406: u32 = 0; + let mut x407: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x406, &mut x407, x4, (arg2[1])); + let mut x408: u32 = 0; + let mut x409: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x408, &mut x409, x4, (arg2[0])); + let mut x410: u32 = 0; + let mut x411: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x410, &mut x411, 0x0, x409, x406); + let mut x412: u32 = 0; + let mut x413: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x412, &mut x413, x411, x407, x404); + let mut x414: u32 = 0; + let mut x415: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x414, &mut x415, x413, x405, x402); + let mut x416: u32 = 0; + let mut x417: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x416, &mut x417, x415, x403, x400); + let mut x418: u32 = 0; + let mut x419: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x418, &mut x419, x417, x401, x398); + let mut x420: u32 = 0; + let mut x421: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x420, &mut x421, x419, x399, x396); + let mut x422: u32 = 0; + let mut x423: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x422, &mut x423, x421, x397, x394); + let x424: u32 = ((x423 as u32) + x395); + let mut x425: u32 = 0; + let mut x426: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x425, &mut x426, 0x0, x377, x408); + let mut x427: u32 = 0; + let mut x428: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x427, &mut x428, x426, x379, x410); + let mut x429: u32 = 0; + let mut x430: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x429, &mut x430, x428, x381, x412); + let mut x431: u32 = 0; + let mut x432: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x431, &mut x432, x430, x383, x414); + let mut x433: u32 = 0; + let mut x434: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x433, &mut x434, x432, x385, x416); + let mut x435: u32 = 0; + let mut x436: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x435, &mut x436, x434, x387, x418); + let mut x437: u32 = 0; + let mut x438: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x437, &mut x438, x436, x389, x420); + let mut x439: u32 = 0; + let mut x440: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x439, &mut x440, x438, x391, x422); + let mut x441: u32 = 0; + let mut x442: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x441, &mut x442, x440, x393, x424); + let mut x443: u32 = 0; + let mut x444: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x443, &mut x444, x425, 0x5588b13f); + let mut x445: u32 = 0; + let mut x446: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x445, &mut x446, x443, 0xffffffff); + let mut x447: u32 = 0; + let mut x448: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x447, &mut x448, x443, 0xffffffff); + let mut x449: u32 = 0; + let mut x450: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x449, &mut x450, x443, 0xffffffff); + let mut x451: u32 = 0; + let mut x452: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x451, &mut x452, x443, 0xfffffffe); + let mut x453: u32 = 0; + let mut x454: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x453, &mut x454, x443, 0xbaaedce6); + let mut x455: u32 = 0; + let mut x456: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x455, &mut x456, x443, 0xaf48a03b); + let mut x457: u32 = 0; + let mut x458: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x457, &mut x458, x443, 0xbfd25e8c); + let mut x459: u32 = 0; + let mut x460: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x459, &mut x460, x443, 0xd0364141); + let mut x461: u32 = 0; + let mut x462: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x461, &mut x462, 0x0, x460, x457); + let mut x463: u32 = 0; + let mut x464: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x463, &mut x464, x462, x458, x455); + let mut x465: u32 = 0; + let mut x466: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x465, &mut x466, x464, x456, x453); + let mut x467: u32 = 0; + let mut x468: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x467, &mut x468, x466, x454, x451); + let mut x469: u32 = 0; + let mut x470: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x469, &mut x470, x468, x452, x449); + let mut x471: u32 = 0; + let mut x472: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x471, &mut x472, x470, x450, x447); + let mut x473: u32 = 0; + let mut x474: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x473, &mut x474, x472, x448, x445); + let x475: u32 = ((x474 as u32) + x446); + let mut x476: u32 = 0; + let mut x477: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x476, &mut x477, 0x0, x425, x459); + let mut x478: u32 = 0; + let mut x479: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x478, &mut x479, x477, x427, x461); + let mut x480: u32 = 0; + let mut x481: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x480, &mut x481, x479, x429, x463); + let mut x482: u32 = 0; + let mut x483: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x482, &mut x483, x481, x431, x465); + let mut x484: u32 = 0; + let mut x485: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x484, &mut x485, x483, x433, x467); + let mut x486: u32 = 0; + let mut x487: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x486, &mut x487, x485, x435, x469); + let mut x488: u32 = 0; + let mut x489: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x488, &mut x489, x487, x437, x471); + let mut x490: u32 = 0; + let mut x491: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x490, &mut x491, x489, x439, x473); + let mut x492: u32 = 0; + let mut x493: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x492, &mut x493, x491, x441, x475); + let x494: u32 = ((x493 as u32) + (x442 as u32)); + let mut x495: u32 = 0; + let mut x496: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x495, &mut x496, x5, (arg2[7])); + let mut x497: u32 = 0; + let mut x498: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x497, &mut x498, x5, (arg2[6])); + let mut x499: u32 = 0; + let mut x500: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x499, &mut x500, x5, (arg2[5])); + let mut x501: u32 = 0; + let mut x502: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x501, &mut x502, x5, (arg2[4])); + let mut x503: u32 = 0; + let mut x504: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x503, &mut x504, x5, (arg2[3])); + let mut x505: u32 = 0; + let mut x506: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x505, &mut x506, x5, (arg2[2])); + let mut x507: u32 = 0; + let mut x508: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x507, &mut x508, x5, (arg2[1])); + let mut x509: u32 = 0; + let mut x510: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x509, &mut x510, x5, (arg2[0])); + let mut x511: u32 = 0; + let mut x512: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x511, &mut x512, 0x0, x510, x507); + let mut x513: u32 = 0; + let mut x514: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x513, &mut x514, x512, x508, x505); + let mut x515: u32 = 0; + let mut x516: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x515, &mut x516, x514, x506, x503); + let mut x517: u32 = 0; + let mut x518: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x517, &mut x518, x516, x504, x501); + let mut x519: u32 = 0; + let mut x520: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x519, &mut x520, x518, x502, x499); + let mut x521: u32 = 0; + let mut x522: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x521, &mut x522, x520, x500, x497); + let mut x523: u32 = 0; + let mut x524: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x523, &mut x524, x522, x498, x495); + let x525: u32 = ((x524 as u32) + x496); + let mut x526: u32 = 0; + let mut x527: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x526, &mut x527, 0x0, x478, x509); + let mut x528: u32 = 0; + let mut x529: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x528, &mut x529, x527, x480, x511); + let mut x530: u32 = 0; + let mut x531: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x530, &mut x531, x529, x482, x513); + let mut x532: u32 = 0; + let mut x533: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x532, &mut x533, x531, x484, x515); + let mut x534: u32 = 0; + let mut x535: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x534, &mut x535, x533, x486, x517); + let mut x536: u32 = 0; + let mut x537: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x536, &mut x537, x535, x488, x519); + let mut x538: u32 = 0; + let mut x539: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x538, &mut x539, x537, x490, x521); + let mut x540: u32 = 0; + let mut x541: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x540, &mut x541, x539, x492, x523); + let mut x542: u32 = 0; + let mut x543: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x542, &mut x543, x541, x494, x525); + let mut x544: u32 = 0; + let mut x545: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x544, &mut x545, x526, 0x5588b13f); + let mut x546: u32 = 0; + let mut x547: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x546, &mut x547, x544, 0xffffffff); + let mut x548: u32 = 0; + let mut x549: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x548, &mut x549, x544, 0xffffffff); + let mut x550: u32 = 0; + let mut x551: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x550, &mut x551, x544, 0xffffffff); + let mut x552: u32 = 0; + let mut x553: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x552, &mut x553, x544, 0xfffffffe); + let mut x554: u32 = 0; + let mut x555: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x554, &mut x555, x544, 0xbaaedce6); + let mut x556: u32 = 0; + let mut x557: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x556, &mut x557, x544, 0xaf48a03b); + let mut x558: u32 = 0; + let mut x559: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x558, &mut x559, x544, 0xbfd25e8c); + let mut x560: u32 = 0; + let mut x561: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x560, &mut x561, x544, 0xd0364141); + let mut x562: u32 = 0; + let mut x563: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x562, &mut x563, 0x0, x561, x558); + let mut x564: u32 = 0; + let mut x565: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x564, &mut x565, x563, x559, x556); + let mut x566: u32 = 0; + let mut x567: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x566, &mut x567, x565, x557, x554); + let mut x568: u32 = 0; + let mut x569: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x568, &mut x569, x567, x555, x552); + let mut x570: u32 = 0; + let mut x571: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x570, &mut x571, x569, x553, x550); + let mut x572: u32 = 0; + let mut x573: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x572, &mut x573, x571, x551, x548); + let mut x574: u32 = 0; + let mut x575: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x574, &mut x575, x573, x549, x546); + let x576: u32 = ((x575 as u32) + x547); + let mut x577: u32 = 0; + let mut x578: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x577, &mut x578, 0x0, x526, x560); + let mut x579: u32 = 0; + let mut x580: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x579, &mut x580, x578, x528, x562); + let mut x581: u32 = 0; + let mut x582: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x581, &mut x582, x580, x530, x564); + let mut x583: u32 = 0; + let mut x584: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x583, &mut x584, x582, x532, x566); + let mut x585: u32 = 0; + let mut x586: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x585, &mut x586, x584, x534, x568); + let mut x587: u32 = 0; + let mut x588: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x587, &mut x588, x586, x536, x570); + let mut x589: u32 = 0; + let mut x590: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x589, &mut x590, x588, x538, x572); + let mut x591: u32 = 0; + let mut x592: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x591, &mut x592, x590, x540, x574); + let mut x593: u32 = 0; + let mut x594: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x593, &mut x594, x592, x542, x576); + let x595: u32 = ((x594 as u32) + (x543 as u32)); + let mut x596: u32 = 0; + let mut x597: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x596, &mut x597, x6, (arg2[7])); + let mut x598: u32 = 0; + let mut x599: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x598, &mut x599, x6, (arg2[6])); + let mut x600: u32 = 0; + let mut x601: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x600, &mut x601, x6, (arg2[5])); + let mut x602: u32 = 0; + let mut x603: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x602, &mut x603, x6, (arg2[4])); + let mut x604: u32 = 0; + let mut x605: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x604, &mut x605, x6, (arg2[3])); + let mut x606: u32 = 0; + let mut x607: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x606, &mut x607, x6, (arg2[2])); + let mut x608: u32 = 0; + let mut x609: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x608, &mut x609, x6, (arg2[1])); + let mut x610: u32 = 0; + let mut x611: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x610, &mut x611, x6, (arg2[0])); + let mut x612: u32 = 0; + let mut x613: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x612, &mut x613, 0x0, x611, x608); + let mut x614: u32 = 0; + let mut x615: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x614, &mut x615, x613, x609, x606); + let mut x616: u32 = 0; + let mut x617: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x616, &mut x617, x615, x607, x604); + let mut x618: u32 = 0; + let mut x619: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x618, &mut x619, x617, x605, x602); + let mut x620: u32 = 0; + let mut x621: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x620, &mut x621, x619, x603, x600); + let mut x622: u32 = 0; + let mut x623: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x622, &mut x623, x621, x601, x598); + let mut x624: u32 = 0; + let mut x625: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x624, &mut x625, x623, x599, x596); + let x626: u32 = ((x625 as u32) + x597); + let mut x627: u32 = 0; + let mut x628: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x627, &mut x628, 0x0, x579, x610); + let mut x629: u32 = 0; + let mut x630: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x629, &mut x630, x628, x581, x612); + let mut x631: u32 = 0; + let mut x632: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x631, &mut x632, x630, x583, x614); + let mut x633: u32 = 0; + let mut x634: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x633, &mut x634, x632, x585, x616); + let mut x635: u32 = 0; + let mut x636: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x635, &mut x636, x634, x587, x618); + let mut x637: u32 = 0; + let mut x638: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x637, &mut x638, x636, x589, x620); + let mut x639: u32 = 0; + let mut x640: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x639, &mut x640, x638, x591, x622); + let mut x641: u32 = 0; + let mut x642: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x641, &mut x642, x640, x593, x624); + let mut x643: u32 = 0; + let mut x644: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x643, &mut x644, x642, x595, x626); + let mut x645: u32 = 0; + let mut x646: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x645, &mut x646, x627, 0x5588b13f); + let mut x647: u32 = 0; + let mut x648: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x647, &mut x648, x645, 0xffffffff); + let mut x649: u32 = 0; + let mut x650: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x649, &mut x650, x645, 0xffffffff); + let mut x651: u32 = 0; + let mut x652: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x651, &mut x652, x645, 0xffffffff); + let mut x653: u32 = 0; + let mut x654: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x653, &mut x654, x645, 0xfffffffe); + let mut x655: u32 = 0; + let mut x656: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x655, &mut x656, x645, 0xbaaedce6); + let mut x657: u32 = 0; + let mut x658: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x657, &mut x658, x645, 0xaf48a03b); + let mut x659: u32 = 0; + let mut x660: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x659, &mut x660, x645, 0xbfd25e8c); + let mut x661: u32 = 0; + let mut x662: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x661, &mut x662, x645, 0xd0364141); + let mut x663: u32 = 0; + let mut x664: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x663, &mut x664, 0x0, x662, x659); + let mut x665: u32 = 0; + let mut x666: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x665, &mut x666, x664, x660, x657); + let mut x667: u32 = 0; + let mut x668: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x667, &mut x668, x666, x658, x655); + let mut x669: u32 = 0; + let mut x670: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x669, &mut x670, x668, x656, x653); + let mut x671: u32 = 0; + let mut x672: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x671, &mut x672, x670, x654, x651); + let mut x673: u32 = 0; + let mut x674: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x673, &mut x674, x672, x652, x649); + let mut x675: u32 = 0; + let mut x676: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x675, &mut x676, x674, x650, x647); + let x677: u32 = ((x676 as u32) + x648); + let mut x678: u32 = 0; + let mut x679: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x678, &mut x679, 0x0, x627, x661); + let mut x680: u32 = 0; + let mut x681: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x680, &mut x681, x679, x629, x663); + let mut x682: u32 = 0; + let mut x683: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x682, &mut x683, x681, x631, x665); + let mut x684: u32 = 0; + let mut x685: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x684, &mut x685, x683, x633, x667); + let mut x686: u32 = 0; + let mut x687: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x686, &mut x687, x685, x635, x669); + let mut x688: u32 = 0; + let mut x689: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x688, &mut x689, x687, x637, x671); + let mut x690: u32 = 0; + let mut x691: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x690, &mut x691, x689, x639, x673); + let mut x692: u32 = 0; + let mut x693: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x692, &mut x693, x691, x641, x675); + let mut x694: u32 = 0; + let mut x695: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x694, &mut x695, x693, x643, x677); + let x696: u32 = ((x695 as u32) + (x644 as u32)); + let mut x697: u32 = 0; + let mut x698: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x697, &mut x698, x7, (arg2[7])); + let mut x699: u32 = 0; + let mut x700: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x699, &mut x700, x7, (arg2[6])); + let mut x701: u32 = 0; + let mut x702: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x701, &mut x702, x7, (arg2[5])); + let mut x703: u32 = 0; + let mut x704: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x703, &mut x704, x7, (arg2[4])); + let mut x705: u32 = 0; + let mut x706: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x705, &mut x706, x7, (arg2[3])); + let mut x707: u32 = 0; + let mut x708: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x707, &mut x708, x7, (arg2[2])); + let mut x709: u32 = 0; + let mut x710: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x709, &mut x710, x7, (arg2[1])); + let mut x711: u32 = 0; + let mut x712: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x711, &mut x712, x7, (arg2[0])); + let mut x713: u32 = 0; + let mut x714: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x713, &mut x714, 0x0, x712, x709); + let mut x715: u32 = 0; + let mut x716: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x715, &mut x716, x714, x710, x707); + let mut x717: u32 = 0; + let mut x718: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x717, &mut x718, x716, x708, x705); + let mut x719: u32 = 0; + let mut x720: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x719, &mut x720, x718, x706, x703); + let mut x721: u32 = 0; + let mut x722: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x721, &mut x722, x720, x704, x701); + let mut x723: u32 = 0; + let mut x724: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x723, &mut x724, x722, x702, x699); + let mut x725: u32 = 0; + let mut x726: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x725, &mut x726, x724, x700, x697); + let x727: u32 = ((x726 as u32) + x698); + let mut x728: u32 = 0; + let mut x729: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x728, &mut x729, 0x0, x680, x711); + let mut x730: u32 = 0; + let mut x731: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x730, &mut x731, x729, x682, x713); + let mut x732: u32 = 0; + let mut x733: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x732, &mut x733, x731, x684, x715); + let mut x734: u32 = 0; + let mut x735: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x734, &mut x735, x733, x686, x717); + let mut x736: u32 = 0; + let mut x737: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x736, &mut x737, x735, x688, x719); + let mut x738: u32 = 0; + let mut x739: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x738, &mut x739, x737, x690, x721); + let mut x740: u32 = 0; + let mut x741: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x740, &mut x741, x739, x692, x723); + let mut x742: u32 = 0; + let mut x743: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x742, &mut x743, x741, x694, x725); + let mut x744: u32 = 0; + let mut x745: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x744, &mut x745, x743, x696, x727); + let mut x746: u32 = 0; + let mut x747: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x746, &mut x747, x728, 0x5588b13f); + let mut x748: u32 = 0; + let mut x749: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x748, &mut x749, x746, 0xffffffff); + let mut x750: u32 = 0; + let mut x751: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x750, &mut x751, x746, 0xffffffff); + let mut x752: u32 = 0; + let mut x753: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x752, &mut x753, x746, 0xffffffff); + let mut x754: u32 = 0; + let mut x755: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x754, &mut x755, x746, 0xfffffffe); + let mut x756: u32 = 0; + let mut x757: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x756, &mut x757, x746, 0xbaaedce6); + let mut x758: u32 = 0; + let mut x759: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x758, &mut x759, x746, 0xaf48a03b); + let mut x760: u32 = 0; + let mut x761: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x760, &mut x761, x746, 0xbfd25e8c); + let mut x762: u32 = 0; + let mut x763: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x762, &mut x763, x746, 0xd0364141); + let mut x764: u32 = 0; + let mut x765: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x764, &mut x765, 0x0, x763, x760); + let mut x766: u32 = 0; + let mut x767: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x766, &mut x767, x765, x761, x758); + let mut x768: u32 = 0; + let mut x769: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x768, &mut x769, x767, x759, x756); + let mut x770: u32 = 0; + let mut x771: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x770, &mut x771, x769, x757, x754); + let mut x772: u32 = 0; + let mut x773: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x772, &mut x773, x771, x755, x752); + let mut x774: u32 = 0; + let mut x775: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x774, &mut x775, x773, x753, x750); + let mut x776: u32 = 0; + let mut x777: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x776, &mut x777, x775, x751, x748); + let x778: u32 = ((x777 as u32) + x749); + let mut x779: u32 = 0; + let mut x780: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x779, &mut x780, 0x0, x728, x762); + let mut x781: u32 = 0; + let mut x782: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x781, &mut x782, x780, x730, x764); + let mut x783: u32 = 0; + let mut x784: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x783, &mut x784, x782, x732, x766); + let mut x785: u32 = 0; + let mut x786: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x785, &mut x786, x784, x734, x768); + let mut x787: u32 = 0; + let mut x788: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x787, &mut x788, x786, x736, x770); + let mut x789: u32 = 0; + let mut x790: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x789, &mut x790, x788, x738, x772); + let mut x791: u32 = 0; + let mut x792: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x791, &mut x792, x790, x740, x774); + let mut x793: u32 = 0; + let mut x794: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x793, &mut x794, x792, x742, x776); + let mut x795: u32 = 0; + let mut x796: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x795, &mut x796, x794, x744, x778); + let x797: u32 = ((x796 as u32) + (x745 as u32)); + let mut x798: u32 = 0; + let mut x799: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x798, &mut x799, 0x0, x781, 0xd0364141); + let mut x800: u32 = 0; + let mut x801: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x800, &mut x801, x799, x783, 0xbfd25e8c); + let mut x802: u32 = 0; + let mut x803: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x802, &mut x803, x801, x785, 0xaf48a03b); + let mut x804: u32 = 0; + let mut x805: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x804, &mut x805, x803, x787, 0xbaaedce6); + let mut x806: u32 = 0; + let mut x807: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x806, &mut x807, x805, x789, 0xfffffffe); + let mut x808: u32 = 0; + let mut x809: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x808, &mut x809, x807, x791, 0xffffffff); + let mut x810: u32 = 0; + let mut x811: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x810, &mut x811, x809, x793, 0xffffffff); + let mut x812: u32 = 0; + let mut x813: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x812, &mut x813, x811, x795, 0xffffffff); + let mut x814: u32 = 0; + let mut x815: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x814, &mut x815, x813, x797, (0x0 as u32)); + let mut x816: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x816, x815, x798, x781); + let mut x817: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x817, x815, x800, x783); + let mut x818: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x818, x815, x802, x785); + let mut x819: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x819, x815, x804, x787); + let mut x820: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x820, x815, x806, x789); + let mut x821: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x821, x815, x808, x791); + let mut x822: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x822, x815, x810, x793); + let mut x823: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x823, x815, x812, x795); + out1[0] = x816; + out1[1] = x817; + out1[2] = x818; + out1[3] = x819; + out1[4] = x820; + out1[5] = x821; + out1[6] = x822; + out1[7] = x823; +} + +/// The function fiat_secp256k1_scalar_square squares a field element in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg1)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_secp256k1_scalar_square(out1: &mut fiat_secp256k1_scalar_montgomery_domain_field_element, arg1: &fiat_secp256k1_scalar_montgomery_domain_field_element) -> () { + let x1: u32 = (arg1[1]); + let x2: u32 = (arg1[2]); + let x3: u32 = (arg1[3]); + let x4: u32 = (arg1[4]); + let x5: u32 = (arg1[5]); + let x6: u32 = (arg1[6]); + let x7: u32 = (arg1[7]); + let x8: u32 = (arg1[0]); + let mut x9: u32 = 0; + let mut x10: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x9, &mut x10, x8, (arg1[7])); + let mut x11: u32 = 0; + let mut x12: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x11, &mut x12, x8, (arg1[6])); + let mut x13: u32 = 0; + let mut x14: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x13, &mut x14, x8, (arg1[5])); + let mut x15: u32 = 0; + let mut x16: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x15, &mut x16, x8, (arg1[4])); + let mut x17: u32 = 0; + let mut x18: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x17, &mut x18, x8, (arg1[3])); + let mut x19: u32 = 0; + let mut x20: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x19, &mut x20, x8, (arg1[2])); + let mut x21: u32 = 0; + let mut x22: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x21, &mut x22, x8, (arg1[1])); + let mut x23: u32 = 0; + let mut x24: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x23, &mut x24, x8, (arg1[0])); + let mut x25: u32 = 0; + let mut x26: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x25, &mut x26, 0x0, x24, x21); + let mut x27: u32 = 0; + let mut x28: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x27, &mut x28, x26, x22, x19); + let mut x29: u32 = 0; + let mut x30: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x29, &mut x30, x28, x20, x17); + let mut x31: u32 = 0; + let mut x32: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x31, &mut x32, x30, x18, x15); + let mut x33: u32 = 0; + let mut x34: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x33, &mut x34, x32, x16, x13); + let mut x35: u32 = 0; + let mut x36: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x35, &mut x36, x34, x14, x11); + let mut x37: u32 = 0; + let mut x38: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x37, &mut x38, x36, x12, x9); + let x39: u32 = ((x38 as u32) + x10); + let mut x40: u32 = 0; + let mut x41: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x40, &mut x41, x23, 0x5588b13f); + let mut x42: u32 = 0; + let mut x43: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x42, &mut x43, x40, 0xffffffff); + let mut x44: u32 = 0; + let mut x45: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x44, &mut x45, x40, 0xffffffff); + let mut x46: u32 = 0; + let mut x47: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x46, &mut x47, x40, 0xffffffff); + let mut x48: u32 = 0; + let mut x49: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x48, &mut x49, x40, 0xfffffffe); + let mut x50: u32 = 0; + let mut x51: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x50, &mut x51, x40, 0xbaaedce6); + let mut x52: u32 = 0; + let mut x53: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x52, &mut x53, x40, 0xaf48a03b); + let mut x54: u32 = 0; + let mut x55: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x54, &mut x55, x40, 0xbfd25e8c); + let mut x56: u32 = 0; + let mut x57: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x56, &mut x57, x40, 0xd0364141); + let mut x58: u32 = 0; + let mut x59: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x58, &mut x59, 0x0, x57, x54); + let mut x60: u32 = 0; + let mut x61: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x60, &mut x61, x59, x55, x52); + let mut x62: u32 = 0; + let mut x63: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x62, &mut x63, x61, x53, x50); + let mut x64: u32 = 0; + let mut x65: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x64, &mut x65, x63, x51, x48); + let mut x66: u32 = 0; + let mut x67: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x66, &mut x67, x65, x49, x46); + let mut x68: u32 = 0; + let mut x69: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x68, &mut x69, x67, x47, x44); + let mut x70: u32 = 0; + let mut x71: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x70, &mut x71, x69, x45, x42); + let x72: u32 = ((x71 as u32) + x43); + let mut x73: u32 = 0; + let mut x74: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x73, &mut x74, 0x0, x23, x56); + let mut x75: u32 = 0; + let mut x76: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x75, &mut x76, x74, x25, x58); + let mut x77: u32 = 0; + let mut x78: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x77, &mut x78, x76, x27, x60); + let mut x79: u32 = 0; + let mut x80: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x79, &mut x80, x78, x29, x62); + let mut x81: u32 = 0; + let mut x82: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x81, &mut x82, x80, x31, x64); + let mut x83: u32 = 0; + let mut x84: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x83, &mut x84, x82, x33, x66); + let mut x85: u32 = 0; + let mut x86: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x85, &mut x86, x84, x35, x68); + let mut x87: u32 = 0; + let mut x88: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x87, &mut x88, x86, x37, x70); + let mut x89: u32 = 0; + let mut x90: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x89, &mut x90, x88, x39, x72); + let mut x91: u32 = 0; + let mut x92: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x91, &mut x92, x1, (arg1[7])); + let mut x93: u32 = 0; + let mut x94: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x93, &mut x94, x1, (arg1[6])); + let mut x95: u32 = 0; + let mut x96: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x95, &mut x96, x1, (arg1[5])); + let mut x97: u32 = 0; + let mut x98: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x97, &mut x98, x1, (arg1[4])); + let mut x99: u32 = 0; + let mut x100: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x99, &mut x100, x1, (arg1[3])); + let mut x101: u32 = 0; + let mut x102: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x101, &mut x102, x1, (arg1[2])); + let mut x103: u32 = 0; + let mut x104: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x103, &mut x104, x1, (arg1[1])); + let mut x105: u32 = 0; + let mut x106: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x105, &mut x106, x1, (arg1[0])); + let mut x107: u32 = 0; + let mut x108: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x107, &mut x108, 0x0, x106, x103); + let mut x109: u32 = 0; + let mut x110: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x109, &mut x110, x108, x104, x101); + let mut x111: u32 = 0; + let mut x112: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x111, &mut x112, x110, x102, x99); + let mut x113: u32 = 0; + let mut x114: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x113, &mut x114, x112, x100, x97); + let mut x115: u32 = 0; + let mut x116: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x115, &mut x116, x114, x98, x95); + let mut x117: u32 = 0; + let mut x118: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x117, &mut x118, x116, x96, x93); + let mut x119: u32 = 0; + let mut x120: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x119, &mut x120, x118, x94, x91); + let x121: u32 = ((x120 as u32) + x92); + let mut x122: u32 = 0; + let mut x123: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x122, &mut x123, 0x0, x75, x105); + let mut x124: u32 = 0; + let mut x125: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x124, &mut x125, x123, x77, x107); + let mut x126: u32 = 0; + let mut x127: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x126, &mut x127, x125, x79, x109); + let mut x128: u32 = 0; + let mut x129: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x128, &mut x129, x127, x81, x111); + let mut x130: u32 = 0; + let mut x131: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x130, &mut x131, x129, x83, x113); + let mut x132: u32 = 0; + let mut x133: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x132, &mut x133, x131, x85, x115); + let mut x134: u32 = 0; + let mut x135: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x134, &mut x135, x133, x87, x117); + let mut x136: u32 = 0; + let mut x137: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x136, &mut x137, x135, x89, x119); + let mut x138: u32 = 0; + let mut x139: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x138, &mut x139, x137, (x90 as u32), x121); + let mut x140: u32 = 0; + let mut x141: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x140, &mut x141, x122, 0x5588b13f); + let mut x142: u32 = 0; + let mut x143: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x142, &mut x143, x140, 0xffffffff); + let mut x144: u32 = 0; + let mut x145: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x144, &mut x145, x140, 0xffffffff); + let mut x146: u32 = 0; + let mut