pasta_fp.go

//
// Copyright Coinbase, Inc. All Rights Reserved.
//
// SPDX-License-Identifier: Apache-2.0
//

// Autogenerated: './src/ExtractionOCaml/word_by_word_montgomery' --lang Go pasta_fp 64 '2^254 + 45560315531419706090280762371685220353'
//
// curve description: pasta_fp
//
// machine_wordsize = 64 (from "64")
//
// requested operations: (all)
//
// m = 0x40000000000000000000000000000000224698fc094cf91b992d30ed00000001 (from "2^254 + 45560315531419706090280762371685220353")
//
//
//
// NOTE: In addition to the bounds specified above each function, all
//
//   functions synthesized for this Montgomery arithmetic require the
//
//   input to be strictly less than the prime modulus (m), and also
//
//   require the input to be in the unique saturated representation.
//
//   All functions also ensure that these two properties are true of
//
//   return values.
//
//
//
// Computed values:
//
//   eval z = z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192)
//
//   bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248)
//
//   twos_complement_eval z = let x1 := z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) in
//
//                            if x1 & (2^256-1) < 2^255 then x1 & (2^256-1) else (x1 & (2^256-1)) - 2^256
package fp

import "math/bits"

type fiat_pasta_fp_uint1 uint64 // We use uint64 instead of a more narrow type for performance reasons; see https://github.com/mit-plv/fiat-crypto/pull/1006#issuecomment-892625927
type fiat_pasta_fp_int1 int64   // We use uint64 instead of a more narrow type for performance reasons; see https://github.com/mit-plv/fiat-crypto/pull/1006#issuecomment-892625927

// The type fiat_pasta_fp_montgomery_domain_field_element is a field element in the Montgomery domain.
//
// Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
type fiat_pasta_fp_montgomery_domain_field_element [4]uint64

// The type fiat_pasta_fp_non_montgomery_domain_field_element is a field element NOT in the Montgomery domain.
//
// Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
type fiat_pasta_fp_non_montgomery_domain_field_element [4]uint64

// The function fiat_pasta_fp_addcarryx_u64 is a thin wrapper around bits.Add64 that uses fiat_pasta_fp_uint1 rather than uint64
func fiat_pasta_fp_addcarryx_u64(x uint64, y uint64, carry fiat_pasta_fp_uint1) (uint64, fiat_pasta_fp_uint1) {
	sum, carryOut := bits.Add64(x, y, uint64(carry))
	return sum, fiat_pasta_fp_uint1(carryOut)
}

// The function fiat_pasta_fp_subborrowx_u64 is a thin wrapper around bits.Sub64 that uses fiat_pasta_fp_uint1 rather than uint64
func fiat_pasta_fp_subborrowx_u64(x uint64, y uint64, carry fiat_pasta_fp_uint1) (uint64, fiat_pasta_fp_uint1) {
	sum, carryOut := bits.Sub64(x, y, uint64(carry))
	return sum, fiat_pasta_fp_uint1(carryOut)
}

// The function fiat_pasta_fp_cmovznz_u64 is a single-word conditional move.
//
// Postconditions:
//   out1 = (if arg1 = 0 then arg2 else arg3)
//
// Input Bounds:
//   arg1: [0x0 ~> 0x1]
//   arg2: [0x0 ~> 0xffffffffffffffff]
//   arg3: [0x0 ~> 0xffffffffffffffff]
// Output Bounds:
//   out1: [0x0 ~> 0xffffffffffffffff]
func fiat_pasta_fp_cmovznz_u64(out1 *uint64, arg1 fiat_pasta_fp_uint1, arg2 uint64, arg3 uint64) {
	x1 := arg1
	x2 := (uint64((fiat_pasta_fp_int1(0x0) - fiat_pasta_fp_int1(x1))) & 0xffffffffffffffff)
	x3 := ((x2 & arg3) | ((^x2) & arg2))
	*out1 = x3
}

