From 23e2b25ca29604c93ef1b3cba1a6be041dcaad1f Mon Sep 17 00:00:00 2001 From: Frank Denis Date: Thu, 8 Oct 2026 08:45:01 +0200 Subject: [PATCH] std.crypto: update fiat-crypto generated code Zig was the first programming language to ship with field arithmetic generated by fiat-crypto. This is great! But since then, two things happened: - We manually modified the generated code to deal with changes in Zig - Fiat-crypto evolved, including its Zig backend - Barriers turned out to be necessary to avoid memory loads depending on a secret selector. What we ship in Zig didn't had them. So, reconciliate everything and update the code we ship with what fiat now produces. As a bonus, point multiplication on NIST curves gets ~10% faster. --- lib/std/crypto/pcurves/p256/p256_64.zig | 824 +++++++------ .../crypto/pcurves/p256/p256_scalar_64.zig | 796 ++++++------- lib/std/crypto/pcurves/p384/p384_64.zig | 1061 +++++++++-------- .../crypto/pcurves/p384/p384_scalar_64.zig | 1049 ++++++++-------- .../crypto/pcurves/secp256k1/secp256k1_64.zig | 729 +++++------ .../pcurves/secp256k1/secp256k1_scalar_64.zig | 721 +++++------ 6 files changed, 2574 insertions(+), 2606 deletions(-) diff --git a/lib/std/crypto/pcurves/p256/p256_64.zig b/lib/std/crypto/pcurves/p256/p256_64.zig index 8cc9016ed38957ae5cd6647141dd0909dc3b90c3..f72d75c64b0d925245e8f07ac82cd1aef49ab544 100644 --- a/lib/std/crypto/pcurves/p256/p256_64.zig +++ b/lib/std/crypto/pcurves/p256/p256_64.zig @@ -13,42 +13,10 @@ // // Computed values: // eval z = z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) -// bytes_eval z = z[0] -// + (z[1] << 8) -// + (z[2] << 16) -// + (z[3] << 24) -// + (z[4] << 32) -// + (z[5] << 40) -// + (z[6] << 48) -// + (z[7] << 56) -// + (z[8] << 64) -// + (z[9] << 72) -// + (z[10] << 80) -// + (z[11] << 88) -// + (z[12] << 96) -// + (z[13] << 104) -// + (z[14] << 112) -// + (z[15] << 120) -// + (z[16] << 128) -// + (z[17] << 136) -// + (z[18] << 144) -// + (z[19] << 152) -// + (z[20] << 160) -// + (z[21] << 168) -// + (z[22] << 176) -// + (z[23] << 184) -// + (z[24] << 192) -// + (z[25] << 200) -// + (z[26] << 208) -// + (z[27] << 216) -// + (z[28] << 224) -// + (z[29] << 232) -// + (z[30] << 240) -// + (z[31] << 248) +// bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248) // twos_complement_eval z = let x1 := z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) in // if x1 & (2^256-1) < 2^255 then x1 & (2^256-1) else (x1 & (2^256-1)) - 2^256 -const std = @import("std"); const mode = @import("builtin").mode; // Checked arithmetic is disabled in non-debug modes to avoid side channels // The type MontgomeryDomainFieldElement is a field element in the Montgomery domain. @@ -59,80 +27,70 @@ pub const MontgomeryDomainFieldElement = [4]u64; // Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] pub const NonMontgomeryDomainFieldElement = [4]u64; -/// The function addcarryxU64 is an addition with carry. -/// -/// Postconditions: -/// out1 = (arg1 + arg2 + arg3) mod 2^64 -/// out2 = ⌊(arg1 + arg2 + arg3) / 2^64⌋ -/// -/// Input Bounds: -/// arg1: [0x0 ~> 0x1] -/// arg2: [0x0 ~> 0xffffffffffffffff] -/// arg3: [0x0 ~> 0xffffffffffffffff] -/// Output Bounds: -/// out1: [0x0 ~> 0xffffffffffffffff] -/// out2: [0x0 ~> 0x1] +/// Add two limbs and a carry bit, returning the sum modulo 2^64 and the carry bit. fn addcarryxU64(out1: *u64, out2: *u1, arg1: u1, arg2: u64, arg3: u64) void { - const x = @as(u128, arg2) +% arg3 +% arg1; - out1.* = @truncate(x); - out2.* = @truncate(x >> 64); + @setRuntimeSafety(mode == .debug); + + const x = @addWithOverflow(arg2, arg3); + const y = @addWithOverflow(x[0], arg1); + out1.* = y[0]; + out2.* = x[1] | y[1]; } -/// The function subborrowxU64 is a subtraction with borrow. -/// -/// Postconditions: -/// out1 = (-arg1 + arg2 + -arg3) mod 2^64 -/// out2 = -⌊(-arg1 + arg2 + -arg3) / 2^64⌋ -/// -/// Input Bounds: -/// arg1: [0x0 ~> 0x1] -/// arg2: [0x0 ~> 0xffffffffffffffff] -/// arg3: [0x0 ~> 0xffffffffffffffff] -/// Output Bounds: -/// out1: [0x0 ~> 0xffffffffffffffff] -/// out2: [0x0 ~> 0x1] +/// Subtract two limbs and a borrow bit, returning the difference modulo 2^64 and the borrow bit. fn subborrowxU64(out1: *u64, out2: *u1, arg1: u1, arg2: u64, arg3: u64) void { - const x = @as(u128, arg2) -% arg3 -% arg1; - out1.* = @truncate(x); - out2.* = @truncate(x >> 64); + @setRuntimeSafety(mode == .debug); + + const x = @subWithOverflow(arg2, arg3); + const y = @subWithOverflow(x[0], arg1); + out1.* = y[0]; + out2.* = x[1] | y[1]; } -/// The function mulxU64 is a multiplication, returning the full double-width result. -/// -/// Postconditions: -/// out1 = (arg1 * arg2) mod 2^64 -/// out2 = ⌊arg1 * arg2 / 2^64⌋ -/// -/// Input Bounds: -/// arg1: [0x0 ~> 0xffffffffffffffff] -/// arg2: [0x0 ~> 0xffffffffffffffff] -/// Output Bounds: -/// out1: [0x0 ~> 0xffffffffffffffff] -/// out2: [0x0 ~> 0xffffffffffffffff] +/// Multiply two limbs, returning the low and high halves of the product. fn mulxU64(out1: *u64, out2: *u64, arg1: u64, arg2: u64) void { @setRuntimeSafety(mode == .debug); - const x = @as(u128, arg1) * @as(u128, arg2); - out1.* = @as(u64, @truncate(x)); - out2.* = @as(u64, @truncate(x >> 64)); + const x = @as(u128, arg1) * arg2; + out1.* = @truncate(x); + out2.* = @intCast(x >> 64); } -/// The function cmovznzU64 is a single-word conditional move. -/// -/// Postconditions: -/// out1 = (if arg1 = 0 then arg2 else arg3) -/// -/// Input Bounds: -/// arg1: [0x0 ~> 0x1] -/// arg2: [0x0 ~> 0xffffffffffffffff] -/// arg3: [0x0 ~> 0xffffffffffffffff] -/// Output Bounds: -/// out1: [0x0 ~> 0xffffffffffffffff] +/// Keep selection masks opaque to the optimizer without adding instructions. +fn selectionMaskU64(arg1: u1) u64 { + @setRuntimeSafety(mode == .debug); + + const value: u64 = 0 -% @as(u64, arg1); + if (@inComptime()) return value; + switch (@import("builtin").zig_backend) { + .stage2_c, .stage2_wasm => return value, + else => {}, + } + if (@bitSizeOf(u64) <= @bitSizeOf(usize)) { + return asm ("" + : [mask] "=r" (-> u64), + : [value] "0" (value), + ); + } + var mask: u64 = 0; + inline for (0..