x147: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x146, &mut x147, x140, 0xffffffff); + let mut x148: u32 = 0; + let mut x149: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x148, &mut x149, x140, 0xfffffffe); + let mut x150: u32 = 0; + let mut x151: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x150, &mut x151, x140, 0xbaaedce6); + let mut x152: u32 = 0; + let mut x153: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x152, &mut x153, x140, 0xaf48a03b); + let mut x154: u32 = 0; + let mut x155: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x154, &mut x155, x140, 0xbfd25e8c); + let mut x156: u32 = 0; + let mut x157: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x156, &mut x157, x140, 0xd0364141); + let mut x158: u32 = 0; + let mut x159: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x158, &mut x159, 0x0, x157, x154); + let mut x160: u32 = 0; + let mut x161: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x160, &mut x161, x159, x155, x152); + let mut x162: u32 = 0; + let mut x163: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x162, &mut x163, x161, x153, x150); + let mut x164: u32 = 0; + let mut x165: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x164, &mut x165, x163, x151, x148); + let mut x166: u32 = 0; + let mut x167: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x166, &mut x167, x165, x149, x146); + let mut x168: u32 = 0; + let mut x169: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x168, &mut x169, x167, x147, x144); + let mut x170: u32 = 0; + let mut x171: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x170, &mut x171, x169, x145, x142); + let x172: u32 = ((x171 as u32) + x143); + let mut x173: u32 = 0; + let mut x174: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x173, &mut x174, 0x0, x122, x156); + let mut x175: u32 = 0; + let mut x176: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x175, &mut x176, x174, x124, x158); + let mut x177: u32 = 0; + let mut x178: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x177, &mut x178, x176, x126, x160); + let mut x179: u32 = 0; + let mut x180: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x179, &mut x180, x178, x128, x162); + let mut x181: u32 = 0; + let mut x182: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x181, &mut x182, x180, x130, x164); + let mut x183: u32 = 0; + let mut x184: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x183, &mut x184, x182, x132, x166); + let mut x185: u32 = 0; + let mut x186: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x185, &mut x186, x184, x134, x168); + let mut x187: u32 = 0; + let mut x188: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x187, &mut x188, x186, x136, x170); + let mut x189: u32 = 0; + let mut x190: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x189, &mut x190, x188, x138, x172); + let x191: u32 = ((x190 as u32) + (x139 as u32)); + let mut x192: u32 = 0; + let mut x193: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x192, &mut x193, x2, (arg1[7])); + let mut x194: u32 = 0; + let mut x195: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x194, &mut x195, x2, (arg1[6])); + let mut x196: u32 = 0; + let mut x197: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x196, &mut x197, x2, (arg1[5])); + let mut x198: u32 = 0; + let mut x199: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x198, &mut x199, x2, (arg1[4])); + let mut x200: u32 = 0; + let mut x201: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x200, &mut x201, x2, (arg1[3])); + let mut x202: u32 = 0; + let mut x203: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x202, &mut x203, x2, (arg1[2])); + let mut x204: u32 = 0; + let mut x205: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x204, &mut x205, x2, (arg1[1])); + let mut x206: u32 = 0; + let mut x207: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x206, &mut x207, x2, (arg1[0])); + let mut x208: u32 = 0; + let mut x209: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x208, &mut x209, 0x0, x207, x204); + let mut x210: u32 = 0; + let mut x211: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x210, &mut x211, x209, x205, x202); + let mut x212: u32 = 0; + let mut x213: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x212, &mut x213, x211, x203, x200); + let mut x214: u32 = 0; + let mut x215: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x214, &mut x215, x213, x201, x198); + let mut x216: u32 = 0; + let mut x217: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x216, &mut x217, x215, x199, x196); + let mut x218: u32 = 0; + let mut x219: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x218, &mut x219, x217, x197, x194); + let mut x220: u32 = 0; + let mut x221: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x220, &mut x221, x219, x195, x192); + let x222: u32 = ((x221 as u32) + x193); + let mut x223: u32 = 0; + let mut x224: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x223, &mut x224, 0x0, x175, x206); + let mut x225: u32 = 0; + let mut x226: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x225, &mut x226, x224, x177, x208); + let mut x227: u32 = 0; + let mut x228: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x227, &mut x228, x226, x179, x210); + let mut x229: u32 = 0; + let mut x230: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x229, &mut x230, x228, x181, x212); + let mut x231: u32 = 0; + let mut x232: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x231, &mut x232, x230, x183, x214); + let mut x233: u32 = 0; + let mut x234: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x233, &mut x234, x232, x185, x216); + let mut x235: u32 = 0; + let mut x236: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x235, &mut x236, x234, x187, x218); + let mut x237: u32 = 0; + let mut x238: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x237, &mut x238, x236, x189, x220); + let mut x239: u32 = 0; + let mut x240: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x239, &mut x240, x238, x191, x222); + let mut x241: u32 = 0; + let mut x242: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x241, &mut x242, x223, 0x5588b13f); + let mut x243: u32 = 0; + let mut x244: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x243, &mut x244, x241, 0xffffffff); + let mut x245: u32 = 0; + let mut x246: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x245, &mut x246, x241, 0xffffffff); + let mut x247: u32 = 0; + let mut x248: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x247, &mut x248, x241, 0xffffffff); + let mut x249: u32 = 0; + let mut x250: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x249, &mut x250, x241, 0xfffffffe); + let mut x251: u32 = 0; + let mut x252: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x251, &mut x252, x241, 0xbaaedce6); + let mut x253: u32 = 0; + let mut x254: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x253, &mut x254, x241, 0xaf48a03b); + let mut x255: u32 = 0; + let mut x256: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x255, &mut x256, x241, 0xbfd25e8c); + let mut x257: u32 = 0; + let mut x258: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x257, &mut x258, x241, 0xd0364141); + let mut x259: u32 = 0; + let mut x260: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x259, &mut x260, 0x0, x258, x255); + let mut x261: u32 = 0; + let mut x262: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x261, &mut x262, x260, x256, x253); + let mut x263: u32 = 0; + let mut x264: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x263, &mut x264, x262, x254, x251); + let mut x265: u32 = 0; + let mut x266: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x265, &mut x266, x264, x252, x249); + let mut x267: u32 = 0; + let mut x268: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x267, &mut x268, x266, x250, x247); + let mut x269: u32 = 0; + let mut x270: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x269, &mut x270, x268, x248, x245); + let mut x271: u32 = 0; + let mut x272: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x271, &mut x272, x270, x246, x243); + let x273: u32 = ((x272 as u32) + x244); + let mut x274: u32 = 0; + let mut x275: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x274, &mut x275, 0x0, x223, x257); + let mut x276: u32 = 0; + let mut x277: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x276, &mut x277, x275, x225, x259); + let mut x278: u32 = 0; + let mut x279: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x278, &mut x279, x277, x227, x261); + let mut x280: u32 = 0; + let mut x281: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x280, &mut x281, x279, x229, x263); + let mut x282: u32 = 0; + let mut x283: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x282, &mut x283, x281, x231, x265); + let mut x284: u32 = 0; + let mut x285: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x284, &mut x285, x283, x233, x267); + let mut x286: u32 = 0; + let mut x287: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x286, &mut x287, x285, x235, x269); + let mut x288: u32 = 0; + let mut x289: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x288, &mut x289, x287, x237, x271); + let mut x290: u32 = 0; + let mut x291: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x290, &mut x291, x289, x239, x273); + let x292: u32 = ((x291 as u32) + (x240 as u32)); + let mut x293: u32 = 0; + let mut x294: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x293, &mut x294, x3, (arg1[7])); + let mut x295: u32 = 0; + let mut x296: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x295, &mut x296, x3, (arg1[6])); + let mut x297: u32 = 0; + let mut x298: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x297, &mut x298, x3, (arg1[5])); + let mut x299: u32 = 0; + let mut x300: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x299, &mut x300, x3, (arg1[4])); + let mut x301: u32 = 0; + let mut x302: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x301, &mut x302, x3, (arg1[3])); + let mut x303: u32 = 0; + let mut x304: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x303, &mut x304, x3, (arg1[2])); + let mut x305: u32 = 0; + let mut x306: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x305, &mut x306, x3, (arg1[1])); + let mut x307: u32 = 0; + let mut x308: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x307, &mut x308, x3, (arg1[0])); + let mut x309: u32 = 0; + let mut x310: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x309, &mut x310, 0x0, x308, x305); + let mut x311: u32 = 0; + let mut x312: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x311, &mut x312, x310, x306, x303); + let mut x313: u32 = 0; + let mut x314: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x313, &mut x314, x312, x304, x301); + let mut x315: u32 = 0; + let mut x316: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x315, &mut x316, x314, x302, x299); + let mut x317: u32 = 0; + let mut x318: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x317, &mut x318, x316, x300, x297); + let mut x319: u32 = 0; + let mut x320: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x319, &mut x320, x318, x298, x295); + let mut x321: u32 = 0; + let mut x322: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x321, &mut x322, x320, x296, x293); + let x323: u32 = ((x322 as u32) + x294); + let mut x324: u32 = 0; + let mut x325: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x324, &mut x325, 0x0, x276, x307); + let mut x326: u32 = 0; + let mut x327: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x326, &mut x327, x325, x278, x309); + let mut x328: u32 = 0; + let mut x329: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x328, &mut x329, x327, x280, x311); + let mut x330: u32 = 0; + let mut x331: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x330, &mut x331, x329, x282, x313); + let mut x332: u32 = 0; + let mut x333: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x332, &mut x333, x331, x284, x315); + let mut x334: u32 = 0; + let mut x335: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x334, &mut x335, x333, x286, x317); + let mut x336: u32 = 0; + let mut x337: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x336, &mut x337, x335, x288, x319); + let mut x338: u32 = 0; + let mut x339: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x338, &mut x339, x337, x290, x321); + let mut x340: u32 = 0; + let mut x341: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x340, &mut x341, x339, x292, x323); + let mut x342: u32 = 0; + let mut x343: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x342, &mut x343, x324, 0x5588b13f); + let mut x344: u32 = 0; + let mut x345: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x344, &mut x345, x342, 0xffffffff); + let mut x346: u32 = 0; + let mut x347: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x346, &mut x347, x342, 0xffffffff); + let mut x348: u32 = 0; + let mut x349: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x348, &mut x349, x342, 0xffffffff); + let mut x350: u32 = 0; + let mut x351: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x350, &mut x351, x342, 0xfffffffe); + let mut x352: u32 = 0; + let mut x353: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x352, &mut x353, x342, 0xbaaedce6); + let mut x354: u32 = 0; + let mut x355: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x354, &mut x355, x342, 0xaf48a03b); + let mut x356: u32 = 0; + let mut x357: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x356, &mut x357, x342, 0xbfd25e8c); + let mut x358: u32 = 0; + let mut x359: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x358, &mut x359, x342, 0xd0364141); + let mut x360: u32 = 0; + let mut x361: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x360, &mut x361, 0x0, x359, x356); + let mut x362: u32 = 0; + let mut x363: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x362, &mut x363, x361, x357, x354); + let mut x364: u32 = 0; + let mut x365: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x364, &mut x365, x363, x355, x352); + let mut x366: u32 = 0; + let mut x367: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x366, &mut x367, x365, x353, x350); + let mut x368: u32 = 0; + let mut x369: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x368, &mut x369, x367, x351, x348); + let mut x370: u32 = 0; + let mut x371: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x370, &mut x371, x369, x349, x346); + let mut x372: u32 = 0; + let mut x373: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x372, &mut x373, x371, x347, x344); + let x374: u32 = ((x373 as u32) + x345); + let mut x375: u32 = 0; + let mut x376: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x375, &mut x376, 0x0, x324, x358); + let mut x377: u32 = 0; + let mut x378: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x377, &mut x378, x376, x326, x360); + let mut x379: u32 = 0; + let mut x380: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x379, &mut x380, x378, x328, x362); + let mut x381: u32 = 0; + let mut x382: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x381, &mut x382, x380, x330, x364); + let mut x383: u32 = 0; + let mut x384: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x383, &mut x384, x382, x332, x366); + let mut x385: u32 = 0; + let mut x386: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x385, &mut x386, x384, x334, x368); + let mut x387: u32 = 0; + let mut x388: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x387, &mut x388, x386, x336, x370); + let mut x389: u32 = 0; + let mut x390: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x389, &mut x390, x388, x338, x372); + let mut x391: u32 = 0; + let mut x392: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x391, &mut x392, x390, x340, x374); + let x393: u32 = ((x392 as u32) + (x341 as u32)); + let mut x394: u32 = 0; + let mut x395: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x394, &mut x395, x4, (arg1[7])); + let mut x396: u32 = 0; + let mut x397: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x396, &mut x397, x4, (arg1[6])); + let mut x398: u32 = 0; + let mut x399: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x398, &mut x399, x4, (arg1[5])); + let mut x400: u32 = 0; + let mut x401: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x400, &mut x401, x4, (arg1[4])); + let mut x402: u32 = 0; + let mut x403: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x402, &mut x403, x4, (arg1[3])); + let mut x404: u32 = 0; + let mut x405: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x404, &mut x405, x4, (arg1[2])); + let mut x406: u32 = 0; + let mut x407: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x406, &mut x407, x4, (arg1[1])); + let mut x408: u32 = 0; + let mut x409: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x408, &mut x409, x4, (arg1[0])); + let mut x410: u32 = 0; + let mut x411: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x410, &mut x411, 0x0, x409, x406); + let mut x412: u32 = 0; + let mut x413: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x412, &mut x413, x411, x407, x404); + let mut x414: u32 = 0; + let mut x415: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x414, &mut x415, x413, x405, x402); + let mut x416: u32 = 0; + let mut x417: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x416, &mut x417, x415, x403, x400); + let mut x418: u32 = 0; + let mut x419: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x418, &mut x419, x417, x401, x398); + let mut x420: u32 = 0; + let mut x421: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x420, &mut x421, x419, x399, x396); + let mut x422: u32 = 0; + let mut x423: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x422, &mut x423, x421, x397, x394); + let x424: u32 = ((x423 as u32) + x395); + let mut x425: u32 = 0; + let mut x426: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x425, &mut x426, 0x0, x377, x408); + let mut x427: u32 = 0; + let mut x428: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x427, &mut x428, x426, x379, x410); + let mut x429: u32 = 0; + let mut x430: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x429, &mut x430, x428, x381, x412); + let mut x431: u32 = 0; + let mut x432: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x431, &mut x432, x430, x383, x414); + let mut x433: u32 = 0; + let mut x434: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x433, &mut x434, x432, x385, x416); + let mut x435: u32 = 0; + let mut x436: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x435, &mut x436, x434, x387, x418); + let mut x437: u32 = 0; + let mut x438: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x437, &mut x438, x436, x389, x420); + let mut x439: u32 = 0; + let mut x440: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x439, &mut x440, x438, x391, x422); + let mut x441: u32 = 0; + let mut x442: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x441, &mut x442, x440, x393, x424); + let mut x443: u32 = 0; + let mut x444: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x443, &mut x444, x425, 0x5588b13f); + let mut x445: u32 = 0; + let mut x446: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x445, &mut x446, x443, 0xffffffff); + let mut x447: u32 = 0; + let mut x448: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x447, &mut x448, x443, 0xffffffff); + let mut x449: u32 = 0; + let mut x450: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x449, &mut x450, x443, 0xffffffff); + let mut x451: u32 = 0; + let mut x452: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x451, &mut x452, x443, 0xfffffffe); + let mut x453: u32 = 0; + let mut x454: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x453, &mut x454, x443, 0xbaaedce6); + let mut x455: u32 = 0; + let mut x456: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x455, &mut x456, x443, 0xaf48a03b); + let mut x457: u32 = 0; + let mut x458: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x457, &mut x458, x443, 0xbfd25e8c); + let mut x459: u32 = 0; + let mut x460: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x459, &mut x460, x443, 0xd0364141); + let mut x461: u32 = 0; + let mut x462: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x461, &mut x462, 0x0, x460, x457); + let mut x463: u32 = 0; + let mut x464: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x463, &mut x464, x462, x458, x455); + let mut x465: u32 = 0; + let mut x466: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x465, &mut x466, x464, x456, x453); + let mut x467: u32 = 0; + let mut x468: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x467, &mut x468, x466, x454, x451); + let mut x469: u32 = 0; + let mut x470: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x469, &mut x470, x468, x452, x449); + let mut x471: u32 = 0; + let mut x472: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x471, &mut x472, x470, x450, x447); + let mut x473: u32 = 0; + let mut x474: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x473, &mut x474, x472, x448, x445); + let x475: u32 = ((x474 as u32) + x446); + let mut x476: u32 = 0; + let mut x477: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x476, &mut x477, 0x0, x425, x459); + let mut x478: u32 = 0; + let mut x479: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x478, &mut x479, x477, x427, x461); + let mut x480: u32 = 0; + let mut x481: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x480, &mut x481, x479, x429, x463); + let mut x482: u32 = 0; + let mut x483: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x482, &mut x483, x481, x431, x465); + let mut x484: u32 = 0; + let mut x485: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x484, &mut x485, x483, x433, x467); + let mut x486: u32 = 0; + let mut x487: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x486, &mut x487, x485, x435, x469); + let mut x488: u32 = 0; + let mut x489: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x488, &mut x489, x487, x437, x471); + let mut x490: u32 = 0; + let mut x491: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x490, &mut x491, x489, x439, x473); + let mut x492: u32 = 0; + let mut x493: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x492, &mut x493, x491, x441, x475); + let x494: u32 = ((x493 as u32) + (x442 as u32)); + let mut x495: u32 = 0; + let mut x496: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x495, &mut x496, x5, (arg1[7])); + let mut x497: u32 = 0; + let mut x498: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x497, &mut x498, x5, (arg1[6])); + let mut x499: u32 = 0; + let mut x500: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x499, &mut x500, x5, (arg1[5])); + let mut x501: u32 = 0; + let mut x502: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x501, &mut x502, x5, (arg1[4])); + let mut x503: u32 = 0; + let mut x504: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x503, &mut x504, x5, (arg1[3])); + let mut x505: u32 = 0; + let mut x506: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x505, &mut x506, x5, (arg1[2])); + let mut x507: u32 = 0; + let mut x508: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x507, &mut x508, x5, (arg1[1])); + let mut x509: u32 = 0; + let mut x510: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x509, &mut x510, x5, (arg1[0])); + let mut x511: u32 = 0; + let mut x512: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x511, &mut x512, 0x0, x510, x507); + let mut x513: u32 = 0; + let mut x514: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x513, &mut x514, x512, x508, x505); + let mut x515: u32 = 0; + let mut x516: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x515, &mut x516, x514, x506, x503); + let mut x517: u32 = 0; + let mut x518: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x517, &mut x518, x516, x504, x501); + let mut x519: u32 = 0; + let mut x520: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x519, &mut x520, x518, x502, x499); + let mut x521: u32 = 0; + let mut x522: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x521, &mut x522, x520, x500, x497); + let mut x523: u32 = 0; + let mut x524: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x523, &mut x524, x522, x498, x495); + let x525: u32 = ((x524 as u32) + x496); + let mut x526: u32 = 0; + let mut x527: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x526, &mut x527, 0x0, x478, x509); + let mut x528: u32 = 0; + let mut x529: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x528, &mut x529, x527, x480, x511); + let mut x530: u32 = 0; + let mut x531: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x530, &mut x531, x529, x482, x513); + let mut x532: u32 = 0; + let mut x533: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x532, &mut x533, x531, x484, x515); + let mut x534: u32 = 0; + let mut x535: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x534, &mut x535, x533, x486, x517); + let mut x536: u32 = 0; + let mut x537: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x536, &mut x537, x535, x488, x519); + let mut x538: u32 = 0; + let mut x539: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x538, &mut x539, x537, x490, x521); + let mut x540: u32 = 0; + let mut x541: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x540, &mut x541, x539, x492, x523); + let mut x542: u32 = 0; + let mut x543: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x542, &mut x543, x541, x494, x525); + let mut x544: u32 = 0; + let mut x545: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x544, &mut x545, x526, 0x5588b13f); + let mut x546: u32 = 0; + let mut x547: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x546, &mut x547, x544, 0xffffffff); + let mut x548: u32 = 0; + let mut x549: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x548, &mut x549, x544, 0xffffffff); + let mut x550: u32 = 0; + let mut x551: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x550, &mut x551, x544, 0xffffffff); + let mut x552: u32 = 0; + let mut x553: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x552, &mut x553, x544, 0xfffffffe); + let mut x554: u32 = 0; + let mut x555: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x554, &mut x555, x544, 0xbaaedce6); + let mut x556: u32 = 0; + let mut x557: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x556, &mut x557, x544, 0xaf48a03b); + let mut x558: u32 = 0; + let mut x559: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x558, &mut x559, x544, 0xbfd25e8c); + let mut x560: u32 = 0; + let mut x561: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x560, &mut x561, x544, 0xd0364141); + let mut x562: u32 = 0; + let mut x563: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x562, &mut x563, 0x0, x561, x558); + let mut x564: u32 = 0; + let mut x565: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x564, &mut x565, x563, x559, x556); + let mut x566: u32 = 0; + let mut x567: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x566, &mut x567, x565, x557, x554); + let mut x568: u32 = 0; + let mut x569: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x568, &mut x569, x567, x555, x552); + let mut x570: u32 = 0; + let mut x571: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x570, &mut x571, x569, x553, x550); + let mut x572: u32 = 0; + let mut x573: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x572, &mut x573, x571, x551, x548); + let mut x574: u32 = 0; + let mut x575: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x574, &mut x575, x573, x549, x546); + let x576: u32 = ((x575 as u32) + x547); + let mut x577: u32 = 0; + let mut x578: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x577, &mut x578, 0x0, x526, x560); + let mut x579: u32 = 0; + let mut x580: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x579, &mut x580, x578, x528, x562); + let mut x581: u32 = 0; + let mut x582: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x581, &mut x582, x580, x530, x564); + let mut x583: u32 = 0; + let mut x584: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x583, &mut x584, x582, x532, x566); + let mut x585: u32 = 0; + let mut x586: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x585, &mut x586, x584, x534, x568); + let mut x587: u32 = 0; + let mut x588: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x587, &mut x588, x586, x536, x570); + let mut x589: u32 = 0; + let mut x590: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x589, &mut x590, x588, x538, x572); + let mut x591: u32 = 0; + let mut x592: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x591, &mut x592, x590, x540, x574); + let mut x593: u32 = 0; + let mut x594: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x593, &mut x594, x592, x542, x576); + let x595: u32 = ((x594 as u32) + (x543 as u32)); + let mut x596: u32 = 0; + let mut x597: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x596, &mut x597, x6, (arg1[7])); + let mut x598: u32 = 0; + let mut x599: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x598, &mut x599, x6, (arg1[6])); + let mut x600: u32 = 0; + let mut x601: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x600, &mut x601, x6, (arg1[5])); + let mut x602: u32 = 0; + let mut x603: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x602, &mut x603, x6, (arg1[4])); + let mut x604: u32 = 0; + let mut x605: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x604, &mut x605, x6, (arg1[3])); + let mut x606: u32 = 0; + let mut x607: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x606, &mut x607, x6, (arg1[2])); + let mut x608: u32 = 0; + let mut x609: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x608, &mut x609, x6, (arg1[1])); + let mut x610: u32 = 0; + let mut x611: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x610, &mut x611, x6, (arg1[0])); + let mut x612: u32 = 0; + let mut x613: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x612, &mut x613, 0x0, x611, x608); + let mut x614: u32 = 0; + let mut x615: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x614, &mut x615, x613, x609, x606); + let mut x616: u32 = 0; + let mut x617: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x616, &mut x617, x615, x607, x604); + let mut x618: u32 = 0; + let mut x619: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x618, &mut x619, x617, x605, x602); + let mut x620: u32 = 0; + let mut x621: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x620, &mut x621, x619, x603, x600); + let mut x622: u32 = 0; + let mut x623: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x622, &mut x623, x621, x601, x598); + let mut x624: u32 = 0; + let mut x625: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x624, &mut x625, x623, x599, x596); + let x626: u32 = ((x625 as u32) + x597); + let mut x627: u32 = 0; + let mut x628: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x627, &mut x628, 0x0, x579, x610); + let mut x629: u32 = 0; + let mut x630: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x629, &mut x630, x628, x581, x612); + let mut x631: u32 = 0; + let mut x632: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x631, &mut x632, x630, x583, x614); + let mut x633: u32 = 0; + let mut x634: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x633, &mut x634, x632, x585, x616); + let mut x635: u32 = 0; + let mut x636: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x635, &mut x636, x634, x587, x618); + let mut x637: u32 = 0; + let mut x638: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x637, &mut x638, x636, x589, x620); + let mut x639: u32 = 0; + let mut x640: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x639, &mut x640, x638, x591, x622); + let mut x641: u32 = 0; + let mut x642: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x641, &mut x642, x640, x593, x624); + let mut x643: u32 = 0; + let mut x644: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x643, &mut x644, x642, x595, x626); + let mut x645: u32 = 0; + let mut x646: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x645, &mut x646, x627, 0x5588b13f); + let mut x647: u32 = 0; + let mut x648: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x647, &mut x648, x645, 0xffffffff); + let mut x649: u32 = 0; + let mut x650: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x649, &mut x650, x645, 0xffffffff); + let mut x651: u32 = 0; + let mut x652: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x651, &mut x652, x645, 0xffffffff); + let mut x653: u32 = 0; + let mut x654: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x653, &mut x654, x645, 0xfffffffe); + let mut x655: u32 = 0; + let mut x656: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x655, &mut x656, x645, 0xbaaedce6); + let mut x657: u32 = 0; + let mut x658: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x657, &mut x658, x645, 0xaf48a03b); + let mut x659: u32 = 0; + let mut x660: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x659, &mut x660, x645, 0xbfd25e8c); + let mut x661: u32 = 0; + let mut x662: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x661, &mut x662, x645, 0xd0364141); + let mut x663: u32 = 0; + let mut x664: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x663, &mut x664, 0x0, x662, x659); + let mut x665: u32 = 0; + let mut x666: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x665, &mut x666, x664, x660, x657); + let mut x667: u32 = 0; + let mut x668: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x667, &mut x668, x666, x658, x655); + let mut x669: u32 = 0; + let mut x670: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x669, &mut x670, x668, x656, x653); + let mut x671: u32 = 0; + let mut x672: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x671, &mut x672, x670, x654, x651); + let mut x673: u32 = 0; + let mut x674: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x673, &mut x674, x672, x652, x649); + let mut x675: u32 = 0; + let mut x676: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x675, &mut x676, x674, x650, x647); + let x677: u32 = ((x676 as u32) + x648); + let mut x678: u32 = 0; + let mut x679: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x678, &mut x679, 0x0, x627, x661); + let mut x680: u32 = 0; + let mut x681: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x680, &mut x681, x679, x629, x663); + let mut x682: u32 = 0; + let mut x683: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x682, &mut x683, x681, x631, x665); + let mut x684: u32 = 0; + let mut x685: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x684, &mut x685, x683, x633, x667); + let mut x686: u32 = 0; + let mut x687: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x686, &mut x687, x685, x635, x669); + let mut x688: u32 = 0; + let mut x689: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x688, &mut x689, x687, x637, x671); + let mut x690: u32 = 0; + let mut x691: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x690, &mut x691, x689, x639, x673); + let mut x692: u32 = 0; + let mut x693: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x692, &mut x693, x691, x641, x675); + let mut x694: u32 = 0; + let mut x695: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x694, &mut x695, x693, x643, x677); + let x696: u32 = ((x695 as u32) + (x644 as u32)); + let mut x697: u32 = 0; + let mut x698: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x697, &mut x698, x7, (arg1[7])); + let mut x699: u32 = 0; + let mut x700: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x699, &mut x700, x7, (arg1[6])); + let mut x701: u32 = 0; + let mut x702: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x701, &mut x702, x7, (arg1[5])); + let mut x703: u32 = 0; + let mut x704: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x703, &mut x704, x7, (arg1[4])); + let mut x705: u32 = 0; + let mut x706: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x705, &mut x706, x7, (arg1[3])); + let mut x707: u32 = 0; + let mut x708: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x707, &mut x708, x7, (arg1[2])); + let mut x709: u32 = 0; + let mut x710: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x709, &mut x710, x7, (arg1[1])); + let mut x711: u32 = 0; + let mut x712: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x711, &mut x712, x7, (arg1[0])); + let mut x713: u32 = 0; + let mut