// The function fiat_pasta_fp_mul multiplies two field elements in the Montgomery domain.
//
// Preconditions:
//   0 ≤ eval arg1 < m
//   0 ≤ eval arg2 < m
// Postconditions:
//   eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg2)) mod m
//   0 ≤ eval out1 < m
//
func fiat_pasta_fp_mul(out1 *fiat_pasta_fp_montgomery_domain_field_element, arg1 *fiat_pasta_fp_montgomery_domain_field_element, arg2 *fiat_pasta_fp_montgomery_domain_field_element) {
	x1 := arg1[1]
	x2 := arg1[2]
	x3 := arg1[3]
	x4 := arg1[0]
	var x5 uint64
	var x6 uint64
	x6, x5 = bits.Mul64(x4, arg2[3])
	var x7 uint64
	var x8 uint64
	x8, x7 = bits.Mul64(x4, arg2[2])
	var x9 uint64
	var x10 uint64
	x10, x9 = bits.Mul64(x4, arg2[1])
	var x11 uint64
	var x12 uint64
	x12, x11 = bits.Mul64(x4, arg2[0])
	var x13 uint64
	var x14 fiat_pasta_fp_uint1
	x13, x14 = fiat_pasta_fp_addcarryx_u64(x12, x9, 0x0)
	var x15 uint64
	var x16 fiat_pasta_fp_uint1
	x15, x16 = fiat_pasta_fp_addcarryx_u64(x10, x7, x14)
	var x17 uint64
	var x18 fiat_pasta_fp_uint1
	x17, x18 = fiat_pasta_fp_addcarryx_u64(x8, x5, x16)
	x19 := (uint64(x18) + x6)
	var x20 uint64
	_, x20 = bits.Mul64(x11, 0x992d30ecffffffff)
	var x22 uint64
	var x23 uint64
	x23, x22 = bits.Mul64(x20, 0x4000000000000000)
	var x24 uint64
	var x25 uint64
	x25, x24 = bits.Mul64(x20, 0x224698fc094cf91b)
	var x26 uint64
	var x27 uint64
	x27, x26 = bits.Mul64(x20, 0x992d30ed00000001)
	var x28 uint64
	var x29 fiat_pasta_fp_uint1
	x28, x29 = fiat_pasta_fp_addcarryx_u64(x27, x24, 0x0)
	x30 := (uint64(x29) + x25)
	var x32 fiat_pasta_fp_uint1
	_, x32 = fiat_pasta_fp_addcarryx_u64(x11, x26, 0x0)
	var x33 uint64
	var x34 fiat_pasta_fp_uint1
	x33, x34 = fiat_pasta_fp_addcarryx_u64(x13, x28, x32)
	var x35 uint64
	var x36 fiat_pasta_fp_uint1
	x35, x36 = fiat_pasta_fp_addcarryx_u64(x15, x30, x34)
	var x37 uint64
	var x38 fiat_pasta_fp_uint1
	x37, x38 = fiat_pasta_fp_addcarryx_u64(x17, x22, x36)
	var x39 uint64
	var x40 fiat_pasta_fp_uint1
	x39, x40 = fiat_pasta_fp_addcarryx_u64(x19, x23, x38)
	var x41 uint64
	var x42 uint64
	x42, x41 = bits.Mul64(x1, arg2[3])
	var x43 uint64
	var x44 uint64
	x44, x43 = bits.Mul64(x1, arg2[2])
	var x45 uint64
	var x46 uint64
	x46, x45 = bits.Mul64(x1, arg2[1])
	var x47 uint64
	var x48 uint64
	x48, x47 = bits.Mul64(x1, arg2[0])
	var x49 uint64
	var x50 fiat_pasta_fp_uint1
	x49, x50 = fiat_pasta_fp_addcarryx_u64(x48, x45, 0x0)
	var x51 uint64
	var x52 fiat_pasta_fp_uint1
	x51, x52 = fiat_pasta_fp_addcarryx_u64(x46, x43, x50)
	var x53 uint64
	var x54 fiat_pasta_fp_uint1
	x53, x54 = fiat_pasta_fp_addcarryx_u64(x44, x41, x52)
	x55 := (uint64(x54) + x42)
	var x56 uint64
	var x57 fiat_pasta_fp_uint1
	x56, x57 = fiat_pasta_fp_addcarryx_u64(x33, x47, 0x0)
	var x58 uint64
	var x59 fiat_pasta_fp_uint1
	x58, x59 = fiat_pasta_fp_addcarryx_u64(x35, x49, x57)
	var x60 uint64
	var x61 fiat_pasta_fp_uint1
	x60, x61 = fiat_pasta_fp_addcarryx_u64(x37, x51, x59)
	var x62 uint64
	var x63 fiat_pasta_fp_uint1
	x62, x63 = fiat_pasta_fp_addcarryx_u64(x39, x53, x61)
	var x64 uint64
	var x65 fiat_pasta_fp_uint1
	x64, x65 = fiat_pasta_fp_addcarryx_u64(uint64(x40), x55, x63)
	var x66 uint64
	_, x66 = bits.Mul64(x56, 0x992d30ecffffffff)
	var x68 uint64
	var x69 uint64
	x69, x68 = bits.Mul64(x66, 0x4000000000000000)
	var x70 uint64
	var x71 uint64
	x71, x70 = bits.Mul64(x66, 0x224698fc094cf91b)
	var x72 uint64
	var x73 uint64
	x73, x72 = bits.Mul64(x66, 0x992d30ed00000001)
	var x74 uint64
	var x75 fiat_pasta_fp_uint1
	x74, x75 = fiat_pasta_fp_addcarryx_u64(x73, x70, 0x0)
	x76 := (uint64(x75) + x71)
	var x78 fiat_pasta_fp_uint1
	_, x78 = fiat_pasta_fp_addcarryx_u64(x56, x72, 0x0)
	var x79 uint64
	var x80 fiat_pasta_fp_uint1
	x79, x80 = fiat_pasta_fp_addcarryx_u64(x58, x74, x78)
	var x81 uint64
	var x82 fiat_pasta_fp_uint1
	x81, x82 = fiat_pasta_fp_addcarryx_u64(x60, x76, x80)
	var x83 uint64
	var x84 fiat_pasta_fp_uint1
	x83, x84 = fiat_pasta_fp_addcarryx_u64(x62, x68, x82)
	var x85 uint64
	var x86 fiat_pasta_fp_uint1
	x85, x86 = fiat_pasta_fp_addcarryx_u64(x64, x69, x84)
	x87 := (uint64(x86) + uint64(x65))
	var x88 uint64
	var x89 uint64
	x89, x88 = bits.Mul64(x2, arg2[3])
	var x90 uint64
	var x91 uint64
	x91, x90 = bits.Mul64(x2, arg2[2])
	var x92 uint64
	var x93 uint64
	x93, x92 = bits.Mul64(x2, arg2[1])
	var x94 uint64
	var x95 uint64
	x95, x94 = bits.Mul64(x2, arg2[0])
	var x96 uint64
	var x97 fiat_pasta_fp_uint1
	x96, x97 = fiat_pasta_fp_addcarryx_u64(x95, x92, 0x0)
	var x98 uint64
	var x99 fiat_pasta_fp_uint1
	x98, x99 = fiat_pasta_fp_addcarryx_u64(x93, x90, x97)
	var x100 uint64
	var x101 fiat_pasta_fp_uint1
	x100, x101 = fiat_pasta_fp_addcarryx_u64(x91, x88, x99)
	x102 := (uint64(x101) + x89)
	var x103 uint64
	var x104 fiat_pasta_fp_uint1
	x103, x104 = fiat_pasta_fp_addcarryx_u64(x79, x94, 0x0)
	var x105 uint64
	var x106 fiat_pasta_fp_uint1
	x105, x106 = fiat_pasta_fp_addcarryx_u64(x81, x96, x104)
	var x107 uint64
	var x108 fiat_pasta_fp_uint1
	x107, x108 = fiat_pasta_fp_addcarryx_u64(x83, x98, x106)
	var x109 uint64
	var x110 fiat_pasta_fp_uint1
	x109, x110 = fiat_pasta_fp_addcarryx_u64(x85, x100, x108)
	var x111 uint64
	var x112 fiat_pasta_fp_uint1
	x111, x112 = fiat_pasta_fp_addcarryx_u64(x87, x102, x110)
	var x113 uint64
	_, x113 = bits.Mul64(x103, 0x992d30ecffffffff)
	var x115 uint64
	var x116 uint64
	x116, x115 = bits.Mul64(x113, 0x4000000000000000)
	var x117 uint64
	var x118 uint64
	x118, x117 = bits.Mul64(x113, 0x224698fc094cf91b)
	var x119 uint64
	var x120 uint64
	x120, x119 = bits.Mul64(x113, 0x992d30ed00000001)
	var x121 uint64
	var x122 fiat_pasta_fp_uint1
	x121, x122 = fiat_pasta_fp_addcarryx_u64(x120, x117, 0x0)
	x123 := (uint64(x122) + x118)
	var x125 fiat_pasta_fp_uint1
	_, x125 = fiat_pasta_fp_addcarryx_u64(x103, x119, 0x0)
	var x126 uint64
	var x127 fiat_pasta_fp_uint1
	x126, x127 = fiat_pasta_fp_addcarryx_u64(x105, x121, x125)
	var x128 uint64
	var x129 fiat_pasta_fp_uint1
	x128, x129 = fiat_pasta_fp_addcarryx_u64(x107, x123, x127)
	var x130 uint64
	var x131 fiat_pasta_fp_uint1
	x130, x131 = fiat_pasta_fp_addcarryx_u64(x109, x115, x129)
	var x132 uint64
	var x133 fiat_pasta_fp_uint1
	x132, x133 = fiat_pasta_fp_addcarryx_u64(x111, x116, x131)
	x134 := (uint64(x133) + uint64(x112))
	var x135 uint64
	var x136 uint64
	x136, x135 = bits.Mul64(x3, arg2[3])
	var x137 uint64
	var x138 uint64
	x138, x137 = bits.Mul64(x3, arg2[2])
	var x139 uint64
	var x140 uint64
	x140, x139 = bits.Mul64(x3, arg2[1])
	var x141 uint64
	var x142 uint64
	x142, x141 = bits.Mul64(x3, arg2[0])
	var x143 uint64
	var x144 fiat_pasta_fp_uint1
	x143, x144 = fiat_pasta_fp_addcarryx_u64(x142, x139, 0x0)
	var x145 uint64
	var x146 fiat_pasta_fp_uint1
	x145, x146 = fiat_pasta_fp_addcarryx_u64(x140, x137, x144)
	var x147 uint64
	var x148 fiat_pasta_fp_uint1
	x147, x148 = fiat_pasta_fp_addcarryx_u64(x138, x135, x146)
	x149 := (uint64(x148) + x136)
	var x150 uint64
	var x151 fiat_pasta_fp_uint1
	x150, x151 = fiat_pasta_fp_addcarryx_u64(x126, x141, 0x0)
	var x152 uint64
	var x153 fiat_pasta_fp_uint1
	x152, x153 = fiat_pasta_fp_addcarryx_u64(x128, x143, x151)
	var x154 uint64
	var x155 fiat_pasta_fp_uint1
	x154, x155 = fiat_pasta_fp_addcarryx_u64(x130, x145, x153)
	var x156 uint64
	var x157 fiat_pasta_fp_uint1
	x156, x157 = fiat_pasta_fp_addcarryx_u64(x132, x147, x155)
	var x158 uint64
	var x159 fiat_pasta_fp_uint1
	x158, x159 = fiat_pasta_fp_addcarryx_u64(x134, x149, x157)
	var x160 uint64
	_, x160 = bits.Mul64(x150, 0x992d30ecffffffff)
	var x162 uint64
	var x163 uint64
	x163, x162 = bits.Mul64(x160, 0x4000000000000000)
	var x164 uint64
	var x165 uint64
	x165, x164 = bits.Mul64(x160, 0x224698fc094cf91b)
	var x166 uint64
	var x167 uint64
	x167, x166 = bits.Mul64(x160, 0x992d30ed00000001)
	var x168 uint64
	var x169 fiat_pasta_fp_uint1
	x168, x169 = fiat_pasta_fp_addcarryx_u64(x167, x164, 0x0)
	x170 := (uint64(x169) + x165)
	var x172 fiat_pasta_fp_uint1
	_, x172 = fiat_pasta_fp_addcarryx_u64(x150, x166, 0x0)
	var x173 uint64
	var x174 fiat_pasta_fp_uint1
	x173, x174 = fiat_pasta_fp_addcarryx_u64(x152, x168, x172)
	var x175 uint64
	var x176 fiat_pasta_fp_uint1
	x175, x176 = fiat_pasta_fp_addcarryx_u64(x154, x170, x174)
	var x177 uint64
	var x178 fiat_pasta_fp_uint1
	x177, x178 = fiat_pasta_fp_addcarryx_u64(x156, x162, x176)
	var x179 uint64
	var x180 fiat_pasta_fp_uint1
	x179, x180 = fiat_pasta_fp_addcarryx_u64(x158, x163, x178)
	x181 := (uint64(x180) + uint64(x159))
	var x182 uint64
	var x183 fiat_pasta_fp_uint1
	x182, x183 = fiat_pasta_fp_subborrowx_u64(x173, 0x992d30ed00000001, 0x0)
	var x184 uint64
	var x185 fiat_pasta_fp_uint1
	x184, x185 = fiat_pasta_fp_subborrowx_u64(x175, 0x224698fc094cf91b, x183)
	var x186 uint64
	var x187 fiat_pasta_fp_uint1
	x186, x187 = fiat_pasta_fp_subborrowx_u64(x177, uint64(0x0), x185)
	var x188 uint64
	var x189 fiat_pasta_fp_uint1
	x188, x189 = fiat_pasta_fp_subborrowx_u64(x179, 0x4000000000000000, x187)
	var x191 fiat_pasta_fp_uint1
	_, x191 = fiat_pasta_fp_subborrowx_u64(x181, uint64(0x0), x189)
	var x192 uint64
	fiat_pasta_fp_cmovznz_u64(&x192, x191, x182, x173)
	var x193 uint64
	fiat_pasta_fp_cmovznz_u64(&x193, x191, x184, x175)
	var x194 uint64
	fiat_pasta_fp_cmovznz_u64(&x194, x191, x186, x177)
	var x195 uint64
	fiat_pasta_fp_cmovznz_u64(&x195, x191, x188, x179)
	out1[0] = x192
	out1[1] = x193
	out1[2] = x194
	out1[3] = x195
}