@divExact(@bitSizeOf(u64), @bitSizeOf(usize))) |i| { + const shift = i * @bitSizeOf(usize); + const chunk: usize = @truncate(value >> shift); + const part = asm ("" + : [mask] "=r" (-> usize), + : [value] "0" (chunk), + ); + mask |= @as(u64, part) << shift; + } + return mask; +} + +/// Select arg2 when arg1 is zero and arg3 otherwise, using a bit mask. fn cmovznzU64(out1: *u64, arg1: u1, arg2: u64, arg3: u64) void { @setRuntimeSafety(mode == .debug); - const mask = 0 -% @as(u64, arg1); - out1.* = (mask & arg3) | ((~mask) & arg2); + const mask = selectionMaskU64(arg1); + out1.* = arg2 ^ ((arg2 ^ arg3) & mask); } /// The function mul multiplies two field elements in the Montgomery domain. @@ -147,22 +105,22 @@ fn cmovznzU64(out1: *u64, arg1: u1, arg2: u64, arg3: u64) void { pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldElement, arg2: MontgomeryDomainFieldElement) void { @setRuntimeSafety(mode == .debug); - const x1 = (arg1[1]); - const x2 = (arg1[2]); - const x3 = (arg1[3]); - const x4 = (arg1[0]); + const x1: u64 = arg1[1]; + const x2: u64 = arg1[2]; + const x3: u64 = arg1[3]; + const x4: u64 = arg1[0]; var x5: u64 = undefined; var x6: u64 = undefined; - mulxU64(&x5, &x6, x4, (arg2[3])); + mulxU64(&x5, &x6, x4, arg2[3]); var x7: u64 = undefined; var x8: u64 = undefined; - mulxU64(&x7, &x8, x4, (arg2[2])); + mulxU64(&x7, &x8, x4, arg2[2]); var x9: u64 = undefined; var x10: u64 = undefined; - mulxU64(&x9, &x10, x4, (arg2[1])); + mulxU64(&x9, &x10, x4, arg2[1]); var x11: u64 = undefined; var x12: u64 = undefined; - mulxU64(&x11, &x12, x4, (arg2[0])); + mulxU64(&x11, &x12, x4, arg2[0]); var x13: u64 = undefined; var x14: u1 = undefined; addcarryxU64(&x13, &x14, 0x0, x12, x9); @@ -172,7 +130,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x17: u64 = undefined; var x18: u1 = undefined; addcarryxU64(&x17, &x18, x16, x8, x5); - const x19 = (@as(u64, x18) + x6); + const x19: u64 = (x18 + x6); var x20: u64 = undefined; var x21: u64 = undefined; mulxU64(&x20, &x21, x11, 0xffffffff00000001); @@ -185,7 +143,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x26: u64 = undefined; var x27: u1 = undefined; addcarryxU64(&x26, &x27, 0x0, x25, x22); - const x28 = (@as(u64, x27) + x23); + const x28: u64 = (x27 + x23); var x29: u64 = undefined; var x30: u1 = undefined; addcarryxU64(&x29, &x30, 0x0, x11, x24); @@ -203,16 +161,16 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme addcarryxU64(&x37, &x38, x36, x19, x21); var x39: u64 = undefined; var x40: u64 = undefined; - mulxU64(&x39, &x40, x1, (arg2[3])); + mulxU64(&x39, &x40, x1, arg2[3]); var x41: u64 = undefined; var x42: u64 = undefined; - mulxU64(&x41, &x42, x1, (arg2[2])); + mulxU64(&x41, &x42, x1, arg2[2]); var x43: u64 = undefined; var x44: u64 = undefined; - mulxU64(&x43, &x44, x1, (arg2[1])); + mulxU64(&x43, &x44, x1, arg2[1]); var x45: u64 = undefined; var x46: u64 = undefined; - mulxU64(&x45, &x46, x1, (arg2[0])); + mulxU64(&x45, &x46, x1, arg2[0]); var x47: u64 = undefined; var x48: u1 = undefined; addcarryxU64(&x47, &x48, 0x0, x46, x43); @@ -222,7 +180,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x51: u64 = undefined; var x52: u1 = undefined; addcarryxU64(&x51, &x52, x50, x42, x39); - const x53 = (@as(u64, x52) + x40); + const x53: u64 = (x52 + x40); var x54: u64 = undefined; var x55: u1 = undefined; addcarryxU64(&x54, &x55, 0x0, x31, x45); @@ -237,7 +195,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme addcarryxU64(&x60, &x61, x59, x37, x51); var x62: u64 = undefined; var x63: u1 = undefined; - addcarryxU64(&x62, &x63, x61, @as(u64, x38), x53); + addcarryxU64(&x62, &x63, x61, x38, x53); var x64: u64 = undefined; var x65: u64 = undefined; mulxU64(&x64, &x65, x54, 0xffffffff00000001); @@ -250,7 +208,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x70: u64 = undefined; var x71: u1 = undefined; addcarryxU64(&x70, &x71, 0x0, x69, x66); - const x72 = (@as(u64, x71) + x67); + const x72: u64 = (x71 + x67); var x73: u64 = undefined; var x74: u1 = undefined; addcarryxU64(&x73, &x74, 0x0, x54, x68); @@ -266,19 +224,19 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x81: u64 = undefined; var x82: u1 = undefined; addcarryxU64(&x81, &x82, x80, x62, x65); - const x83 = (@as(u64, x82) + @as(u64, x63)); + const x83: u64 = (@as(u64, x82) + x63); var x84: u64 = undefined; var x85: u64 = undefined; - mulxU64(&x84, &x85, x2, (arg2[3])); + mulxU64(&x84, &x85, x2, arg2[3]); var x86: u64 = undefined; var x87: u64 = undefined; - mulxU64(&x86, &x87, x2, (arg2[2])); + mulxU64(&x86, &x87, x2, arg2[2]); var x88: u64 = undefined; var x89: u64 = undefined; - mulxU64(&x88, &x89, x2, (arg2[1])); + mulxU64(&x88, &x89, x2, arg2[1]); var x90: u64 = undefined; var x91: u64 = undefined; - mulxU64(&x90, &x91, x2, (arg2[0])); + mulxU64(&x90, &x91, x2, arg2[0]); var x92: u64 = undefined; var x93: u1 = undefined; addcarryxU64(&x92, &x93, 0x0, x91, x88); @@ -288,7 +246,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x96: u64 = undefined; var x97: u1 = undefined; addcarryxU64(&x96, &x97, x95, x87, x84); - const x98 = (@as(u64, x97) + x85); + const x98: u64 = (x97 + x85); var x99: u64 = undefined; var x100: u1 = undefined; addcarryxU64(&x99, &x100, 0x0, x75, x90); @@ -316,7 +274,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x115: u64 = undefined; var x116: u1 = undefined; addcarryxU64(&x115, &x116, 0x0, x114, x111); - const x117 = (@as(u64, x116) + x112); + const x117: u64 = (x116 + x112); var x118: u64 = undefined; var x119: u1 = undefined; addcarryxU64(&x118, &x119, 0x0, x99, x113); @@ -332,19 +290,19 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x126: u64 = undefined; var x127: u1 = undefined; addcarryxU64(&x126, &x127, x125, x107, x110); - const x128 = (@as(u64, x127) + @as(u64, x108)); + const x128: u64 = (@as(u64, x127) + x108); var x129: u64 = undefined; var x130: u64 = undefined; - mulxU64(&x129, &x130, x3, (arg2[3])); + mulxU64(&x129, &x130, x3, arg2[3]); var x131: u64 = undefined; var x132: u64 = undefined; - mulxU64(&x131, &x132, x3, (arg2[2])); + mulxU64(&x131, &x132, x3, arg2[2]); var x133: u64 = undefined; var x134: u64 = undefined; - mulxU64(&x133, &x134, x3, (arg2[1])); + mulxU64(&x133, &x134, x3, arg2[1]); var x135: u64 = undefined; var x136: u64 = undefined; - mulxU64(&x135, &x136, x3, (arg2[0])); + mulxU64(&x135, &x136, x3, arg2[0]); var x137: u64 = undefined; var x138: u1 = undefined; addcarryxU64(&x137, &x138, 0x0, x136, x133); @@ -354,7 +312,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x141: u64 = undefined; var x142: u1 = undefined; addcarryxU64(&x141, &x142, x140, x132, x129); - const x143 = (@as(u64, x142) + x130); + const x143: u64 = (x142 + x130); var x144: u64 = undefined; var x145: u1 = undefined; addcarryxU64(&x144, &x145, 0x0, x120, x135); @@ -382,7 +340,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x160: u64 = undefined; var x161: u1 = undefined; addcarryxU64(&x160, &x161, 0x0, x159, x156); - const x162 = (@as(u64, x161) + x157); + const x162: u64 = (x161 + x157); var x163: u64 = undefined; var x164: u1 = undefined; addcarryxU64(&x163, &x164, 0x0, x144, x158); @@ -398,7 +356,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x171: u64 = undefined; var x172: u1 = undefined; addcarryxU64(&x171, &x172, x170, x152, x155); - const x173 = (@as(u64, x172) + @as(u64, x153)); + const x173: u64 = (@as(u64, x172) + x153); var x174: u64 = undefined; var x175: u1 = undefined; subborrowxU64(&x174, &x175, 0x0, x165, 0xffffffffffffffff); @@ -407,21 +365,22 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme subborrowxU64(&x176, &x177, x175, x167, 0xffffffff); var x178: u64 = undefined; var x179: u1 = undefined; - subborrowxU64(&x178, &x179, x177, x169, @as(u64, 0x0)); + subborrowxU64(&x178, &x179, x177, x169, 0x0); var x180: u64 = undefined; var x181: u1 = undefined; subborrowxU64(&x180, &x181, x179, x171, 0xffffffff00000001); var x182: u64 = undefined; var x183: u1 = undefined; - subborrowxU64(&x182, &x183, x181, x173, @as(u64, 0x0)); + subborrowxU64(&x182, &x183, x181, x173, 0x0); var x184: u64 = undefined; - cmovznzU64(&x184, x183, x174, x165); + const x184_selection_mask = selectionMaskU64(x183); + x184 = x174 ^ ((x174 ^ x165) & x184_selection_mask); var x185: u64 = undefined; - cmovznzU64(&x185, x183, x176, x167); + x185 = x176 ^ ((x176 ^ x167) & x184_selection_mask); var x186: u64 = undefined; - cmovznzU64(&x186, x183, x178, x169); + x186 = x178 ^ ((x178 ^ x169) & x184_selection_mask); var x187: u64 = undefined; - cmovznzU64(&x187, x183, x180, x171); + x187 = x180 ^ ((x180 ^ x171) & x184_selection_mask); out1[0] = x184; out1[1] = x185; out1[2] = x186; @@ -439,22 +398,22 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldElement) void { @setRuntimeSafety(mode == .debug); - const x1 = (arg1[1]); - const x2 = (arg1[2]); - const x3 = (arg1[3]); - const x4 = (arg1[0]); + const x1: u64 = arg1[1]; + const x2: u64 = arg1[2]; + const x3: u64 = arg1[3]; + const x4: u64 = arg1[0]; var x5: u64 = undefined; var x6: u64 = undefined; - mulxU64(&x5, &x6, x4, (arg1[3])); + mulxU64(&x5, &x6, x4, arg1[3]); var x7: u64 = undefined; var x8: u64 = undefined; - mulxU64(&x7, &x8, x4, (arg1[2])); + mulxU64(&x7, &x8, x4, arg1[2]); var x9: u64 = undefined; var x10: u64 = undefined; - mulxU64(&x9, &x10, x4, (arg1[1])); + mulxU64(&x9, &x10, x4, arg1[1]); var x11: u64 = undefined; var x12: u64 = undefined; - mulxU64(&x11, &x12, x4, (arg1[0])); + mulxU64(&x11, &x12, x4, arg1[0]); var x13: u64 = undefined; var x14: u1 = undefined; addcarryxU64(&x13, &x14, 0x0, x12, x9); @@ -464,7 +423,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x17: u64 = undefined; var x18: u1 = undefined; addcarryxU64(&x17, &x18, x16, x8, x5); - const x19 = (@as(u64, x18) + x6); + const x19: u64 = (x18 + x6); var x20: u64 = undefined; var x21: u64 = undefined; mulxU64(&x20, &x21, x11, 0xffffffff00000001); @@ -477,7 +436,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x26: u64 = undefined; var x27: u1 = undefined; addcarryxU64(&x26, &x27, 0x0, x25, x22); - const x28 = (@as(u64, x27) + x23); + const x28: u64 = (x27 + x23); var x29: u64 = undefined; var x30: u1 = undefined; addcarryxU64(&x29, &x30, 0x0, x11, x24); @@ -495,16 +454,16 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl addcarryxU64(&x37, &x38, x36, x19, x21); var x39: u64 = undefined; var x40: u64 = undefined; - mulxU64(&x39, &x40, x1, (arg1[3])); + mulxU64(&x39, &x40, x1, arg1[3]); var x41: u64 = undefined; var x42: u64 = undefined; - mulxU64(&x41, &x42, x1, (arg1[2])); + mulxU64(&x41, &x42, x1, arg1[2]); var x43: u64 = undefined; var x44: u64 = undefined; - mulxU64(&x43, &x44, x1, (arg1[1])); + mulxU64(&x43, &x44, x1, arg1[1]); var x45: u64 = undefined; var x46: u64 = undefined; - mulxU64(&x45, &x46, x1, (arg1[0])); + mulxU64(&x45, &x46, x1, arg1[0]); var x47: u64 = undefined; var x48: u1 = undefined; addcarryxU64(&x47, &x48, 0x0, x46, x43); @@ -514,7 +473,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x51: u64 = undefined; var x52: u1 = undefined; addcarryxU64(&x51, &x52, x50, x42, x39); - const x53 = (@as(u64, x52) + x40); + const x53: u64 = (x52 + x40); var x54: u64 = undefined; var x55: u1 = undefined; addcarryxU64(&x54, &x55, 0x0, x31, x45); @@ -529,7 +488,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl addcarryxU64(&x60, &x61, x59, x37, x51); var x62: u64 = undefined; var x63: u1 = undefined; - addcarryxU64(&x62, &x63, x61, @as(u64, x38), x53); + addcarryxU64(&x62, &x63, x61, x38, x53); var x64: u64 = undefined; var x65: u64 = undefined; mulxU64(&x64, &x65, x54, 0xffffffff00000001); @@ -542,7 +501,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x70: u64 = undefined; var x71: u1 = undefined; addcarryxU64(&x70, &x71, 0x0, x69, x66); - const x72 = (@as(u64, x71) + x67); + const x72: u64 = (x71 + x67); var x73: u64 = undefined; var x74: u1 = undefined; addcarryxU64(&x73, &x74, 0x0, x54, x68); @@ -558,19 +517,19 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x81: u64 = undefined; var x82: u1 = undefined; addcarryxU64(&x81, &x82, x80, x62, x65); - const x83 = (@as(u64, x82) + @as(u64, x63)); + const x83: u64 = (@as(u64, x82) + x63); var x84: u64 = undefined; var x85: u64 = undefined; - mulxU64(&x84, &x85, x2, (arg1[3])); + mulxU64(&x84, &x85, x2, arg1[3]); var x86: u64 = undefined; var x87: u64 = undefined; - mulxU64(&x86, &x87, x2, (arg1[2])); + mulxU64(&x86, &x87, x2, arg1[2]); var x88: u64 = undefined; var x89: u64 = undefined; - mulxU64(&x88, &x89, x2, (arg1[1])); + mulxU64(&x88, &x89, x2, arg1[1]); var x90: u64 = undefined; var x91: u64 = undefined; - mulxU64(&x90, &x91, x2, (arg1[0])); + mulxU64(&x90, &x91, x2, arg1[0]); var x92: u64 = undefined; var x93: u1 = undefined; addcarryxU64(&x92, &x93, 0x0, x91, x88); @@ -580,7 +539,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x96: u64 = undefined; var x97: u1 = undefined; addcarryxU64(&x96, &x97, x95, x87, x84); - const x98 = (@as(u64, x97) + x85); + const x98: u64 = (x97 + x85); var x99: u64 = undefined; var x100: u1 = undefined; addcarryxU64(&x99, &x100, 0x0, x75, x90); @@ -608,7 +567,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x115: u64 = undefined; var x116: u1 = undefined; addcarryxU64(&x115, &x116, 0x0, x114, x111); - const x117 = (@as(u64, x116) + x112); + const x117: u64 = (x116 + x112); var x118: u64 = undefined; var x119: u1 = undefined; addcarryxU64(&x118, &x119, 0x0, x99, x113); @@ -624,19 +583,19 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x126: u64 = undefined; var x127: u1 = undefined; addcarryxU64(&x126, &x127, x125, x107, x110); - const x128 = (@as(u64, x127) + @as(u64, x108)); + const x128: u64 = (@as(u64, x127) + x108); var x129: u64 = undefined; var x130: u64 = undefined; - mulxU64(&x129, &x130, x3, (arg1[3])); + mulxU64(&x129, &x130, x3, arg1[3]); var x131: u64 = undefined; var x132: u64 = undefined; - mulxU64(&x131, &x132, x3, (arg1[2])); + mulxU64(&x131, &x132, x3, arg1[2]); var x133: u64 = undefined; var x134: u64 = undefined; - mulxU64(&x133, &x134, x3, (arg1[1])); + mulxU64(&x133, &x134, x3, arg1[1]); var x135: u64 = undefined; var x136: u64 = undefined; - mulxU64(&x135, &x136, x3, (arg1[0])); + mulxU64(&x135, &x136, x3, arg1[0]); var x137: u64 = undefined; var x138: u1 = undefined; addcarryxU64(&x137, &x138, 0x0, x136, x133); @@ -646,7 +605,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x141: u64 = undefined; var x142: u1 = undefined; addcarryxU64(&x141, &x142, x140, x132, x129); - const x143 = (@as(u64, x142) + x130); + const x143: u64 = (x142 + x130); var x144: u64 = undefined; var x145: u1 = undefined; addcarryxU64(&x144, &x145, 0x0, x120, x135); @@ -674,7 +633,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x160: u64 = undefined; var x161: u1 = undefined; addcarryxU64(&x160, &x161, 0x0, x159, x156); - const x162 = (@as(u64, x161) + x157); + const x162: u64 = (x161 + x157); var x163: u64 = undefined; var x164: u1 = undefined; addcarryxU64(&x163, &x164, 0x0, x144, x158); @@ -690,7 +649,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x171: u64 = undefined; var x172: u1 = undefined; addcarryxU64(&x171, &x172, x170, x152, x155); - const x173 = (@as(u64, x172) + @as(u64, x153)); + const x173: u64 = (@as(u64, x172) + x153); var x174: u64 = undefined; var x175: u1 = undefined; subborrowxU64(&x174, &x175, 0x0, x165, 0xffffffffffffffff); @@ -699,21 +658,22 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl subborrowxU64(&x176, &x177, x175, x167, 0xffffffff); var x178: u64 = undefined; var x179: u1 = undefined; - subborrowxU64(&x178, &x179, x177, x169, @as(u64, 0x0)); + subborrowxU64(&x178, &x179, x177, x169, 0x0); var x180: u64 = undefined; var x181: u1 = undefined; subborrowxU64(&x180, &x181, x179, x171, 0xffffffff00000001); var x182: u64 = undefined; var x183: u1 = undefined; - subborrowxU64(&x182, &x183, x181, x173, @as(u64, 0x0)); + subborrowxU64(&x182, &x183, x181, x173, 0x0); var x184: u64 = undefined; - cmovznzU64(&x184, x183, x174, x165); + const x184_selection_mask = selectionMaskU64(x183); + x184 = x174 ^ ((x174 ^ x165) & x184_selection_mask); var x185: u64 = undefined; - cmovznzU64(&x185, x183, x176, x167); + x185 = x176 ^ ((x176 ^ x167) & x184_selection_mask); var x186: u64 = undefined; - cmovznzU64(&x186, x183, x178, x169); + x186 = x178 ^ ((x178 ^ x169) & x184_selection_mask); var x187: u64 = undefined; - cmovznzU64(&x187, x183, x180, x171); + x187 = x180 ^ ((x180 ^ x171) & x184_selection_mask); out1[0] = x184; out1[1] = x185; out1[2] = x186; @@ -734,16 +694,16 @@ pub fn add(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x1: u64 = undefined; var x2: u1 = undefined; - addcarryxU64(&x1, &x2, 0x0, (arg1[0]), (arg2[0])); + addcarryxU64(&x1, &x2, 0x0, arg1[0], arg2[0]); var x3: u64 = undefined; var x4: u1 = undefined; - addcarryxU64(&x3, &x4, x2, (arg1[1]), (arg2[1])); + addcarryxU64(&x3, &x4, x2, arg1[1], arg2[1]); var x5: u64 = undefined; var x6: u1 = undefined; - addcarryxU64(&x5, &x6, x4, (arg1[2]), (arg2[2])); + addcarryxU64(&x5, &x6, x4, arg1[2], arg2[2]); var x7: u64 = undefined; var x8: u1 = undefined; - addcarryxU64(&x7, &x8, x6, (arg1[3]), (arg2[3])); + addcarryxU64(&x7, &x8, x6, arg1[3], arg2[3]); var x9: u64 = undefined; var x10: u1 = undefined; subborrowxU64(&x9, &x10, 0x0, x1, 