x714: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x713, &mut x714, 0x0, x712, x709); + let mut x715: u32 = 0; + let mut x716: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x715, &mut x716, x714, x710, x707); + let mut x717: u32 = 0; + let mut x718: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x717, &mut x718, x716, x708, x705); + let mut x719: u32 = 0; + let mut x720: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x719, &mut x720, x718, x706, x703); + let mut x721: u32 = 0; + let mut x722: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x721, &mut x722, x720, x704, x701); + let mut x723: u32 = 0; + let mut x724: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x723, &mut x724, x722, x702, x699); + let mut x725: u32 = 0; + let mut x726: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x725, &mut x726, x724, x700, x697); + let x727: u32 = ((x726 as u32) + x698); + let mut x728: u32 = 0; + let mut x729: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x728, &mut x729, 0x0, x680, x711); + let mut x730: u32 = 0; + let mut x731: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x730, &mut x731, x729, x682, x713); + let mut x732: u32 = 0; + let mut x733: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x732, &mut x733, x731, x684, x715); + let mut x734: u32 = 0; + let mut x735: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x734, &mut x735, x733, x686, x717); + let mut x736: u32 = 0; + let mut x737: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x736, &mut x737, x735, x688, x719); + let mut x738: u32 = 0; + let mut x739: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x738, &mut x739, x737, x690, x721); + let mut x740: u32 = 0; + let mut x741: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x740, &mut x741, x739, x692, x723); + let mut x742: u32 = 0; + let mut x743: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x742, &mut x743, x741, x694, x725); + let mut x744: u32 = 0; + let mut x745: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x744, &mut x745, x743, x696, x727); + let mut x746: u32 = 0; + let mut x747: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x746, &mut x747, x728, 0x5588b13f); + let mut x748: u32 = 0; + let mut x749: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x748, &mut x749, x746, 0xffffffff); + let mut x750: u32 = 0; + let mut x751: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x750, &mut x751, x746, 0xffffffff); + let mut x752: u32 = 0; + let mut x753: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x752, &mut x753, x746, 0xffffffff); + let mut x754: u32 = 0; + let mut x755: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x754, &mut x755, x746, 0xfffffffe); + let mut x756: u32 = 0; + let mut x757: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x756, &mut x757, x746, 0xbaaedce6); + let mut x758: u32 = 0; + let mut x759: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x758, &mut x759, x746, 0xaf48a03b); + let mut x760: u32 = 0; + let mut x761: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x760, &mut x761, x746, 0xbfd25e8c); + let mut x762: u32 = 0; + let mut x763: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x762, &mut x763, x746, 0xd0364141); + let mut x764: u32 = 0; + let mut x765: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x764, &mut x765, 0x0, x763, x760); + let mut x766: u32 = 0; + let mut x767: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x766, &mut x767, x765, x761, x758); + let mut x768: u32 = 0; + let mut x769: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x768, &mut x769, x767, x759, x756); + let mut x770: u32 = 0; + let mut x771: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x770, &mut x771, x769, x757, x754); + let mut x772: u32 = 0; + let mut x773: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x772, &mut x773, x771, x755, x752); + let mut x774: u32 = 0; + let mut x775: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x774, &mut x775, x773, x753, x750); + let mut x776: u32 = 0; + let mut x777: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x776, &mut x777, x775, x751, x748); + let x778: u32 = ((x777 as u32) + x749); + let mut x779: u32 = 0; + let mut x780: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x779, &mut x780, 0x0, x728, x762); + let mut x781: u32 = 0; + let mut x782: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x781, &mut x782, x780, x730, x764); + let mut x783: u32 = 0; + let mut x784: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x783, &mut x784, x782, x732, x766); + let mut x785: u32 = 0; + let mut x786: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x785, &mut x786, x784, x734, x768); + let mut x787: u32 = 0; + let mut x788: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x787, &mut x788, x786, x736, x770); + let mut x789: u32 = 0; + let mut x790: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x789, &mut x790, x788, x738, x772); + let mut x791: u32 = 0; + let mut x792: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x791, &mut x792, x790, x740, x774); + let mut x793: u32 = 0; + let mut x794: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x793, &mut x794, x792, x742, x776); + let mut x795: u32 = 0; + let mut x796: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x795, &mut x796, x794, x744, x778); + let x797: u32 = ((x796 as u32) + (x745 as u32)); + let mut x798: u32 = 0; + let mut x799: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x798, &mut x799, 0x0, x781, 0xd0364141); + let mut x800: u32 = 0; + let mut x801: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x800, &mut x801, x799, x783, 0xbfd25e8c); + let mut x802: u32 = 0; + let mut x803: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x802, &mut x803, x801, x785, 0xaf48a03b); + let mut x804: u32 = 0; + let mut x805: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x804, &mut x805, x803, x787, 0xbaaedce6); + let mut x806: u32 = 0; + let mut x807: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x806, &mut x807, x805, x789, 0xfffffffe); + let mut x808: u32 = 0; + let mut x809: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x808, &mut x809, x807, x791, 0xffffffff); + let mut x810: u32 = 0; + let mut x811: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x810, &mut x811, x809, x793, 0xffffffff); + let mut x812: u32 = 0; + let mut x813: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x812, &mut x813, x811, x795, 0xffffffff); + let mut x814: u32 = 0; + let mut x815: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x814, &mut x815, x813, x797, (0x0 as u32)); + let mut x816: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x816, x815, x798, x781); + let mut x817: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x817, x815, x800, x783); + let mut x818: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x818, x815, x802, x785); + let mut x819: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x819, x815, x804, x787); + let mut x820: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x820, x815, x806, x789); + let mut x821: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x821, x815, x808, x791); + let mut x822: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x822, x815, x810, x793); + let mut x823: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x823, x815, x812, x795); + out1[0] = x816; + out1[1] = x817; + out1[2] = x818; + out1[3] = x819; + out1[4] = x820; + out1[5] = x821; + out1[6] = x822; + out1[7] = x823; +} + +/// The function fiat_secp256k1_scalar_add adds two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) + eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_secp256k1_scalar_add(out1: &mut fiat_secp256k1_scalar_montgomery_domain_field_element, arg1: &fiat_secp256k1_scalar_montgomery_domain_field_element, arg2: &fiat_secp256k1_scalar_montgomery_domain_field_element) -> () { + let mut x1: u32 = 0; + let mut x2: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x1, &mut x2, 0x0, (arg1[0]), (arg2[0])); + let mut x3: u32 = 0; + let mut x4: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x3, &mut x4, x2, (arg1[1]), (arg2[1])); + let mut x5: u32 = 0; + let mut x6: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x5, &mut x6, x4, (arg1[2]), (arg2[2])); + let mut x7: u32 = 0; + let mut x8: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x7, &mut x8, x6, (arg1[3]), (arg2[3])); + let mut x9: u32 = 0; + let mut x10: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x9, &mut x10, x8, (arg1[4]), (arg2[4])); + let mut x11: u32 = 0; + let mut x12: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x11, &mut x12, x10, (arg1[5]), (arg2[5])); + let mut x13: u32 = 0; + let mut x14: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x13, &mut x14, x12, (arg1[6]), (arg2[6])); + let mut x15: u32 = 0; + let mut x16: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x15, &mut x16, x14, (arg1[7]), (arg2[7])); + let mut x17: u32 = 0; + let mut x18: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x17, &mut x18, 0x0, x1, 0xd0364141); + let mut x19: u32 = 0; + let mut x20: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x19, &mut x20, x18, x3, 0xbfd25e8c); + let mut x21: u32 = 0; + let mut x22: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x21, &mut x22, x20, x5, 0xaf48a03b); + let mut x23: u32 = 0; + let mut x24: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x23, &mut x24, x22, x7, 0xbaaedce6); + let mut x25: u32 = 0; + let mut x26: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x25, &mut x26, x24, x9, 0xfffffffe); + let mut x27: u32 = 0; + let mut x28: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x27, &mut x28, x26, x11, 0xffffffff); + let mut x29: u32 = 0; + let mut x30: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x29, &mut x30, x28, x13, 0xffffffff); + let mut x31: u32 = 0; + let mut x32: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x31, &mut x32, x30, x15, 0xffffffff); + let mut x33: u32 = 0; + let mut x34: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x33, &mut x34, x32, (x16 as u32), (0x0 as u32)); + let mut x35: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x35, x34, x17, x1); + let mut x36: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x36, x34, x19, x3); + let mut x37: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x37, x34, x21, x5); + let mut x38: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x38, x34, x23, x7); + let mut x39: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x39, x34, x25, x9); + let mut x40: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x40, x34, x27, x11); + let mut x41: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x41, x34, x29, x13); + let mut x42: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x42, x34, x31, x15); + out1[0] = x35; + out1[1] = x36; + out1[2] = x37; + out1[3] = x38; + out1[4] = x39; + out1[5] = x40; + out1[6] = x41; + out1[7] = x42; +} + +/// The function fiat_secp256k1_scalar_sub subtracts two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) - eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_secp256k1_scalar_sub(out1: &mut fiat_secp256k1_scalar_montgomery_domain_field_element, arg1: &fiat_secp256k1_scalar_montgomery_domain_field_element, arg2: &fiat_secp256k1_scalar_montgomery_domain_field_element) -> () { + let mut x1: u32 = 0; + let mut x2: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x1, &mut x2, 0x0, (arg1[0]), (arg2[0])); + let mut x3: u32 = 0; + let mut x4: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x3, &mut x4, x2, (arg1[1]), (arg2[1])); + let mut x5: u32 = 0; + let mut x6: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x5, &mut x6, x4, (arg1[2]), (arg2[2])); + let mut x7: u32 = 0; + let mut x8: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x7, &mut x8, x6, (arg1[3]), (arg2[3])); + let mut x9: u32 = 0; + let mut x10: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x9, &mut x10, x8, (arg1[4]), (arg2[4])); + let mut x11: u32 = 0; + let mut x12: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x11, &mut x12, x10, (arg1[5]), (arg2[5])); + let mut x13: u32 = 0; + let mut x14: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x13, &mut x14, x12, (arg1[6]), (arg2[6])); + let mut x15: u32 = 0; + let mut x16: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x15, &mut x16, x14, (arg1[7]), (arg2[7])); + let mut x17: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x17, x16, (0x0 as u32), 0xffffffff); + let mut x18: u32 = 0; + let mut x19: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x18, &mut x19, 0x0, x1, (x17 & 0xd0364141)); + let mut x20: u32 = 0; + let mut x21: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x20, &mut x21, x19, x3, (x17 & 0xbfd25e8c)); + let mut x22: u32 = 0; + let mut x23: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x22, &mut x23, x21, x5, (x17 & 0xaf48a03b)); + let mut x24: u32 = 0; + let mut x25: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x24, &mut x25, x23, x7, (x17 & 0xbaaedce6)); + let mut x26: u32 = 0; + let mut x27: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x26, &mut x27, x25, x9, (x17 & 0xfffffffe)); + let mut x28: u32 = 0; + let mut x29: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x28, &mut x29, x27, x11, x17); + let mut x30: u32 = 0; + let mut x31: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x30, &mut x31, x29, x13, x17); + let mut x32: u32 = 0; + let mut x33: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x32, &mut x33, x31, x15, x17); + out1[0] = x18; + out1[1] = x20; + out1[2] = x22; + out1[3] = x24; + out1[4] = x26; + out1[5] = x28; + out1[6] = x30; + out1[7] = x32; +} + +/// The function fiat_secp256k1_scalar_opp negates a field element in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = -eval (from_montgomery arg1) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_secp256k1_scalar_opp(out1: &mut fiat_secp256k1_scalar_montgomery_domain_field_element, arg1: &fiat_secp256k1_scalar_montgomery_domain_field_element) -> () { + let mut x1: u32 = 0; + let mut x2: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x1, &mut x2, 0x0, (0x0 as u32), (arg1[0])); + let mut x3: u32 = 0; + let mut x4: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x3, &mut x4, x2, (0x0 as u32), (arg1[1])); + let mut x5: u32 = 0; + let mut x6: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x5, &mut x6, x4, (0x0 as u32), (arg1[2])); + let mut x7: u32 = 0; + let mut x8: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x7, &mut x8, x6, (0x0 as u32), (arg1[3])); + let mut x9: u32 = 0; + let mut x10: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x9, &mut x10, x8, (0x0 as u32), (arg1[4])); + let mut x11: u32 = 0; + let mut x12: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x11, &mut x12, x10, (0x0 as u32), (arg1[5])); + let mut x13: u32 = 0; + let mut x14: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x13, &mut x14, x12, (0x0 as u32), (arg1[6])); + let mut x15: u32 = 0; + let mut x16: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x15, &mut x16, x14, (0x0 as u32), (arg1[7])); + let mut x17: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x17, x16, (0x0 as u32), 0xffffffff); + let mut x18: u32 = 0; + let mut x19: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x18, &mut x19, 0x0, x1, (x17 & 0xd0364141)); + let mut x20: u32 = 0; + let mut x21: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x20, &mut x21, x19, x3, (x17 & 0xbfd25e8c)); + let mut x22: u32 = 0; + let mut x23: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x22, &mut x23, x21, x5, (x17 & 0xaf48a03b)); + let mut x24: u32 = 0; + let mut x25: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x24, &mut x25, x23, x7, (x17 & 0xbaaedce6)); + let mut x26: u32 = 0; + let mut x27: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x26, &mut x27, x25, x9, (x17 & 0xfffffffe)); + let mut x28: u32 = 0; + let mut x29: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x28, &mut x29, x27, x11, x17); + let mut x30: u32 = 0; + let mut x31: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x30, &mut x31, x29, x13, x17); + let mut x32: u32 = 0; + let mut x33: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x32, &mut x33, x31, x15, x17); + out1[0] = x18; + out1[1] = x20; + out1[2] = x22; + out1[3] = x24; + out1[4] = x26; + out1[5] = x28; + out1[6] = x30; + out1[7] = x32; +} + +/// The function fiat_secp256k1_scalar_from_montgomery translates a field element out of the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval out1 mod m = (eval arg1 * ((2^32)⁻¹ mod m)^8) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_secp256k1_scalar_from_montgomery(out1: &mut fiat_secp256k1_scalar_non_montgomery_domain_field_element, arg1: &fiat_secp256k1_scalar_montgomery_domain_field_element) -> () { + let x1: u32 = (arg1[0]); + let mut x2: u32 = 0; + let mut x3: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x2, &mut x3, x1, 0x5588b13f); + let mut x4: u32 = 0; + let mut x5: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x4, &mut x5, x2, 0xffffffff); + let mut x6: u32 = 0; + let mut x7: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x6, &mut x7, x2, 0xffffffff); + let mut x8: u32 = 0; + let mut x9: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x8, &mut x9, x2, 0xffffffff); + let mut x10: u32 = 0; + let mut x11: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x10, &mut x11, x2, 0xfffffffe); + let mut x12: u32 = 0; + let mut x13: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x12, &mut x13, x2, 0xbaaedce6); + let mut x14: u32 = 0; + let mut x15: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x14, &mut x15, x2, 0xaf48a03b); + let mut x16: u32 = 0; + let mut x17: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x16, &mut x17, x2, 0xbfd25e8c); + let mut x18: u32 = 0; + let mut x19: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x18, &mut x19, x2, 0xd0364141); + let mut x20: u32 = 0; + let mut x21: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x20, &mut x21, 0x0, x19, x16); + let mut x22: u32 = 0; + let mut x23: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x22, &mut x23, x21, x17, x14); + let mut x24: u32 = 0; + let mut x25: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x24, &mut x25, x23, x15, x12); + let mut x26: u32 = 0; + let mut x27: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x26, &mut x27, x25, x13, x10); + let mut x28: u32 = 0; + let mut x29: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x28, &mut x29, x27, x11, x8); + let mut x30: u32 = 0; + let mut x31: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x30, &mut x31, x29, x9, x6); + let mut x32: u32 = 0; + let mut x33: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x32, &mut x33, x31, x7, x4); + let mut x34: u32 = 0; + let mut x35: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x34, &mut x35, 0x0, x1, x18); + let mut x36: u32 = 0; + let mut x37: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x36, &mut x37, x35, (0x0 as u32), x20); + let mut x38: u32 = 0; + let mut x39: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x38, &mut x39, x37, (0x0 as u32), x22); + let mut x40: u32 = 0; + let mut x41: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x40, &mut x41, x39, (0x0 as u32), x24); + let mut x42: u32 = 0; + let mut x43: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x42, &mut x43, x41, (0x0 as u32), x26); + let mut x44: u32 = 0; + let mut x45: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x44, &mut x45, x43, (0x0 as u32), x28); + let mut x46: u32 = 0; + let mut x47: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x46, &mut x47, x45, (0x0 as u32), x30); + let mut x48: u32 = 0; + let mut x49: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x48, &mut x49, x47, (0x0 as u32), x32); + let mut x50: u32 = 0; + let mut x51: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x50, &mut x51, x49, (0x0 as u32), ((x33 as u32) + x5)); + let mut x52: u32 = 0; + let mut x53: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x52, &mut x53, 0x0, x36, (arg1[1])); + let mut x54: u32 = 0; + let mut x55: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x54, &mut x55, x53, x38, (0x0 as u32)); + let mut x56: u32 = 0; + let mut x57: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x56, &mut x57, x55, x40, (0x0 as u32)); + let mut x58: u32 = 0; + let mut x59: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x58, &mut x59, x57, x42, (0x0 as u32)); + let mut x60: u32 = 0; + let mut x61: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x60, &mut x61, x59, x44, (0x0 as u32)); + let mut x62: u32 = 0; + let mut x63: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x62, &mut x63, x61, x46, (0x0 as u32)); + let mut x64: u32 = 0; + let mut x65: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x64, &mut x65, x63, x48, (0x0 as u32)); + let mut x66: u32 = 0; + let mut x67: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x66, &mut x67, x65, x50, (0x0 as u32)); + let mut x68: u32 = 0; + let mut x69: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x68, &mut x69, x52, 0x5588b13f); + let mut x70: u32 = 0; + let mut x71: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x70, &mut x71, x68, 0xffffffff); + let mut x72: u32 = 0; + let mut x73: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x72, &mut x73, x68, 0xffffffff); + let mut x74: u32 = 0; + let mut x75: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x74, &mut x75, x68, 0xffffffff); + let mut x76: u32 = 0; + let mut x77: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x76, &mut x77, x68, 0xfffffffe); + let mut x78: u32 = 0; + let mut x79: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x78, &mut x79, x68, 0xbaaedce6); + let mut x80: u32 = 0; + let mut x81: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x80, &mut x81, x68, 0xaf48a03b); + let mut x82: u32 = 0; + let mut x83: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x82, &mut x83, x68, 0xbfd25e8c); + let mut x84: u32 = 0; + let mut x85: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x84, &mut x85, x68, 0xd0364141); + let mut x86: u32 = 0; + let mut x87: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x86, &mut x87, 0x0, x85, x82); + let mut x88: u32 = 0; + let mut x89: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x88, &mut x89, x87, x83, x80); + let mut x90: u32 = 0; + let mut x91: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x90, &mut x91, x89, x81, x78); + let mut x92: u32 = 0; + let mut x93: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x92, &mut x93, x91, x79, x76); + let mut x94: u32 = 0; + let mut x95: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x94, &mut x95, x93, x77, x74); + let mut x96: u32 = 0; + let mut x97: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x96, &mut x97, x95, x75, x72); + let mut x98: u32 = 0; + let mut x99: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x98, &mut x99, x97, x73, x70); + let mut x100: u32 = 0; + let mut x101: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x100, &mut x101, 0x0, x52, x84); + let mut x102: u32 = 0; + let mut x103: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x102, &mut x103, x101, x54, x86); + let mut x104: u32 = 0; + let mut x105: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x104, &mut x105, x103, x56, x88); + let mut x106: u32 = 0; + let mut x107: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x106, &mut x107, x105, x58, x90); + let mut x108: u32 = 0; + let mut x109: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x108, &mut x109, x107, x60, x92); + let mut x110: u32 = 0; + let mut x111: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x110, &mut x111, x109, x62, x94); + let mut x112: u32 = 0; + let mut x113: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x112, &mut x113, x111, x64, x96); + let mut x114: u32 = 0; + let mut x115: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x114, &mut x115, x113, x66, x98); + let mut x116: u32 = 0; + let mut x117: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x116, &mut x117, x115, ((x67 as u32) + (x51 as u32)), ((x99 as u32) + x71)); + let mut x118: u32 = 0; + let mut x119: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x118, &mut x119, 0x0, x102, (arg1[2])); + let mut x120: u32 = 0; + let mut x121: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x120, &mut x121, x119, x104, (0x0 as u32)); + let mut x122: u32 = 0; + let mut x123: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x122, &mut x123, x121, x106, (0x0 as u32)); + let mut x124: u32 = 0; + let mut x125: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x124, &mut x125, x123, x108, (0x0 as u32)); + let mut x126: u32 = 0; + let mut x127: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x126, &mut x127, x125, x110, (0x0 as u32)); + let mut x128: u32 = 0; + let mut x129: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x128, &mut x129, x127, x112, (0x0 as u32)); + let mut x130: u32 = 0; + let mut x131: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x130, &mut x131, x129, x114, (0x0 as u32)); + let mut x132: u32 = 0; + let mut x133: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x132, &mut x133, x131, x116, (0x0 as u32)); + let mut x134: u32 = 0; + let mut x135: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x134, &mut x135, x118, 0x5588b13f); + let mut x136: u32 = 0; + let mut x137: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x136, &mut x137, x134, 0xffffffff); + let mut x138: u32 = 0; + let mut x139: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x138, &mut x139, x134, 0xffffffff); + let mut x140: u32 = 0; + let mut x141: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x140, &mut x141, x134, 0xffffffff); + let mut x142: u32 = 0; + let mut x143: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x142, &mut x143, x134, 0xfffffffe); + let mut x144: u32 = 0; + let mut x145: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x144, &mut x145, x134, 0xbaaedce6); + let mut x146: u32 = 0; + let mut x147: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x146, &mut x147, x134, 0xaf48a03b); + let mut x148: u32 = 0; + let mut x149: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x148, &mut x149, x134, 0xbfd25e8c); + let mut x150: u32 = 0; + let mut x151: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x150, &mut x151, x134, 0xd0364141); + let mut x152: u32 = 0; + let mut x153: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x152, &mut x153, 0x0, x151, x148); + let mut x154: u32 = 0; + let mut x155: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x154, &mut x155, x153, x149, x146); + let mut x156: u32 = 0; + let mut x157: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x156, &mut x157, x155, x147, x144); + let mut x158: u32 = 0; + let mut x159: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x158, &mut x159, x157, x145, x142); + let mut x160: u32 = 0; + let mut x161: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x160, &mut x161, x159, x143, x140); + let mut x162: u32 = 0; + let mut x163: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x162, &mut x163, x161, x141, x138); + let mut x164: u32 = 0; + let mut x165: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x164, &mut x165, x163, x139, x136); + let mut x166: u32 = 0; + let mut x167: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x166, &mut x167, 0x0, x118, x150); + let mut x168: u32 = 0; + let mut x169: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x168, &mut x169, x167, x120, x152); + let mut x170: u32 = 0; + let mut x171: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x170, &mut x171, x169, x122, x154); + let mut x172: u32 = 0; + let mut x173: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x172, &mut x173, x171, x124, x156); + let mut x174: u32 = 0; + let mut x175: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x174, &mut x175, x173, x126, x158); + let mut x176: u32 = 0; + let mut x177: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x176, &mut x177, x175, x128, x160); + let mut x178: u32 = 0; + let mut x179: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x178, &mut x179, x177, x130, x162); + let mut x180: u32 = 0; + let mut x181: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x180, &mut x181, x179, x132, x164); + let mut x182: u32 = 0; + let mut x183: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x182, &mut x183, x181, ((x133 as u32) + (x117 as u32)), ((x165 as u32) + x137)); + let mut x184: u32 = 0; + let mut x185: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x184, &mut x185, 0x0, x168, (arg1[3])); + let mut x186: u32 = 0; + let mut x187: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x186, &mut x187, x185, x170, (0x0 as u32)); + let mut x188: u32 = 0; + let mut x189: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x188, &mut x189, x187, x172, (0x0 as u32)); + let mut x190: u32 = 0; + let mut x191: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x190, &mut x191, x189, x174, (0x0 as u32)); + let mut x192: u32 = 0; + let mut x193: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x192, &mut x193, x191, x176, (0x0 as u32)); + let mut x194: u32 = 0; + let mut x195: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x194, &mut x195, x193, x178, (0x0 as u32)); + let mut x196: u32 = 0; + let mut x197: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x196, &mut x197, x195, x180, (0x0 as u32)); + let mut x198: u32 = 0; + let mut x199: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x198, &mut x199, x197, x182, (0x0 as u32)); + let mut x200: u32 = 0; + let mut x201: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x200, &mut x201, x184, 0x5588b13f); + let mut x202: u32 = 0; + let mut x203: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x202, &mut x203, x200, 0xffffffff); + let mut x204: u32 = 0; + let mut x205: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x204, &mut x205, x200, 0xffffffff); + let mut x206: u32 = 0; + let mut x207: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x206, &mut x207, x200, 0xffffffff); + let mut x208: u32 = 0; + let mut x209: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x208, &mut x209, x200, 0xfffffffe); + let mut x210: u32 = 0; + let mut x211: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x210, &mut x211, x200, 0xbaaedce6); + let mut x212: u32 = 0; + let mut x213: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x212, &mut x213, x200, 0xaf48a03b); + let mut x214: u32 = 0; + let mut x215: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x214, &mut x215, x200, 0xbfd25e8c); + let mut x216: u32 = 0; + let mut x217: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x216, &mut x217, x200, 0xd0364141); + let mut x218: u32 = 0; + let mut x219: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x218, &mut x219, 0x0, x217, x214); + let mut x220: u32 = 0; + let mut x221: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x220, &mut x221, x219, x215, x212); + let mut x222: u32 = 0; + let mut x223: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x222, &mut x223, x221, x213, x210); + let mut x224: u32 = 0; + let mut x225: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x224, &mut x225, x223, x211, x208); + let mut x226: u32 = 0; + let mut x227: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x226, &mut x227, x225, x209, x206); + let mut x228: u32 = 0; + let mut x229: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x228, &mut x229, x227, x207, x204); + let mut x230: u32 = 0; + let mut x231: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x230, &mut x231, x229, x205, x202); + let mut x232: u32 = 0; + let mut x233: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x232, &mut x233, 0x0, x184, x216); + let mut x234: u32 = 0; + let mut x235: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x234, &mut x235, x233, x186, x218); + let mut x236: u32 = 0; + let mut x237: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x236, &mut x237, x235, x188, x220); + let mut x238: u32 = 0; + let mut x239: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x238, &mut x239, x237, x190, x222); + let mut x240: u32 = 0; + let mut x241: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x240, &mut x241, x239, x192, x224); + let mut x242: u32 = 0; + let mut x243: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x242, &mut x243, x241, x194, x226); + let mut x244: u32 = 0; + let mut x245: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x244, &mut x245, x243, x196, x228); + let mut x246: u32 = 0; + let mut x247: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x246, &mut x247, x245, x198, x230); + let mut x248: u32 = 0; + let mut x249: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x248, &mut x249, x247, ((x199 as u32) + (x183 as u32)), ((x231 as u32) + x203)); + let mut x250: u32 = 0; + let mut x251: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x250, &mut x251, 0x0, x234, (arg1[4])); + let mut x252: u32 = 0; + let mut x253: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x252, &mut x253, x251, x236, (0x0 as u32)); + let mut x254: u32 = 0; + let mut x255: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x254, &mut x255, x253, x238, (0x0 as u32)); + let mut x256: u32 = 0; + let mut x257: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x256, &mut x257, x255, x240, (0x0 as u32)); + let mut x258: u32 = 0; + let mut x259: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x258, &mut x259, x257, x242, (0x0 as u32)); + let mut x260: u32 = 0; + let mut x261: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x260, &mut x261, x259, x244, (0x0 as u32)); + let mut x262: u32 = 0; + let mut x263: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x262, &mut x263, x261, x246, (0x0 as u32)); + let mut x264: u32 = 0; + let mut x265: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x264, &mut x265, x263, x248, (0x0 as u32)); + let mut x266: u32 = 0; + let mut x267: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x266, &mut x267, x250, 0x5588b13f); + let mut x268: u32 = 0; + let mut x269: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x268, &mut x269, x266, 0xffffffff); + let mut x270: u32 = 0; + let mut x271: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x270, &mut x271, x266, 0xffffffff); + let mut x272: u32 = 0; + let mut x273: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x272, &mut x273, x266, 0xffffffff); + let mut x274: u32 = 0; + let mut x275: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x274, &mut x275, x266, 0xfffffffe); + let mut x276: u32 = 0; + let mut x277: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x276, &mut x277, x266, 0xbaaedce6); + let mut x278: u32 = 0; + let mut x279: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x278, &mut x279, x266, 0xaf48a03b); + let mut x280: u32 = 0; + let mut x281: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x280, &mut x281, x266, 0xbfd25e8c); + let mut x282: u32 = 0; + let mut x283: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x282, &mut x283, x266, 0xd0364141); + let mut x284: u32 = 0; + let mut x285: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x284, &mut x285, 0x0, x283, x280); + let mut x286: u32 = 0; + let mut x287: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x286, &mut x287, x285, x281, x278); + let mut x288: u32 = 0; + let mut x289: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x288, &mut x289, x287, x279, x276); + let mut x290: u32 = 0; + let mut x291: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x290, &mut x291, x289, x277, x274); + let mut x292: u32 = 0; + let mut x293: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x292, &mut x293, x291, x275, x272); + let mut x294: u32 = 0; + let mut x295: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x294, &mut x295, x293, x273, x270); + let mut x296: u32 = 0; + let mut x297: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x296, &mut x297, x295, x271, x268); + let mut x298: u32 = 0; + let mut x299: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x298, &mut