// The function fiat_pasta_fp_square squares a field element in the Montgomery domain.
//
// Preconditions:
//   0 ≤ eval arg1 < m
// Postconditions:
//   eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg1)) mod m
//   0 ≤ eval out1 < m
//
func fiat_pasta_fp_square(out1 *fiat_pasta_fp_montgomery_domain_field_element, arg1 *fiat_pasta_fp_montgomery_domain_field_element) {
	x1 := arg1[1]
	x2 := arg1[2]
	x3 := arg1[3]
	x4 := arg1[0]
	var x5 uint64
	var x6 uint64
	x6, x5 = bits.Mul64(x4, arg1[3])
	var x7 uint64
	var x8 uint64
	x8, x7 = bits.Mul64(x4, arg1[2])
	var x9 uint64
	var x10 uint64
	x10, x9 = bits.Mul64(x4, arg1[1])
	var x11 uint64
	var x12 uint64
	x12, x11 = bits.Mul64(x4, arg1[0])
	var x13 uint64
	var x14 fiat_pasta_fp_uint1
	x13, x14 = fiat_pasta_fp_addcarryx_u64(x12, x9, 0x0)
	var x15 uint64
	var x16 fiat_pasta_fp_uint1
	x15, x16 = fiat_pasta_fp_addcarryx_u64(x10, x7, x14)
	var x17 uint64
	var x18 fiat_pasta_fp_uint1
	x17, x18 = fiat_pasta_fp_addcarryx_u64(x8, x5, x16)
	x19 := (uint64(x18) + x6)
	var x20 uint64
	_, x20 = bits.Mul64(x11, 0x992d30ecffffffff)
	var x22 uint64
	var x23 uint64
	x23, x22 = bits.Mul64(x20, 0x4000000000000000)
	var x24 uint64
	var x25 uint64
	x25, x24 = bits.Mul64(x20, 0x224698fc094cf91b)
	var x26 uint64
	var x27 uint64
	x27, x26 = bits.Mul64(x20, 0x992d30ed00000001)
	var x28 uint64
	var x29 fiat_pasta_fp_uint1
	x28, x29 = fiat_pasta_fp_addcarryx_u64(x27, x24, 0x0)
	x30 := (uint64(x29) + x25)
	var x32 fiat_pasta_fp_uint1
	_, x32 = fiat_pasta_fp_addcarryx_u64(x11, x26, 0x0)
	var x33 uint64
	var x34 fiat_pasta_fp_uint1
	x33, x34 = fiat_pasta_fp_addcarryx_u64(x13, x28, x32)
	var x35 uint64
	var x36 fiat_pasta_fp_uint1
	x35, x36 = fiat_pasta_fp_addcarryx_u64(x15, x30, x34)
	var x37 uint64
	var x38 fiat_pasta_fp_uint1
	x37, x38 = fiat_pasta_fp_addcarryx_u64(x17, x22, x36)
	var x39 uint64
	var x40 fiat_pasta_fp_uint1
	x39, x40 = fiat_pasta_fp_addcarryx_u64(x19, x23, x38)
	var x41 uint64
	var x42 uint64
	x42, x41 = bits.Mul64(x1, arg1[3])
	var x43 uint64
	var x44 uint64
	x44, x43 = bits.Mul64(x1, arg1[2])
	var x45 uint64
	var x46 uint64
	x46, x45 = bits.Mul64(x1, arg1[1])
	var x47 uint64
	var x48 uint64
	x48, x47 = bits.Mul64(x1, arg1[0])
	var x49 uint64
	var x50 fiat_pasta_fp_uint1
	x49, x50 = fiat_pasta_fp_addcarryx_u64(x48, x45, 0x0)
	var x51 uint64
	var x52 fiat_pasta_fp_uint1
	x51, x52 = fiat_pasta_fp_addcarryx_u64(x46, x43, x50)
	var x53 uint64
	var x54 fiat_pasta_fp_uint1
	x53, x54 = fiat_pasta_fp_addcarryx_u64(x44, x41, x52)
	x55 := (uint64(x54) + x42)
	var x56 uint64
	var x57 fiat_pasta_fp_uint1
	x56, x57 = fiat_pasta_fp_addcarryx_u64(x33, x47, 0x0)
	var x58 uint64
	var x59 fiat_pasta_fp_uint1
	x58, x59 = fiat_pasta_fp_addcarryx_u64(x35, x49, x57)
	var x60 uint64
	var x61 fiat_pasta_fp_uint1
	x60, x61 = fiat_pasta_fp_addcarryx_u64(x37, x51, x59)
	var x62 uint64
	var x63 fiat_pasta_fp_uint1
	x62, x63 = fiat_pasta_fp_addcarryx_u64(x39, x53, x61)
	var x64 uint64
	var x65 fiat_pasta_fp_uint1
	x64, x65 = fiat_pasta_fp_addcarryx_u64(uint64(x40), x55, x63)
	var x66 uint64
	_, x66 = bits.Mul64(x56, 0x992d30ecffffffff)
	var x68 uint64
	var x69 uint64
	x69, x68 = bits.Mul64(x66, 0x4000000000000000)
	var x70 uint64
	var x71 uint64
	x71, x70 = bits.Mul64(x66, 0x224698fc094cf91b)
	var x72 uint64
	var x73 uint64
	x73, x72 = bits.Mul64(x66, 0x992d30ed00000001)
	var x74 uint64
	var x75 fiat_pasta_fp_uint1
	x74, x75 = fiat_pasta_fp_addcarryx_u64(x73, x70, 0x0)
	x76 := (uint64(x75) + x71)
	var x78 fiat_pasta_fp_uint1
	_, x78 = fiat_pasta_fp_addcarryx_u64(x56, x72, 0x0)
	var x79 uint64
	var x80 fiat_pasta_fp_uint1
	x79, x80 = fiat_pasta_fp_addcarryx_u64(x58, x74, x78)
	var x81 uint64
	var x82 fiat_pasta_fp_uint1
	x81, x82 = fiat_pasta_fp_addcarryx_u64(x60, x76, x80)
	var x83 uint64
	var x84 fiat_pasta_fp_uint1
	x83, x84 = fiat_pasta_fp_addcarryx_u64(x62, x68, x82)
	var x85 uint64
	var x86 fiat_pasta_fp_uint1
	x85, x86 = fiat_pasta_fp_addcarryx_u64(x64, x69, x84)
	x87 := (uint64(x86) + uint64(x65))
	var x88 uint64
	var x89 uint64
	x89, x88 = bits.Mul64(x2, arg1[3])
	var x90 uint64
	var x91 uint64
	x91, x90 = bits.Mul64(x2, arg1[2])
	var x92 uint64
	var x93 uint64
	x93, x92 = bits.Mul64(x2, arg1[1])
	var x94 uint64
	var x95 uint64
	x95, x94 = bits.Mul64(x2, arg1[0])
	var x96 uint64
	var x97 fiat_pasta_fp_uint1
	x96, x97 = fiat_pasta_fp_addcarryx_u64(x95, x92, 0x0)
	var x98 uint64
	var x99 fiat_pasta_fp_uint1
	x98, x99 = fiat_pasta_fp_addcarryx_u64(x93, x90, x97)
	var x100 uint64
	var x101 fiat_pasta_fp_uint1
	x100, x101 = fiat_pasta_fp_addcarryx_u64(x91, x88, x99)
	x102 := (uint64(x101) + x89)
	var x103 uint64
	var x104 fiat_pasta_fp_uint1
	x103, x104 = fiat_pasta_fp_addcarryx_u64(x79, x94, 0x0)
	var x105 uint64
	var x106 fiat_pasta_fp_uint1
	x105, x106 = fiat_pasta_fp_addcarryx_u64(x81, x96, x104)
	var x107 uint64
	var x108 fiat_pasta_fp_uint1
	x107, x108 = fiat_pasta_fp_addcarryx_u64(x83, x98, x106)
	var x109 uint64
	var x110 fiat_pasta_fp_uint1
	x109, x110 = fiat_pasta_fp_addcarryx_u64(x85, x100, x108)
	var x111 uint64
	var x112 fiat_pasta_fp_uint1
	x111, x112 = fiat_pasta_fp_addcarryx_u64(x87, x102, x110)
	var x113 uint64
	_, x113 = bits.Mul64(x103, 0x992d30ecffffffff)
	var x115 uint64
	var x116 uint64
	x116, x115 = bits.Mul64(x113, 0x4000000000000000)
	var x117 uint64
	var x118 uint64
	x118, x117 = bits.Mul64(x113, 0x224698fc094cf91b)
	var x119 uint64
	var x120 uint64
	x120, x119 = bits.Mul64(x113, 0x992d30ed00000001)
	var x121 uint64
	var x122 fiat_pasta_fp_uint1
	x121, x122 = fiat_pasta_fp_addcarryx_u64(x120, x117, 0x0)
	x123 := (uint64(x122) + x118)
	var x125 fiat_pasta_fp_uint1
	_, x125 = fiat_pasta_fp_addcarryx_u64(x103, x119, 0x0)
	var x126 uint64
	var x127 fiat_pasta_fp_uint1
	x126, x127 = fiat_pasta_fp_addcarryx_u64(x105, x121, x125)
	var x128 uint64
	var x129 fiat_pasta_fp_uint1
	x128, x129 = fiat_pasta_fp_addcarryx_u64(x107, x123, x127)
	var x130 uint64
	var x131 fiat_pasta_fp_uint1
	x130, x131 = fiat_pasta_fp_addcarryx_u64(x109, x115, x129)
	var x132 uint64
	var x133 fiat_pasta_fp_uint1
	x132, x133 = fiat_pasta_fp_addcarryx_u64(x111, x116, x131)
	x134 := (uint64(x133) + uint64(x112))
	var x135 uint64
	var x136 uint64
	x136, x135 = bits.Mul64(x3, arg1[3])
	var x137 uint64
	var x138 uint64
	x138, x137 = bits.Mul64(x3, arg1[2])
	var x139 uint64
	var x140 uint64
	x140, x139 = bits.Mul64(x3, arg1[1])
	var x141 uint64
	var x142 uint64
	x142, x141 = bits.Mul64(x3, arg1[0])
	var x143 uint64
	var x144 fiat_pasta_fp_uint1
	x143, x144 = fiat_pasta_fp_addcarryx_u64(x142, x139, 0x0)
	var x145 uint64
	var x146 fiat_pasta_fp_uint1
	x145, x146 = fiat_pasta_fp_addcarryx_u64(x140, x137, x144)
	var x147 uint64
	var x148 fiat_pasta_fp_uint1
	x147, x148 = fiat_pasta_fp_addcarryx_u64(x138, x135, x146)
	x149 := (uint64(x148) + x136)
	var x150 uint64
	var x151 fiat_pasta_fp_uint1
	x150, x151 = fiat_pasta_fp_addcarryx_u64(x126, x141, 0x0)
	var x152 uint64
	var x153 fiat_pasta_fp_uint1
	x152, x153 = fiat_pasta_fp_addcarryx_u64(x128, x143, x151)
	var x154 uint64
	var x155 fiat_pasta_fp_uint1
	x154, x155 = fiat_pasta_fp_addcarryx_u64(x130, x145, x153)
	var x156 uint64
	var x157 fiat_pasta_fp_uint1
	x156, x157 = fiat_pasta_fp_addcarryx_u64(x132, x147, x155)
	var x158 uint64
	var x159 fiat_pasta_fp_uint1
	x158, x159 = fiat_pasta_fp_addcarryx_u64(x134, x149, x157)
	var x160 uint64
	_, x160 = bits.Mul64(x150, 0x992d30ecffffffff)
	var x162 uint64
	var x163 uint64
	x163, x162 = bits.Mul64(x160, 0x4000000000000000)
	var x164 uint64
	var x165 uint64
	x165, x164 = bits.Mul64(x160, 0x224698fc094cf91b)
	var x166 uint64
	var x167 uint64
	x167, x166 = bits.Mul64(x160, 0x992d30ed00000001)
	var x168 uint64
	var x169 fiat_pasta_fp_uint1
	x168, x169 = fiat_pasta_fp_addcarryx_u64(x167, x164, 0x0)
	x170 := (uint64(x169) + x165)
	var x172 fiat_pasta_fp_uint1
	_, x172 = fiat_pasta_fp_addcarryx_u64(x150, x166, 0x0)
	var x173 uint64
	var x174 fiat_pasta_fp_uint1
	x173, x174 = fiat_pasta_fp_addcarryx_u64(x152, x168, x172)
	var x175 uint64
	var x176 fiat_pasta_fp_uint1
	x175, x176 = fiat_pasta_fp_addcarryx_u64(x154, x170, x174)
	var x177 uint64
	var x178 fiat_pasta_fp_uint1
	x177, x178 = fiat_pasta_fp_addcarryx_u64(x156, x162, x176)
	var x179 uint64
	var x180 fiat_pasta_fp_uint1
	x179, x180 = fiat_pasta_fp_addcarryx_u64(x158, x163, x178)
	x181 := (uint64(x180) + uint64(x159))
	var x182 uint64
	var x183 fiat_pasta_fp_uint1
	x182, x183 = fiat_pasta_fp_subborrowx_u64(x173, 0x992d30ed00000001, 0x0)
	var x184 uint64
	var x185 fiat_pasta_fp_uint1
	x184, x185 = fiat_pasta_fp_subborrowx_u64(x175, 0x224698fc094cf91b, x183)
	var x186 uint64
	var x187 fiat_pasta_fp_uint1
	x186, x187 = fiat_pasta_fp_subborrowx_u64(x177, uint64(0x0), x185)
	var x188 uint64
	var x189 fiat_pasta_fp_uint1
	x188, x189 = fiat_pasta_fp_subborrowx_u64(x179, 0x4000000000000000, x187)
	var x191 fiat_pasta_fp_uint1
	_, x191 = fiat_pasta_fp_subborrowx_u64(x181, uint64(0x0), x189)
	var x192 uint64
	fiat_pasta_fp_cmovznz_u64(&x192, x191, x182, x173)
	var x193 uint64
	fiat_pasta_fp_cmovznz_u64(&x193, x191, x184, x175)
	var x194 uint64
	fiat_pasta_fp_cmovznz_u64(&x194, x191, x186, x177)
	var x195 uint64
	fiat_pasta_fp_cmovznz_u64(&x195, x191, x188, x179)
	out1[0] = x192
	out1[1] = x193
	out1[2] = x194
	out1[3] = x195
}

