RT，我的要做 $4$ 次乘法：

using u128 = __uint128_t;
struct u256{
	u128 hi, lo;
	constexpr u256(u128 hi, u128 lo):hi(hi), lo(lo){}
	constexpr u256 &operator=(u256 x){ hi=x.hi, lo=x.lo; return *this; }
	constexpr u256 operator+=(u256 x){ 
		if(((lo>>1)+(x.lo>>1)+(lo&1&x.lo)) >> 63) hi++;
		hi += x.hi; lo += x.lo;
		return *this;
	}
};
constexpr u256 mul128(u128 x, u128 y){
	u64 xl(x), xh(x>>64), yl(y), yh(y>>64);
	u128 mid(u128(xl)*yh), anslo(u128(xl)*yl);
	u64 mh(mid>>64), ml(mid);
	mid = u128(yl)*xh + ml + (anslo >> 64);
	return u256(u128(xh)*yh + mh + (mid>>64), 
			(mid<<64) | u64(anslo));
}

当然您有 int128 快速模乘的方法更好，我现在用的是 Montgomery 模乘（