x299, 0x0, x250, x282); + let mut x300: u32 = 0; + let mut x301: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x300, &mut x301, x299, x252, x284); + let mut x302: u32 = 0; + let mut x303: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x302, &mut x303, x301, x254, x286); + let mut x304: u32 = 0; + let mut x305: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x304, &mut x305, x303, x256, x288); + let mut x306: u32 = 0; + let mut x307: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x306, &mut x307, x305, x258, x290); + let mut x308: u32 = 0; + let mut x309: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x308, &mut x309, x307, x260, x292); + let mut x310: u32 = 0; + let mut x311: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x310, &mut x311, x309, x262, x294); + let mut x312: u32 = 0; + let mut x313: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x312, &mut x313, x311, x264, x296); + let mut x314: u32 = 0; + let mut x315: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x314, &mut x315, x313, ((x265 as u32) + (x249 as u32)), ((x297 as u32) + x269)); + let mut x316: u32 = 0; + let mut x317: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x316, &mut x317, 0x0, x300, (arg1[5])); + let mut x318: u32 = 0; + let mut x319: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x318, &mut x319, x317, x302, (0x0 as u32)); + let mut x320: u32 = 0; + let mut x321: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x320, &mut x321, x319, x304, (0x0 as u32)); + let mut x322: u32 = 0; + let mut x323: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x322, &mut x323, x321, x306, (0x0 as u32)); + let mut x324: u32 = 0; + let mut x325: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x324, &mut x325, x323, x308, (0x0 as u32)); + let mut x326: u32 = 0; + let mut x327: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x326, &mut x327, x325, x310, (0x0 as u32)); + let mut x328: u32 = 0; + let mut x329: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x328, &mut x329, x327, x312, (0x0 as u32)); + let mut x330: u32 = 0; + let mut x331: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x330, &mut x331, x329, x314, (0x0 as u32)); + let mut x332: u32 = 0; + let mut x333: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x332, &mut x333, x316, 0x5588b13f); + let mut x334: u32 = 0; + let mut x335: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x334, &mut x335, x332, 0xffffffff); + let mut x336: u32 = 0; + let mut x337: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x336, &mut x337, x332, 0xffffffff); + let mut x338: u32 = 0; + let mut x339: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x338, &mut x339, x332, 0xffffffff); + let mut x340: u32 = 0; + let mut x341: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x340, &mut x341, x332, 0xfffffffe); + let mut x342: u32 = 0; + let mut x343: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x342, &mut x343, x332, 0xbaaedce6); + let mut x344: u32 = 0; + let mut x345: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x344, &mut x345, x332, 0xaf48a03b); + let mut x346: u32 = 0; + let mut x347: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x346, &mut x347, x332, 0xbfd25e8c); + let mut x348: u32 = 0; + let mut x349: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x348, &mut x349, x332, 0xd0364141); + let mut x350: u32 = 0; + let mut x351: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x350, &mut x351, 0x0, x349, x346); + let mut x352: u32 = 0; + let mut x353: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x352, &mut x353, x351, x347, x344); + let mut x354: u32 = 0; + let mut x355: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x354, &mut x355, x353, x345, x342); + let mut x356: u32 = 0; + let mut x357: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x356, &mut x357, x355, x343, x340); + let mut x358: u32 = 0; + let mut x359: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x358, &mut x359, x357, x341, x338); + let mut x360: u32 = 0; + let mut x361: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x360, &mut x361, x359, x339, x336); + let mut x362: u32 = 0; + let mut x363: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x362, &mut x363, x361, x337, x334); + let mut x364: u32 = 0; + let mut x365: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x364, &mut x365, 0x0, x316, x348); + let mut x366: u32 = 0; + let mut x367: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x366, &mut x367, x365, x318, x350); + let mut x368: u32 = 0; + let mut x369: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x368, &mut x369, x367, x320, x352); + let mut x370: u32 = 0; + let mut x371: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x370, &mut x371, x369, x322, x354); + let mut x372: u32 = 0; + let mut x373: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x372, &mut x373, x371, x324, x356); + let mut x374: u32 = 0; + let mut x375: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x374, &mut x375, x373, x326, x358); + let mut x376: u32 = 0; + let mut x377: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x376, &mut x377, x375, x328, x360); + let mut x378: u32 = 0; + let mut x379: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x378, &mut x379, x377, x330, x362); + let mut x380: u32 = 0; + let mut x381: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x380, &mut x381, x379, ((x331 as u32) + (x315 as u32)), ((x363 as u32) + x335)); + let mut x382: u32 = 0; + let mut x383: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x382, &mut x383, 0x0, x366, (arg1[6])); + let mut x384: u32 = 0; + let mut x385: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x384, &mut x385, x383, x368, (0x0 as u32)); + let mut x386: u32 = 0; + let mut x387: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x386, &mut x387, x385, x370, (0x0 as u32)); + let mut x388: u32 = 0; + let mut x389: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x388, &mut x389, x387, x372, (0x0 as u32)); + let mut x390: u32 = 0; + let mut x391: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x390, &mut x391, x389, x374, (0x0 as u32)); + let mut x392: u32 = 0; + let mut x393: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x392, &mut x393, x391, x376, (0x0 as u32)); + let mut x394: u32 = 0; + let mut x395: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x394, &mut x395, x393, x378, (0x0 as u32)); + let mut x396: u32 = 0; + let mut x397: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x396, &mut x397, x395, x380, (0x0 as u32)); + let mut x398: u32 = 0; + let mut x399: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x398, &mut x399, x382, 0x5588b13f); + let mut x400: u32 = 0; + let mut x401: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x400, &mut x401, x398, 0xffffffff); + let mut x402: u32 = 0; + let mut x403: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x402, &mut x403, x398, 0xffffffff); + let mut x404: u32 = 0; + let mut x405: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x404, &mut x405, x398, 0xffffffff); + let mut x406: u32 = 0; + let mut x407: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x406, &mut x407, x398, 0xfffffffe); + let mut x408: u32 = 0; + let mut x409: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x408, &mut x409, x398, 0xbaaedce6); + let mut x410: u32 = 0; + let mut x411: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x410, &mut x411, x398, 0xaf48a03b); + let mut x412: u32 = 0; + let mut x413: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x412, &mut x413, x398, 0xbfd25e8c); + let mut x414: u32 = 0; + let mut x415: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x414, &mut x415, x398, 0xd0364141); + let mut x416: u32 = 0; + let mut x417: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x416, &mut x417, 0x0, x415, x412); + let mut x418: u32 = 0; + let mut x419: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x418, &mut x419, x417, x413, x410); + let mut x420: u32 = 0; + let mut x421: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x420, &mut x421, x419, x411, x408); + let mut x422: u32 = 0; + let mut x423: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x422, &mut x423, x421, x409, x406); + let mut x424: u32 = 0; + let mut x425: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x424, &mut x425, x423, x407, x404); + let mut x426: u32 = 0; + let mut x427: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x426, &mut x427, x425, x405, x402); + let mut x428: u32 = 0; + let mut x429: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x428, &mut x429, x427, x403, x400); + let mut x430: u32 = 0; + let mut x431: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x430, &mut x431, 0x0, x382, x414); + let mut x432: u32 = 0; + let mut x433: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x432, &mut x433, x431, x384, x416); + let mut x434: u32 = 0; + let mut x435: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x434, &mut x435, x433, x386, x418); + let mut x436: u32 = 0; + let mut x437: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x436, &mut x437, x435, x388, x420); + let mut x438: u32 = 0; + let mut x439: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x438, &mut x439, x437, x390, x422); + let mut x440: u32 = 0; + let mut x441: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x440, &mut x441, x439, x392, x424); + let mut x442: u32 = 0; + let mut x443: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x442, &mut x443, x441, x394, x426); + let mut x444: u32 = 0; + let mut x445: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x444, &mut x445, x443, x396, x428); + let mut x446: u32 = 0; + let mut x447: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x446, &mut x447, x445, ((x397 as u32) + (x381 as u32)), ((x429 as u32) + x401)); + let mut x448: u32 = 0; + let mut x449: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x448, &mut x449, 0x0, x432, (arg1[7])); + let mut x450: u32 = 0; + let mut x451: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x450, &mut x451, x449, x434, (0x0 as u32)); + let mut x452: u32 = 0; + let mut x453: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x452, &mut x453, x451, x436, (0x0 as u32)); + let mut x454: u32 = 0; + let mut x455: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x454, &mut x455, x453, x438, (0x0 as u32)); + let mut x456: u32 = 0; + let mut x457: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x456, &mut x457, x455, x440, (0x0 as u32)); + let mut x458: u32 = 0; + let mut x459: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x458, &mut x459, x457, x442, (0x0 as u32)); + let mut x460: u32 = 0; + let mut x461: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x460, &mut x461, x459, x444, (0x0 as u32)); + let mut x462: u32 = 0; + let mut x463: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x462, &mut x463, x461, x446, (0x0 as u32)); + let mut x464: u32 = 0; + let mut x465: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x464, &mut x465, x448, 0x5588b13f); + let mut x466: u32 = 0; + let mut x467: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x466, &mut x467, x464, 0xffffffff); + let mut x468: u32 = 0; + let mut x469: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x468, &mut x469, x464, 0xffffffff); + let mut x470: u32 = 0; + let mut x471: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x470, &mut x471, x464, 0xffffffff); + let mut x472: u32 = 0; + let mut x473: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x472, &mut x473, x464, 0xfffffffe); + let mut x474: u32 = 0; + let mut x475: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x474, &mut x475, x464, 0xbaaedce6); + let mut x476: u32 = 0; + let mut x477: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x476, &mut x477, x464, 0xaf48a03b); + let mut x478: u32 = 0; + let mut x479: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x478, &mut x479, x464, 0xbfd25e8c); + let mut x480: u32 = 0; + let mut x481: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x480, &mut x481, x464, 0xd0364141); + let mut x482: u32 = 0; + let mut x483: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x482, &mut x483, 0x0, x481, x478); + let mut x484: u32 = 0; + let mut x485: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x484, &mut x485, x483, x479, x476); + let mut x486: u32 = 0; + let mut x487: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x486, &mut x487, x485, x477, x474); + let mut x488: u32 = 0; + let mut x489: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x488, &mut x489, x487, x475, x472); + let mut x490: u32 = 0; + let mut x491: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x490, &mut x491, x489, x473, x470); + let mut x492: u32 = 0; + let mut x493: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x492, &mut x493, x491, x471, x468); + let mut x494: u32 = 0; + let mut x495: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x494, &mut x495, x493, x469, x466); + let mut x496: u32 = 0; + let mut x497: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x496, &mut x497, 0x0, x448, x480); + let mut x498: u32 = 0; + let mut x499: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x498, &mut x499, x497, x450, x482); + let mut x500: u32 = 0; + let mut x501: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x500, &mut x501, x499, x452, x484); + let mut x502: u32 = 0; + let mut x503: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x502, &mut x503, x501, x454, x486); + let mut x504: u32 = 0; + let mut x505: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x504, &mut x505, x503, x456, x488); + let mut x506: u32 = 0; + let mut x507: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x506, &mut x507, x505, x458, x490); + let mut x508: u32 = 0; + let mut x509: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x508, &mut x509, x507, x460, x492); + let mut x510: u32 = 0; + let mut x511: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x510, &mut x511, x509, x462, x494); + let mut x512: u32 = 0; + let mut x513: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x512, &mut x513, x511, ((x463 as u32) + (x447 as u32)), ((x495 as u32) + x467)); + let mut x514: u32 = 0; + let mut x515: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x514, &mut x515, 0x0, x498, 0xd0364141); + let mut x516: u32 = 0; + let mut x517: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x516, &mut x517, x515, x500, 0xbfd25e8c); + let mut x518: u32 = 0; + let mut x519: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x518, &mut x519, x517, x502, 0xaf48a03b); + let mut x520: u32 = 0; + let mut x521: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x520, &mut x521, x519, x504, 0xbaaedce6); + let mut x522: u32 = 0; + let mut x523: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x522, &mut x523, x521, x506, 0xfffffffe); + let mut x524: u32 = 0; + let mut x525: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x524, &mut x525, x523, x508, 0xffffffff); + let mut x526: u32 = 0; + let mut x527: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x526, &mut x527, x525, x510, 0xffffffff); + let mut x528: u32 = 0; + let mut x529: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x528, &mut x529, x527, x512, 0xffffffff); + let mut x530: u32 = 0; + let mut x531: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x530, &mut x531, x529, (x513 as u32), (0x0 as u32)); + let mut x532: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x532, x531, x514, x498); + let mut x533: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x533, x531, x516, x500); + let mut x534: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x534, x531, x518, x502); + let mut x535: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x535, x531, x520, x504); + let mut x536: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x536, x531, x522, x506); + let mut x537: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x537, x531, x524, x508); + let mut x538: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x538, x531, x526, x510); + let mut x539: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x539, x531, x528, x512); + out1[0] = x532; + out1[1] = x533; + out1[2] = x534; + out1[3] = x535; + out1[4] = x536; + out1[5] = x537; + out1[6] = x538; + out1[7] = x539; +} + +/// The function fiat_secp256k1_scalar_to_montgomery translates a field element into the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = eval arg1 mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_secp256k1_scalar_to_montgomery(out1: &mut fiat_secp256k1_scalar_montgomery_domain_field_element, arg1: &fiat_secp256k1_scalar_non_montgomery_domain_field_element) -> () { + let x1: u32 = (arg1[1]); + let x2: u32 = (arg1[2]); + let x3: u32 = (arg1[3]); + let x4: u32 = (arg1[4]); + let x5: u32 = (arg1[5]); + let x6: u32 = (arg1[6]); + let x7: u32 = (arg1[7]); + let x8: u32 = (arg1[0]); + let mut x9: u32 = 0; + let mut x10: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x9, &mut x10, x8, 0x9d671cd5); + let mut x11: u32 = 0; + let mut x12: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x11, &mut x12, x8, 0x81c69bc5); + let mut x13: u32 = 0; + let mut x14: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x13, &mut x14, x8, 0xe697f5e4); + let mut x15: u32 = 0; + let mut x16: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x15, &mut x16, x8, 0x5bcd07c6); + let mut x17: u32 = 0; + let mut x18: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x17, &mut x18, x8, 0x741496c2); + let mut x19: u32 = 0; + let mut x20: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x19, &mut x20, x8, 0xe7cf878); + let mut x21: u32 = 0; + let mut x22: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x21, &mut x22, x8, 0x896cf214); + let mut x23: u32 = 0; + let mut x24: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x23, &mut x24, x8, 0x67d7d140); + let mut x25: u32 = 0; + let mut x26: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x25, &mut x26, 0x0, x24, x21); + let mut x27: u32 = 0; + let mut x28: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x27, &mut x28, x26, x22, x19); + let mut x29: u32 = 0; + let mut x30: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x29, &mut x30, x28, x20, x17); + let mut x31: u32 = 0; + let mut x32: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x31, &mut x32, x30, x18, x15); + let mut x33: u32 = 0; + let mut x34: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x33, &mut x34, x32, x16, x13); + let mut x35: u32 = 0; + let mut x36: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x35, &mut x36, x34, x14, x11); + let mut x37: u32 = 0; + let mut x38: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x37, &mut x38, x36, x12, x9); + let mut x39: u32 = 0; + let mut x40: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x39, &mut x40, x23, 0x5588b13f); + let mut x41: u32 = 0; + let mut x42: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x41, &mut x42, x39, 0xffffffff); + let mut x43: u32 = 0; + let mut x44: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x43, &mut x44, x39, 0xffffffff); + let mut x45: u32 = 0; + let mut x46: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x45, &mut x46, x39, 0xffffffff); + let mut x47: u32 = 0; + let mut x48: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x47, &mut x48, x39, 0xfffffffe); + let mut x49: u32 = 0; + let mut x50: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x49, &mut x50, x39, 0xbaaedce6); + let mut x51: u32 = 0; + let mut x52: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x51, &mut x52, x39, 0xaf48a03b); + let mut x53: u32 = 0; + let mut x54: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x53, &mut x54, x39, 0xbfd25e8c); + let mut x55: u32 = 0; + let mut x56: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x55, &mut x56, x39, 0xd0364141); + let mut x57: u32 = 0; + let mut x58: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x57, &mut x58, 0x0, x56, x53); + let mut x59: u32 = 0; + let mut x60: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x59, &mut x60, x58, x54, x51); + let mut x61: u32 = 0; + let mut x62: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x61, &mut x62, x60, x52, x49); + let mut x63: u32 = 0; + let mut x64: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x63, &mut x64, x62, x50, x47); + let mut x65: u32 = 0; + let mut x66: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x65, &mut x66, x64, x48, x45); + let mut x67: u32 = 0; + let mut x68: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x67, &mut x68, x66, x46, x43); + let mut x69: u32 = 0; + let mut x70: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x69, &mut x70, x68, x44, x41); + let mut x71: u32 = 0; + let mut x72: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x71, &mut x72, 0x0, x23, x55); + let mut x73: u32 = 0; + let mut x74: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x73, &mut x74, x72, x25, x57); + let mut x75: u32 = 0; + let mut x76: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x75, &mut x76, x74, x27, x59); + let mut x77: u32 = 0; + let mut x78: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x77, &mut x78, x76, x29, x61); + let mut x79: u32 = 0; + let mut x80: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x79, &mut x80, x78, x31, x63); + let mut x81: u32 = 0; + let mut x82: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x81, &mut x82, x80, x33, x65); + let mut x83: u32 = 0; + let mut x84: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x83, &mut x84, x82, x35, x67); + let mut x85: u32 = 0; + let mut x86: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x85, &mut x86, x84, x37, x69); + let mut x87: u32 = 0; + let mut x88: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x87, &mut x88, x86, ((x38 as u32) + x10), ((x70 as u32) + x42)); + let mut x89: u32 = 0; + let mut x90: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x89, &mut x90, x1, 0x9d671cd5); + let mut x91: u32 = 0; + let mut x92: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x91, &mut x92, x1, 0x81c69bc5); + let mut x93: u32 = 0; + let mut x94: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x93, &mut x94, x1, 0xe697f5e4); + let mut x95: u32 = 0; + let mut x96: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x95, &mut x96, x1, 0x5bcd07c6); + let mut x97: u32 = 0; + let mut x98: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x97, &mut x98, x1, 0x741496c2); + let mut x99: u32 = 0; + let mut x100: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x99, &mut x100, x1, 0xe7cf878); + let mut x101: u32 = 0; + let mut x102: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x101, &mut x102, x1, 0x896cf214); + let mut x103: u32 = 0; + let mut x104: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x103, &mut x104, x1, 0x67d7d140); + let mut x105: u32 = 0; + let mut x106: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x105, &mut x106, 0x0, x104, x101); + let mut x107: u32 = 0; + let mut x108: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x107, &mut x108, x106, x102, x99); + let mut x109: u32 = 0; + let mut x110: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x109, &mut x110, x108, x100, x97); + let mut x111: u32 = 0; + let mut x112: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x111, &mut x112, x110, x98, x95); + let mut x113: u32 = 0; + let mut x114: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x113, &mut x114, x112, x96, x93); + let mut x115: u32 = 0; + let mut x116: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x115, &mut x116, x114, x94, x91); + let mut x117: u32 = 0; + let mut x118: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x117, &mut x118, x116, x92, x89); + let mut x119: u32 = 0; + let mut x120: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x119, &mut x120, 0x0, x73, x103); + let mut x121: u32 = 0; + let mut x122: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x121, &mut x122, x120, x75, x105); + let mut x123: u32 = 0; + let mut x124: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x123, &mut x124, x122, x77, x107); + let mut x125: u32 = 0; + let mut x126: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x125, &mut x126, x124, x79, x109); + let mut x127: u32 = 0; + let mut x128: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x127, &mut x128, x126, x81, x111); + let mut x129: u32 = 0; + let mut x130: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x129, &mut x130, x128, x83, x113); + let mut x131: u32 = 0; + let mut x132: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x131, &mut x132, x130, x85, x115); + let mut x133: u32 = 0; + let mut x134: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x133, &mut x134, x132, x87, x117); + let mut x135: u32 = 0; + let mut x136: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x135, &mut x136, x119, 0x5588b13f); + let mut x137: u32 = 0; + let mut x138: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x137, &mut x138, x135, 0xffffffff); + let mut x139: u32 = 0; + let mut x140: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x139, &mut x140, x135, 0xffffffff); + let mut x141: u32 = 0; + let mut x142: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x141, &mut x142, x135, 0xffffffff); + let mut x143: u32 = 0; + let mut x144: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x143, &mut x144, x135, 0xfffffffe); + let mut x145: u32 = 0; + let mut x146: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x145, &mut x146, x135, 0xbaaedce6); + let mut x147: u32 = 0; + let mut x148: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x147, &mut x148, x135, 0xaf48a03b); + let mut x149: u32 = 0; + let mut x150: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x149, &mut x150, x135, 0xbfd25e8c); + let mut x151: u32 = 0; + let mut x152: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x151, &mut x152, x135, 0xd0364141); + let mut x153: u32 = 0; + let mut x154: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x153, &mut x154, 0x0, x152, x149); + let mut x155: u32 = 0; + let mut x156: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x155, &mut x156, x154, x150, x147); + let mut x157: u32 = 0; + let mut x158: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x157, &mut x158, x156, x148, x145); + let mut x159: u32 = 0; + let mut x160: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x159, &mut x160, x158, x146, x143); + let mut x161: u32 = 0; + let mut x162: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x161, &mut x162, x160, x144, x141); + let mut x163: u32 = 0; + let mut x164: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x163, &mut x164, x162, x142, x139); + let mut x165: u32 = 0; + let mut x166: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x165, &mut x166, x164, x140, x137); + let mut x167: u32 = 0; + let mut x168: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x167, &mut x168, 0x0, x119, x151); + let mut x169: u32 = 0; + let mut x170: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x169, &mut x170, x168, x121, x153); + let mut x171: u32 = 0; + let mut x172: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x171, &mut x172, x170, x123, x155); + let mut x173: u32 = 0; + let mut x174: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x173, &mut x174, x172, x125, x157); + let mut x175: u32 = 0; + let mut x176: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x175, &mut x176, x174, x127, x159); + let mut x177: u32 = 0; + let mut x178: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x177, &mut x178, x176, x129, x161); + let mut x179: u32 = 0; + let mut x180: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x179, &mut x180, x178, x131, x163); + let mut x181: u32 = 0; + let mut x182: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x181, &mut x182, x180, x133, x165); + let mut x183: u32 = 0; + let mut x184: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x183, &mut x184, x182, (((x134 as u32) + (x88 as u32)) + ((x118 as u32) + x90)), ((x166 as u32) + x138)); + let mut x185: u32 = 0; + let mut x186: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x185, &mut x186, x2, 0x9d671cd5); + let mut x187: u32 = 0; + let mut x188: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x187, &mut x188, x2, 0x81c69bc5); + let mut x189: u32 = 0; + let mut x190: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x189, &mut x190, x2, 0xe697f5e4); + let mut x191: u32 = 0; + let mut x192: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x191, &mut x192, x2, 0x5bcd07c6); + let mut x193: u32 = 0; + let mut x194: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x193, &mut x194, x2, 0x741496c2); + let mut x195: u32 = 0; + let mut x196: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x195, &mut x196, x2, 0xe7cf878); + let mut x197: u32 = 0; + let mut x198: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x197, &mut x198, x2, 0x896cf214); + let mut x199: u32 = 0; + let mut x200: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x199, &mut x200, x2, 0x67d7d140); + let mut x201: u32 = 0; + let mut x202: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x201, &mut x202, 0x0, x200, x197); + let mut x203: u32 = 0; + let mut x204: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x203, &mut x204, x202, x198, x195); + let mut x205: u32 = 0; + let mut x206: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x205, &mut x206, x204, x196, x193); + let mut x207: u32 = 0; + let mut x208: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x207, &mut x208, x206, x194, x191); + let mut x209: u32 = 0; + let mut x210: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x209, &mut x210, x208, x192, x189); + let mut x211: u32 = 0; + let mut x212: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x211, &mut x212, x210, x190, x187); + let mut x213: u32 = 0; + let mut x214: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x213, &mut x214, x212, x188, x185); + let mut x215: u32 = 0; + let mut x216: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x215, &mut x216, 0x0, x169, x199); + let mut x217: u32 = 0; + let mut x218: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x217, &mut x218, x216, x171, x201); + let mut x219: u32 = 0; + let mut x220: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x219, &mut x220, x218, x173, x203); + let mut x221: u32 = 0; + let mut x222: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x221, &mut x222, x220, x175, x205); + let mut x223: u32 = 0; + let mut x224: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x223, &mut x224, x222, x177, x207); + let mut x225: u32 = 0; + let mut x226: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x225, &mut x226, x224, x179, x209); + let mut x227: u32 = 0; + let mut x228: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x227, &mut x228, x226, x181, x211); + let mut x229: u32 = 0; + let mut x230: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x229, &mut x230, x228, x183, x213); + let mut x231: u32 = 0; + let mut x232: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x231, &mut x232, x215, 0x5588b13f); + let mut x233: u32 = 0; + let mut x234: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x233, &mut x234, x231, 0xffffffff); + let mut x235: u32 = 0; + let mut x236: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x235, &mut x236, x231, 0xffffffff); + let mut x237: u32 = 0; + let mut x238: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x237, &mut x238, x231, 0xffffffff); + let mut x239: u32 = 0; + let mut x240: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x239, &mut x240, x231, 0xfffffffe); + let mut x241: u32 = 0; + let mut x242: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x241, &mut x242, x231, 0xbaaedce6); + let mut x243: u32 = 0; + let mut x244: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x243, &mut x244, x231, 0xaf48a03b); + let mut x245: u32 = 0; + let mut x246: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x245, &mut x246, x231, 0xbfd25e8c); + let mut x247: u32 = 0; + let mut x248: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x247, &mut x248, x231, 0xd0364141); + let mut x249: u32 = 0; + let mut x250: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x249, &mut x250, 0x0, x248, x245); + let mut x251: u32 = 0; + let mut x252: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x251, &mut x252, x250, x246, x243); + let mut x253: u32 = 0; + let mut x254: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x253, &mut x254, x252, x244, x241); + let mut x255: u32 = 0; + let mut x256: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x255, &mut x256, x254, x242, x239); + let mut x257: u32 = 0; + let mut x258: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x257, &mut x258, x256, x240, x237); + let mut x259: u32 = 0; + let mut x260: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x259, &mut x260, x258, x238, x235); + let mut x261: u32 = 0; + let mut x262: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x261, &mut x262, x260, x236, x233); + let mut x263: u32 = 0; + let mut x264: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x263, &mut x264, 0x0, x215, x247); + let mut x265: u32 = 0; + let mut x266: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x265, &mut x266, x264, x217, x249); + let mut x267: u32 = 0; + let mut x268: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x267, &mut x268, x266, x219, x251); + let mut x269: u32 = 0; + let mut x270: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x269, &mut x270, x268, x221, x253); + let mut x271: u32 = 0; + let mut x272: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x271, &mut x272, x270, x223, x255); + let mut x273: u32 = 0; + let mut x274: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x273, &mut x274, x272, x225, x257); + let mut x275: u32 = 0; + let mut x276: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x275, &mut x276, x274, x227, x259); + let mut x277: u32 = 0; + let mut x278: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x277, &mut x278, x276, x229, x261); + let mut x279: u32 = 0; + let mut x280: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x279, &mut x280, x278, (((x230 as u32) + (x184 as u32)) + ((x214 as u32) + x186)), ((x262 as u32) + x234)); + let mut x281: u32 = 0; + let mut x282: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x281, &mut x282, x3, 0x9d671cd5); + let mut x283: u32 = 0; + let mut x284: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x283, &mut x284, x3, 0x81c69bc5); + let mut x285: u32 = 0; + let mut x286: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x285, &mut x286, x3, 0xe697f5e4); + let mut x287: u32 = 0; + let mut x288: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x287, &mut x288, x3, 0x5bcd07c6); + let mut x289: u32 = 0; + let mut x290: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x289, &mut x290, x3, 0x741496c2); + let mut x291: u32 = 0; + let mut x292: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x291, &mut x292, x3, 0xe7cf878); + let mut x293: u32 = 0; + let mut x294: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x293, &mut x294, x3, 0x896cf214); + let mut x295: u32 = 0; + let mut x296: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x295, &mut x296, x3, 0x67d7d140); + let mut x297: u32 = 0; + let mut x298: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x297, &mut x298, 0x0, x296, x293); + let mut x299: u32 = 0; + let mut x300: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x299, &mut x300, x298, x294, x291); + let mut x301: u32 = 0; + let mut x302: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x301, &mut x302, x300, x292, x289); + let mut x303: u32 = 0; + let mut x304: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x303, &mut x304, x302, x290, x287); + let mut x305: u32 = 0; + let mut x306: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x305, &mut x306, x304, x288, x285); + let mut x307: u32 = 0; + let mut x308: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x307, &mut x308, x306, x286, x283); + let