// The function fiat_pasta_fp_add adds two field elements in the Montgomery domain.
//
// Preconditions:
//   0 ≤ eval arg1 < m
//   0 ≤ eval arg2 < m
// Postconditions:
//   eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) + eval (from_montgomery arg2)) mod m
//   0 ≤ eval out1 < m
//
func fiat_pasta_fp_add(out1 *fiat_pasta_fp_montgomery_domain_field_element, arg1 *fiat_pasta_fp_montgomery_domain_field_element, arg2 *fiat_pasta_fp_montgomery_domain_field_element) {
	var x1 uint64
	var x2 fiat_pasta_fp_uint1
	x1, x2 = fiat_pasta_fp_addcarryx_u64(arg1[0], arg2[0], 0x0)
	var x3 uint64
	var x4 fiat_pasta_fp_uint1
	x3, x4 = fiat_pasta_fp_addcarryx_u64(arg1[1], arg2[1], x2)
	var x5 uint64
	var x6 fiat_pasta_fp_uint1
	x5, x6 = fiat_pasta_fp_addcarryx_u64(arg1[2], arg2[2], x4)
	var x7 uint64
	var x8 fiat_pasta_fp_uint1
	x7, x8 = fiat_pasta_fp_addcarryx_u64(arg1[3], arg2[3], x6)
	var x9 uint64
	var x10 fiat_pasta_fp_uint1
	x9, x10 = fiat_pasta_fp_subborrowx_u64(x1, 0x992d30ed00000001, 0x0)
	var x11 uint64
	var x12 fiat_pasta_fp_uint1
	x11, x12 = fiat_pasta_fp_subborrowx_u64(x3, 0x224698fc094cf91b, x10)
	var x13 uint64
	var x14 fiat_pasta_fp_uint1
	x13, x14 = fiat_pasta_fp_subborrowx_u64(x5, uint64(0x0), x12)
	var x15 uint64
	var x16 fiat_pasta_fp_uint1
	x15, x16 = fiat_pasta_fp_subborrowx_u64(x7, 0x4000000000000000, x14)
	var x18 fiat_pasta_fp_uint1
	_, x18 = fiat_pasta_fp_subborrowx_u64(uint64(x8), uint64(0x0), x16)
	var x19 uint64
	fiat_pasta_fp_cmovznz_u64(&x19, x18, x9, x1)
	var x20 uint64
	fiat_pasta_fp_cmovznz_u64(&x20, x18, x11, x3)
	var x21 uint64
	fiat_pasta_fp_cmovznz_u64(&x21, x18, x13, x5)
	var x22 uint64
	fiat_pasta_fp_cmovznz_u64(&x22, x18, x15, x7)
	out1[0] = x19
	out1[1] = x20
	out1[2] = x21
	out1[3] = x22
}