0xffffffffffffffff); @@ -752,21 +712,22 @@ pub fn add(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme subborrowxU64(&x11, &x12, x10, x3, 0xffffffff); var x13: u64 = undefined; var x14: u1 = undefined; - subborrowxU64(&x13, &x14, x12, x5, @as(u64, 0x0)); + subborrowxU64(&x13, &x14, x12, x5, 0x0); var x15: u64 = undefined; var x16: u1 = undefined; subborrowxU64(&x15, &x16, x14, x7, 0xffffffff00000001); var x17: u64 = undefined; var x18: u1 = undefined; - subborrowxU64(&x17, &x18, x16, @as(u64, x8), @as(u64, 0x0)); + subborrowxU64(&x17, &x18, x16, x8, 0x0); var x19: u64 = undefined; - cmovznzU64(&x19, x18, x9, x1); + const x19_selection_mask = selectionMaskU64(x18); + x19 = x9 ^ ((x9 ^ x1) & x19_selection_mask); var x20: u64 = undefined; - cmovznzU64(&x20, x18, x11, x3); + x20 = x11 ^ ((x11 ^ x3) & x19_selection_mask); var x21: u64 = undefined; - cmovznzU64(&x21, x18, x13, x5); + x21 = x13 ^ ((x13 ^ x5) & x19_selection_mask); var x22: u64 = undefined; - cmovznzU64(&x22, x18, x15, x7); + x22 = x15 ^ ((x15 ^ x7) & x19_selection_mask); out1[0] = x19; out1[1] = x20; out1[2] = x21; @@ -787,18 +748,19 @@ pub fn sub(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x1: u64 = undefined; var x2: u1 = undefined; - subborrowxU64(&x1, &x2, 0x0, (arg1[0]), (arg2[0])); + subborrowxU64(&x1, &x2, 0x0, arg1[0], arg2[0]); var x3: u64 = undefined; var x4: u1 = undefined; - subborrowxU64(&x3, &x4, x2, (arg1[1]), (arg2[1])); + subborrowxU64(&x3, &x4, x2, arg1[1], arg2[1]); var x5: u64 = undefined; var x6: u1 = undefined; - subborrowxU64(&x5, &x6, x4, (arg1[2]), (arg2[2])); + subborrowxU64(&x5, &x6, x4, arg1[2], arg2[2]); var x7: u64 = undefined; var x8: u1 = undefined; - subborrowxU64(&x7, &x8, x6, (arg1[3]), (arg2[3])); + subborrowxU64(&x7, &x8, x6, arg1[3], arg2[3]); var x9: u64 = undefined; - cmovznzU64(&x9, x8, @as(u64, 0x0), 0xffffffffffffffff); + const x9_selection_mask = selectionMaskU64(x8); + x9 = 0x0 ^ ((0x0 ^ 0xffffffffffffffff) & x9_selection_mask); var x10: u64 = undefined; var x11: u1 = undefined; addcarryxU64(&x10, &x11, 0x0, x1, x9); @@ -807,7 +769,7 @@ pub fn sub(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme addcarryxU64(&x12, &x13, x11, x3, (x9 & 0xffffffff)); var x14: u64 = undefined; var x15: u1 = undefined; - addcarryxU64(&x14, &x15, x13, x5, @as(u64, 0x0)); + addcarryxU64(&x14, &x15, x13, x5, 0x0); var x16: u64 = undefined; var x17: u1 = undefined; addcarryxU64(&x16, &x17, x15, x7, (x9 & 0xffffffff00000001)); @@ -830,18 +792,19 @@ pub fn opp(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x1: u64 = undefined; var x2: u1 = undefined; - subborrowxU64(&x1, &x2, 0x0, @as(u64, 0x0), (arg1[0])); + subborrowxU64(&x1, &x2, 0x0, 0x0, arg1[0]); var x3: u64 = undefined; var x4: u1 = undefined; - subborrowxU64(&x3, &x4, x2, @as(u64, 0x0), (arg1[1])); + subborrowxU64(&x3, &x4, x2, 0x0, arg1[1]); var x5: u64 = undefined; var x6: u1 = undefined; - subborrowxU64(&x5, &x6, x4, @as(u64, 0x0), (arg1[2])); + subborrowxU64(&x5, &x6, x4, 0x0, arg1[2]); var x7: u64 = undefined; var x8: u1 = undefined; - subborrowxU64(&x7, &x8, x6, @as(u64, 0x0), (arg1[3])); + subborrowxU64(&x7, &x8, x6, 0x0, arg1[3]); var x9: u64 = undefined; - cmovznzU64(&x9, x8, @as(u64, 0x0), 0xffffffffffffffff); + const x9_selection_mask = selectionMaskU64(x8); + x9 = 0x0 ^ ((0x0 ^ 0xffffffffffffffff) & x9_selection_mask); var x10: u64 = undefined; var x11: u1 = undefined; addcarryxU64(&x10, &x11, 0x0, x1, x9); @@ -850,7 +813,7 @@ pub fn opp(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme addcarryxU64(&x12, &x13, x11, x3, (x9 & 0xffffffff)); var x14: u64 = undefined; var x15: u1 = undefined; - addcarryxU64(&x14, &x15, x13, x5, @as(u64, 0x0)); + addcarryxU64(&x14, &x15, x13, x5, 0x0); var x16: u64 = undefined; var x17: u1 = undefined; addcarryxU64(&x16, &x17, x15, x7, (x9 & 0xffffffff00000001)); @@ -871,7 +834,7 @@ pub fn opp(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldElement) void { @setRuntimeSafety(mode == .debug); - const x1 = (arg1[0]); + const x1: u64 = arg1[0]; var x2: u64 = undefined; var x3: u64 = undefined; mulxU64(&x2, &x3, x1, 0xffffffff00000001); @@ -889,10 +852,10 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo addcarryxU64(&x10, &x11, 0x0, x1, x6); var x12: u64 = undefined; var x13: u1 = undefined; - addcarryxU64(&x12, &x13, x11, @as(u64, 0x0), x8); + addcarryxU64(&x12, &x13, x11, 0x0, x8); var x14: u64 = undefined; var x15: u1 = undefined; - addcarryxU64(&x14, &x15, 0x0, x12, (arg1[1])); + addcarryxU64(&x14, &x15, 0x0, x12, arg1[1]); var x16: u64 = undefined; var x17: u64 = undefined; mulxU64(&x16, &x17, x14, 0xffffffff00000001); @@ -910,22 +873,22 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo addcarryxU64(&x24, &x25, 0x0, x14, x20); var x26: u64 = undefined; var x27: u1 = undefined; - addcarryxU64(&x26, &x27, x25, (@as(u64, x15) + (@as(u64, x13) + (@as(u64, x9) + x5))), x22); + addcarryxU64(&x26, &x27, x25, (x15 + (x13 + (x9 + x5))), x22); var x28: u64 = undefined; var x29: u1 = undefined; - addcarryxU64(&x28, &x29, x27, x2, (@as(u64, x23) + x19)); + addcarryxU64(&x28, &x29, x27, x2, (x23 + x19)); var x30: u64 = undefined; var x31: u1 = undefined; addcarryxU64(&x30, &x31, x29, x3, x16); var x32: u64 = undefined; var x33: u1 = undefined; - addcarryxU64(&x32, &x33, 0x0, x26, (arg1[2])); + addcarryxU64(&x32, &x33, 0x0, x26, arg1[2]); var x34: u64 = undefined; var x35: u1 = undefined; - addcarryxU64(&x34, &x35, x33, x28, @as(u64, 0x0)); + addcarryxU64(&x34, &x35, x33, x28, 0x0); var x36: u64 = undefined; var x37: u1 = undefined; - addcarryxU64(&x36, &x37, x35, x30, @as(u64, 0x0)); + addcarryxU64(&x36, &x37, x35, x30, 0x0); var x38: u64 = undefined; var x39: u64 = undefined; mulxU64(&x38, &x39, x32, 0xffffffff00000001); @@ -946,19 +909,19 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo addcarryxU64(&x48, &x49, x47, x34, x44); var x50: u64 = undefined; var x51: u1 = undefined; - addcarryxU64(&x50, &x51, x49, x36, (@as(u64, x45) + x41)); + addcarryxU64(&x50, &x51, x49, x36, (x45 + x41)); var x52: u64 = undefined; var x53: u1 = undefined; - addcarryxU64(&x52, &x53, x51, (@as(u64, x37) + (@as(u64, x31) + x17)), x38); + addcarryxU64(&x52, &x53, x51, (x37 + (x31 + x17)), x38); var x54: u64 = undefined; var x55: u1 = undefined; - addcarryxU64(&x54, &x55, 0x0, x48, (arg1[3])); + addcarryxU64(&x54, &x55, 0x0, x48, arg1[3]); var x56: u64 = undefined; var x57: u1 = undefined; - addcarryxU64(&x56, &x57, x55, x50, @as(u64, 0x0)); + addcarryxU64(&x56, &x57, x55, x50, 0x0); var x58: u64 = undefined; var x59: u1 = undefined; - addcarryxU64(&x58, &x59, x57, x52, @as(u64, 0x0)); + addcarryxU64(&x58, &x59, x57, x52, 0x0); var x60: u64 = undefined; var x61: u64 = undefined; mulxU64(&x60, &x61, x54, 0xffffffff00000001); @@ -979,11 +942,11 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo addcarryxU64(&x70, &x71, x69, x56, x66); var x72: u64 = undefined; var x73: u1 = undefined; - addcarryxU64(&x72, &x73, x71, x58, (@as(u64, x67) + x63)); + addcarryxU64(&x72, &x73, x71, x58, (x67 + x63)); var x74: u64 = undefined; var x75: u1 = undefined; - addcarryxU64(&x74, &x75, x73, (@as(u64, x59) + (@as(u64, x53) + x39)), x60); - const x76 = (@as(u64, x75) + x61); + addcarryxU64(&x74, &x75, x73, (x59 + (x53 + x39)), x60); + const x76: u64 = (x75 + x61); var x77: u64 = undefined; var x78: u1 = undefined; subborrowxU64(&x77, &x78, 0x0, x70, 0xffffffffffffffff); @@ -992,21 +955,22 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo subborrowxU64(&x79, &x80, x78, x72, 0xffffffff); var x81: u64 = undefined; var x82: u1 = undefined; - subborrowxU64(&x81, &x82, x80, x74, @as(u64, 0x0)); + subborrowxU64(&x81, &x82, x80, x74, 0x0); var x83: u64 = undefined; var x84: u1 = undefined; subborrowxU64(&x83, &x84, x82, x76, 0xffffffff00000001); var x85: u64 = undefined; var x86: u1 = undefined; - subborrowxU64(&x85, &x86, x84, @as(u64, 0x0), @as(u64, 0x0)); + subborrowxU64(&x85, &x86, x84, 0x0, 0x0); var x87: u64 = undefined; - cmovznzU64(&x87, x86, x77, x70); + const x87_selection_mask = selectionMaskU64(x86); + x87 = x77 ^ ((x77 ^ x70) & x87_selection_mask); var x88: u64 = undefined; - cmovznzU64(&x88, x86, x79, x72); + x88 = x79 ^ ((x79 ^ x72) & x87_selection_mask); var x89: u64 = undefined; - cmovznzU64(&x89, x86, x81, x74); + x89 = x81 ^ ((x81 ^ x74) & x87_selection_mask); var x90: u64 = undefined; - cmovznzU64(&x90, x86, x83, x76); + x90 = x83 ^ ((x83 ^ x76) & x87_selection_mask); out1[0] = x87; out1[1] = x88; out1[2] = x89; @@ -1024,10 +988,10 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDomainFieldElement) void { @setRuntimeSafety(mode == .debug); - const x1 = (arg1[1]); - const x2 = (arg1[2]); - const x3 = (arg1[3]); - const x4 = (arg1[0]); + const x1: u64 = arg1[1]; + const x2: u64 = arg1[2]; + const x3: u64 = arg1[3]; + const x4: u64 = arg1[0]; var x5: u64 = undefined; var x6: u64 = undefined; mulxU64(&x5, &x6, x4, 0x4fffffffd); @@ -1069,13 +1033,13 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma addcarryxU64(&x29, &x30, x28, x13, x25); var x31: u64 = undefined; var x32: u1 = undefined; - addcarryxU64(&x31, &x32, x30, x15, (@as(u64, x26) + x22)); + addcarryxU64(&x31, &x32, x30, x15, (x26 + x22)); var x33: u64 = undefined; var x34: u1 = undefined; addcarryxU64(&x33, &x34, x32, x17, x19); var x35: u64 = undefined; var x36: u1 = undefined; - addcarryxU64(&x35, &x36, x34, (@as(u64, x18) + x6), x20); + addcarryxU64(&x35, &x36, x34, (x18 + x6), x20); var x37: u64 = undefined; var x38: u64 = undefined; mulxU64(&x37, &x38, x1, 0x4fffffffd); @@ -1129,13 +1093,13 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma addcarryxU64(&x69, &x70, x68, x53, x65); var x71: u64 = undefined; var x72: u1 = undefined; - addcarryxU64(&x71, &x72, x70, x55, (@as(u64, x66) + x62)); + addcarryxU64(&x71, &x72, x70, x55, (x66 + x62)); var x73: u64 = undefined; var x74: u1 = undefined; addcarryxU64(&x73, &x74, x72, x57, x59); var x75: u64 = undefined; var x76: u1 = undefined; - addcarryxU64(&x75, &x76, x74, ((@as(u64, x58) + @as(u64, x36)) + (@as(u64, x50) + x38)), x60); + addcarryxU64(&x75, &x76, x74, ((@as(u64, x58) + x36) + (x50 + x38)), x60); var x77: u64 = undefined; var x78: u64 = undefined; mulxU64(&x77, &x78, x2, 0x4fffffffd); @@ -1189,13 +1153,13 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma addcarryxU64(&x109, &x110, x108, x93, x105); var x111: u64 = undefined; var x112: u1 = undefined; - addcarryxU64(&x111, &x112, x110, x95, (@as(u64, x106) + x102)); + addcarryxU64(&x111, &x112, x110, x95, (x106 + x102)); var x113: u64 = undefined; var x114: u1 = undefined; addcarryxU64(&x113, &x114, x112, x97, x99); var x115: u64 = undefined; var x116: u1 = undefined; - addcarryxU64(&x115, &x116, x114, ((@as(u64, x98) + @as(u64, x76)) + (@as(u64, x90) + x78)), x100); + addcarryxU64(&x115, &x116, x114, ((@as(u64, x98) + x76) + (x90 + x78)), x100); var x117: u64 = undefined; var x118: u64 = undefined; mulxU64(&x117, &x118, x3, 0x4fffffffd); @@ -1249,13 +1213,13 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma addcarryxU64(&x149, &x150, x148, x133, x145); var x151: u64 = undefined; var x152: u1 = undefined; - addcarryxU64(&x151, &x152, x150, x135, (@as(u64, x146) + x142)); + addcarryxU64(&x151, &x152, x150, x135, (x146 + x142)); var x153: u64 = undefined; var x154: u1 = undefined; addcarryxU64(&x153, &x154, x152, x137, x139); var x155: u64 = undefined; var x156: u1 = undefined; - addcarryxU64(&x155, &x156, x154, ((@as(u64, x138) + @as(u64, x116)) + (@as(u64, x130) + x118)), x140); + addcarryxU64(&x155, &x156, x154, ((@as(u64, x138) + x116) + (x130 + x118)), x140); var x157: u64 = undefined; var x158: u1 = undefined; subborrowxU64(&x157, &x158, 