mut x309: u32 = 0; + let mut x310: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x309, &mut x310, x308, x284, x281); + let mut x311: u32 = 0; + let mut x312: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x311, &mut x312, 0x0, x265, x295); + let mut x313: u32 = 0; + let mut x314: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x313, &mut x314, x312, x267, x297); + let mut x315: u32 = 0; + let mut x316: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x315, &mut x316, x314, x269, x299); + let mut x317: u32 = 0; + let mut x318: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x317, &mut x318, x316, x271, x301); + let mut x319: u32 = 0; + let mut x320: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x319, &mut x320, x318, x273, x303); + let mut x321: u32 = 0; + let mut x322: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x321, &mut x322, x320, x275, x305); + let mut x323: u32 = 0; + let mut x324: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x323, &mut x324, x322, x277, x307); + let mut x325: u32 = 0; + let mut x326: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x325, &mut x326, x324, x279, x309); + let mut x327: u32 = 0; + let mut x328: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x327, &mut x328, x311, 0x5588b13f); + let mut x329: u32 = 0; + let mut x330: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x329, &mut x330, x327, 0xffffffff); + let mut x331: u32 = 0; + let mut x332: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x331, &mut x332, x327, 0xffffffff); + let mut x333: u32 = 0; + let mut x334: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x333, &mut x334, x327, 0xffffffff); + let mut x335: u32 = 0; + let mut x336: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x335, &mut x336, x327, 0xfffffffe); + let mut x337: u32 = 0; + let mut x338: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x337, &mut x338, x327, 0xbaaedce6); + let mut x339: u32 = 0; + let mut x340: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x339, &mut x340, x327, 0xaf48a03b); + let mut x341: u32 = 0; + let mut x342: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x341, &mut x342, x327, 0xbfd25e8c); + let mut x343: u32 = 0; + let mut x344: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x343, &mut x344, x327, 0xd0364141); + let mut x345: u32 = 0; + let mut x346: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x345, &mut x346, 0x0, x344, x341); + let mut x347: u32 = 0; + let mut x348: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x347, &mut x348, x346, x342, x339); + let mut x349: u32 = 0; + let mut x350: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x349, &mut x350, x348, x340, x337); + let mut x351: u32 = 0; + let mut x352: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x351, &mut x352, x350, x338, x335); + let mut x353: u32 = 0; + let mut x354: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x353, &mut x354, x352, x336, x333); + let mut x355: u32 = 0; + let mut x356: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x355, &mut x356, x354, x334, x331); + let mut x357: u32 = 0; + let mut x358: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x357, &mut x358, x356, x332, x329); + let mut x359: u32 = 0; + let mut x360: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x359, &mut x360, 0x0, x311, x343); + let mut x361: u32 = 0; + let mut x362: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x361, &mut x362, x360, x313, x345); + let mut x363: u32 = 0; + let mut x364: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x363, &mut x364, x362, x315, x347); + let mut x365: u32 = 0; + let mut x366: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x365, &mut x366, x364, x317, x349); + let mut x367: u32 = 0; + let mut x368: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x367, &mut x368, x366, x319, x351); + let mut x369: u32 = 0; + let mut x370: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x369, &mut x370, x368, x321, x353); + let mut x371: u32 = 0; + let mut x372: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x371, &mut x372, x370, x323, x355); + let mut x373: u32 = 0; + let mut x374: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x373, &mut x374, x372, x325, x357); + let mut x375: u32 = 0; + let mut x376: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x375, &mut x376, x374, (((x326 as u32) + (x280 as u32)) + ((x310 as u32) + x282)), ((x358 as u32) + x330)); + let mut x377: u32 = 0; + let mut x378: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x377, &mut x378, x4, 0x9d671cd5); + let mut x379: u32 = 0; + let mut x380: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x379, &mut x380, x4, 0x81c69bc5); + let mut x381: u32 = 0; + let mut x382: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x381, &mut x382, x4, 0xe697f5e4); + let mut x383: u32 = 0; + let mut x384: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x383, &mut x384, x4, 0x5bcd07c6); + let mut x385: u32 = 0; + let mut x386: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x385, &mut x386, x4, 0x741496c2); + let mut x387: u32 = 0; + let mut x388: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x387, &mut x388, x4, 0xe7cf878); + let mut x389: u32 = 0; + let mut x390: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x389, &mut x390, x4, 0x896cf214); + let mut x391: u32 = 0; + let mut x392: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x391, &mut x392, x4, 0x67d7d140); + let mut x393: u32 = 0; + let mut x394: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x393, &mut x394, 0x0, x392, x389); + let mut x395: u32 = 0; + let mut x396: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x395, &mut x396, x394, x390, x387); + let mut x397: u32 = 0; + let mut x398: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x397, &mut x398, x396, x388, x385); + let mut x399: u32 = 0; + let mut x400: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x399, &mut x400, x398, x386, x383); + let mut x401: u32 = 0; + let mut x402: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x401, &mut x402, x400, x384, x381); + let mut x403: u32 = 0; + let mut x404: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x403, &mut x404, x402, x382, x379); + let mut x405: u32 = 0; + let mut x406: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x405, &mut x406, x404, x380, x377); + let mut x407: u32 = 0; + let mut x408: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x407, &mut x408, 0x0, x361, x391); + let mut x409: u32 = 0; + let mut x410: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x409, &mut x410, x408, x363, x393); + let mut x411: u32 = 0; + let mut x412: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x411, &mut x412, x410, x365, x395); + let mut x413: u32 = 0; + let mut x414: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x413, &mut x414, x412, x367, x397); + let mut x415: u32 = 0; + let mut x416: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x415, &mut x416, x414, x369, x399); + let mut x417: u32 = 0; + let mut x418: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x417, &mut x418, x416, x371, x401); + let mut x419: u32 = 0; + let mut x420: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x419, &mut x420, x418, x373, x403); + let mut x421: u32 = 0; + let mut x422: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x421, &mut x422, x420, x375, x405); + let mut x423: u32 = 0; + let mut x424: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x423, &mut x424, x407, 0x5588b13f); + let mut x425: u32 = 0; + let mut x426: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x425, &mut x426, x423, 0xffffffff); + let mut x427: u32 = 0; + let mut x428: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x427, &mut x428, x423, 0xffffffff); + let mut x429: u32 = 0; + let mut x430: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x429, &mut x430, x423, 0xffffffff); + let mut x431: u32 = 0; + let mut x432: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x431, &mut x432, x423, 0xfffffffe); + let mut x433: u32 = 0; + let mut x434: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x433, &mut x434, x423, 0xbaaedce6); + let mut x435: u32 = 0; + let mut x436: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x435, &mut x436, x423, 0xaf48a03b); + let mut x437: u32 = 0; + let mut x438: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x437, &mut x438, x423, 0xbfd25e8c); + let mut x439: u32 = 0; + let mut x440: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x439, &mut x440, x423, 0xd0364141); + let mut x441: u32 = 0; + let mut x442: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x441, &mut x442, 0x0, x440, x437); + let mut x443: u32 = 0; + let mut x444: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x443, &mut x444, x442, x438, x435); + let mut x445: u32 = 0; + let mut x446: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x445, &mut x446, x444, x436, x433); + let mut x447: u32 = 0; + let mut x448: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x447, &mut x448, x446, x434, x431); + let mut x449: u32 = 0; + let mut x450: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x449, &mut x450, x448, x432, x429); + let mut x451: u32 = 0; + let mut x452: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x451, &mut x452, x450, x430, x427); + let mut x453: u32 = 0; + let mut x454: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x453, &mut x454, x452, x428, x425); + let mut x455: u32 = 0; + let mut x456: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x455, &mut x456, 0x0, x407, x439); + let mut x457: u32 = 0; + let mut x458: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x457, &mut x458, x456, x409, x441); + let mut x459: u32 = 0; + let mut x460: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x459, &mut x460, x458, x411, x443); + let mut x461: u32 = 0; + let mut x462: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x461, &mut x462, x460, x413, x445); + let mut x463: u32 = 0; + let mut x464: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x463, &mut x464, x462, x415, x447); + let mut x465: u32 = 0; + let mut x466: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x465, &mut x466, x464, x417, x449); + let mut x467: u32 = 0; + let mut x468: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x467, &mut x468, x466, x419, x451); + let mut x469: u32 = 0; + let mut x470: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x469, &mut x470, x468, x421, x453); + let mut x471: u32 = 0; + let mut x472: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x471, &mut x472, x470, (((x422 as u32) + (x376 as u32)) + ((x406 as u32) + x378)), ((x454 as u32) + x426)); + let mut x473: u32 = 0; + let mut x474: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x473, &mut x474, x5, 0x9d671cd5); + let mut x475: u32 = 0; + let mut x476: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x475, &mut x476, x5, 0x81c69bc5); + let mut x477: u32 = 0; + let mut x478: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x477, &mut x478, x5, 0xe697f5e4); + let mut x479: u32 = 0; + let mut x480: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x479, &mut x480, x5, 0x5bcd07c6); + let mut x481: u32 = 0; + let mut x482: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x481, &mut x482, x5, 0x741496c2); + let mut x483: u32 = 0; + let mut x484: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x483, &mut x484, x5, 0xe7cf878); + let mut x485: u32 = 0; + let mut x486: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x485, &mut x486, x5, 0x896cf214); + let mut x487: u32 = 0; + let mut x488: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x487, &mut x488, x5, 0x67d7d140); + let mut x489: u32 = 0; + let mut x490: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x489, &mut x490, 0x0, x488, x485); + let mut x491: u32 = 0; + let mut x492: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x491, &mut x492, x490, x486, x483); + let mut x493: u32 = 0; + let mut x494: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x493, &mut x494, x492, x484, x481); + let mut x495: u32 = 0; + let mut x496: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x495, &mut x496, x494, x482, x479); + let mut x497: u32 = 0; + let mut x498: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x497, &mut x498, x496, x480, x477); + let mut x499: u32 = 0; + let mut x500: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x499, &mut x500, x498, x478, x475); + let mut x501: u32 = 0; + let mut x502: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x501, &mut x502, x500, x476, x473); + let mut x503: u32 = 0; + let mut x504: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x503, &mut x504, 0x0, x457, x487); + let mut x505: u32 = 0; + let mut x506: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x505, &mut x506, x504, x459, x489); + let mut x507: u32 = 0; + let mut x508: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x507, &mut x508, x506, x461, x491); + let mut x509: u32 = 0; + let mut x510: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x509, &mut x510, x508, x463, x493); + let mut x511: u32 = 0; + let mut x512: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x511, &mut x512, x510, x465, x495); + let mut x513: u32 = 0; + let mut x514: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x513, &mut x514, x512, x467, x497); + let mut x515: u32 = 0; + let mut x516: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x515, &mut x516, x514, x469, x499); + let mut x517: u32 = 0; + let mut x518: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x517, &mut x518, x516, x471, x501); + let mut x519: u32 = 0; + let mut x520: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x519, &mut x520, x503, 0x5588b13f); + let mut x521: u32 = 0; + let mut x522: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x521, &mut x522, x519, 0xffffffff); + let mut x523: u32 = 0; + let mut x524: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x523, &mut x524, x519, 0xffffffff); + let mut x525: u32 = 0; + let mut x526: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x525, &mut x526, x519, 0xffffffff); + let mut x527: u32 = 0; + let mut x528: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x527, &mut x528, x519, 0xfffffffe); + let mut x529: u32 = 0; + let mut x530: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x529, &mut x530, x519, 0xbaaedce6); + let mut x531: u32 = 0; + let mut x532: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x531, &mut x532, x519, 0xaf48a03b); + let mut x533: u32 = 0; + let mut x534: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x533, &mut x534, x519, 0xbfd25e8c); + let mut x535: u32 = 0; + let mut x536: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x535, &mut x536, x519, 0xd0364141); + let mut x537: u32 = 0; + let mut x538: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x537, &mut x538, 0x0, x536, x533); + let mut x539: u32 = 0; + let mut x540: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x539, &mut x540, x538, x534, x531); + let mut x541: u32 = 0; + let mut x542: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x541, &mut x542, x540, x532, x529); + let mut x543: u32 = 0; + let mut x544: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x543, &mut x544, x542, x530, x527); + let mut x545: u32 = 0; + let mut x546: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x545, &mut x546, x544, x528, x525); + let mut x547: u32 = 0; + let mut x548: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x547, &mut x548, x546, x526, x523); + let mut x549: u32 = 0; + let mut x550: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x549, &mut x550, x548, x524, x521); + let mut x551: u32 = 0; + let mut x552: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x551, &mut x552, 0x0, x503, x535); + let mut x553: u32 = 0; + let mut x554: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x553, &mut x554, x552, x505, x537); + let mut x555: u32 = 0; + let mut x556: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x555, &mut x556, x554, x507, x539); + let mut x557: u32 = 0; + let mut x558: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x557, &mut x558, x556, x509, x541); + let mut x559: u32 = 0; + let mut x560: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x559, &mut x560, x558, x511, x543); + let mut x561: u32 = 0; + let mut x562: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x561, &mut x562, x560, x513, x545); + let mut x563: u32 = 0; + let mut x564: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x563, &mut x564, x562, x515, x547); + let mut x565: u32 = 0; + let mut x566: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x565, &mut x566, x564, x517, x549); + let mut x567: u32 = 0; + let mut x568: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x567, &mut x568, x566, (((x518 as u32) + (x472 as u32)) + ((x502 as u32) + x474)), ((x550 as u32) + x522)); + let mut x569: u32 = 0; + let mut x570: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x569, &mut x570, x6, 0x9d671cd5); + let mut x571: u32 = 0; + let mut x572: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x571, &mut x572, x6, 0x81c69bc5); + let mut x573: u32 = 0; + let mut x574: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x573, &mut x574, x6, 0xe697f5e4); + let mut x575: u32 = 0; + let mut x576: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x575, &mut x576, x6, 0x5bcd07c6); + let mut x577: u32 = 0; + let mut x578: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x577, &mut x578, x6, 0x741496c2); + let mut x579: u32 = 0; + let mut x580: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x579, &mut x580, x6, 0xe7cf878); + let mut x581: u32 = 0; + let mut x582: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x581, &mut x582, x6, 0x896cf214); + let mut x583: u32 = 0; + let mut x584: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x583, &mut x584, x6, 0x67d7d140); + let mut x585: u32 = 0; + let mut x586: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x585, &mut x586, 0x0, x584, x581); + let mut x587: u32 = 0; + let mut x588: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x587, &mut x588, x586, x582, x579); + let mut x589: u32 = 0; + let mut x590: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x589, &mut x590, x588, x580, x577); + let mut x591: u32 = 0; + let mut x592: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x591, &mut x592, x590, x578, x575); + let mut x593: u32 = 0; + let mut x594: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x593, &mut x594, x592, x576, x573); + let mut x595: u32 = 0; + let mut x596: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x595, &mut x596, x594, x574, x571); + let mut x597: u32 = 0; + let mut x598: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x597, &mut x598, x596, x572, x569); + let mut x599: u32 = 0; + let mut x600: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x599, &mut x600, 0x0, x553, x583); + let mut x601: u32 = 0; + let mut x602: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x601, &mut x602, x600, x555, x585); + let mut x603: u32 = 0; + let mut x604: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x603, &mut x604, x602, x557, x587); + let mut x605: u32 = 0; + let mut x606: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x605, &mut x606, x604, x559, x589); + let mut x607: u32 = 0; + let mut x608: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x607, &mut x608, x606, x561, x591); + let mut x609: u32 = 0; + let mut x610: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x609, &mut x610, x608, x563, x593); + let mut x611: u32 = 0; + let mut x612: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x611, &mut x612, x610, x565, x595); + let mut x613: u32 = 0; + let mut x614: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x613, &mut x614, x612, x567, x597); + let mut x615: u32 = 0; + let mut x616: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x615, &mut x616, x599, 0x5588b13f); + let mut x617: u32 = 0; + let mut x618: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x617, &mut x618, x615, 0xffffffff); + let mut x619: u32 = 0; + let mut x620: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x619, &mut x620, x615, 0xffffffff); + let mut x621: u32 = 0; + let mut x622: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x621, &mut x622, x615, 0xffffffff); + let mut x623: u32 = 0; + let mut x624: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x623, &mut x624, x615, 0xfffffffe); + let mut x625: u32 = 0; + let mut x626: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x625, &mut x626, x615, 0xbaaedce6); + let mut x627: u32 = 0; + let mut x628: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x627, &mut x628, x615, 0xaf48a03b); + let mut x629: u32 = 0; + let mut x630: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x629, &mut x630, x615, 0xbfd25e8c); + let mut x631: u32 = 0; + let mut x632: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x631, &mut x632, x615, 0xd0364141); + let mut x633: u32 = 0; + let mut x634: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x633, &mut x634, 0x0, x632, x629); + let mut x635: u32 = 0; + let mut x636: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x635, &mut x636, x634, x630, x627); + let mut x637: u32 = 0; + let mut x638: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x637, &mut x638, x636, x628, x625); + let mut x639: u32 = 0; + let mut x640: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x639, &mut x640, x638, x626, x623); + let mut x641: u32 = 0; + let mut x642: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x641, &mut x642, x640, x624, x621); + let mut x643: u32 = 0; + let mut x644: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x643, &mut x644, x642, x622, x619); + let mut x645: u32 = 0; + let mut x646: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x645, &mut x646, x644, x620, x617); + let mut x647: u32 = 0; + let mut x648: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x647, &mut x648, 0x0, x599, x631); + let mut x649: u32 = 0; + let mut x650: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x649, &mut x650, x648, x601, x633); + let mut x651: u32 = 0; + let mut x652: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x651, &mut x652, x650, x603, x635); + let mut x653: u32 = 0; + let mut x654: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x653, &mut x654, x652, x605, x637); + let mut x655: u32 = 0; + let mut x656: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x655, &mut x656, x654, x607, x639); + let mut x657: u32 = 0; + let mut x658: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x657, &mut x658, x656, x609, x641); + let mut x659: u32 = 0; + let mut x660: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x659, &mut x660, x658, x611, x643); + let mut x661: u32 = 0; + let mut x662: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x661, &mut x662, x660, x613, x645); + let mut x663: u32 = 0; + let mut x664: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x663, &mut x664, x662, (((x614 as u32) + (x568 as u32)) + ((x598 as u32) + x570)), ((x646 as u32) + x618)); + let mut x665: u32 = 0; + let mut x666: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x665, &mut x666, x7, 0x9d671cd5); + let mut x667: u32 = 0; + let mut x668: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x667, &mut x668, x7, 0x81c69bc5); + let mut x669: u32 = 0; + let mut x670: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x669, &mut x670, x7, 0xe697f5e4); + let mut x671: u32 = 0; + let mut x672: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x671, &mut x672, x7, 0x5bcd07c6); + let mut x673: u32 = 0; + let mut x674: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x673, &mut x674, x7, 0x741496c2); + let mut x675: u32 = 0; + let mut x676: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x675, &mut x676, x7, 0xe7cf878); + let mut x677: u32 = 0; + let mut x678: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x677, &mut x678, x7, 0x896cf214); + let mut x679: u32 = 0; + let mut x680: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x679, &mut x680, x7, 0x67d7d140); + let mut x681: u32 = 0; + let mut x682: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x681, &mut x682, 0x0, x680, x677); + let mut x683: u32 = 0; + let mut x684: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x683, &mut x684, x682, x678, x675); + let mut x685: u32 = 0; + let mut x686: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x685, &mut x686, x684, x676, x673); + let mut x687: u32 = 0; + let mut x688: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x687, &mut x688, x686, x674, x671); + let mut x689: u32 = 0; + let mut x690: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x689, &mut x690, x688, x672, x669); + let mut x691: u32 = 0; + let mut x692: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x691, &mut x692, x690, x670, x667); + let mut x693: u32 = 0; + let mut x694: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x693, &mut x694, x692, x668, x665); + let mut x695: u32 = 0; + let mut x696: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x695, &mut x696, 0x0, x649, x679); + let mut x697: u32 = 0; + let mut x698: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x697, &mut x698, x696, x651, x681); + let mut x699: u32 = 0; + let mut x700: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x699, &mut x700, x698, x653, x683); + let mut x701: u32 = 0; + let mut x702: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x701, &mut x702, x700, x655, x685); + let mut x703: u32 = 0; + let mut x704: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x703, &mut x704, x702, x657, x687); + let mut x705: u32 = 0; + let mut x706: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x705, &mut x706, x704, x659, x689); + let mut x707: u32 = 0; + let mut x708: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x707, &mut x708, x706, x661, x691); + let mut x709: u32 = 0; + let mut x710: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x709, &mut x710, x708, x663, x693); + let mut x711: u32 = 0; + let mut x712: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x711, &mut x712, x695, 0x5588b13f); + let mut x713: u32 = 0; + let mut x714: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x713, &mut x714, x711, 0xffffffff); + let mut x715: u32 = 0; + let mut x716: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x715, &mut x716, x711, 0xffffffff); + let mut x717: u32 = 0; + let mut x718: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x717, &mut x718, x711, 0xffffffff); + let mut x719: u32 = 0; + let mut x720: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x719, &mut x720, x711, 0xfffffffe); + let mut x721: u32 = 0; + let mut x722: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x721, &mut x722, x711, 0xbaaedce6); + let mut x723: u32 = 0; + let mut x724: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x723, &mut x724, x711, 0xaf48a03b); + let mut x725: u32 = 0; + let mut x726: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x725, &mut x726, x711, 0xbfd25e8c); + let mut x727: u32 = 0; + let mut x728: u32 = 0; + fiat_secp256k1_scalar_mulx_u32(&mut x727, &mut x728, x711, 0xd0364141); + let mut x729: u32 = 0; + let mut x730: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x729, &mut x730, 0x0, x728, x725); + let mut x731: u32 = 0; + let mut x732: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x731, &mut x732, x730, x726, x723); + let mut x733: u32 = 0; + let mut x734: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x733, &mut x734, x732, x724, x721); + let mut x735: u32 = 0; + let mut x736: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x735, &mut x736, x734, x722, x719); + let mut x737: u32 = 0; + let mut x738: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x737, &mut x738, x736, x720, x717); + let mut x739: u32 = 0; + let mut x740: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x739, &mut x740, x738, x718, x715); + let mut x741: u32 = 0; + let mut x742: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x741, &mut x742, x740, x716, x713); + let mut x743: u32 = 0; + let mut x744: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x743, &mut x744, 0x0, x695, x727); + let mut x745: u32 = 0; + let mut x746: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x745, &mut x746, x744, x697, x729); + let mut x747: u32 = 0; + let mut x748: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x747, &mut x748, x746, x699, x731); + let mut x749: u32 = 0; + let mut x750: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x749, &mut x750, x748, x701, x733); + let mut x751: u32 = 0; + let mut x752: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x751, &mut x752, x750, x703, x735); + let mut x753: u32 = 0; + let mut x754: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x753, &mut x754, x752, x705, x737); + let mut x755: u32 = 0; + let mut x756: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x755, &mut x756, x754, x707, x739); + let mut x757: u32 = 0; + let mut x758: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x757, &mut x758, x756, x709, x741); + let mut x759: u32 = 0; + let mut x760: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x759, &mut x760, x758, (((x710 as u32) + (x664 as u32)) + ((x694 as u32) + x666)), ((x742 as u32) + x714)); + let mut x761: u32 = 0; + let mut x762: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x761, &mut x762, 0x0, x745, 0xd0364141); + let mut x763: u32 = 0; + let mut x764: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x763, &mut x764, x762, x747, 0xbfd25e8c); + let mut x765: u32 = 0; + let mut x766: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x765, &mut x766, x764, x749, 0xaf48a03b); + let mut x767: u32 = 0; + let mut x768: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x767, &mut x768, x766, x751, 0xbaaedce6); + let mut x769: u32 = 0; + let mut x770: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x769, &mut x770, x768, x753, 0xfffffffe); + let mut x771: u32 = 0; + let mut x772: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x771, &mut x772, x770, x755, 0xffffffff); + let mut x773: u32 = 0; + let mut x774: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x773, &mut x774, x772, x757, 0xffffffff); + let mut x775: u32 = 0; + let mut x776: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x775, &mut x776, x774, x759, 0xffffffff); + let mut x777: u32 = 0; + let mut x778: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x777, &mut x778, x776, (x760 as u32), (0x0 as u32)); + let mut x779: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x779, x778, x761, x745); + let mut x780: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x780, x778, x763, x747); + let mut x781: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x781, x778, x765, x749); + let mut x782: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x782, x778, x767, x751); + let mut x783: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x783, x778, x769, x753); + let mut x784: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x784, x778, x771, x755); + let mut x785: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x785, x778, x773, x757); + let mut x786: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x786, x778, x775, x759); + out1[0] = x779; + out1[1] = x780; + out1[2] = x781; + out1[3] = x782; + out1[4] = x783; + out1[5] = x784; + out1[6] = x785; + out1[7] = x786; +} + +/// The function fiat_secp256k1_scalar_nonzero outputs a single non-zero word if the input is non-zero and zero otherwise. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// out1 = 0 ↔ eval (from_montgomery arg1) mod m = 0 +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +#[inline] +pub fn fiat_secp256k1_scalar_nonzero(out1: &mut u32, arg1: &[u32; 8]) -> () { + let x1: u32 = ((arg1[0]) | ((arg1[1]) | ((arg1[2]) | ((arg1[3]) | ((arg1[4]) | ((arg1[5]) | ((arg1[6]) | (arg1[7])))))))); + *out1 = x1; +} + +/// The function fiat_secp256k1_scalar_selectznz is a multi-limb conditional select. +/// +/// Postconditions: +/// out1 = (if arg1 = 0 then arg2 else arg3) +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// arg3: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +#[inline] +pub fn fiat_secp256k1_scalar_selectznz(out1: &mut [u32; 8], arg1: fiat_secp256k1_scalar_u1, arg2: &[u32; 8], arg3: &[u32; 8]) -> () { + let mut x1: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x1, arg1, (arg2[0]), (arg3[0])); + let mut x2: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x2, arg1, (arg2[1]), (arg3[1])); + let mut x3: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x3, arg1, (arg2[2]), (arg3[2])); + let mut x4: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x4, arg1, (arg2[3]), (arg3[3])); + let mut x5: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x5, arg1, (arg2[4]), (arg3[4])); + let mut x6: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x6, arg1, (arg2[5]), (arg3[5])); + let mut x7: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x7, arg1, (arg2[6]), (arg3[6])); + let mut x8: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x8, arg1, (arg2[7]), (arg3[7])); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; + out1[3] = x4; + out1[4] = x5; + out1[5] = x6; + out1[6] = x7; + out1[7] = x8; +} + +/// The function fiat_secp256k1_scalar_to_bytes serializes a field element NOT in the Montgomery domain to bytes in little-endian order. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..31] +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] +#[inline] +pub fn fiat_secp256k1_scalar_to_bytes(out1: &mut [u8; 32], arg1: &[u32; 8]) -> () { + let x1: u32 = (arg1[7]); + let x2: u32 = (arg1[6]); + let x3: u32 = (arg1[5]); + let x4: u32 = (arg1[4]); + let x5: u32 = (arg1[3]); + let x6: u32 = (arg1[2]); + let x7: u32 = (arg1[1]); + let x8: u32 = (arg1[0]); + let x9: u8 = ((x8 & (0xff as u32)) as u8); + let x10: u32 = (x8 >> 8); + let x11: u8 = ((x10 & (0xff as u32)) as u8); + let x12: u32 = (x10 >> 8); + let x13: u8 = ((x12 & (0xff as u32)) as u8); + let x14: u8 = ((x12 >> 8) as u8); + let x15: u8 = ((x7 & (0xff as u32)) as u8); + let x16: u32 = (x7 >> 8); + let x17: u8 = ((x16 & (0xff as u32)) as u8); + let x18: u32 = (x16 >> 8); + let x19: u8 = ((x18 & (0xff as u32)) as u8); + let x20: u8 = ((x18 >> 8) as u8); + let x21: u8 = ((x6 & (0xff as u32)) as u8); + let x22: u32 = (x6 >> 8); + let x23: u8 = ((x22 & (0xff as u32)) as u8); + let x24: u32 = (x22 >> 8); + let x25: u8 = ((x24 & (0xff as u32)) as u8); + let x26: u8 = ((x24 >> 8) as u8); + let x27: u8 = ((x5 & (0xff as u32)) as u8); + let x28: u32 = (x5 >> 8); + let x29: u8 = ((x28 & (0xff as u32)) as u8); + let x30: u32 = (x28 >> 8); + let x31: u8 = ((x30 & (0xff as u32)) as u8); + let x32: u8 = ((x30 >> 8) as u8); + let x33: u8 = ((x4 & (0xff as u32)) as u8); + let x34: u32 = (x4 >> 8); + let x35: u8 = ((x34 & (0xff as u32)) as u8); + let x36: u32 = (x34 >> 8); + let x37: u8 = ((x36 & (0xff as u32)) as u8); + let x38: u8 = ((x36 >> 8) as u8); + let x39: u8 = ((x3 & (0xff as u32)) as u8); + let x40: u32 = (x3 >> 8); + let x41: u8 = ((x40 & (0xff as u32)) as u8); + let x42: u32 = (x40 >> 8); + let x43: u8 = ((x42 & (0xff as u32)) as u8); + let x44: u8 = ((x42 >> 8) as u8); + let x45: u8 = ((x2 & (0xff as u32)) as u8); + let x46: u32 = (x2 >> 8); + let x47: u8 = ((x46 & (0xff as u32)) as u8); + let x48: u32 = (x46 >> 8); + let x49: u8 = ((x48 & (0xff as u32)) as u8); + let x50: u8 = ((x48 >> 8) as u8); + let x51: u8 = ((x1 & (0xff as u32)) as u8); + let x52: u32 = (x1 >> 8); + let x53: u8 = ((x52 & (0xff as u32)) as u8); + let x54: u32 = (x52 >> 8); + let x55: u8 = ((x54 & (0xff as u32)) as u8); + let x56: u8 = ((x54 >> 8) as u8); + out1[0] = x9; + out1[1] = x11; + out1[2] = x13; + out1[3] = x14; + out1[4] = x15; + out1[5] = x17; + out1[6] = x19; + out1[7] = x20; + out1[8] = x21; + out1[9] = x23; + out1[10] = x25; + out1[11] = x26; + out1[12] = x27; + out1[13] = x29; + out1[14] = x31; + out1[15] = x32; + out1[16] = x33; + out1[17] = x35; + out1[18] = x37; + out1[19] = x38; + out1[20] = x39; + out1[21] = x41; + out1[22] = x43; + out1[23] = x44; + out1[24] = x45; + out1[25] = x47; + out1[26] = x49; + out1[27] = x50; + out1[28] = x51; + out1[29] = x53; + out1[30] = x55; + out1[31] = x56; +} + +/// The function fiat_secp256k1_scalar_from_bytes deserializes a field element NOT in the Montgomery domain from bytes in little-endian order. +/// +/// Preconditions: +/// 0 ≤ bytes_eval arg1 < m +/// Postconditions: +/// eval out1 mod m = bytes_eval arg1 mod m +/// 0 ≤ eval out1 < m +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +#[inline] +pub fn fiat_secp256k1_scalar_from_bytes(out1: &mut [u32; 8], arg1: &[u8; 32]) -> () { + let x1: u32 = (((arg1[31]) as u32) << 24); + let x2: u32 = (((arg1[30]) as u32) << 16); + let x3: u32 = (((arg1[29]) as u32) << 8); + let x4: u8 = (arg1[28]); + let x5: u32 = (((arg1[27]) as u32) << 24); + let x6: u32 = (((arg1[26]) as u32) << 16); + let x7: u32 = (((arg1[25]) as u32) << 8); + let x8: u8 = (arg1[24]); + let x9: u32 = (((arg1[23]) as u32) << 24); + let x10: u32 = (((arg1[22]) as u32) << 16); + let x11: u32 = (((arg1[21]) as u32) << 8); + let x12: u8 = (arg1[20]); + let x13: u32 = (((arg1[19]) as u32) << 24); + let x14: u32 = (((arg1[18]) as u32) << 16); + let x15: u32 = (((arg1[17]) as u32) << 8); + let x16: u8 = (arg1[16]); + let x17: u32 = (((arg1[15]) as u32) << 24); + let x18: u32 = (((arg1[14]) as u32) << 16); + let x19: u32 = (((arg1[13]) as u32) << 8); + let x20: u8 = (arg1[12]); + let x21: u32 = (((arg1[11]) as u32) << 24); + let x22: u32 = (((arg1[10]) as u32) << 16); + let x23: u32 = (((arg1[9]) as u32) << 8); + let x24: u8 = (arg1[8]); + let x25: u32 = (((arg1[7]) as u32) << 24); + let x26: u32 = (((arg1[6]) as u32) << 16); + let x27: u32 = (((arg1[5]) as u32) << 8); + let x28: u8 = (arg1[4]); + let x29: u32 = (((arg1[3]) as u32) << 24); + let x30: u32 = (((arg1[2]) as u32) << 16); + let x31: u32 = (((arg1[1]) as u32) << 8); + let x32: u8 = (arg1[0]); + let x33: u32 = (x31 + (x32 as u32)); + let x34: u32 = (x30 + x33); + let x35: u32 = (x29 + x34); + let x36: u32 = (x27 + (x28 as u32)); + let x37: u32 = (x26 + x36); + let x38: u32 = (x25 + x37); + let x39: u32 = (x23 + (x24 as u32)); + let x40: u32 = (x22 + x39); + let x41: u32 = (x21 + x40); + let x42: u32 = (x19 + (x20 as u32)); + let x43: u32 = (x18 + x42); + let x44: u32 = (x17 + x43); + let x45: u32 = (x15 + (x16 as u32)); + let x46: u32 = (x14 + x45); + let x47: u32 = (x13 + x46); + let x48: u32 = (x11 + (x12 as u32)); + let x49: u32 = (x10 + x48); + let x50: u32 = (x9 + x49); + let x51: u32 = (x7 + (x8 as u32)); + let x52: u32 = (x6 + x51); + let x53: u32 = (x5 + x52); + let x54: u32 = (x3 + (x4 as u32)); + let x55: u32 = (x2 + x54); + let x56: u32 = (x1 + x55); + out1[0] = x35; + out1[1] = x38; + out1[2] = x41; + out1[3] = x44; + out1[4] = x47; + out1[5] = x50; + out1[6] = x53; + out1[7] = x56; +} + +/// The function fiat_secp256k1_scalar_set_one returns the field element one in the Montgomery domain. +/// +/// Postconditions: +/// eval (from_montgomery out1) mod m = 1 mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_secp256k1_scalar_set_one(out1: &mut fiat_secp256k1_scalar_montgomery_domain_field_element) -> () { + out1[0] = 0x2fc9bebf; + out1[1] = 0x402da173; + out1[2] = 0x50b75fc4; + out1[3] = 0x45512319; + out1[4] = (0x1 as u32); + out1[5] = (0x0 as u32); + out1[6] = (0x0 as u32); + out1[7] = (0x0 as u32); +} + +/// The function fiat_secp256k1_scalar_msat returns the saturated representation of the prime modulus. +/// +/// Postconditions: +/// twos_complement_eval out1 = m +/// 0 ≤ eval out1 < m +/// +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +#[inline] +pub fn fiat_secp256k1_scalar_msat(out1: &mut [u32; 9]) -> () { + out1[0] = 0xd0364141; + out1[1] = 0xbfd25e8c; + out1[2] = 0xaf48a03b; + out1[3] = 0xbaaedce6; + out1[4] = 0xfffffffe; + out1[5] = 0xffffffff; + out1[6] = 0xffffffff; + out1[7] = 0xffffffff; + out1[8] = (0x0 as u32); +} + +/// The function fiat_secp256k1_scalar_divstep computes a divstep. +/// +/// Preconditions: +/// 0 ≤ eval arg4 < m +/// 0 ≤ eval arg5 < m +/// Postconditions: +/// out1 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then 1 - arg1 else 1 + arg1) +/// twos_complement_eval out2 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then twos_complement_eval arg3 else twos_complement_eval arg2) +/// twos_complement_eval out3 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then ⌊(twos_complement_eval arg3 - twos_complement_eval arg2) / 2⌋ else ⌊(twos_complement_eval arg3 + (twos_complement_eval arg3 mod 2) * twos_complement_eval arg2) / 2⌋) +/// eval (from_montgomery out4) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (2 * eval (from_montgomery arg5)) mod m else (2 * eval (from_montgomery arg4)) mod m) +/// eval (from_montgomery out5) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (eval (from_montgomery arg4) - eval (from_montgomery arg4)) mod m else (eval (from_montgomery arg5) + (twos_complement_eval arg3 mod 2) * eval (from_montgomery arg4)) mod m) +/// 0 ≤ eval out5 < m +/// 0 ≤ eval out5 < m +/// 0 ≤ eval out2 < m +/// 0 ≤ eval out3 < m +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0xffffffff] +/// arg2: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// arg3: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// arg4: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// arg5: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffff] +/// out2: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// out3: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// out4: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +/// out5: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +#[inline] +pub fn fiat_secp256k1_scalar_divstep(out1: &mut u32, out2: &mut [u32; 9], out3: &mut [u32; 9], out4: &mut [u32; 8], out5: &mut [u32; 8], arg1: u32, arg2: &[u32; 9], arg3: &[u32; 9], arg4: &[u32; 8], arg5: &[u32; 8]) -> () { + let mut x1: u32 = 0; + let mut x2: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x1, &mut x2, 0x0, (!arg1), (0x1 as u32)); + let x3: fiat_secp256k1_scalar_u1 = (((x1 >> 31) as fiat_secp256k1_scalar_u1) & (((arg3[0]) & (0x1 as u32)) as fiat_secp256k1_scalar_u1)); + let mut x4: u32 = 0; + let mut x5: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x4, &mut x5, 0x0, (!arg1), (0x1 as u32)); + let mut x6: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x6, x3, arg1, x4); + let mut x7: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x7, x3, (arg2[0]), (arg3[0])); + let mut x8: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x8, x3, (arg2[1]), (arg3[1])); + let mut x9: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x9, x3, (arg2[2]), (arg3[2])); + let mut x10: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x10, x3, (arg2[3]), (arg3[3])); + let mut x11: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x11, x3, (arg2[4]), (arg3[4])); + let mut x12: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x12, x3, (arg2[5]), (arg3[5])); + let mut x13: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x13, x3, (arg2[6]), (arg3[6])); + let mut x14: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x14, x3, (arg2[7]), (arg3[7])); + let mut x15: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x15, x3, (arg2[8]), (arg3[8])); + let mut x16: u32 = 0; + let mut x17: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x16, &mut x17, 0x0, (0x1 as u32), (!(arg2[0]))); + let mut x18: u32 = 0; + let mut x19: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x18, &mut x19, x17, (0x0 as u32), (!(arg2[1]))); + let mut x20: u32 = 0; + let mut x21: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x20, &mut x21, x19, (0x0 as u32), (!(arg2[2]))); + let mut x22: u32 = 0; + let mut x23: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x22, &mut x23, x21, (0x0 as u32), (!(arg2[3]))); + let mut x24: u32 = 0; + let mut x25: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x24, &mut x25, x23, (0x0 as u32), (!(arg2[4]))); + let mut x26: u32 = 0; + let mut x27: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x26, &mut x27, x25, (0x0 as u32), (!(arg2[5]))); + let mut x28: u32 = 0; + let mut x29: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x28, &mut x29, x27, (0x0 as u32), (!(arg2[6]))); + let mut x30: u32 = 0; + let mut x31: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x30, &mut x31, x29, (0x0 as u32), (!(arg2[7]))); + let mut x32: u32 = 0; + let mut x33: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x32, &mut x33, x31, (0x0 as u32), (!(arg2[8]))); + let mut x34: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x34, x3, (arg3[0]), x16); + let mut x35: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x35, x3, (arg3[1]), x18); + let mut x36: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x36, x3, (arg3[2]), x20); + let mut x37: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x37, x3, (arg3[3]), x22); + let mut x38: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x38, x3, (arg3[4]), x24); + let mut x39: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x39, x3, (arg3[5]), x26); + let mut x40: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x40, x3, (arg3[6]), x28); + let mut x41: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x41, x3, (arg3[7]), x30); + let mut x42: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x42, x3, (arg3[8]), x32); + let mut x43: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x43, x3, (arg4[0]), (arg5[0])); + let mut x44: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x44, x3, (arg4[1]), (arg5[1])); + let mut x45: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x45, x3, (arg4[2]), (arg5[2])); + let mut x46: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x46, x3, (arg4[3]), (arg5[3])); + let mut x47: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x47, x3, (arg4[4]), (arg5[4])); + let mut x48: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x48, x3, (arg4[5]), (arg5[5])); + let mut x49: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x49, x3, (arg4[6]), (arg5[6])); + let mut x50: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x50, x3, (arg4[7]), (arg5[7])); + let mut x51: u32 = 0; + let mut x52: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x51, &mut x52, 0x0, x43, x43); + let mut x53: u32 = 0; + let mut x54: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x53, &mut x54, x52, x44, x44); + let mut x55: u32 = 0; + let mut x56: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x55, &mut x56, x54, x45, x45); + let mut x57: u32 = 0; + let mut x58: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x57, &mut x58, x56, x46, x46); + let mut x59: u32 = 0; + let mut x60: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x59, &mut x60, x58, x47, x47); + let mut x61: u32 = 0; + let mut x62: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x61, &mut x62, x60, x48, x48); + let mut x63: u32 = 0; + let mut x64: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x63, &mut x64, x62, x49, x49); + let mut x65: u32 = 0; + let mut x66: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x65, &mut x66, x64, x50, x50); + let mut x67: u32 = 0; + let mut x68: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x67, &mut x68, 0x0, x51, 0xd0364141); + let mut x69: u32 = 0; + let mut x70: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x69, &mut x70, x68, x53, 0xbfd25e8c); + let mut x71: u32 = 0; + let mut x72: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x71, &mut x72, x70, x55, 0xaf48a03b); + let mut x73: u32 = 0; + let mut x74: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x73, &mut x74, x72, x57, 0xbaaedce6); + let mut x75: u32 = 0; + let mut x76: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x75, &mut x76, x74, x59, 0xfffffffe); + let mut x77: u32 = 0; + let mut x78: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x77, &mut x78, x76, x61, 0xffffffff); + let mut x79: u32 = 0; + let mut x80: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x79, &mut x80, x78, x63, 0xffffffff); + let mut x81: u32 = 0; + let mut x82: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x81, &mut x82, x80, x65, 0xffffffff); + let mut x83: u32 = 0; + let mut x84: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x83, &mut x84, x82, (x66 as u32), (0x0 as u32)); + let x85: u32 = (arg4[7]); + let x86: u32 = (arg4[6]); + let x87: u32 = (arg4[5]); + let x88: u32 = (arg4[4]); + let x89: u32 = (arg4[3]); + let x90: u32 = (arg4[2]); + let x91: u32 = (arg4[1]); + let x92: u32 = (arg4[0]); + let mut x93: u32 = 0; + let mut x94: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x93, &mut x94, 0x0, (0x0 as u32), x92); + let mut x95: u32 = 0; + let mut x96: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x95, &mut x96, x94, (0x0 as u32), x91); + let mut x97: u32 = 0; + let mut x98: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x97, &mut x98, x96, (0x0 as u32), x90); + let mut x99: u32 = 0; + let mut x100: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x99, &mut x100, x98, (0x0 as u32), x89); + let mut x101: u32 = 0; + let mut x102: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x101, &mut x102, x100, (0x0 as u32), x88); + let mut x103: u32 = 0; + let mut x104: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x103, &mut x104, x102, (0x0 as u32), x87); + let mut x105: u32 = 0; + let mut x106: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x105, &mut x106, x104, (0x0 as u32), x86); + let mut x107: u32 = 0; + let mut x108: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x107, &mut x108, x106, (0x0 as u32), x85); + let mut x109: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x109, x108, (0x0 as u32), 0xffffffff); + let mut x110: u32 = 0; + let mut x111: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x110, &mut x111, 0x0, x93, (x109 & 0xd0364141)); + let mut x112: u32 = 0; + let mut x113: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x112, &mut x113, x111, x95, (x109 & 0xbfd25e8c)); + let mut x114: u32 = 0; + let mut x115: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x114, &mut x115, x113, x97, (x109 & 0xaf48a03b)); + let mut x116: u32 = 0; + let mut x117: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x116, &mut x117, x115, x99, (x109 & 0xbaaedce6)); + let mut x118: u32 = 0; + let mut x119: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x118, &mut x119, x117, x101, (x109 & 0xfffffffe)); + let mut x120: u32 = 0; + let mut x121: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x120, &mut x121, x119, x103, x109); + let mut x122: u32 = 0; + let mut x123: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x122, &mut x123, x121, x105, x109); + let mut x124: u32 = 0; + let mut x125: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x124, &mut x125, x123, x107, x109); + let mut x126: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x126, x3, (arg5[0]), x110); + let mut x127: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x127, x3, (arg5[1]), x112); + let mut x128: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x128, x3, (arg5[2]), x114); + let mut x129: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x129, x3, (arg5[3]), x116); + let mut x130: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x130, x3, (arg5[4]), x118); + let mut x131: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x131, x3, (arg5[5]), x120); + let mut x132: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x132, x3, (arg5[6]), x122); + let mut x133: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x133, x3, (arg5[7]), x124); + let x134: fiat_secp256k1_scalar_u1 = ((x34 & (0x1 as u32)) as fiat_secp256k1_scalar_u1); + let mut x135: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x135, x134, (0x0 as u32), x7); + let mut x136: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x136, x134, (0x0 as u32), x8); + let mut x137: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x137, x134, (0x0 as u32), x9); + let mut x138: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x138, x134, (0x0 as u32), x10); + let mut x139: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x139, x134, (0x0 as u32), x11); + let mut x140: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x140, x134, (0x0 as u32), x12); + let mut x141: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x141, x134, (0x0 as u32), x13); + let mut x142: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x142, x134, (0x0 as u32), x14); + let mut x143: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x143, x134, (0x0 as u32), x15); + let mut x144: u32 = 0; + let mut x145: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x144, &mut x145, 0x0, x34, x135); + let mut x146: u32 = 0; + let mut x147: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x146, &mut x147, x145, x35, x136); + let mut x148: u32 = 0; + let mut x149: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x148, &mut x149, x147, x36, x137); + let mut x150: u32 = 0; + let mut x151: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x150, &mut x151, x149, x37, x138); + let mut x152: u32 = 0; + let mut x153: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x152, &mut x153, x151, x38, x139); + let mut x154: u32 = 0; + let mut x155: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x154, &mut x155, x153, x39, x140); + let mut x156: u32 = 0; + let mut x157: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x156, &mut x157, x155, x40, x141); + let mut x158: u32 = 0; + let mut x159: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x158, &mut x159, x157, x41, x142); + let mut x160: u32 = 0; + let mut x161: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x160, &mut x161, x159, x42, x143); + let mut x162: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x162, x134, (0x0 as u32), x43); + let mut x163: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x163, x134, (0x0 as u32), x44); + let mut x164: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x164, x134, (0x0 as u32), x45); + let mut x165: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x165, x134, (0x0 as u32), x46); + let mut x166: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x166, x134, (0x0 as u32), x47); + let mut x167: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x167, x134, (0x0 as u32), x48); + let mut x168: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x168, x134, (0x0 as u32), x49); + let mut x169: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x169, x134, (0x0 as u32), x50); + let mut x170: u32 = 0; + let mut x171: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x170, &mut x171, 0x0, x126, x162); + let mut x172: u32 = 0; + let mut x173: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x172, &mut x173, x171, x127, x163); + let mut x174: u32 = 0; + let mut x175: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x174, &mut x175, x173, x128, x164); + let mut x176: u32 = 0; + let mut x177: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x176, &mut x177, x175, x129, x165); + let mut x178: u32 = 0; + let mut x179: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x178, &mut x179, x177, x130, x166); + let mut x180: u32 = 0; + let mut x181: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x180, &mut x181, x179, x131, x167); + let mut x182: u32 = 0; + let mut x183: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x182, &mut x183, x181, x132, x168); + let mut x184: u32 = 0; + let mut x185: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x184, &mut x185, x183, x133, x169); + let mut x186: u32 = 0; + let mut x187: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x186, &mut x187, 0x0, x170, 0xd0364141); + let mut x188: u32 = 0; + let mut x189: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x188, &mut x189, x187, x172, 0xbfd25e8c); + let mut x190: u32 = 0; + let mut x191: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x190, &mut x191, x189, x174, 0xaf48a03b); + let mut x192: u32 = 0; + let mut x193: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x192, &mut x193, x191, x176, 0xbaaedce6); + let mut x194: u32 = 0; + let mut x195: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x194, &mut x195, x193, x178, 0xfffffffe); + let mut x196: u32 = 0; + let mut x197: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x196, &mut x197, x195, x180, 0xffffffff); + let mut x198: u32 = 0; + let mut x199: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x198, &mut x199, x197, x182, 0xffffffff); + let mut x200: u32 = 0; + let mut x201: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x200, &mut x201, x199, x184, 0xffffffff); + let mut x202: u32 = 0; + let mut x203: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u32(&mut x202, &mut x203, x201, (x185 as u32), (0x0 as u32)); + let mut x204: u32 = 0; + let mut x205: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u32(&mut x204, &mut x205, 0x0, x6, (0x1 as u32)); + let x206: u32 = ((x144 >> 1) | ((x146 << 31) & 0xffffffff)); + let x207: u32 = ((x146 >> 1) | ((x148 << 31) & 0xffffffff)); + let x208: u32 = ((x148 >> 1) | ((x150 << 31) & 0xffffffff)); + let x209: u32 = ((x150 >> 1) | ((x152 << 31) & 0xffffffff)); + let x210: u32 = ((x152 >> 1) | ((x154 << 31) & 0xffffffff)); + let x211: u32 = ((x154 >> 1) | ((x156 << 31) & 0xffffffff)); + let x212: u32 = ((x156 >> 1) | ((x158 << 31) & 0xffffffff)); + let x213: u32 = ((x158 >> 1) | ((x160 << 31) & 0xffffffff)); + let x214: u32 = ((x160 & 0x80000000) | (x160 >> 1)); + let mut x215: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x215, x84, x67, x51); + let mut x216: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x216, x84, x69, x53); + let mut x217: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x217, x84, x71, x55); + let mut x218: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x218, x84, x73, x57); + let mut x219: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x219, x84, x75, x59); + let mut x220: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x220, x84, x77, x61); + let mut x221: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x221, x84, x79, x63); + let mut x222: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x222, x84, x81, x65); + let mut x223: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x223, x203, x186, x170); + let mut x224: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x224, x203, x188, x172); + let mut x225: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x225, x203, x190, x174); + let mut x226: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x226, x203, x192, x176); + let mut x227: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x227, x203, x194, x178); + let mut x228: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x228, x203, x196, x180); + let mut x229: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x229, x203, x198, x182); + let mut x230: u32 = 0; + fiat_secp256k1_scalar_cmovznz_u32(&mut x230, x203, x200, x184); + *out1 = x204; + out2[0] = x7; + out2[1] = x8; + out2[2] = x9; + out2[3] = x10; + out2[4] = x11; + out2[5] = x12; + out2[6] = x13; + out2[7] = x14; + out2[8] = x15; + out3[0] = x206; + out3[1] = x207; + out3[2] = x208; + out3[3] = x209; + out3[4] = x210; + out3[5] = x211; + out3[6] = x212; + out3[7] = x213; + out3[8] = x214; + out4[0] = x215; + out4[1] = x216; + out4[2] = x217; + out4[3] = x218; + out4[4] = x219; + out4[5] = x220; + out4[6] = x221; + out4[7] = x222; + out5[0] = x223; + out5[1] = x224; + out5[2] = x225; + out5[3] = x226; + out5[4] = x227; + out5[5] = x228; + out5[6] = x229; + out5[7] = x230; +} + +/// The function fiat_secp256k1_scalar_divstep_precomp returns the precomputed value for Bernstein-Yang-inversion (in montgomery form). +/// +/// Postconditions: +/// eval (from_montgomery out1) = ⌊(m - 1) / 2⌋^(if ⌊log2 m⌋ + 1 < 46 then ⌊(49 * (⌊log2 m⌋ + 1) + 80) / 17⌋ else ⌊(49 * (⌊log2 m⌋ + 1) + 57) / 17⌋) +/// 0 ≤ eval out1 < m +/// +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff], [0x0 ~> 0xffffffff]] +#[inline] +pub fn fiat_secp256k1_scalar_divstep_precomp(out1: &mut [u32; 8]) -> () { + out1[0] = 0x2b9cb4e9; + out1[1] = 0xd7431a4d; + out1[2] = 0x32d9c503; + out1[3] = 0xab67d35a; + out1[4] = 0x859ce35f; + out1[5] = 0xadf6c7e5; + out1[6] = 0x1df6c379; + out1[7] = 0x61544145; +} diff --git a/vendor/fiat-crypto/src/secp256k1_scalar_64.rs b/vendor/fiat-crypto/src/secp256k1_scalar_64.rs new file mode 100644 index 000000000..5778e6d41 --- /dev/null +++ b/vendor/fiat-crypto/src/secp256k1_scalar_64.rs @@ -0,0 +1,2017 @@ +//! Autogenerated: 'src/ExtractionOCaml/word_by_word_montgomery' --lang Rust --inline secp256k1_scalar 64 '2^256 - 432420386565659656852420866394968145599' mul square add sub opp from_montgomery to_montgomery nonzero selectznz to_bytes from_bytes one msat divstep divstep_precomp +//! curve description: secp256k1_scalar +//! machine_wordsize = 64 (from "64") +//! requested operations: mul, square, add, sub, opp, from_montgomery, to_montgomery, nonzero, selectznz, to_bytes, from_bytes, one, msat, divstep, divstep_precomp +//! m = 0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141 (from "2^256 - 432420386565659656852420866394968145599") +//! +//! NOTE: In addition to the bounds specified above each function, all +//! functions synthesized for this Montgomery arithmetic require the +//! input to be strictly less than the prime modulus (m), and also +//! require the input to be in the unique saturated representation. +//! All functions also ensure that these two properties are true of +//! return values. +//! +//! Computed values: +//! eval z = z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) +//! bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248) +//! twos_complement_eval z = let x1 := z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) in +//! if x1 & (2^256-1) < 2^255 then x1 & (2^256-1) else (x1 & (2^256-1)) - 2^256 + +#![allow(unused_parens)] +#![allow(non_camel_case_types)] + +pub type fiat_secp256k1_scalar_u1 = u8; +pub type fiat_secp256k1_scalar_i1 = i8; +pub type fiat_secp256k1_scalar_u2 = u8; +pub type fiat_secp256k1_scalar_i2 = i8; + +/* The type fiat_secp256k1_scalar_montgomery_domain_field_element is a field element in the Montgomery domain. */ +/* Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] */ +pub type fiat_secp256k1_scalar_montgomery_domain_field_element = [u64; 4]; + +/* The type fiat_secp256k1_scalar_non_montgomery_domain_field_element is a field element NOT in the Montgomery domain. */ +/* Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] */ +pub type fiat_secp256k1_scalar_non_montgomery_domain_field_element = [u64; 4]; + + +/// The function fiat_secp256k1_scalar_addcarryx_u64 is an addition with carry. +/// +/// Postconditions: +/// out1 = (arg1 + arg2 + arg3) mod 2^64 +/// out2 = ⌊(arg1 + arg2 + arg3) / 2^64⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffffffffffff] +/// arg3: [0x0 ~> 0xffffffffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_secp256k1_scalar_addcarryx_u64(out1: &mut u64, out2: &mut fiat_secp256k1_scalar_u1, arg1: fiat_secp256k1_scalar_u1, arg2: u64, arg3: u64) -> () { + let x1: u128 = (((arg1 as u128) + (arg2 as u128)) + (arg3 as u128)); + let x2: u64 = ((x1 & (0xffffffffffffffff as u128)) as u64); + let x3: fiat_secp256k1_scalar_u1 = ((x1 >> 64) as fiat_secp256k1_scalar_u1); + *out1 = x2; + *out2 = x3; +} + +/// The function fiat_secp256k1_scalar_subborrowx_u64 is a subtraction with borrow. +/// +/// Postconditions: +/// out1 = (-arg1 + arg2 + -arg3) mod 2^64 +/// out2 = -⌊(-arg1 + arg2 + -arg3) / 2^64⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffffffffffff] +/// arg3: [0x0 ~> 0xffffffffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +/// out2: [0x0 ~> 0x1] +#[inline] +pub fn fiat_secp256k1_scalar_subborrowx_u64(out1: &mut u64, out2: &mut fiat_secp256k1_scalar_u1, arg1: fiat_secp256k1_scalar_u1, arg2: u64, arg3: u64) -> () { + let x1: i128 = (((arg2 as i128) - (arg1 as i128)) - (arg3 as i128)); + let x2: fiat_secp256k1_scalar_i1 = ((x1 >> 64) as fiat_secp256k1_scalar_i1); + let x3: u64 = ((x1 & (0xffffffffffffffff as i128)) as u64); + *out1 = x3; + *out2 = (((0x0 as fiat_secp256k1_scalar_i2) - (x2 as fiat_secp256k1_scalar_i2)) as fiat_secp256k1_scalar_u1); +} + +/// The function fiat_secp256k1_scalar_mulx_u64 is a multiplication, returning the full double-width result. +/// +/// Postconditions: +/// out1 = (arg1 * arg2) mod 2^64 +/// out2 = ⌊arg1 * arg2 / 2^64⌋ +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0xffffffffffffffff] +/// arg2: [0x0 ~> 0xffffffffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +/// out2: [0x0 ~> 0xffffffffffffffff] +#[inline] +pub fn fiat_secp256k1_scalar_mulx_u64(out1: &mut u64, out2: &mut u64, arg1: u64, arg2: u64) -> () { + let x1: u128 = ((arg1 as u128) * (arg2 as u128)); + let x2: u64 = ((x1 & (0xffffffffffffffff as u128)) as u64); + let x3: u64 = ((x1 >> 64) as u64); + *out1 = x2; + *out2 = x3; +} + +/// The function fiat_secp256k1_scalar_cmovznz_u64 is a single-word conditional move. +/// +/// Postconditions: +/// out1 = (if arg1 = 0 then arg2 else arg3) +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [0x0 ~> 0xffffffffffffffff] +/// arg3: [0x0 ~> 0xffffffffffffffff] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +#[inline] +pub fn fiat_secp256k1_scalar_cmovznz_u64(out1: &mut u64, arg1: fiat_secp256k1_scalar_u1, arg2: u64, arg3: u64) -> () { + let x1: fiat_secp256k1_scalar_u1 = (!(!arg1)); + let x2: u64 = ((((((0x0 as fiat_secp256k1_scalar_i2) - (x1 as fiat_secp256k1_scalar_i2)) as fiat_secp256k1_scalar_i1) as i128) & (0xffffffffffffffff as i128)) as u64); + let x3: u64 = ((x2 & arg3) | ((!x2) & arg2)); + *out1 = x3; +} + +/// The function fiat_secp256k1_scalar_mul multiplies two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_secp256k1_scalar_mul(out1: &mut fiat_secp256k1_scalar_montgomery_domain_field_element, arg1: &fiat_secp256k1_scalar_montgomery_domain_field_element, arg2: &fiat_secp256k1_scalar_montgomery_domain_field_element) -> () { + let x1: u64 = (arg1[1]); + let x2: u64 = (arg1[2]); + let x3: u64 = (arg1[3]); + let x4: u64 = (arg1[0]); + let mut x5: u64 = 0; + let mut x6: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x5, &mut x6, x4, (arg2[3])); + let mut x7: u64 = 0; + let mut x8: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x7, &mut x8, x4, (arg2[2])); + let mut x9: u64 = 0; + let mut x10: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x9, &mut x10, x4, (arg2[1])); + let mut x11: u64 = 0; + let mut x12: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x11, &mut x12, x4, (arg2[0])); + let mut x13: u64 = 0; + let mut x14: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x13, &mut x14, 0x0, x12, x9); + let mut x15: u64 = 0; + let mut x16: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x15, &mut x16, x14, x10, x7); + let mut x17: u64 = 0; + let mut x18: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x17, &mut x18, x16, x8, x5); + let x19: u64 = ((x18 as u64) + x6); + let mut x20: u64 = 0; + let mut x21: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x20, &mut x21, x11, 0x4b0dff665588b13f); + let mut x22: u64 = 0; + let mut x23: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x22, &mut x23, x20, 0xffffffffffffffff); + let mut x24: u64 = 0; + let mut x25: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x24, &mut x25, x20, 0xfffffffffffffffe); + let mut x26: u64 = 0; + let mut x27: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x26, &mut x27, x20, 0xbaaedce6af48a03b); + let mut x28: u64 = 0; + let mut x29: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x28, &mut x29, x20, 0xbfd25e8cd0364141); + let mut x30: u64 = 0; + let mut x31: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x30, &mut x31, 0x0, x29, x26); + let mut x32: u64 = 0; + let mut x33: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x32, &mut x33, x31, x27, x24); + let mut x34: u64 = 0; + let mut x35: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x34, &mut x35, x33, x25, x22); + let x36: u64 = ((x35 as u64) + x23); + let mut x37: u64 = 0; + let mut x38: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x37, &mut x38, 0x0, x11, x28); + let mut x39: u64 = 0; + let mut x40: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x39, &mut x40, x38, x13, x30); + let mut x41: u64 = 0; + let mut x42: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x41, &mut x42, x40, x15, x32); + let mut x43: u64 = 0; + let mut x44: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x43, &mut x44, x42, x17, x34); + let mut x45: u64 = 0; + let mut x46: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x45, &mut x46, x44, x19, x36); + let mut x47: u64 = 0; + let mut x48: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x47, &mut x48, x1, (arg2[3])); + let mut x49: u64 = 0; + let mut x50: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x49, &mut x50, x1, (arg2[2])); + let mut x51: u64 = 0; + let mut x52: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x51, &mut x52, x1, (arg2[1])); + let mut x53: u64 = 0; + let mut x54: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x53, &mut x54, x1, (arg2[0])); + let mut x55: u64 = 0; + let mut x56: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x55, &mut x56, 0x0, x54, x51); + let mut x57: u64 = 0; + let mut x58: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x57, &mut x58, x56, x52, x49); + let mut x59: u64 = 0; + let mut x60: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x59, &mut x60, x58, x50, x47); + let x61: u64 = ((x60 as u64) + x48); + let mut x62: u64 = 0; + let mut x63: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x62, &mut x63, 0x0, x39, x53); + let mut x64: u64 = 0; + let mut x65: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x64, &mut x65, x63, x41, x55); + let mut x66: u64 = 0; + let mut x67: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x66, &mut x67, x65, x43, x57); + let mut x68: u64 = 0; + let mut x69: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x68, &mut x69, x67, x45, x59); + let mut x70: u64 = 0; + let mut x71: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x70, &mut x71, x69, (x46 as u64), x61); + let mut x72: u64 = 0; + let mut x73: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x72, &mut x73, x62, 0x4b0dff665588b13f); + let mut x74: u64 = 0; + let mut x75: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x74, &mut x75, x72, 0xffffffffffffffff); + let mut x76: u64 = 0; + let mut x77: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x76, &mut x77, x72, 0xfffffffffffffffe); + let mut x78: u64 = 0; + let mut x79: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x78, &mut x79, x72, 0xbaaedce6af48a03b); + let mut x80: u64 = 0; + let mut x81: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x80, &mut x81, x72, 0xbfd25e8cd0364141); + let mut x82: u64 = 0; + let mut x83: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x82, &mut x83, 0x0, x81, x78); + let mut x84: u64 = 0; + let mut x85: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x84, &mut x85, x83, x79, x76); + let mut x86: u64 = 0; + let mut x87: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x86, &mut x87, x85, x77, x74); + let x88: u64 = ((x87 as u64) + x75); + let mut x89: u64 = 0; + let mut x90: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x89, &mut x90, 0x0, x62, x80); + let mut x91: u64 = 0; + let mut x92: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x91, &mut x92, x90, x64, x82); + let mut x93: u64 = 0; + let mut x94: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x93, &mut x94, x92, x66, x84); + let mut x95: u64 = 0; + let mut x96: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x95, &mut x96, x94, x68, x86); + let mut x97: u64 = 0; + let mut x98: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x97, &mut x98, x96, x70, x88); + let x99: u64 = ((x98 as u64) + (x71 as u64)); + let mut x100: u64 = 0; + let mut