// The function fiat_pasta_fp_sub subtracts two field elements in the Montgomery domain.
//
// Preconditions:
//   0 ≤ eval arg1 < m
//   0 ≤ eval arg2 < m
// Postconditions:
//   eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) - eval (from_montgomery arg2)) mod m
//   0 ≤ eval out1 < m
//
func fiat_pasta_fp_sub(out1 *fiat_pasta_fp_montgomery_domain_field_element, arg1 *fiat_pasta_fp_montgomery_domain_field_element, arg2 *fiat_pasta_fp_montgomery_domain_field_element) {
	var x1 uint64
	var x2 fiat_pasta_fp_uint1
	x1, x2 = fiat_pasta_fp_subborrowx_u64(arg1[0], arg2[0], 0x0)
	var x3 uint64
	var x4 fiat_pasta_fp_uint1
	x3, x4 = fiat_pasta_fp_subborrowx_u64(arg1[1], arg2[1], x2)
	var x5 uint64
	var x6 fiat_pasta_fp_uint1
	x5, x6 = fiat_pasta_fp_subborrowx_u64(arg1[2], arg2[2], x4)
	var x7 uint64
	var x8 fiat_pasta_fp_uint1
	x7, x8 = fiat_pasta_fp_subborrowx_u64(arg1[3], arg2[3], x6)
	var x9 uint64
	fiat_pasta_fp_cmovznz_u64(&x9, x8, uint64(0x0), 0xffffffffffffffff)
	var x10 uint64
	var x11 fiat_pasta_fp_uint1
	x10, x11 = fiat_pasta_fp_addcarryx_u64(x1, (x9 & 0x992d30ed00000001), 0x0)
	var x12 uint64
	var x13 fiat_pasta_fp_uint1
	x12, x13 = fiat_pasta_fp_addcarryx_u64(x3, (x9 & 0x224698fc094cf91b), x11)
	var x14 uint64
	var x15 fiat_pasta_fp_uint1
	x14, x15 = fiat_pasta_fp_addcarryx_u64(x5, uint64(0x0), x13)
	var x16 uint64
	x16, _ = fiat_pasta_fp_addcarryx_u64(x7, (x9 & 0x4000000000000000), x15)
	out1[0] = x10
	out1[1] = x12
	out1[2] = x14
	out1[3] = x16
}

// The function fiat_pasta_fp_opp negates a field element in the Montgomery domain.
//
// Preconditions:
//   0 ≤ eval arg1 < m
// Postconditions:
//   eval (from_montgomery out1) mod m = -eval (from_montgomery arg1) mod m
//   0 ≤ eval out1 < m
//
func fiat_pasta_fp_opp(out1 *fiat_pasta_fp_montgomery_domain_field_element, arg1 *fiat_pasta_fp_montgomery_domain_field_element) {
	var x1 uint64
	var x2 fiat_pasta_fp_uint1
	x1, x2 = fiat_pasta_fp_subborrowx_u64(uint64(0x0), arg1[0], 0x0)
	var x3 uint64
	var x4 fiat_pasta_fp_uint1
	x3, x4 = fiat_pasta_fp_subborrowx_u64(uint64(0x0), arg1[1], x2)
	var x5 uint64
	var x6 fiat_pasta_fp_uint1
	x5, x6 = fiat_pasta_fp_subborrowx_u64(uint64(0x0), arg1[2], x4)
	var x7 uint64
	var x8 fiat_pasta_fp_uint1
	x7, x8 = fiat_pasta_fp_subborrowx_u64(uint64(0x0), arg1[3], x6)
	var x9 uint64
	fiat_pasta_fp_cmovznz_u64(&x9, x8, uint64(0x0), 0xffffffffffffffff)
	var x10 uint64
	var x11 fiat_pasta_fp_uint1
	x10, x11 = fiat_pasta_fp_addcarryx_u64(x1, (x9 & 0x992d30ed00000001), 0x0)
	var x12 uint64
	var x13 fiat_pasta_fp_uint1
	x12, x13 = fiat_pasta_fp_addcarryx_u64(x3, (x9 & 0x224698fc094cf91b), x11)
	var x14 uint64
	var x15 fiat_pasta_fp_uint1
	x14, x15 = fiat_pasta_fp_addcarryx_u64(x5, uint64(0x0), x13)
	var x16 uint64
	x16, _ = fiat_pasta_fp_addcarryx_u64(x7, (x9 & 0x4000000000000000), x15)
	out1[0] = x10
	out1[1] = x12
	out1[2] = x14
	out1[3] = x16
}

// The function fiat_pasta_fp_from_montgomery translates a field element out of the Montgomery domain.
//
// Preconditions:
//   0 ≤ eval arg1 < m
// Postconditions:
//   eval out1 mod m = (eval arg1 * ((2^64)⁻¹ mod m)^4) mod m
//   0 ≤ eval out1 < m
//
func fiat_pasta_fp_from_montgomery(out1 *fiat_pasta_fp_non_montgomery_domain_field_element, arg1 *fiat_pasta_fp_montgomery_domain_field_element) {
	x1 := arg1[0]
	var x2 uint64
	_, x2 = bits.Mul64(x1, 0x992d30ecffffffff)
	var x4 uint64
	var x5 uint64
	x5, x4 = bits.Mul64(x2, 0x4000000000000000)
	var x6 uint64
	var x7 uint64
	x7, x6 = bits.Mul64(x2, 0x224698fc094cf91b)
	var x8 uint64
	var x9 uint64
	x9, x8 = bits.Mul64(x2, 0x992d30ed00000001)
	var x10 uint64
	var x11 fiat_pasta_fp_uint1
	x10, x11 = fiat_pasta_fp_addcarryx_u64(x9, x6, 0x0)
	var x13 fiat_pasta_fp_uint1
	_, x13 = fiat_pasta_fp_addcarryx_u64(x1, x8, 0x0)
	var x14 uint64
	var x15 fiat_pasta_fp_uint1
	x14, x15 = fiat_pasta_fp_addcarryx_u64(uint64(0x0), x10, x13)
	var x16 uint64
	var x17 fiat_pasta_fp_uint1
	x16, x17 = fiat_pasta_fp_addcarryx_u64(x14, arg1[1], 0x0)
	var x18 uint64
	_, x18 = bits.Mul64(x16, 0x992d30ecffffffff)
	var x20 uint64
	var x21 uint64
	x21, x20 = bits.Mul64(x18, 0x4000000000000000)
	var x22 uint64
	var x23 uint64
	x23, x22 = bits.Mul64(x18, 0x224698fc094cf91b)
	var x24 uint64
	var x25 uint64
	x25, x24 = bits.Mul64(x18, 0x992d30ed00000001)
	var x26 uint64
	var x27 fiat_pasta_fp_uint1
	x26, x27 = fiat_pasta_fp_addcarryx_u64(x25, x22, 0x0)
	var x29 fiat_pasta_fp_uint1
	_, x29 = fiat_pasta_fp_addcarryx_u64(x16, x24, 0x0)
	var x30 uint64
	var x31 fiat_pasta_fp_uint1
	x30, x31 = fiat_pasta_fp_addcarryx_u64((uint64(x17) + (uint64(x15) + (uint64(x11) + x7))), x26, x29)
	var x32 uint64
	var x33 fiat_pasta_fp_uint1
	x32, x33 = fiat_pasta_fp_addcarryx_u64(x4, (uint64(x27) + x23), x31)
	var x34 uint64
	var x35 fiat_pasta_fp_uint1
	x34, x35 = fiat_pasta_fp_addcarryx_u64(x5, x20, x33)
	var x36 uint64
	var x37 fiat_pasta_fp_uint1
	x36, x37 = fiat_pasta_fp_addcarryx_u64(x30, arg1[2], 0x0)
	var x38 uint64
	var x39 fiat_pasta_fp_uint1
	x38, x39 = fiat_pasta_fp_addcarryx_u64(x32, uint64(0x0), x37)
	var x40 uint64
	var x41 fiat_pasta_fp_uint1
	x40, x41 = fiat_pasta_fp_addcarryx_u64(x34, uint64(0x0), x39)
	var x42 uint64
	_, x42 = bits.Mul64(x36, 0x992d30ecffffffff)
	var x44 uint64
	var x45 uint64
	x45, x44 = bits.Mul64(x42, 0x4000000000000000)
	var x46 uint64
	var x47 uint64
	x47, x46 = bits.Mul64(x42, 0x224698fc094cf91b)
	var x48 uint64
	var x49 uint64
	x49, x48 = bits.Mul64(x42, 0x992d30ed00000001)
	var x50 uint64
	var x51 fiat_pasta_fp_uint1
	x50, x51 = fiat_pasta_fp_addcarryx_u64(x49, x46, 0x0)
	var x53 fiat_pasta_fp_uint1
	_, x53 = fiat_pasta_fp_addcarryx_u64(x36, x48, 0x0)
	var x54 uint64
	var x55 fiat_pasta_fp_uint1
	x54, x55 = fiat_pasta_fp_addcarryx_u64(x38, x50, x53)
	var x56 uint64
	var x57 fiat_pasta_fp_uint1
	x56, x57 = fiat_pasta_fp_addcarryx_u64(x40, (uint64(x51) + x47), x55)
	var x58 uint64
	var x59 fiat_pasta_fp_uint1
	x58, x59 = fiat_pasta_fp_addcarryx_u64((uint64(x41) + (uint64(x35) + x21)), x44, x57)
	var x60 uint64
	var x61 fiat_pasta_fp_uint1
	x60, x61 = fiat_pasta_fp_addcarryx_u64(x54, arg1[3], 0x0)
	var x62 uint64
	var x63 fiat_pasta_fp_uint1
	x62, x63 = fiat_pasta_fp_addcarryx_u64(x56, uint64(0x0), x61)
	var x64 uint64
	var x65 fiat_pasta_fp_uint1
	x64, x65 = fiat_pasta_fp_addcarryx_u64(x58, uint64(0x0), x63)
	var x66 uint64
	_, x66 = bits.Mul64(x60, 0x992d30ecffffffff)
	var x68 uint64
	var x69 uint64
	x69, x68 = bits.Mul64(x66, 0x4000000000000000)
	var x70 uint64
	var x71 uint64
	x71, x70 = bits.Mul64(x66, 0x224698fc094cf91b)
	var x72 uint64
	var x73 uint64
	x73, x72 = bits.Mul64(x66, 0x992d30ed00000001)
	var x74 uint64
	var x75 fiat_pasta_fp_uint1
	x74, x75 = fiat_pasta_fp_addcarryx_u64(x73, x70, 0x0)
	var x77 fiat_pasta_fp_uint1
	_, x77 = fiat_pasta_fp_addcarryx_u64(x60, x72, 0x0)
	var x78 uint64
	var x79 fiat_pasta_fp_uint1
	x78, x79 = fiat_pasta_fp_addcarryx_u64(x62, x74, x77)
	var x80 uint64
	var x81 fiat_pasta_fp_uint1
	x80, x81 = fiat_pasta_fp_addcarryx_u64(x64, (uint64(x75) + x71), x79)
	var x82 uint64
	var x83 fiat_pasta_fp_uint1
	x82, x83 = fiat_pasta_fp_addcarryx_u64((uint64(x65) + (uint64(x59) + x45)), x68, x81)
	x84 := (uint64(x83) + x69)
	var x85 uint64
	var x86 fiat_pasta_fp_uint1
	x85, x86 = fiat_pasta_fp_subborrowx_u64(x78, 0x992d30ed00000001, 0x0)
	var x87 uint64
	var x88 fiat_pasta_fp_uint1
	x87, x88 = fiat_pasta_fp_subborrowx_u64(x80, 0x224698fc094cf91b, x86)
	var x89 uint64
	var x90 fiat_pasta_fp_uint1
	x89, x90 = fiat_pasta_fp_subborrowx_u64(x82, uint64(0x0), x88)
	var x91 uint64
	var x92 fiat_pasta_fp_uint1
	x91, x92 = fiat_pasta_fp_subborrowx_u64(x84, 0x4000000000000000, x90)
	var x94 fiat_pasta_fp_uint1
	_, x94 = fiat_pasta_fp_subborrowx_u64(uint64(0x0), uint64(0x0), x92)
	var x95 uint64
	fiat_pasta_fp_cmovznz_u64(&x95, x94, x85, x78)
	var x96 uint64
	fiat_pasta_fp_cmovznz_u64(&x96, x94, x87, x80)
	var x97 uint64
	fiat_pasta_fp_cmovznz_u64(&x97, x94, x89, x82)
	var x98 uint64
	fiat_pasta_fp_cmovznz_u64(&x98, x94, x91, x84)
	out1[0] = x95
	out1[1] = x96
	out1[2] = x97
	out1[3] = x98
}