x101: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x100, &mut x101, x2, (arg2[3])); + let mut x102: u64 = 0; + let mut x103: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x102, &mut x103, x2, (arg2[2])); + let mut x104: u64 = 0; + let mut x105: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x104, &mut x105, x2, (arg2[1])); + let mut x106: u64 = 0; + let mut x107: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x106, &mut x107, x2, (arg2[0])); + let mut x108: u64 = 0; + let mut x109: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x108, &mut x109, 0x0, x107, x104); + let mut x110: u64 = 0; + let mut x111: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x110, &mut x111, x109, x105, x102); + let mut x112: u64 = 0; + let mut x113: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x112, &mut x113, x111, x103, x100); + let x114: u64 = ((x113 as u64) + x101); + let mut x115: u64 = 0; + let mut x116: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x115, &mut x116, 0x0, x91, x106); + let mut x117: u64 = 0; + let mut x118: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x117, &mut x118, x116, x93, x108); + let mut x119: u64 = 0; + let mut x120: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x119, &mut x120, x118, x95, x110); + let mut x121: u64 = 0; + let mut x122: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x121, &mut x122, x120, x97, x112); + let mut x123: u64 = 0; + let mut x124: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x123, &mut x124, x122, x99, x114); + let mut x125: u64 = 0; + let mut x126: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x125, &mut x126, x115, 0x4b0dff665588b13f); + let mut x127: u64 = 0; + let mut x128: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x127, &mut x128, x125, 0xffffffffffffffff); + let mut x129: u64 = 0; + let mut x130: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x129, &mut x130, x125, 0xfffffffffffffffe); + let mut x131: u64 = 0; + let mut x132: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x131, &mut x132, x125, 0xbaaedce6af48a03b); + let mut x133: u64 = 0; + let mut x134: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x133, &mut x134, x125, 0xbfd25e8cd0364141); + let mut x135: u64 = 0; + let mut x136: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x135, &mut x136, 0x0, x134, x131); + let mut x137: u64 = 0; + let mut x138: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x137, &mut x138, x136, x132, x129); + let mut x139: u64 = 0; + let mut x140: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x139, &mut x140, x138, x130, x127); + let x141: u64 = ((x140 as u64) + x128); + let mut x142: u64 = 0; + let mut x143: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x142, &mut x143, 0x0, x115, x133); + let mut x144: u64 = 0; + let mut x145: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x144, &mut x145, x143, x117, x135); + let mut x146: u64 = 0; + let mut x147: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x146, &mut x147, x145, x119, x137); + let mut x148: u64 = 0; + let mut x149: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x148, &mut x149, x147, x121, x139); + let mut x150: u64 = 0; + let mut x151: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x150, &mut x151, x149, x123, x141); + let x152: u64 = ((x151 as u64) + (x124 as u64)); + let mut x153: u64 = 0; + let mut x154: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x153, &mut x154, x3, (arg2[3])); + let mut x155: u64 = 0; + let mut x156: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x155, &mut x156, x3, (arg2[2])); + let mut x157: u64 = 0; + let mut x158: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x157, &mut x158, x3, (arg2[1])); + let mut x159: u64 = 0; + let mut x160: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x159, &mut x160, x3, (arg2[0])); + let mut x161: u64 = 0; + let mut x162: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x161, &mut x162, 0x0, x160, x157); + let mut x163: u64 = 0; + let mut x164: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x163, &mut x164, x162, x158, x155); + let mut x165: u64 = 0; + let mut x166: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x165, &mut x166, x164, x156, x153); + let x167: u64 = ((x166 as u64) + x154); + let mut x168: u64 = 0; + let mut x169: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x168, &mut x169, 0x0, x144, x159); + let mut x170: u64 = 0; + let mut x171: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x170, &mut x171, x169, x146, x161); + let mut x172: u64 = 0; + let mut x173: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x172, &mut x173, x171, x148, x163); + let mut x174: u64 = 0; + let mut x175: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x174, &mut x175, x173, x150, x165); + let mut x176: u64 = 0; + let mut x177: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x176, &mut x177, x175, x152, x167); + let mut x178: u64 = 0; + let mut x179: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x178, &mut x179, x168, 0x4b0dff665588b13f); + let mut x180: u64 = 0; + let mut x181: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x180, &mut x181, x178, 0xffffffffffffffff); + let mut x182: u64 = 0; + let mut x183: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x182, &mut x183, x178, 0xfffffffffffffffe); + let mut x184: u64 = 0; + let mut x185: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x184, &mut x185, x178, 0xbaaedce6af48a03b); + let mut x186: u64 = 0; + let mut x187: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x186, &mut x187, x178, 0xbfd25e8cd0364141); + let mut x188: u64 = 0; + let mut x189: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x188, &mut x189, 0x0, x187, x184); + let mut x190: u64 = 0; + let mut x191: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x190, &mut x191, x189, x185, x182); + let mut x192: u64 = 0; + let mut x193: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x192, &mut x193, x191, x183, x180); + let x194: u64 = ((x193 as u64) + x181); + let mut x195: u64 = 0; + let mut x196: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x195, &mut x196, 0x0, x168, x186); + let mut x197: u64 = 0; + let mut x198: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x197, &mut x198, x196, x170, x188); + let mut x199: u64 = 0; + let mut x200: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x199, &mut x200, x198, x172, x190); + let mut x201: u64 = 0; + let mut x202: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x201, &mut x202, x200, x174, x192); + let mut x203: u64 = 0; + let mut x204: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x203, &mut x204, x202, x176, x194); + let x205: u64 = ((x204 as u64) + (x177 as u64)); + let mut x206: u64 = 0; + let mut x207: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u64(&mut x206, &mut x207, 0x0, x197, 0xbfd25e8cd0364141); + let mut x208: u64 = 0; + let mut x209: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u64(&mut x208, &mut x209, x207, x199, 0xbaaedce6af48a03b); + let mut x210: u64 = 0; + let mut x211: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u64(&mut x210, &mut x211, x209, x201, 0xfffffffffffffffe); + let mut x212: u64 = 0; + let mut x213: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u64(&mut x212, &mut x213, x211, x203, 0xffffffffffffffff); + let mut x214: u64 = 0; + let mut x215: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u64(&mut x214, &mut x215, x213, x205, (0x0 as u64)); + let mut x216: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x216, x215, x206, x197); + let mut x217: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x217, x215, x208, x199); + let mut x218: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x218, x215, x210, x201); + let mut x219: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x219, x215, x212, x203); + out1[0] = x216; + out1[1] = x217; + out1[2] = x218; + out1[3] = x219; +} + +/// The function fiat_secp256k1_scalar_square squares a field element in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg1)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_secp256k1_scalar_square(out1: &mut fiat_secp256k1_scalar_montgomery_domain_field_element, arg1: &fiat_secp256k1_scalar_montgomery_domain_field_element) -> () { + let x1: u64 = (arg1[1]); + let x2: u64 = (arg1[2]); + let x3: u64 = (arg1[3]); + let x4: u64 = (arg1[0]); + let mut x5: u64 = 0; + let mut x6: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x5, &mut x6, x4, (arg1[3])); + let mut x7: u64 = 0; + let mut x8: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x7, &mut x8, x4, (arg1[2])); + let mut x9: u64 = 0; + let mut x10: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x9, &mut x10, x4, (arg1[1])); + let mut x11: u64 = 0; + let mut x12: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x11, &mut x12, x4, (arg1[0])); + let mut x13: u64 = 0; + let mut x14: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x13, &mut x14, 0x0, x12, x9); + let mut x15: u64 = 0; + let mut x16: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x15, &mut x16, x14, x10, x7); + let mut x17: u64 = 0; + let mut x18: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x17, &mut x18, x16, x8, x5); + let x19: u64 = ((x18 as u64) + x6); + let mut x20: u64 = 0; + let mut x21: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x20, &mut x21, x11, 0x4b0dff665588b13f); + let mut x22: u64 = 0; + let mut x23: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x22, &mut x23, x20, 0xffffffffffffffff); + let mut x24: u64 = 0; + let mut x25: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x24, &mut x25, x20, 0xfffffffffffffffe); + let mut x26: u64 = 0; + let mut x27: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x26, &mut x27, x20, 0xbaaedce6af48a03b); + let mut x28: u64 = 0; + let mut x29: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x28, &mut x29, x20, 0xbfd25e8cd0364141); + let mut x30: u64 = 0; + let mut x31: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x30, &mut x31, 0x0, x29, x26); + let mut x32: u64 = 0; + let mut x33: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x32, &mut x33, x31, x27, x24); + let mut x34: u64 = 0; + let mut x35: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x34, &mut x35, x33, x25, x22); + let x36: u64 = ((x35 as u64) + x23); + let mut x37: u64 = 0; + let mut x38: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x37, &mut x38, 0x0, x11, x28); + let mut x39: u64 = 0; + let mut x40: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x39, &mut x40, x38, x13, x30); + let mut x41: u64 = 0; + let mut x42: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x41, &mut x42, x40, x15, x32); + let mut x43: u64 = 0; + let mut x44: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x43, &mut x44, x42, x17, x34); + let mut x45: u64 = 0; + let mut x46: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x45, &mut x46, x44, x19, x36); + let mut x47: u64 = 0; + let mut x48: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x47, &mut x48, x1, (arg1[3])); + let mut x49: u64 = 0; + let mut x50: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x49, &mut x50, x1, (arg1[2])); + let mut x51: u64 = 0; + let mut x52: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x51, &mut x52, x1, (arg1[1])); + let mut x53: u64 = 0; + let mut x54: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x53, &mut x54, x1, (arg1[0])); + let mut x55: u64 = 0; + let mut x56: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x55, &mut x56, 0x0, x54, x51); + let mut x57: u64 = 0; + let mut x58: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x57, &mut x58, x56, x52, x49); + let mut x59: u64 = 0; + let mut x60: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x59, &mut x60, x58, x50, x47); + let x61: u64 = ((x60 as u64) + x48); + let mut x62: u64 = 0; + let mut x63: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x62, &mut x63, 0x0, x39, x53); + let mut x64: u64 = 0; + let mut x65: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x64, &mut x65, x63, x41, x55); + let mut x66: u64 = 0; + let mut x67: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x66, &mut x67, x65, x43, x57); + let mut x68: u64 = 0; + let mut x69: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x68, &mut x69, x67, x45, x59); + let mut x70: u64 = 0; + let mut x71: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x70, &mut x71, x69, (x46 as u64), x61); + let mut x72: u64 = 0; + let mut x73: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x72, &mut x73, x62, 0x4b0dff665588b13f); + let mut x74: u64 = 0; + let mut x75: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x74, &mut x75, x72, 0xffffffffffffffff); + let mut x76: u64 = 0; + let mut x77: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x76, &mut x77, x72, 0xfffffffffffffffe); + let mut x78: u64 = 0; + let mut x79: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x78, &mut x79, x72, 0xbaaedce6af48a03b); + let mut x80: u64 = 0; + let mut x81: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x80, &mut x81, x72, 0xbfd25e8cd0364141); + let mut x82: u64 = 0; + let mut x83: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x82, &mut x83, 0x0, x81, x78); + let mut x84: u64 = 0; + let mut x85: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x84, &mut x85, x83, x79, x76); + let mut x86: u64 = 0; + let mut x87: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x86, &mut x87, x85, x77, x74); + let x88: u64 = ((x87 as u64) + x75); + let mut x89: u64 = 0; + let mut x90: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x89, &mut x90, 0x0, x62, x80); + let mut x91: u64 = 0; + let mut x92: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x91, &mut x92, x90, x64, x82); + let mut x93: u64 = 0; + let mut x94: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x93, &mut x94, x92, x66, x84); + let mut x95: u64 = 0; + let mut x96: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x95, &mut x96, x94, x68, x86); + let mut x97: u64 = 0; + let mut x98: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x97, &mut x98, x96, x70, x88); + let x99: u64 = ((x98 as u64) + (x71 as u64)); + let mut x100: u64 = 0; + let mut x101: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x100, &mut x101, x2, (arg1[3])); + let mut x102: u64 = 0; + let mut x103: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x102, &mut x103, x2, (arg1[2])); + let mut x104: u64 = 0; + let mut x105: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x104, &mut x105, x2, (arg1[1])); + let mut x106: u64 = 0; + let mut x107: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x106, &mut x107, x2, (arg1[0])); + let mut x108: u64 = 0; + let mut x109: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x108, &mut x109, 0x0, x107, x104); + let mut x110: u64 = 0; + let mut x111: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x110, &mut x111, x109, x105, x102); + let mut x112: u64 = 0; + let mut x113: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x112, &mut x113, x111, x103, x100); + let x114: u64 = ((x113 as u64) + x101); + let mut x115: u64 = 0; + let mut x116: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x115, &mut x116, 0x0, x91, x106); + let mut x117: u64 = 0; + let mut x118: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x117, &mut x118, x116, x93, x108); + let mut x119: u64 = 0; + let mut x120: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x119, &mut x120, x118, x95, x110); + let mut x121: u64 = 0; + let mut x122: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x121, &mut x122, x120, x97, x112); + let mut x123: u64 = 0; + let mut x124: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x123, &mut x124, x122, x99, x114); + let mut x125: u64 = 0; + let mut x126: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x125, &mut x126, x115, 0x4b0dff665588b13f); + let mut x127: u64 = 0; + let mut x128: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x127, &mut x128, x125, 0xffffffffffffffff); + let mut x129: u64 = 0; + let mut x130: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x129, &mut x130, x125, 0xfffffffffffffffe); + let mut x131: u64 = 0; + let mut x132: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x131, &mut x132, x125, 0xbaaedce6af48a03b); + let mut x133: u64 = 0; + let mut x134: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x133, &mut x134, x125, 0xbfd25e8cd0364141); + let mut x135: u64 = 0; + let mut x136: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x135, &mut x136, 0x0, x134, x131); + let mut x137: u64 = 0; + let mut x138: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x137, &mut x138, x136, x132, x129); + let mut x139: u64 = 0; + let mut x140: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x139, &mut x140, x138, x130, x127); + let x141: u64 = ((x140 as u64) + x128); + let mut x142: u64 = 0; + let mut x143: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x142, &mut x143, 0x0, x115, x133); + let mut x144: u64 = 0; + let mut x145: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x144, &mut x145, x143, x117, x135); + let mut x146: u64 = 0; + let mut x147: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x146, &mut x147, x145, x119, x137); + let mut x148: u64 = 0; + let mut x149: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x148, &mut x149, x147, x121, x139); + let mut x150: u64 = 0; + let mut x151: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x150, &mut x151, x149, x123, x141); + let x152: u64 = ((x151 as u64) + (x124 as u64)); + let mut x153: u64 = 0; + let mut x154: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x153, &mut x154, x3, (arg1[3])); + let mut x155: u64 = 0; + let mut x156: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x155, &mut x156, x3, (arg1[2])); + let mut x157: u64 = 0; + let mut x158: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x157, &mut x158, x3, (arg1[1])); + let mut x159: u64 = 0; + let mut x160: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x159, &mut x160, x3, (arg1[0])); + let mut x161: u64 = 0; + let mut x162: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x161, &mut x162, 0x0, x160, x157); + let mut x163: u64 = 0; + let mut x164: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x163, &mut x164, x162, x158, x155); + let mut x165: u64 = 0; + let mut x166: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x165, &mut x166, x164, x156, x153); + let x167: u64 = ((x166 as u64) + x154); + let mut x168: u64 = 0; + let mut x169: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x168, &mut x169, 0x0, x144, x159); + let mut x170: u64 = 0; + let mut x171: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x170, &mut x171, x169, x146, x161); + let mut x172: u64 = 0; + let mut x173: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x172, &mut x173, x171, x148, x163); + let mut x174: u64 = 0; + let mut x175: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x174, &mut x175, x173, x150, x165); + let mut x176: u64 = 0; + let mut x177: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x176, &mut x177, x175, x152, x167); + let mut x178: u64 = 0; + let mut x179: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x178, &mut x179, x168, 0x4b0dff665588b13f); + let mut x180: u64 = 0; + let mut x181: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x180, &mut x181, x178, 0xffffffffffffffff); + let mut x182: u64 = 0; + let mut x183: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x182, &mut x183, x178, 0xfffffffffffffffe); + let mut x184: u64 = 0; + let mut x185: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x184, &mut x185, x178, 0xbaaedce6af48a03b); + let mut x186: u64 = 0; + let mut x187: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x186, &mut x187, x178, 0xbfd25e8cd0364141); + let mut x188: u64 = 0; + let mut x189: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x188, &mut x189, 0x0, x187, x184); + let mut x190: u64 = 0; + let mut x191: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x190, &mut x191, x189, x185, x182); + let mut x192: u64 = 0; + let mut x193: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x192, &mut x193, x191, x183, x180); + let x194: u64 = ((x193 as u64) + x181); + let mut x195: u64 = 0; + let mut x196: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x195, &mut x196, 0x0, x168, x186); + let mut x197: u64 = 0; + let mut x198: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x197, &mut x198, x196, x170, x188); + let mut x199: u64 = 0; + let mut x200: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x199, &mut x200, x198, x172, x190); + let mut x201: u64 = 0; + let mut x202: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x201, &mut x202, x200, x174, x192); + let mut x203: u64 = 0; + let mut x204: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x203, &mut x204, x202, x176, x194); + let x205: u64 = ((x204 as u64) + (x177 as u64)); + let mut x206: u64 = 0; + let mut x207: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u64(&mut x206, &mut x207, 0x0, x197, 0xbfd25e8cd0364141); + let mut x208: u64 = 0; + let mut x209: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u64(&mut x208, &mut x209, x207, x199, 0xbaaedce6af48a03b); + let mut x210: u64 = 0; + let mut x211: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u64(&mut x210, &mut x211, x209, x201, 0xfffffffffffffffe); + let mut x212: u64 = 0; + let mut x213: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u64(&mut x212, &mut x213, x211, x203, 0xffffffffffffffff); + let mut x214: u64 = 0; + let mut x215: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u64(&mut x214, &mut x215, x213, x205, (0x0 as u64)); + let mut x216: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x216, x215, x206, x197); + let mut x217: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x217, x215, x208, x199); + let mut x218: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x218, x215, x210, x201); + let mut x219: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x219, x215, x212, x203); + out1[0] = x216; + out1[1] = x217; + out1[2] = x218; + out1[3] = x219; +} + +/// The function fiat_secp256k1_scalar_add adds two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) + eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_secp256k1_scalar_add(out1: &mut fiat_secp256k1_scalar_montgomery_domain_field_element, arg1: &fiat_secp256k1_scalar_montgomery_domain_field_element, arg2: &fiat_secp256k1_scalar_montgomery_domain_field_element) -> () { + let mut x1: u64 = 0; + let mut x2: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x1, &mut x2, 0x0, (arg1[0]), (arg2[0])); + let mut x3: u64 = 0; + let mut x4: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x3, &mut x4, x2, (arg1[1]), (arg2[1])); + let mut x5: u64 = 0; + let mut x6: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x5, &mut x6, x4, (arg1[2]), (arg2[2])); + let mut x7: u64 = 0; + let mut x8: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x7, &mut x8, x6, (arg1[3]), (arg2[3])); + let mut x9: u64 = 0; + let mut x10: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u64(&mut x9, &mut x10, 0x0, x1, 0xbfd25e8cd0364141); + let mut x11: u64 = 0; + let mut x12: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u64(&mut x11, &mut x12, x10, x3, 0xbaaedce6af48a03b); + let mut x13: u64 = 0; + let mut x14: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u64(&mut x13, &mut x14, x12, x5, 0xfffffffffffffffe); + let mut x15: u64 = 0; + let mut x16: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u64(&mut x15, &mut x16, x14, x7, 0xffffffffffffffff); + let mut x17: u64 = 0; + let mut x18: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u64(&mut x17, &mut x18, x16, (x8 as u64), (0x0 as u64)); + let mut x19: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x19, x18, x9, x1); + let mut x20: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x20, x18, x11, x3); + let mut x21: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x21, x18, x13, x5); + let mut x22: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x22, x18, x15, x7); + out1[0] = x19; + out1[1] = x20; + out1[2] = x21; + out1[3] = x22; +} + +/// The function fiat_secp256k1_scalar_sub subtracts two field elements in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// 0 ≤ eval arg2 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) - eval (from_montgomery arg2)) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_secp256k1_scalar_sub(out1: &mut fiat_secp256k1_scalar_montgomery_domain_field_element, arg1: &fiat_secp256k1_scalar_montgomery_domain_field_element, arg2: &fiat_secp256k1_scalar_montgomery_domain_field_element) -> () { + let mut x1: u64 = 0; + let mut x2: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u64(&mut x1, &mut x2, 0x0, (arg1[0]), (arg2[0])); + let mut x3: u64 = 0; + let mut x4: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u64(&mut x3, &mut x4, x2, (arg1[1]), (arg2[1])); + let mut x5: u64 = 0; + let mut x6: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u64(&mut x5, &mut x6, x4, (arg1[2]), (arg2[2])); + let mut x7: u64 = 0; + let mut x8: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u64(&mut x7, &mut x8, x6, (arg1[3]), (arg2[3])); + let mut x9: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x9, x8, (0x0 as u64), 0xffffffffffffffff); + let mut x10: u64 = 0; + let mut x11: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x10, &mut x11, 0x0, x1, (x9 & 0xbfd25e8cd0364141)); + let mut x12: u64 = 0; + let mut x13: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x12, &mut x13, x11, x3, (x9 & 0xbaaedce6af48a03b)); + let mut x14: u64 = 0; + let mut x15: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x14, &mut x15, x13, x5, (x9 & 0xfffffffffffffffe)); + let mut x16: u64 = 0; + let mut x17: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x16, &mut x17, x15, x7, x9); + out1[0] = x10; + out1[1] = x12; + out1[2] = x14; + out1[3] = x16; +} + +/// The function fiat_secp256k1_scalar_opp negates a field element in the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = -eval (from_montgomery arg1) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_secp256k1_scalar_opp(out1: &mut fiat_secp256k1_scalar_montgomery_domain_field_element, arg1: &fiat_secp256k1_scalar_montgomery_domain_field_element) -> () { + let mut x1: u64 = 0; + let mut x2: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u64(&mut x1, &mut x2, 0x0, (0x0 as u64), (arg1[0])); + let mut x3: u64 = 0; + let mut x4: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u64(&mut x3, &mut x4, x2, (0x0 as u64), (arg1[1])); + let mut x5: u64 = 0; + let mut x6: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u64(&mut x5, &mut x6, x4, (0x0 as u64), (arg1[2])); + let mut x7: u64 = 0; + let mut x8: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u64(&mut x7, &mut x8, x6, (0x0 as u64), (arg1[3])); + let mut x9: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x9, x8, (0x0 as u64), 0xffffffffffffffff); + let mut x10: u64 = 0; + let mut x11: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x10, &mut x11, 0x0, x1, (x9 & 0xbfd25e8cd0364141)); + let mut x12: u64 = 0; + let mut x13: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x12, &mut x13, x11, x3, (x9 & 0xbaaedce6af48a03b)); + let mut x14: u64 = 0; + let mut x15: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x14, &mut x15, x13, x5, (x9 & 0xfffffffffffffffe)); + let mut x16: u64 = 0; + let mut x17: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x16, &mut x17, x15, x7, x9); + out1[0] = x10; + out1[1] = x12; + out1[2] = x14; + out1[3] = x16; +} + +/// The function fiat_secp256k1_scalar_from_montgomery translates a field element out of the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval out1 mod m = (eval arg1 * ((2^64)⁻¹ mod m)^4) mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_secp256k1_scalar_from_montgomery(out1: &mut fiat_secp256k1_scalar_non_montgomery_domain_field_element, arg1: &fiat_secp256k1_scalar_montgomery_domain_field_element) -> () { + let x1: u64 = (arg1[0]); + let mut x2: u64 = 0; + let mut x3: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x2, &mut x3, x1, 0x4b0dff665588b13f); + let mut x4: u64 = 0; + let mut x5: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x4, &mut x5, x2, 0xffffffffffffffff); + let mut x6: u64 = 0; + let mut x7: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x6, &mut x7, x2, 0xfffffffffffffffe); + let mut x8: u64 = 0; + let mut x9: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x8, &mut x9, x2, 0xbaaedce6af48a03b); + let mut x10: u64 = 0; + let mut x11: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x10, &mut x11, x2, 0xbfd25e8cd0364141); + let mut x12: u64 = 0; + let mut x13: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x12, &mut x13, 0x0, x11, x8); + let mut x14: u64 = 0; + let mut x15: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x14, &mut x15, x13, x9, x6); + let mut x16: u64 = 0; + let mut x17: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x16, &mut x17, x15, x7, x4); + let mut x18: u64 = 0; + let mut x19: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x18, &mut x19, 0x0, x1, x10); + let mut x20: u64 = 0; + let mut x21: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x20, &mut x21, x19, (0x0 as u64), x12); + let mut x22: u64 = 0; + let mut x23: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x22, &mut x23, x21, (0x0 as u64), x14); + let mut x24: u64 = 0; + let mut x25: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x24, &mut x25, x23, (0x0 as u64), x16); + let mut x26: u64 = 0; + let mut x27: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x26, &mut x27, x25, (0x0 as u64), ((x17 as u64) + x5)); + let mut x28: u64 = 0; + let mut x29: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x28, &mut x29, 0x0, x20, (arg1[1])); + let mut x30: u64 = 0; + let mut x31: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x30, &mut x31, x29, x22, (0x0 as u64)); + let mut x32: u64 = 0; + let mut x33: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x32, &mut x33, x31, x24, (0x0 as u64)); + let mut x34: u64 = 0; + let mut x35: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x34, &mut x35, x33, x26, (0x0 as u64)); + let mut x36: u64 = 0; + let mut x37: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x36, &mut x37, x28, 0x4b0dff665588b13f); + let mut x38: u64 = 0; + let mut x39: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x38, &mut x39, x36, 0xffffffffffffffff); + let mut x40: u64 = 0; + let mut x41: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x40, &mut x41, x36, 0xfffffffffffffffe); + let mut x42: u64 = 0; + let mut x43: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x42, &mut x43, x36, 0xbaaedce6af48a03b); + let mut x44: u64 = 0; + let mut x45: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x44, &mut x45, x36, 0xbfd25e8cd0364141); + let mut x46: u64 = 0; + let mut x47: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x46, &mut x47, 0x0, x45, x42); + let mut x48: u64 = 0; + let mut x49: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x48, &mut x49, x47, x43, x40); + let mut x50: u64 = 0; + let mut x51: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x50, &mut x51, x49, x41, x38); + let mut x52: u64 = 0; + let mut x53: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x52, &mut x53, 0x0, x28, x44); + let mut x54: u64 = 0; + let mut x55: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x54, &mut x55, x53, x30, x46); + let mut x56: u64 = 0; + let mut x57: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x56, &mut x57, x55, x32, x48); + let mut x58: u64 = 0; + let mut x59: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x58, &mut x59, x57, x34, x50); + let mut x60: u64 = 0; + let mut x61: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x60, &mut x61, x59, ((x35 as u64) + (x27 as u64)), ((x51 as u64) + x39)); + let mut x62: u64 = 0; + let mut x63: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x62, &mut x63, 0x0, x54, (arg1[2])); + let mut x64: u64 = 0; + let mut x65: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x64, &mut x65, x63, x56, (0x0 as u64)); + let mut x66: u64 = 0; + let mut x67: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x66, &mut x67, x65, x58, (0x0 as u64)); + let mut x68: u64 = 0; + let mut x69: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x68, &mut x69, x67, x60, (0x0 as u64)); + let mut x70: u64 = 0; + let mut x71: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x70, &mut x71, x62, 0x4b0dff665588b13f); + let mut x72: u64 = 0; + let mut x73: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x72, &mut x73, x70, 0xffffffffffffffff); + let mut x74: u64 = 0; + let mut x75: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x74, &mut x75, x70, 0xfffffffffffffffe); + let mut x76: u64 = 0; + let mut x77: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x76, &mut x77, x70, 0xbaaedce6af48a03b); + let mut x78: u64 = 0; + let mut x79: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x78, &mut x79, x70, 0xbfd25e8cd0364141); + let mut x80: u64 = 0; + let mut x81: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x80, &mut x81, 0x0, x79, x76); + let mut x82: u64 = 0; + let mut x83: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x82, &mut x83, x81, x77, x74); + let mut x84: u64 = 0; + let mut x85: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x84, &mut x85, x83, x75, x72); + let mut x86: u64 = 0; + let mut x87: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x86, &mut x87, 0x0, x62, x78); + let mut x88: u64 = 0; + let mut x89: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x88, &mut x89, x87, x64, x80); + let mut x90: u64 = 0; + let mut x91: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x90, &mut x91, x89, x66, x82); + let mut x92: u64 = 0; + let mut x93: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x92, &mut x93, x91, x68, x84); + let mut x94: u64 = 0; + let mut x95: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x94, &mut x95, x93, ((x69 as u64) + (x61 as u64)), ((x85 as u64) + x73)); + let mut x96: u64 = 0; + let mut x97: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x96, &mut x97, 0x0, x88, (arg1[3])); + let mut x98: u64 = 0; + let mut x99: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x98, &mut x99, x97, x90, (0x0 as u64)); + let mut x100: u64 = 0; + let mut x101: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x100, &mut x101, x99, x92, (0x0 as u64)); + let mut x102: u64 = 0; + let mut x103: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x102, &mut x103, x101, x94, (0x0 as u64)); + let mut x104: u64 = 0; + let mut x105: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x104, &mut x105, x96, 0x4b0dff665588b13f); + let mut x106: u64 = 0; + let mut x107: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x106, &mut x107, x104, 0xffffffffffffffff); + let mut x108: u64 = 0; + let mut x109: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x108, &mut x109, x104, 0xfffffffffffffffe); + let mut x110: u64 = 0; + let mut x111: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x110, &mut x111, x104, 0xbaaedce6af48a03b); + let mut x112: u64 = 0; + let mut x113: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x112, &mut x113, x104, 0xbfd25e8cd0364141); + let mut x114: u64 = 0; + let mut x115: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x114, &mut x115, 0x0, x113, x110); + let mut x116: u64 = 0; + let mut x117: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x116, &mut x117, x115, x111, x108); + let mut x118: u64 = 0; + let mut x119: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x118, &mut x119, x117, x109, x106); + let mut x120: u64 = 0; + let mut x121: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x120, &mut x121, 0x0, x96, x112); + let mut x122: u64 = 0; + let mut x123: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x122, &mut x123, x121, x98, x114); + let mut x124: u64 = 0; + let mut x125: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x124, &mut x125, x123, x100, x116); + let mut x126: u64 = 0; + let mut x127: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x126, &mut x127, x125, x102, x118); + let mut x128: u64 = 0; + let mut x129: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x128, &mut x129, x127, ((x103 as u64) + (x95 as u64)), ((x119 as u64) + x107)); + let mut x130: u64 = 0; + let mut x131: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u64(&mut x130, &mut x131, 0x0, x122, 0xbfd25e8cd0364141); + let mut x132: u64 = 0; + let mut x133: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u64(&mut x132, &mut x133, x131, x124, 0xbaaedce6af48a03b); + let mut x134: u64 = 0; + let mut x135: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u64(&mut x134, &mut x135, x133, x126, 0xfffffffffffffffe); + let mut x136: u64 = 0; + let mut x137: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u64(&mut x136, &mut x137, x135, x128, 0xffffffffffffffff); + let mut x138: u64 = 0; + let mut x139: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u64(&mut x138, &mut x139, x137, (x129 as u64), (0x0 as u64)); + let mut x140: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x140, x139, x130, x122); + let mut x141: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x141, x139, x132, x124); + let mut x142: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x142, x139, x134, x126); + let mut x143: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x143, x139, x136, x128); + out1[0] = x140; + out1[1] = x141; + out1[2] = x142; + out1[3] = x143; +} + +/// The function fiat_secp256k1_scalar_to_montgomery translates a field element into the Montgomery domain. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// eval (from_montgomery out1) mod m = eval arg1 mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_secp256k1_scalar_to_montgomery(out1: &mut fiat_secp256k1_scalar_montgomery_domain_field_element, arg1: &fiat_secp256k1_scalar_non_montgomery_domain_field_element) -> () { + let x1: u64 = (arg1[1]); + let x2: u64 = (arg1[2]); + let x3: u64 = (arg1[3]); + let x4: u64 = (arg1[0]); + let mut x5: u64 = 0; + let mut x6: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x5, &mut x6, x4, 0x9d671cd581c69bc5); + let mut x7: u64 = 0; + let mut x8: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x7, &mut x8, x4, 0xe697f5e45bcd07c6); + let mut x9: u64 = 0; + let mut x10: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x9, &mut x10, x4, 0x741496c20e7cf878); + let mut x11: u64 = 0; + let mut x12: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x11, &mut x12, x4, 0x896cf21467d7d140); + let mut x13: u64 = 0; + let mut x14: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x13, &mut x14, 0x0, x12, x9); + let mut x15: u64 = 0; + let mut x16: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x15, &mut x16, x14, x10, x7); + let mut x17: u64 = 0; + let mut x18: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x17, &mut x18, x16, x8, x5); + let mut x19: u64 = 0; + let mut x20: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x19, &mut x20, x11, 0x4b0dff665588b13f); + let mut x21: u64 = 0; + let mut x22: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x21, &mut x22, x19, 0xffffffffffffffff); + let mut x23: u64 = 0; + let mut x24: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x23, &mut x24, x19, 0xfffffffffffffffe); + let mut x25: u64 = 0; + let mut x26: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x25, &mut x26, x19, 0xbaaedce6af48a03b); + let mut x27: u64 = 0; + let mut x28: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x27, &mut x28, x19, 0xbfd25e8cd0364141); + let mut x29: u64 = 0; + let mut x30: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x29, &mut x30, 0x0, x28, x25); + let mut x31: u64 = 0; + let mut x32: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x31, &mut x32, x30, x26, x23); + let mut x33: u64 = 0; + let mut x34: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x33, &mut x34, x32, x24, x21); + let mut x35: u64 = 0; + let mut x36: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x35, &mut x36, 0x0, x11, x27); + let mut x37: u64 = 0; + let mut x38: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x37, &mut x38, x36, x13, x29); + let mut x39: u64 = 0; + let mut x40: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x39, &mut x40, x38, x15, x31); + let mut x41: u64 = 0; + let mut x42: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x41, &mut x42, x40, x17, x33); + let mut x43: u64 = 0; + let mut x44: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x43, &mut x44, x42, ((x18 as u64) + x6), ((x34 as u64) + x22)); + let mut x45: u64 = 0; + let mut x46: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x45, &mut x46, x1, 0x9d671cd581c69bc5); + let mut x47: u64 = 0; + let mut x48: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x47, &mut x48, x1, 0xe697f5e45bcd07c6); + let mut x49: u64 = 0; + let mut x50: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x49, &mut x50, x1, 0x741496c20e7cf878); + let mut x51: u64 = 0; + let mut x52: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x51, &mut x52, x1, 0x896cf21467d7d140); + let mut x53: u64 = 0; + let mut x54: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x53, &mut x54, 0x0, x52, x49); + let mut x55: u64 = 0; + let mut x56: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x55, &mut x56, x54, x50, x47); + let mut x57: u64 = 0; + let mut x58: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x57, &mut x58, x56, x48, x45); + let mut x59: u64 = 0; + let mut x60: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x59, &mut x60, 0x0, x37, x51); + let mut x61: u64 = 0; + let mut x62: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x61, &mut x62, x60, x39, x53); + let mut x63: u64 = 0; + let mut x64: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x63, &mut x64, x62, x41, x55); + let mut x65: u64 = 0; + let mut x66: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x65, &mut x66, x64, x43, x57); + let mut x67: u64 = 0; + let mut x68: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x67, &mut x68, x59, 0x4b0dff665588b13f); + let mut x69: u64 = 0; + let mut x70: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x69, &mut x70, x67, 0xffffffffffffffff); + let mut x71: u64 = 0; + let mut x72: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x71, &mut x72, x67, 0xfffffffffffffffe); + let mut x73: u64 = 0; + let mut x74: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x73, &mut x74, x67, 0xbaaedce6af48a03b); + let mut x75: u64 = 0; + let mut x76: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x75, &mut x76, x67, 0xbfd25e8cd0364141); + let mut x77: u64 = 0; + let mut x78: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x77, &mut x78, 0x0, x76, x73); + let mut x79: u64 = 0; + let mut x80: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x79, &mut x80, x78, x74, x71); + let mut x81: u64 = 0; + let mut x82: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x81, &mut x82, x80, x72, x69); + let mut x83: u64 = 0; + let mut x84: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x83, &mut x84, 0x0, x59, x75); + let mut x85: u64 = 0; + let mut x86: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x85, &mut x86, x84, x61, x77); + let mut x87: u64 = 0; + let mut x88: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x87, &mut x88, x86, x63, x79); + let mut x89: u64 = 0; + let mut x90: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x89, &mut x90, x88, x65, x81); + let mut x91: u64 = 0; + let mut x92: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x91, &mut x92, x90, (((x66 as u64) + (x44 as u64)) + ((x58 as u64) + x46)), ((x82 as u64) + x70)); + let mut x93: u64 = 0; + let mut x94: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x93, &mut x94, x2, 0x9d671cd581c69bc5); + let mut x95: u64 = 0; + let mut x96: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x95, &mut x96, x2, 0xe697f5e45bcd07c6); + let mut x97: u64 = 0; + let mut x98: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x97, &mut x98, x2, 0x741496c20e7cf878); + let mut x99: u64 = 0; + let mut x100: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x99, &mut x100, x2, 0x896cf21467d7d140); + let mut x101: u64 = 0; + let mut x102: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x101, &mut x102, 0x0, x100, x97); + let mut x103: u64 = 0; + let mut x104: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x103, &mut x104, x102, x98, x95); + let mut x105: u64 = 0; + let mut x106: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x105, &mut x106, x104, x96, x93); + let mut x107: u64 = 0; + let mut x108: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x107, &mut x108, 0x0, x85, x99); + let mut x109: u64 = 0; + let mut x110: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x109, &mut x110, x108, x87, x101); + let mut x111: u64 = 0; + let mut x112: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x111, &mut x112, x110, x89, x103); + let mut x113: u64 = 0; + let mut x114: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x113, &mut x114, x112, x91, x105); + let mut x115: u64 = 0; + let mut x116: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x115, &mut x116, x107, 0x4b0dff665588b13f); + let mut x117: u64 = 0; + let mut x118: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x117, &mut x118, x115, 0xffffffffffffffff); + let mut x119: u64 = 0; + let mut x120: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x119, &mut x120, x115, 0xfffffffffffffffe); + let mut x121: u64 = 0; + let mut x122: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x121, &mut x122, x115, 0xbaaedce6af48a03b); + let mut x123: u64 = 0; + let mut x124: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x123, &mut x124, x115, 0xbfd25e8cd0364141); + let mut x125: u64 = 0; + let mut x126: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x125, &mut x126, 0x0, x124, x121); + let mut x127: u64 = 0; + let mut x128: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x127, &mut x128, x126, x122, x119); + let mut x129: u64 = 0; + let mut x130: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x129, &mut x130, x128, x120, x117); + let mut x131: u64 = 0; + let mut x132: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x131, &mut x132, 0x0, x107, x123); + let mut x133: u64 = 0; + let mut x134: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x133, &mut x134, x132, x109, x125); + let mut x135: u64 = 0; + let mut x136: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x135, &mut x136, x134, x111, x127); + let mut x137: u64 = 0; + let mut x138: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x137, &mut x138, x136, x113, x129); + let mut x139: u64 = 0; + let mut x140: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x139, &mut x140, x138, (((x114 as u64) + (x92 as u64)) + ((x106 as u64) + x94)), ((x130 as u64) + x118)); + let mut x141: u64 = 0; + let mut x142: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x141, &mut x142, x3, 0x9d671cd581c69bc5); + let mut x143: u64 = 0; + let mut x144: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x143, &mut x144, x3, 0xe697f5e45bcd07c6); + let mut x145: u64 = 0; + let mut x146: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x145, &mut x146, x3, 0x741496c20e7cf878); + let mut x147: u64 = 0; + let mut x148: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x147, &mut x148, x3, 0x896cf21467d7d140); + let mut x149: u64 = 0; + let mut x150: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x149, &mut x150, 0x0, x148, x145); + let mut x151: u64 = 0; + let mut x152: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x151, &mut x152, x150, x146, x143); + let mut x153: u64 = 0; + let mut x154: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x153, &mut x154, x152, x144, x141); + let mut x155: u64 = 0; + let mut x156: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x155, &mut x156, 0x0, x133, x147); + let mut x157: u64 = 0; + let mut x158: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x157, &mut x158, x156, x135, x149); + let mut x159: u64 = 0; + let mut x160: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x159, &mut x160, x158, x137, x151); + let mut x161: u64 = 0; + let mut x162: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x161, &mut x162, x160, x139, x153); + let mut x163: u64 = 0; + let mut x164: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x163, &mut x164, x155, 0x4b0dff665588b13f); + let mut x165: u64 = 0; + let mut x166: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x165, &mut x166, x163, 0xffffffffffffffff); + let mut x167: u64 = 0; + let mut x168: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x167, &mut x168, x163, 0xfffffffffffffffe); + let mut x169: u64 = 0; + let mut x170: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x169, &mut x170, x163, 0xbaaedce6af48a03b); + let mut x171: u64 = 0; + let mut x172: u64 = 0; + fiat_secp256k1_scalar_mulx_u64(&mut x171, &mut x172, x163, 0xbfd25e8cd0364141); + let mut x173: u64 = 0; + let mut x174: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x173, &mut x174, 0x0, x172, x169); + let mut x175: u64 = 0; + let mut x176: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x175, &mut x176, x174, x170, x167); + let mut x177: u64 = 0; + let mut x178: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x177, &mut x178, x176, x168, x165); + let mut x179: u64 = 0; + let mut x180: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x179, &mut x180, 0x0, x155, x171); + let mut x181: u64 = 0; + let mut x182: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x181, &mut x182, x180, x157, x173); + let mut x183: u64 = 0; + let mut x184: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x183, &mut x184, x182, x159, x175); + let mut x185: u64 = 0; + let mut x186: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x185, &mut x186, x184, x161, x177); + let mut x187: u64 = 0; + let mut x188: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x187, &mut x188, x186, (((x162 as u64) + (x140 as u64)) + ((x154 as u64) + x142)), ((x178 as u64) + x166)); + let mut x189: u64 = 0; + let mut x190: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u64(&mut x189, &mut x190, 0x0, x181, 0xbfd25e8cd0364141); + let mut x191: u64 = 0; + let mut x192: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u64(&mut x191, &mut x192, x190, x183, 0xbaaedce6af48a03b); + let mut x193: u64 = 0; + let mut x194: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u64(&mut x193, &mut x194, x192, x185, 0xfffffffffffffffe); + let mut x195: u64 = 0; + let mut x196: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u64(&mut x195, &mut x196, x194, x187, 0xffffffffffffffff); + let mut x197: u64 = 0; + let mut x198: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u64(&mut x197, &mut x198, x196, (x188 as u64), (0x0 as u64)); + let mut x199: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x199, x198, x189, x181); + let mut x200: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x200, x198, x191, x183); + let mut x201: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x201, x198, x193, x185); + let mut x202: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x202, x198, x195, x187); + out1[0] = x199; + out1[1] = x200; + out1[2] = x201; + out1[3] = x202; +} + +/// The function fiat_secp256k1_scalar_nonzero outputs a single non-zero word if the input is non-zero and zero otherwise. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// out1 = 0 ↔ eval (from_montgomery arg1) mod m = 0 +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +#[inline] +pub fn fiat_secp256k1_scalar_nonzero(out1: &mut u64, arg1: &[u64; 4]) -> () { + let x1: u64 = ((arg1[0]) | ((arg1[1]) | ((arg1[2]) | (arg1[3])))); + *out1 = x1; +} + +/// The function fiat_secp256k1_scalar_selectznz is a multi-limb conditional select. +/// +/// Postconditions: +/// out1 = (if arg1 = 0 then arg2 else arg3) +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0x1] +/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +#[inline] +pub fn fiat_secp256k1_scalar_selectznz(out1: &mut [u64; 4], arg1: fiat_secp256k1_scalar_u1, arg2: &[u64; 4], arg3: &[u64; 4]) -> () { + let mut x1: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x1, arg1, (arg2[0]), (arg3[0])); + let mut x2: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x2, arg1, (arg2[1]), (arg3[1])); + let mut x3: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x3, arg1, (arg2[2]), (arg3[2])); + let mut x4: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x4, arg1, (arg2[3]), (arg3[3])); + out1[0] = x1; + out1[1] = x2; + out1[2] = x3; + out1[3] = x4; +} + +/// The function fiat_secp256k1_scalar_to_bytes serializes a field element NOT in the Montgomery domain to bytes in little-endian order. +/// +/// Preconditions: +/// 0 ≤ eval arg1 < m +/// Postconditions: +/// out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..31] +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] +#[inline] +pub fn fiat_secp256k1_scalar_to_bytes(out1: &mut [u8; 32], arg1: &[u64; 4]) -> () { + let x1: u64 = (arg1[3]); + let x2: u64 = (arg1[2]); + let x3: u64 = (arg1[1]); + let x4: u64 = (arg1[0]); + let x5: u8 = ((x4 & (0xff as u64)) as u8); + let x6: u64 = (x4 >> 8); + let x7: u8 = ((x6 & (0xff as u64)) as u8); + let x8: u64 = (x6 >> 8); + let x9: u8 = ((x8 & (0xff as u64)) as u8); + let x10: u64 = (x8 >> 8); + let x11: u8 = ((x10 & (0xff as u64)) as u8); + let x12: u64 = (x10 >> 8); + let x13: u8 = ((x12 & (0xff as u64)) as u8); + let x14: u64 = (x12 >> 8); + let x15: u8 = ((x14 & (0xff as u64)) as u8); + let x16: u64 = (x14 >> 8); + let x17: u8 = ((x16 & (0xff as u64)) as u8); + let x18: u8 = ((x16 >> 8) as u8); + let x19: u8 = ((x3 & (0xff as u64)) as u8); + let x20: u64 = (x3 >> 8); + let x21: u8 = ((x20 & (0xff as u64)) as u8); + let x22: u64 = (x20 >> 8); + let x23: u8 = ((x22 & (0xff as u64)) as u8); + let x24: u64 = (x22 >> 8); + let x25: u8 = ((x24 & (0xff as u64)) as u8); + let x26: u64 = (x24 >> 8); + let x27: u8 = ((x26 & (0xff as u64)) as u8); + let x28: u64 = (x26 >> 8); + let x29: u8 = ((x28 & (0xff as u64)) as u8); + let x30: u64 = (x28 >> 8); + let x31: u8 = ((x30 & (0xff as u64)) as u8); + let x32: u8 = ((x30 >> 8) as u8); + let x33: u8 = ((x2 & (0xff as u64)) as u8); + let x34: u64 = (x2 >> 8); + let x35: u8 = ((x34 & (0xff as u64)) as u8); + let x36: u64 = (x34 >> 8); + let x37: u8 = ((x36 & (0xff as u64)) as u8); + let x38: u64 = (x36 >> 8); + let x39: u8 = ((x38 & (0xff as u64)) as u8); + let x40: u64 = (x38 >> 8); + let x41: u8 = ((x40 & (0xff as u64)) as u8); + let x42: u64 = (x40 >> 8); + let x43: u8 = ((x42 & (0xff as u64)) as u8); + let x44: u64 = (x42 >> 8); + let x45: u8 = ((x44 & (0xff as u64)) as u8); + let x46: u8 = ((x44 >> 8) as u8); + let x47: u8 = ((x1 & (0xff as u64)) as u8); + let x48: u64 = (x1 >> 8); + let x49: u8 = ((x48 & (0xff as u64)) as u8); + let x50: u64 = (x48 >> 8); + let x51: u8 = ((x50 & (0xff as u64)) as u8); + let x52: u64 = (x50 >> 8); + let x53: u8 = ((x52 & (0xff as u64)) as u8); + let x54: u64 = (x52 >> 8); + let x55: u8 = ((x54 & (0xff as u64)) as u8); + let x56: u64 = (x54 >> 8); + let x57: u8 = ((x56 & (0xff as u64)) as u8); + let x58: u64 = (x56 >> 8); + let x59: u8 = ((x58 & (0xff as u64)) as u8); + let x60: u8 = ((x58 >> 8) as u8); + out1[0] = x5; + out1[1] = x7; + out1[2] = x9; + out1[3] = x11; + out1[4] = x13; + out1[5] = x15; + out1[6] = x17; + out1[7] = x18; + out1[8] = x19; + out1[9] = x21; + out1[10] = x23; + out1[11] = x25; + out1[12] = x27; + out1[13] = x29; + out1[14] = x31; + out1[15] = x32; + out1[16] = x33; + out1[17] = x35; + out1[18] = x37; + out1[19] = x39; + out1[20] = x41; + out1[21] = x43; + out1[22] = x45; + out1[23] = x46; + out1[24] = x47; + out1[25] = x49; + out1[26] = x51; + out1[27] = x53; + out1[28] = x55; + out1[29] = x57; + out1[30] = x59; + out1[31] = x60; +} + +/// The function fiat_secp256k1_scalar_from_bytes deserializes a field element NOT in the Montgomery domain from bytes in little-endian order. +/// +/// Preconditions: +/// 0 ≤ bytes_eval arg1 < m +/// Postconditions: +/// eval out1 mod m = bytes_eval arg1 mod m +/// 0 ≤ eval out1 < m +/// +/// Input Bounds: +/// arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +#[inline] +pub fn fiat_secp256k1_scalar_from_bytes(out1: &mut [u64; 4], arg1: &[u8; 32]) -> () { + let x1: u64 = (((arg1[31]) as u64) << 56); + let x2: u64 = (((arg1[30]) as u64) << 48); + let x3: u64 = (((arg1[29]) as u64) << 40); + let x4: u64 = (((arg1[28]) as u64) << 32); + let x5: u64 = (((arg1[27]) as u64) << 24); + let x6: u64 = (((arg1[26]) as u64) << 16); + let x7: u64 = (((arg1[25]) as u64) << 8); + let x8: u8 = (arg1[24]); + let x9: u64 = (((arg1[23]) as u64) << 56); + let x10: u64 = (((arg1[22]) as u64) << 48); + let x11: u64 = (((arg1[21]) as u64) << 40); + let x12: u64 = (((arg1[20]) as u64) << 32); + let x13: u64 = (((arg1[19]) as u64) << 24); + let x14: u64 = (((arg1[18]) as u64) << 16); + let x15: u64 = (((arg1[17]) as u64) << 8); + let x16: u8 = (arg1[16]); + let x17: u64 = (((arg1[15]) as u64) << 56); + let x18: u64 = (((arg1[14]) as u64) << 48); + let x19: u64 = (((arg1[13]) as u64) << 40); + let x20: u64 = (((arg1[12]) as u64) << 32); + let x21: u64 = (((arg1[11]) as u64) << 24); + let x22: u64 = (((arg1[10]) as u64) << 16); + let x23: u64 = (((arg1[9]) as u64) << 8); + let x24: u8 = (arg1[8]); + let x25: u64 = (((arg1[7]) as u64) << 56); + let x26: u64 = (((arg1[6]) as u64) << 48); + let x27: u64 = (((arg1[5]) as u64) << 40); + let x28: u64 = (((arg1[4]) as u64) << 32); + let x29: u64 = (((arg1[3]) as u64) << 24); + let x30: u64 = (((arg1[2]) as u64) << 16); + let x31: u64 = (((arg1[1]) as u64) << 8); + let x32: u8 = (arg1[0]); + let x33: u64 = (x31 + (x32 as u64)); + let x34: u64 = (x30 + x33); + let x35: u64 = (x29 + x34); + let x36: u64 = (x28 + x35); + let x37: u64 = (x27 + x36); + let x38: u64 = (x26 + x37); + let x39: u64 = (x25 + x38); + let x40: u64 = (x23 + (x24 as u64)); + let x41: u64 = (x22 + x40); + let x42: u64 = (x21 + x41); + let x43: u64 = (x20 + x42); + let x44: u64 = (x19 + x43); + let x45: u64 = (x18 + x44); + let x46: u64 = (x17 + x45); + let x47: u64 = (x15 + (x16 as u64)); + let x48: u64 = (x14 + x47); + let x49: u64 = (x13 + x48); + let x50: u64 = (x12 + x49); + let x51: u64 = (x11 + x50); + let x52: u64 = (x10 + x51); + let x53: u64 = (x9 + x52); + let x54: u64 = (x7 + (x8 as u64)); + let x55: u64 = (x6 + x54); + let x56: u64 = (x5 + x55); + let x57: u64 = (x4 + x56); + let x58: u64 = (x3 + x57); + let x59: u64 = (x2 + x58); + let x60: u64 = (x1 + x59); + out1[0] = x39; + out1[1] = x46; + out1[2] = x53; + out1[3] = x60; +} + +/// The function fiat_secp256k1_scalar_set_one returns the field element one in the Montgomery domain. +/// +/// Postconditions: +/// eval (from_montgomery out1) mod m = 1 mod m +/// 0 ≤ eval out1 < m +/// +#[inline] +pub fn fiat_secp256k1_scalar_set_one(out1: &mut fiat_secp256k1_scalar_montgomery_domain_field_element) -> () { + out1[0] = 0x402da1732fc9bebf; + out1[1] = 0x4551231950b75fc4; + out1[2] = (0x1 as u64); + out1[3] = (0x0 as u64); +} + +/// The function fiat_secp256k1_scalar_msat returns the saturated representation of the prime modulus. +/// +/// Postconditions: +/// twos_complement_eval out1 = m +/// 0 ≤ eval out1 < m +/// +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +#[inline] +pub fn fiat_secp256k1_scalar_msat(out1: &mut [u64; 5]) -> () { + out1[0] = 0xbfd25e8cd0364141; + out1[1] = 0xbaaedce6af48a03b; + out1[2] = 0xfffffffffffffffe; + out1[3] = 0xffffffffffffffff; + out1[4] = (0x0 as u64); +} + +/// The function fiat_secp256k1_scalar_divstep computes a divstep. +/// +/// Preconditions: +/// 0 ≤ eval arg4 < m +/// 0 ≤ eval arg5 < m +/// Postconditions: +/// out1 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then 1 - arg1 else 1 + arg1) +/// twos_complement_eval out2 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then twos_complement_eval arg3 else twos_complement_eval arg2) +/// twos_complement_eval out3 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then ⌊(twos_complement_eval arg3 - twos_complement_eval arg2) / 2⌋ else ⌊(twos_complement_eval arg3 + (twos_complement_eval arg3 mod 2) * twos_complement_eval arg2) / 2⌋) +/// eval (from_montgomery out4) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (2 * eval (from_montgomery arg5)) mod m else (2 * eval (from_montgomery arg4)) mod m) +/// eval (from_montgomery out5) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (eval (from_montgomery arg4) - eval (from_montgomery arg4)) mod m else (eval (from_montgomery arg5) + (twos_complement_eval arg3 mod 2) * eval (from_montgomery arg4)) mod m) +/// 0 ≤ eval out5 < m +/// 0 ≤ eval out5 < m +/// 0 ≤ eval out2 < m +/// 0 ≤ eval out3 < m +/// +/// Input Bounds: +/// arg1: [0x0 ~> 0xffffffffffffffff] +/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// arg4: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// arg5: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// Output Bounds: +/// out1: [0x0 ~> 0xffffffffffffffff] +/// out2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// out3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// out4: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +/// out5: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +#[inline] +pub fn fiat_secp256k1_scalar_divstep(out1: &mut u64, out2: &mut [u64; 5], out3: &mut [u64; 5], out4: &mut [u64; 4], out5: &mut [u64; 4], arg1: u64, arg2: &[u64; 5], arg3: &[u64; 5], arg4: &[u64; 4], arg5: &[u64; 4]) -> () { + let mut x1: u64 = 0; + let mut x2: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x1, &mut x2, 0x0, (!arg1), (0x1 as u64)); + let x3: fiat_secp256k1_scalar_u1 = (((x1 >> 63) as fiat_secp256k1_scalar_u1) & (((arg3[0]) & (0x1 as u64)) as fiat_secp256k1_scalar_u1)); + let mut x4: u64 = 0; + let mut x5: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x4, &mut x5, 0x0, (!arg1), (0x1 as u64)); + let mut x6: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x6, x3, arg1, x4); + let mut x7: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x7, x3, (arg2[0]), (arg3[0])); + let mut x8: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x8, x3, (arg2[1]), (arg3[1])); + let mut x9: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x9, x3, (arg2[2]), (arg3[2])); + let mut x10: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x10, x3, (arg2[3]), (arg3[3])); + let mut x11: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x11, x3, (arg2[4]), (arg3[4])); + let mut x12: u64 = 0; + let mut x13: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x12, &mut x13, 0x0, (0x1 as u64), (!(arg2[0]))); + let mut x14: u64 = 0; + let mut x15: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x14, &mut x15, x13, (0x0 as u64), (!(arg2[1]))); + let mut x16: u64 = 0; + let mut x17: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x16, &mut x17, x15, (0x0 as u64), (!(arg2[2]))); + let mut x18: u64 = 0; + let mut x19: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x18, &mut x19, x17, (0x0 as u64), (!(arg2[3]))); + let mut x20: u64 = 0; + let mut x21: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x20, &mut x21, x19, (0x0 as u64), (!(arg2[4]))); + let mut x22: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x22, x3, (arg3[0]), x12); + let mut x23: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x23, x3, (arg3[1]), x14); + let mut x24: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x24, x3, (arg3[2]), x16); + let mut x25: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x25, x3, (arg3[3]), x18); + let mut x26: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x26, x3, (arg3[4]), x20); + let mut x27: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x27, x3, (arg4[0]), (arg5[0])); + let mut x28: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x28, x3, (arg4[1]), (arg5[1])); + let mut x29: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x29, x3, (arg4[2]), (arg5[2])); + let mut x30: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x30, x3, (arg4[3]), (arg5[3])); + let mut x31: u64 = 0; + let mut x32: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x31, &mut x32, 0x0, x27, x27); + let mut x33: u64 = 0; + let mut x34: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x33, &mut x34, x32, x28, x28); + let mut x35: u64 = 0; + let mut x36: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x35, &mut x36, x34, x29, x29); + let mut x37: u64 = 0; + let mut x38: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x37, &mut x38, x36, x30, x30); + let mut x39: u64 = 0; + let mut x40: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u64(&mut x39, &mut x40, 0x0, x31, 0xbfd25e8cd0364141); + let mut x41: u64 = 0; + let mut x42: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u64(&mut x41, &mut x42, x40, x33, 0xbaaedce6af48a03b); + let mut x43: u64 = 0; + let mut x44: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u64(&mut x43, &mut x44, x42, x35, 0xfffffffffffffffe); + let mut x45: u64 = 0; + let mut x46: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u64(&mut x45, &mut x46, x44, x37, 0xffffffffffffffff); + let mut x47: u64 = 0; + let mut x48: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u64(&mut x47, &mut x48, x46, (x38 as u64), (0x0 as u64)); + let x49: u64 = (arg4[3]); + let x50: u64 = (arg4[2]); + let x51: u64 = (arg4[1]); + let x52: u64 = (arg4[0]); + let mut x53: u64 = 0; + let mut x54: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u64(&mut x53, &mut x54, 0x0, (0x0 as u64), x52); + let mut x55: u64 = 0; + let mut x56: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u64(&mut x55, &mut x56, x54, (0x0 as u64), x51); + let mut x57: u64 = 0; + let mut x58: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u64(&mut x57, &mut x58, x56, (0x0 as u64), x50); + let mut x59: u64 = 0; + let mut x60: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u64(&mut x59, &mut x60, x58, (0x0 as u64), x49); + let mut x61: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x61, x60, (0x0 as u64), 0xffffffffffffffff); + let mut x62: u64 = 0; + let mut x63: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x62, &mut x63, 0x0, x53, (x61 & 0xbfd25e8cd0364141)); + let mut x64: u64 = 0; + let mut x65: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x64, &mut x65, x63, x55, (x61 & 0xbaaedce6af48a03b)); + let mut x66: u64 = 0; + let mut x67: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x66, &mut x67, x65, x57, (x61 & 0xfffffffffffffffe)); + let mut x68: u64 = 0; + let mut x69: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x68, &mut x69, x67, x59, x61); + let mut x70: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x70, x3, (arg5[0]), x62); + let mut x71: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x71, x3, (arg5[1]), x64); + let mut x72: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x72, x3, (arg5[2]), x66); + let mut x73: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x73, x3, (arg5[3]), x68); + let x74: fiat_secp256k1_scalar_u1 = ((x22 & (0x1 as u64)) as fiat_secp256k1_scalar_u1); + let mut x75: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x75, x74, (0x0 as u64), x7); + let mut x76: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x76, x74, (0x0 as u64), x8); + let mut x77: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x77, x74, (0x0 as u64), x9); + let mut x78: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x78, x74, (0x0 as u64), x10); + let mut x79: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x79, x74, (0x0 as u64), x11); + let mut x80: u64 = 0; + let mut x81: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x80, &mut x81, 0x0, x22, x75); + let mut x82: u64 = 0; + let mut x83: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x82, &mut x83, x81, x23, x76); + let mut x84: u64 = 0; + let mut x85: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x84, &mut x85, x83, x24, x77); + let mut x86: u64 = 0; + let mut x87: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x86, &mut x87, x85, x25, x78); + let mut x88: u64 = 0; + let mut x89: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x88, &mut x89, x87, x26, x79); + let mut x90: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x90, x74, (0x0 as u64), x27); + let mut x91: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x91, x74, (0x0 as u64), x28); + let mut x92: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x92, x74, (0x0 as u64), x29); + let mut x93: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x93, x74, (0x0 as u64), x30); + let mut x94: u64 = 0; + let mut x95: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x94, &mut x95, 0x0, x70, x90); + let mut x96: u64 = 0; + let mut x97: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x96, &mut x97, x95, x71, x91); + let mut x98: u64 = 0; + let mut x99: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x98, &mut x99, x97, x72, x92); + let mut x100: u64 = 0; + let mut x101: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x100, &mut x101, x99, x73, x93); + let mut x102: u64 = 0; + let mut x103: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u64(&mut x102, &mut x103, 0x0, x94, 0xbfd25e8cd0364141); + let mut x104: u64 = 0; + let mut x105: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u64(&mut x104, &mut x105, x103, x96, 0xbaaedce6af48a03b); + let mut x106: u64 = 0; + let mut x107: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u64(&mut x106, &mut x107, x105, x98, 0xfffffffffffffffe); + let mut x108: u64 = 0; + let mut x109: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u64(&mut x108, &mut x109, x107, x100, 0xffffffffffffffff); + let mut x110: u64 = 0; + let mut x111: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_subborrowx_u64(&mut x110, &mut x111, x109, (x101 as u64), (0x0 as u64)); + let mut x112: u64 = 0; + let mut x113: fiat_secp256k1_scalar_u1 = 0; + fiat_secp256k1_scalar_addcarryx_u64(&mut x112, &mut x113, 0x0, x6, (0x1 as u64)); + let x114: u64 = ((x80 >> 1) | ((x82 << 63) & 0xffffffffffffffff)); + let x115: u64 = ((x82 >> 1) | ((x84 << 63) & 0xffffffffffffffff)); + let x116: u64 = ((x84 >> 1) | ((x86 << 63) & 0xffffffffffffffff)); + let x117: u64 = ((x86 >> 1) | ((x88 << 63) & 0xffffffffffffffff)); + let x118: u64 = ((x88 & 0x8000000000000000) | (x88 >> 1)); + let mut x119: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x119, x48, x39, x31); + let mut x120: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x120, x48, x41, x33); + let mut x121: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x121, x48, x43, x35); + let mut x122: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x122, x48, x45, x37); + let mut x123: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x123, x111, x102, x94); + let mut x124: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x124, x111, x104, x96); + let mut x125: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x125, x111, x106, x98); + let mut x126: u64 = 0; + fiat_secp256k1_scalar_cmovznz_u64(&mut x126, x111, x108, x100); + *out1 = x112; + out2[0] = x7; + out2[1] = x8; + out2[2] = x9; + out2[3] = x10; + out2[4] = x11; + out3[0] = x114; + out3[1] = x115; + out3[2] = x116; + out3[3] = x117; + out3[4] = x118; + out4[0] = x119; + out4[1] = x120; + out4[2] = x121; + out4[3] = x122; + out5[0] = x123; + out5[1] = x124; + out5[2] = x125; + out5[3] = x126; +} + +/// The function fiat_secp256k1_scalar_divstep_precomp returns the precomputed value for Bernstein-Yang-inversion (in montgomery form). +/// +/// Postconditions: +/// eval (from_montgomery out1) = ⌊(m - 1) / 2⌋^(if ⌊log2 m⌋ + 1 < 46 then ⌊(49 * (⌊log2 m⌋ + 1) + 80) / 17⌋ else ⌊(49 * (⌊log2 m⌋ + 1) + 57) / 17⌋) +/// 0 ≤ eval out1 < m +/// +/// Output Bounds: +/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] +#[inline] +pub fn fiat_secp256k1_scalar_divstep_precomp(out1: &mut [u64; 4]) -> () { + out1[0] = 0xd7431a4d2b9cb4e9; + out1[1] = 0xab67d35a32d9c503; + out1[2] = 0xadf6c7e5859ce35f; + out1[3] = 0x615441451df6c379; +} |