// The function fiat_pasta_fp_to_montgomery translates a field element into the Montgomery domain.
//
// Preconditions:
//   0 ≤ eval arg1 < m
// Postconditions:
//   eval (from_montgomery out1) mod m = eval arg1 mod m
//   0 ≤ eval out1 < m
//
func fiat_pasta_fp_to_montgomery(out1 *fiat_pasta_fp_montgomery_domain_field_element, arg1 *fiat_pasta_fp_non_montgomery_domain_field_element) {
	x1 := arg1[1]
	x2 := arg1[2]
	x3 := arg1[3]
	x4 := arg1[0]
	var x5 uint64
	var x6 uint64
	x6, x5 = bits.Mul64(x4, 0x96d41af7b9cb714)
	var x7 uint64
	var x8 uint64
	x8, x7 = bits.Mul64(x4, 0x7797a99bc3c95d18)
	var x9 uint64
	var x10 uint64
	x10, x9 = bits.Mul64(x4, 0xd7d30dbd8b0de0e7)
	var x11 uint64
	var x12 uint64
	x12, x11 = bits.Mul64(x4, 0x8c78ecb30000000f)
	var x13 uint64
	var x14 fiat_pasta_fp_uint1
	x13, x14 = fiat_pasta_fp_addcarryx_u64(x12, x9, 0x0)
	var x15 uint64
	var x16 fiat_pasta_fp_uint1
	x15, x16 = fiat_pasta_fp_addcarryx_u64(x10, x7, x14)
	var x17 uint64
	var x18 fiat_pasta_fp_uint1
	x17, x18 = fiat_pasta_fp_addcarryx_u64(x8, x5, x16)
	var x19 uint64
	_, x19 = bits.Mul64(x11, 0x992d30ecffffffff)
	var x21 uint64
	var x22 uint64
	x22, x21 = bits.Mul64(x19, 0x4000000000000000)
	var x23 uint64
	var x24 uint64
	x24, x23 = bits.Mul64(x19, 0x224698fc094cf91b)
	var x25 uint64
	var x26 uint64
	x26, x25 = bits.Mul64(x19, 0x992d30ed00000001)
	var x27 uint64
	var x28 fiat_pasta_fp_uint1
	x27, x28 = fiat_pasta_fp_addcarryx_u64(x26, x23, 0x0)
	var x30 fiat_pasta_fp_uint1
	_, x30 = fiat_pasta_fp_addcarryx_u64(x11, x25, 0x0)
	var x31 uint64
	var x32 fiat_pasta_fp_uint1
	x31, x32 = fiat_pasta_fp_addcarryx_u64(x13, x27, x30)
	var x33 uint64
	var x34 fiat_pasta_fp_uint1
	x33, x34 = fiat_pasta_fp_addcarryx_u64(x15, (uint64(x28) + x24), x32)
	var x35 uint64
	var x36 fiat_pasta_fp_uint1
	x35, x36 = fiat_pasta_fp_addcarryx_u64(x17, x21, x34)
	var x37 uint64
	var x38 uint64
	x38, x37 = bits.Mul64(x1, 0x96d41af7b9cb714)
	var x39 uint64
	var x40 uint64
	x40, x39 = bits.Mul64(x1, 0x7797a99bc3c95d18)
	var x41 uint64
	var x42 uint64
	x42, x41 = bits.Mul64(x1, 0xd7d30dbd8b0de0e7)
	var x43 uint64
	var x44 uint64
	x44, x43 = bits.Mul64(x1, 0x8c78ecb30000000f)
	var x45 uint64
	var x46 fiat_pasta_fp_uint1
	x45, x46 = fiat_pasta_fp_addcarryx_u64(x44, x41, 0x0)
	var x47 uint64
	var x48 fiat_pasta_fp_uint1
	x47, x48 = fiat_pasta_fp_addcarryx_u64(x42, x39, x46)
	var x49 uint64
	var x50 fiat_pasta_fp_uint1
	x49, x50 = fiat_pasta_fp_addcarryx_u64(x40, x37, x48)
	var x51 uint64
	var x52 fiat_pasta_fp_uint1
	x51, x52 = fiat_pasta_fp_addcarryx_u64(x31, x43, 0x0)
	var x53 uint64
	var x54 fiat_pasta_fp_uint1
	x53, x54 = fiat_pasta_fp_addcarryx_u64(x33, x45, x52)
	var x55 uint64
	var x56 fiat_pasta_fp_uint1
	x55, x56 = fiat_pasta_fp_addcarryx_u64(x35, x47, x54)
	var x57 uint64
	var x58 fiat_pasta_fp_uint1
	x57, x58 = fiat_pasta_fp_addcarryx_u64(((uint64(x36) + (uint64(x18) + x6)) + x22), x49, x56)
	var x59 uint64
	_, x59 = bits.Mul64(x51, 0x992d30ecffffffff)
	var x61 uint64
	var x62 uint64
	x62, x61 = bits.Mul64(x59, 0x4000000000000000)
	var x63 uint64
	var x64 uint64
	x64, x63 = bits.Mul64(x59, 0x224698fc094cf91b)
	var x65 uint64
	var x66 uint64
	x66, x65 = bits.Mul64(x59, 0x992d30ed00000001)
	var x67 uint64
	var x68 fiat_pasta_fp_uint1
	x67, x68 = fiat_pasta_fp_addcarryx_u64(x66, x63, 0x0)
	var x70 fiat_pasta_fp_uint1
	_, x70 = fiat_pasta_fp_addcarryx_u64(x51, x65, 0x0)
	var x71 uint64
	var x72 fiat_pasta_fp_uint1
	x71, x72 = fiat_pasta_fp_addcarryx_u64(x53, x67, x70)
	var x73 uint64
	var x74 fiat_pasta_fp_uint1
	x73, x74 = fiat_pasta_fp_addcarryx_u64(x55, (uint64(x68) + x64), x72)
	var x75 uint64
	var x76 fiat_pasta_fp_uint1
	x75, x76 = fiat_pasta_fp_addcarryx_u64(x57, x61, x74)
	var x77 uint64
	var x78 uint64
	x78, x77 = bits.Mul64(x2, 0x96d41af7b9cb714)
	var x79 uint64
	var x80 uint64
	x80, x79 = bits.Mul64(x2, 0x7797a99bc3c95d18)
	var x81 uint64
	var x82 uint64
	x82, x81 = bits.Mul64(x2, 0xd7d30dbd8b0de0e7)
	var x83 uint64
	var x84 uint64
	x84, x83 = bits.Mul64(x2, 0x8c78ecb30000000f)
	var x85 uint64
	var x86 fiat_pasta_fp_uint1
	x85, x86 = fiat_pasta_fp_addcarryx_u64(x84, x81, 0x0)
	var x87 uint64
	var x88 fiat_pasta_fp_uint1
	x87, x88 = fiat_pasta_fp_addcarryx_u64(x82, x79, x86)
	var x89 uint64
	var x90 fiat_pasta_fp_uint1
	x89, x90 = fiat_pasta_fp_addcarryx_u64(x80, x77, x88)
	var x91 uint64
	var x92 fiat_pasta_fp_uint1
	x91, x92 = fiat_pasta_fp_addcarryx_u64(x71, x83, 0x0)
	var x93 uint64
	var x94 fiat_pasta_fp_uint1
	x93, x94 = fiat_pasta_fp_addcarryx_u64(x73, x85, x92)
	var x95 uint64
	var x96 fiat_pasta_fp_uint1
	x95, x96 = fiat_pasta_fp_addcarryx_u64(x75, x87, x94)
	var x97 uint64
	var x98 fiat_pasta_fp_uint1
	x97, x98 = fiat_pasta_fp_addcarryx_u64(((uint64(x76) + (uint64(x58) + (uint64(x50) + x38))) + x62), x89, x96)
	var x99 uint64
	_, x99 = bits.Mul64(x91, 0x992d30ecffffffff)
	var x101 uint64
	var x102 uint64
	x102, x101 = bits.Mul64(x99, 0x4000000000000000)
	var x103 uint64
	var x104 uint64
	x104, x103 = bits.Mul64(x99, 0x224698fc094cf91b)
	var x105 uint64
	var x106 uint64
	x106, x105 = bits.Mul64(x99, 0x992d30ed00000001)
	var x107 uint64
	var x108 fiat_pasta_fp_uint1
	x107, x108 = fiat_pasta_fp_addcarryx_u64(x106, x103, 0x0)
	var x110 fiat_pasta_fp_uint1
	_, x110 = fiat_pasta_fp_addcarryx_u64(x91, x105, 0x0)
	var x111 uint64
	var x112 fiat_pasta_fp_uint1
	x111, x112 = fiat_pasta_fp_addcarryx_u64(x93, x107, x110)
	var x113 uint64
	var x114 fiat_pasta_fp_uint1
	x113, x114 = fiat_pasta_fp_addcarryx_u64(x95, (uint64(x108) + x104), x112)
	var x115 uint64
	var x116 fiat_pasta_fp_uint1
	x115, x116 = fiat_pasta_fp_addcarryx_u64(x97, x101, x114)
	var x117 uint64
	var x118 uint64
	x118, x117 = bits.Mul64(x3, 0x96d41af7b9cb714)
	var x119 uint64
	var x120 uint64
	x120, x119 = bits.Mul64(x3, 0x7797a99bc3c95d18)
	var x121 uint64
	var x122 uint64
	x122, x121 = bits.Mul64(x3, 0xd7d30dbd8b0de0e7)
	var x123 uint64
	var x124 uint64
	x124, x123 = bits.Mul64(x3, 0x8c78ecb30000000f)
	var x125 uint64
	var x126 fiat_pasta_fp_uint1
	x125, x126 = fiat_pasta_fp_addcarryx_u64(x124, x121, 0x0)
	var x127 uint64
	var x128 fiat_pasta_fp_uint1
	x127, x128 = fiat_pasta_fp_addcarryx_u64(x122, x119, x126)
	var x129 uint64
	var x130 fiat_pasta_fp_uint1
	x129, x130 = fiat_pasta_fp_addcarryx_u64(x120, x117, x128)
	var x131 uint64
	var x132 fiat_pasta_fp_uint1
	x131, x132 = fiat_pasta_fp_addcarryx_u64(x111, x123, 0x0)
	var x133 uint64
	var x134 fiat_pasta_fp_uint1
	x133, x134 = fiat_pasta_fp_addcarryx_u64(x113, x125, x132)
	var x135 uint64
	var x136 fiat_pasta_fp_uint1
	x135, x136 = fiat_pasta_fp_addcarryx_u64(x115, x127, x134)
	var x137 uint64
	var x138 fiat_pasta_fp_uint1
	x137, x138 = fiat_pasta_fp_addcarryx_u64(((uint64(x116) + (uint64(x98) + (uint64(x90) + x78))) + x102), x129, x136)
	var x139 uint64
	_, x139 = bits.Mul64(x131, 0x992d30ecffffffff)
	var x141 uint64
	var x142 uint64
	x142, x141 = bits.Mul64(x139, 0x4000000000000000)
	var x143 uint64
	var x144 uint64
	x144, x143 = bits.Mul64(x139, 0x224698fc094cf91b)
	var x145 uint64
	var x146 uint64
	x146, x145 = bits.Mul64(x139, 0x992d30ed00000001)
	var x147 uint64
	var x148 fiat_pasta_fp_uint1
	x147, x148 = fiat_pasta_fp_addcarryx_u64(x146, x143, 0x0)
	var x150 fiat_pasta_fp_uint1
	_, x150 = fiat_pasta_fp_addcarryx_u64(x131, x145, 0x0)
	var x151 uint64
	var x152 fiat_pasta_fp_uint1
	x151, x152 = fiat_pasta_fp_addcarryx_u64(x133, x147, x150)
	var x153 uint64
	var x154 fiat_pasta_fp_uint1
	x153, x154 = fiat_pasta_fp_addcarryx_u64(x135, (uint64(x148) + x144), x152)
	var x155 uint64
	var x156 fiat_pasta_fp_uint1
	x155, x156 = fiat_pasta_fp_addcarryx_u64(x137, x141, x154)
	x157 := ((uint64(x156) + (uint64(x138) + (uint64(x130) + x118))) + x142)
	var x158 uint64
	var x159 fiat_pasta_fp_uint1
	x158, x159 = fiat_pasta_fp_subborrowx_u64(x151, 0x992d30ed00000001, 0x0)
	var x160 uint64
	var x161 fiat_pasta_fp_uint1
	x160, x161 = fiat_pasta_fp_subborrowx_u64(x153, 0x224698fc094cf91b, x159)
	var x162 uint64
	var x163 fiat_pasta_fp_uint1
	x162, x163 = fiat_pasta_fp_subborrowx_u64(x155, uint64(0x0), x161)
	var x164 uint64
	var x165 fiat_pasta_fp_uint1
	x164, x165 = fiat_pasta_fp_subborrowx_u64(x157, 0x4000000000000000, x163)
	var x167 fiat_pasta_fp_uint1
	_, x167 = fiat_pasta_fp_subborrowx_u64(uint64(0x0), uint64(0x0), x165)
	var x168 uint64
	fiat_pasta_fp_cmovznz_u64(&x168, x167, x158, x151)
	var x169 uint64
	fiat_pasta_fp_cmovznz_u64(&x169, x167, x160, x153)
	var x170 uint64
	fiat_pasta_fp_cmovznz_u64(&x170, x167, x162, x155)
	var x171 uint64
	fiat_pasta_fp_cmovznz_u64(&x171, x167, x164, x157)
	out1[0] = x168
	out1[1] = x169
	out1[2] = x170
	out1[3] = x171
}

// The function fiat_pasta_fp_selectznz is a multi-limb conditional select.
//
// Postconditions:
//   eval out1 = (if arg1 = 0 then eval arg2 else eval arg3)
//
// Input Bounds:
//   arg1: [0x0 ~> 0x1]
//   arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
//   arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
// Output Bounds:
//   out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
func fiat_pasta_fp_selectznz(out1 *[4]uint64, arg1 fiat_pasta_fp_uint1, arg2 *[4]uint64, arg3 *[4]uint64) {
	var x1 uint64
	fiat_pasta_fp_cmovznz_u64(&x1, arg1, arg2[0], arg3[0])
	var x2 uint64
	fiat_pasta_fp_cmovznz_u64(&x2, arg1, arg2[1], arg3[1])
	var x3 uint64
	fiat_pasta_fp_cmovznz_u64(&x3, arg1, arg2[2], arg3[2])
	var x4 uint64
	fiat_pasta_fp_cmovznz_u64(&x4, arg1, arg2[3], arg3[3])
	out1[0] = x1
	out1[1] = x2
	out1[2] = x3
	out1[3] = x4
}

// The function fiat_pasta_fp_to_bytes serializes a field element NOT in the Montgomery domain to bytes in little-endian order.
//
// Preconditions:
//   0 ≤ eval arg1 < m
// Postconditions:
//   out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..31]
//
// Input Bounds:
//   arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0x7fffffffffffffff]]
// Output Bounds:
//   out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0x7f]]
func fiat_pasta_fp_to_bytes(out1 *[32]uint8, arg1 *[4]uint64) {
	x1 := arg1[3]
	x2 := arg1[2]
	x3 := arg1[1]
	x4 := arg1[0]
	x5 := (uint8(x4) & 0xff)
	x6 := (x4 >> 8)
	x7 := (uint8(x6) & 0xff)
	x8 := (x6 >> 8)
	x9 := (uint8(x8) & 0xff)
	x10 := (x8 >> 8)
	x11 := (uint8(x10) & 0xff)
	x12 := (x10 >> 8)
	x13 := (uint8(x12) & 0xff)
	x14 := (x12 >> 8)
	x15 := (uint8(x14) & 0xff)
	x16 := (x14 >> 8)
	x17 := (uint8(x16) & 0xff)
	x18 := uint8((x16 >> 8))
	x19 := (uint8(x3) & 0xff)
	x20 := (x3 >> 8)
	x21 := (uint8(x20) & 0xff)
	x22 := (x20 >> 8)
	x23 := (uint8(x22) & 0xff)
	x24 := (x22 >> 8)
	x25 := (uint8(x24) & 0xff)
	x26 := (x24 >> 8)
	x27 := (uint8(x26) & 0xff)
	x28 := (x26 >> 8)
	x29 := (uint8(x28) & 0xff)
	x30 := (x28 >> 8)
	x31 := (uint8(x30) & 0xff)
	x32 := uint8((x30 >> 8))
	x33 := (uint8(x2) & 0xff)
	x34 := (x2 >> 8)
	x35 := (uint8(x34) & 0xff)
	x36 := (x34 >> 8)
	x37 := (uint8(x36) & 0xff)
	x38 := (x36 >> 8)
	x39 := (uint8(x38) & 0xff)
	x40 := (x38 >> 8)
	x41 := (uint8(x40) & 0xff)
	x42 := (x40 >> 8)
	x43 := (uint8(x42) & 0xff)
	x44 := (x42 >> 8)
	x45 := (uint8(x44) & 0xff)
	x46 := uint8((x44 >> 8))
	x47 := (uint8(x1) & 0xff)
	x48 := (x1 >> 8)
	x49 := (uint8(x48) & 0xff)
	x50 := (x48 >> 8)
	x51 := (uint8(x50) & 0xff)
	x52 := (x50 >> 8)
	x53 := (uint8(x52) & 0xff)
	x54 := (x52 >> 8)
	x55 := (uint8(x54) & 0xff)
	x56 := (x54 >> 8)
	x57 := (uint8(x56) & 0xff)
	x58 := (x56 >> 8)
	x59 := (uint8(x58) & 0xff)
	x60 := uint8((x58 >> 8))
	out1[0] = x5
	out1[1] = x7
	out1[2] = x9
	out1[3] = x11
	out1[4] = x13
	out1[5] = x15
	out1[6] = x17
	out1[7] = x18
	out1[8] = x19
	out1[9] = x21
	out1[10] = x23
	out1[11] = x25
	out1[12] = x27
	out1[13] = x29
	out1[14] = x31
	out1[15] = x32
	out1[16] = x33
	out1[17] = x35
	out1[18] = x37
	out1[19] = x39
	out1[20] = x41
	out1[21] = x43
	out1[22] = x45
	out1[23] = x46
	out1[24] = x47
	out1[25] = x49
	out1[26] = x51
	out1[27] = x53
	out1[28] = x55
	out1[29] = x57
	out1[30] = x59
	out1[31] = x60
}

// The function fiat_pasta_fp_from_bytes deserializes a field element NOT in the Montgomery domain from bytes in little-endian order.
//
// Preconditions:
//   0 ≤ bytes_eval arg1 < m
// Postconditions:
//   eval out1 mod m = bytes_eval arg1 mod m
//   0 ≤ eval out1 < m
//
// Input Bounds:
//   arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0x7f]]
// Output Bounds:
//   out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0x7fffffffffffffff]]
func fiat_pasta_fp_from_bytes(out1 *[4]uint64, arg1 *[32]uint8) {
	x1 := (uint64(arg1[31]) << 56)
	x2 := (uint64(arg1[30]) << 48)
	x3 := (uint64(arg1[29]) << 40)
	x4 := (uint64(arg1[28]) << 32)
	x5 := (uint64(arg1[27]) << 24)
	x6 := (uint64(arg1[26]) << 16)
	x7 := (uint64(arg1[25]) << 8)
	x8 := arg1[24]
	x9 := (uint64(arg1[23]) << 56)
	x10 := (uint64(arg1[22]) << 48)
	x11 := (uint64(arg1[21]) << 40)
	x12 := (uint64(arg1[20]) << 32)
	x13 := (uint64(arg1[19]) << 24)
	x14 := (uint64(arg1[18]) << 16)
	x15 := (uint64(arg1[17]) << 8)
	x16 := arg1[16]
	x17 := (uint64(arg1[15]) << 56)
	x18 := (uint64(arg1[14]) << 48)
	x19 := (uint64(arg1[13]) << 40)
	x20 := (uint64(arg1[12]) << 32)
	x21 := (uint64(arg1[11]) << 24)
	x22 := (uint64(arg1[10]) << 16)
	x23 := (uint64(arg1[9]) << 8)
	x24 := arg1[8]
	x25 := (uint64(arg1[7]) << 56)
	x26 := (uint64(arg1[6]) << 48)
	x27 := (uint64(arg1[5]) << 40)
	x28 := (uint64(arg1[4]) << 32)
	x29 := (uint64(arg1[3]) << 24)
	x30 := (uint64(arg1[2]) << 16)
	x31 := (uint64(arg1[1]) << 8)
	x32 := arg1[0]
	x33 := (x31 + uint64(x32))
	x34 := (x30 + x33)
	x35 := (x29 + x34)
	x36 := (x28 + x35)
	x37 := (x27 + x36)
	x38 := (x26 + x37)
	x39 := (x25 + x38)
	x40 := (x23 + uint64(x24))
	x41 := (x22 + x40)
	x42 := (x21 + x41)
	x43 := (x20 + x42)
	x44 := (x19 + x43)
	x45 := (x18 + x44)
	x46 := (x17 + x45)
	x47 := (x15 + uint64(x16))
	x48 := (x14 + x47)
	x49 := (x13 + x48)
	x50 := (x12 + x49)
	x51 := (x11 + x50)
	x52 := (x10 + x51)
	x53 := (x9 + x52)
	x54 := (x7 + uint64(x8))
	x55 := (x6 + x54)
	x56 := (x5 + x55)
	x57 := (x4 + x56)
	x58 := (x3 + x57)
	x59 := (x2 + x58)
	x60 := (x1 + x59)
	out1[0] = x39
	out1[1] = x46
	out1[2] = x53
	out1[3] = x60
}