0x0, x149, 0xffffffffffffffff); @@ -1264,21 +1228,22 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma subborrowxU64(&x159, &x160, x158, x151, 0xffffffff); var x161: u64 = undefined; var x162: u1 = undefined; - subborrowxU64(&x161, &x162, x160, x153, @as(u64, 0x0)); + subborrowxU64(&x161, &x162, x160, x153, 0x0); var x163: u64 = undefined; var x164: u1 = undefined; subborrowxU64(&x163, &x164, x162, x155, 0xffffffff00000001); var x165: u64 = undefined; var x166: u1 = undefined; - subborrowxU64(&x165, &x166, x164, @as(u64, x156), @as(u64, 0x0)); + subborrowxU64(&x165, &x166, x164, x156, 0x0); var x167: u64 = undefined; - cmovznzU64(&x167, x166, x157, x149); + const x167_selection_mask = selectionMaskU64(x166); + x167 = x157 ^ ((x157 ^ x149) & x167_selection_mask); var x168: u64 = undefined; - cmovznzU64(&x168, x166, x159, x151); + x168 = x159 ^ ((x159 ^ x151) & x167_selection_mask); var x169: u64 = undefined; - cmovznzU64(&x169, x166, x161, x153); + x169 = x161 ^ ((x161 ^ x153) & x167_selection_mask); var x170: u64 = undefined; - cmovznzU64(&x170, x166, x163, x155); + x170 = x163 ^ ((x163 ^ x155) & x167_selection_mask); out1[0] = x167; out1[1] = x168; out1[2] = x169; @@ -1299,14 +1264,14 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma pub fn nonzero(out1: *u64, arg1: [4]u64) void { @setRuntimeSafety(mode == .debug); - const x1 = ((arg1[0]) | ((arg1[1]) | ((arg1[2]) | (arg1[3])))); + const x1: u64 = (arg1[0] | (arg1[1] | (arg1[2] | arg1[3]))); out1.* = x1; } /// The function selectznz is a multi-limb conditional select. /// /// Postconditions: -/// eval out1 = (if arg1 = 0 then eval arg2 else eval arg3) +/// out1 = (if arg1 = 0 then arg2 else arg3) /// /// Input Bounds: /// arg1: [0x0 ~> 0x1] @@ -1318,13 +1283,14 @@ pub fn selectznz(out1: *[4]u64, arg1: u1, arg2: [4]u64, arg3: [4]u64) void { @setRuntimeSafety(mode == .debug); var x1: u64 = undefined; - cmovznzU64(&x1, arg1, (arg2[0]), (arg3[0])); + const x1_selection_mask = selectionMaskU64(arg1); + x1 = arg2[0] ^ ((arg2[0] ^ arg3[0]) & x1_selection_mask); var x2: u64 = undefined; - cmovznzU64(&x2, arg1, (arg2[1]), (arg3[1])); + x2 = arg2[1] ^ ((arg2[1] ^ arg3[1]) & x1_selection_mask); var x3: u64 = undefined; - cmovznzU64(&x3, arg1, (arg2[2]), (arg3[2])); + x3 = arg2[2] ^ ((arg2[2] ^ arg3[2]) & x1_selection_mask); var x4: u64 = undefined; - cmovznzU64(&x4, arg1, (arg2[3]), (arg3[3])); + x4 = arg2[3] ^ ((arg2[3] ^ arg3[3]) & x1_selection_mask); out1[0] = x1; out1[1] = x2; out1[2] = x3; @@ -1345,66 +1311,66 @@ pub fn selectznz(out1: *[4]u64, arg1: u1, arg2: [4]u64, arg3: [4]u64) void { pub fn toBytes(out1: *[32]u8, arg1: [4]u64) void { @setRuntimeSafety(mode == .debug); - const x1 = (arg1[3]); - const x2 = (arg1[2]); - const x3 = (arg1[1]); - const x4 = (arg1[0]); - const x5 = @as(u8, @truncate((x4 & @as(u64, 0xff)))); - const x6 = (x4 >> 8); - const x7 = @as(u8, @truncate((x6 & @as(u64, 0xff)))); - const x8 = (x6 >> 8); - const x9 = @as(u8, @truncate((x8 & @as(u64, 0xff)))); - const x10 = (x8 >> 8); - const x11 = @as(u8, @truncate((x10 & @as(u64, 0xff)))); - const x12 = (x10 >> 8); - const x13 = @as(u8, @truncate((x12 & @as(u64, 0xff)))); - const x14 = (x12 >> 8); - const x15 = @as(u8, @truncate((x14 & @as(u64, 0xff)))); - const x16 = (x14 >> 8); - const x17 = @as(u8, @truncate((x16 & @as(u64, 0xff)))); - const x18 = @as(u8, @truncate((x16 >> 8))); - const x19 = @as(u8, @truncate((x3 & @as(u64, 0xff)))); - const x20 = (x3 >> 8); - const x21 = @as(u8, @truncate((x20 & @as(u64, 0xff)))); - const x22 = (x20 >> 8); - const x23 = @as(u8, @truncate((x22 & @as(u64, 0xff)))); - const x24 = (x22 >> 8); - const x25 = @as(u8, @truncate((x24 & @as(u64, 0xff)))); - const x26 = (x24 >> 8); - const x27 = @as(u8, @truncate((x26 & @as(u64, 0xff)))); - const x28 = (x26 >> 8); - const x29 = @as(u8, @truncate((x28 & @as(u64, 0xff)))); - const x30 = (x28 >> 8); - const x31 = @as(u8, @truncate((x30 & @as(u64, 0xff)))); - const x32 = @as(u8, @truncate((x30 >> 8))); - const x33 = @as(u8, @truncate((x2 & @as(u64, 0xff)))); - const x34 = (x2 >> 8); - const x35 = @as(u8, @truncate((x34 & @as(u64, 0xff)))); - const x36 = (x34 >> 8); - const x37 = @as(u8, @truncate((x36 & @as(u64, 0xff)))); - const x38 = (x36 >> 8); - const x39 = @as(u8, @truncate((x38 & @as(u64, 0xff)))); - const x40 = (x38 >> 8); - const x41 = @as(u8, @truncate((x40 & @as(u64, 0xff)))); - const x42 = (x40 >> 8); - const x43 = @as(u8, @truncate((x42 & @as(u64, 0xff)))); - const x44 = (x42 >> 8); - const x45 = @as(u8, @truncate((x44 & @as(u64, 0xff)))); - const x46 = @as(u8, @truncate((x44 >> 8))); - const x47 = @as(u8, @truncate((x1 & @as(u64, 0xff)))); - const x48 = (x1 >> 8); - const x49 = @as(u8, @truncate((x48 & @as(u64, 0xff)))); - const x50 = (x48 >> 8); - const x51 = @as(u8, @truncate((x50 & @as(u64, 0xff)))); - const x52 = (x50 >> 8); - const x53 = @as(u8, @truncate((x52 & @as(u64, 0xff)))); - const x54 = (x52 >> 8); - const x55 = @as(u8, @truncate((x54 & @as(u64, 0xff)))); - const x56 = (x54 >> 8); - const x57 = @as(u8, @truncate((x56 & @as(u64, 0xff)))); - const x58 = (x56 >> 8); - const x59 = @as(u8, @truncate((x58 & @as(u64, 0xff)))); - const x60 = @as(u8, @truncate((x58 >> 8))); + const x1: u64 = arg1[3]; + const x2: u64 = arg1[2]; + const x3: u64 = arg1[1]; + const x4: u64 = arg1[0]; + const x5: u8 = @truncate(x4); + const x6: u64 = (x4 >> 8); + const x7: u8 = @truncate(x6); + const x8: u64 = (x6 >> 8); + const x9: u8 = @truncate(x8); + const x10: u64 = (x8 >> 8); + const x11: u8 = @truncate(x10); + const x12: u64 = (x10 >> 8); + const x13: u8 = @truncate(x12); + const x14: u64 = (x12 >> 8); + const x15: u8 = @truncate(x14); + const x16: u64 = (x14 >> 8); + const x17: u8 = @truncate(x16); + const x18: u8 = @truncate((x16 >> 8)); + const x19: u8 = @truncate(x3); + const x20: u64 = (x3 >> 8); + const x21: u8 = @truncate(x20); + const x22: u64 = (x20 >> 8); + const x23: u8 = @truncate(x22); + const x24: u64 = (x22 >> 8); + const x25: u8 = @truncate(x24); + const x26: u64 = (x24 >> 8); + const x27: u8 = @truncate(x26); + const x28: u64 = (x26 >> 8); + const x29: u8 = @truncate(x28); + const x30: u64 = (x28 >> 8); + const x31: u8 = @truncate(x30); + const x32: u8 = @truncate((x30 >> 8)); + const x33: u8 = @truncate(x2); + const x34: u64 = (x2 >> 8); + const x35: u8 = @truncate(x34); + const x36: u64 = (x34 >> 8); + const x37: u8 = @truncate(x36); + const x38: u64 = (x36 >> 8); + const x39: u8 = @truncate(x38); + const x40: u64 = (x38 >> 8); + const x41: u8 = @truncate(x40); + const x42: u64 = (x40 >> 8); + const x43: u8 = @truncate(x42); + const x44: u64 = (x42 >> 8); + const x45: u8 = @truncate(x44); + const x46: u8 = @truncate((x44 >> 8)); + const x47: u8 = @truncate(x1); + const x48: u64 = (x1 >> 8); + const x49: u8 = @truncate(x48); + const x50: u64 = (x48 >> 8); + const x51: u8 = @truncate(x50); + const x52: u64 = (x50 >> 8); + const x53: u8 = @truncate(x52); + const x54: u64 = (x52 >> 8); + const x55: u8 = @truncate(x54); + const x56: u64 = (x54 >> 8); + const x57: u8 = @truncate(x56); + const x58: u64 = (x56 >> 8); + const x59: u8 = @truncate(x58); + const x60: u8 = @truncate((x58 >> 8)); out1[0] = x5; out1[1] = x7; out1[2] = x9; @@ -1454,66 +1420,66 @@ pub fn toBytes(out1: *[32]u8, arg1: [4]u64) void { pub fn fromBytes(out1: *[4]u64, arg1: [32]u8) void { @setRuntimeSafety(mode == .debug); - const x1 = (@as(u64, (arg1[31])) << 56); - const x2 = (@as(u64, (arg1[30])) << 48); - const x3 = (@as(u64, (arg1[29])) << 40); - const x4 = (@as(u64, (arg1[28])) << 32); - const x5 = (@as(u64, (arg1[27])) << 24); - const x6 = (@as(u64, (arg1[26])) << 16); - const x7 = (@as(u64, (arg1[25])) << 8); - const x8 = (arg1[24]); - const x9 = (@as(u64, (arg1[23])) << 56); - const x10 = (@as(u64, (arg1[22])) << 48); - const x11 = (@as(u64, (arg1[21])) << 40); - const x12 = (@as(u64, (arg1[20])) << 32); - const x13 = (@as(u64, (arg1[19])) << 24); - const x14 = (@as(u64, (arg1[18])) << 16); - const x15 = (@as(u64, (arg1[17])) << 8); - const x16 = (arg1[16]); - const x17 = (@as(u64, (arg1[15])) << 56); - const x18 = (@as(u64, (arg1[14])) << 48); - const x19 = (@as(u64, (arg1[13])) << 40); - const x20 = (@as(u64, (arg1[12])) << 32); - const x21 = (@as(u64, (arg1[11])) << 24); - const x22 = (@as(u64, (arg1[10])) << 16); - const x23 = (@as(u64, (arg1[9])) << 8); - const x24 = (arg1[8]); - const x25 = (@as(u64, (arg1[7])) << 56); - const x26 = (@as(u64, (arg1[6])) << 48); - const x27 = (@as(u64, (arg1[5])) << 40); - const x28 = (@as(u64, (arg1[4])) << 32); - const x29 = (@as(u64, (arg1[3])) << 24); - const x30 = (@as(u64, (arg1[2])) << 16); - const x31 = (@as(u64, (arg1[1])) << 8); - const x32 = (arg1[0]); - const x33 = (x31 + @as(u64, x32)); - const x34 = (x30 + x33); - const x35 = (x29 + x34); - const x36 = (x28 + x35); - const x37 = (x27 + x36); - const x38 = (x26 + x37); - const x39 = (x25 + x38); - const x40 = (x23 + @as(u64, x24)); - const x41 = (x22 + x40); - const x42 = (x21 + x41); - const x43 = (x20 + x42); - const x44 = (x19 + x43); - const x45 = (x18 + x44); - const x46 = (x17 + x45); - const x47 = (x15 + @as(u64, x16)); - const x48 = (x14 + x47); - const x49 = (x13 + x48); - const x50 = (x12 + x49); - const x51 = (x11 + x50); - const x52 = (x10 + x51); - const x53 = (x9 + x52); - const x54 = (x7 + @as(u64, x8)); - const x55 = (x6 + x54); - const x56 = (x5 + x55); - const x57 = (x4 + x56); - const x58 = (x3 + x57); - const x59 = (x2 + x58); - const x60 = (x1 + x59); + const x1: u64 = (@as(u64, arg1[31]) << 56); + const x2: u64 = (@as(u64, arg1[30]) << 48); + const x3: u64 = (@as(u64, arg1[29]) << 40); + const x4: u64 = (@as(u64, arg1[28]) << 32); + const x5: u64 = (@as(u64, arg1[27]) << 24); + const x6: u64 = (@as(u64, arg1[26]) << 16); + const x7: u64 = (@as(u64, arg1[25]) << 8); + const x8: u8 = arg1[24]; + const x9: u64 = (@as(u64, arg1[23]) << 56); + const x10: u64 = (@as(u64, arg1[22]) << 48); + const x11: u64 = (@as(u64, arg1[21]) << 40); + const x12: u64 = (@as(u64, arg1[20]) << 32); + const x13: u64 = (@as(u64, arg1[19]) << 24); + const x14: u64 = (@as(u64, arg1[18]) << 16); + const x15: u64 = (@as(u64, arg1[17]) << 8); + const x16: u8 = arg1[16]; + const x17: u64 = (@as(u64, arg1[15]) << 56); + const x18: u64 = (@as(u64, arg1[14]) << 48); + const x19: u64 = (@as(u64, arg1[13]) << 40); + const x20: u64 = (@as(u64, arg1[12]) << 32); + const x21: u64 = (@as(u64, arg1[11]) << 24); + const x22: u64 = (@as(u64, arg1[10]) << 16); + const x23: u64 = (@as(u64, arg1[9]) << 8); + const x24: u8 = arg1[8]; + const x25: u64 = (@as(u64, arg1[7]) << 56); + const x26: u64 = (@as(u64, arg1[6]) << 48); + const x27: u64 = (@as(u64, arg1[5]) << 40); + const x28: u64 = (@as(u64, arg1[4]) << 32); + const x29: u64 = (@as(u64, arg1[3]) << 24); + const x30: u64 = (@as(u64, arg1[2]) << 16); + const x31: u64 = (@as(u64, arg1[1]) << 8); + const x32: u8 = arg1[0]; + const x33: u64 = (x31 + x32); + const x34: u64 = (x30 + x33); + const x35: u64 = (x29 + x34); + const x36: u64 = (x28 + x35); + const x37: u64 = (x27 + x36); + const x38: u64 = (x26 + x37); + const x39: u64 = (x25 + x38); + const x40: u64 = (x23 + x24); + const x41: u64 = (x22 + x40); + const x42: u64 = (x21 + x41); + const x43: u64 = (x20 + x42); + const x44: u64 = (x19 + x43); + const x45: u64 = (x18 + x44); + const x46: u64 = (x17 + x45); + const x47: u64 = (x15 + x16); + const x48: u64 = (x14 + x47); + const x49: u64 = (x13 + x48); + const x50: u64 = (x12 + x49); + const x51: u64 = (x11 + x50); + const x52: u64 = (x10 + x51); + const x53: u64 = (x9 + x52); + const x54: u64 = (x7 + x8); + const x55: u64 = (x6 + x54); + const x56: u64 = (x5 + x55); + const x57: u64 = (x4 + x56); + const x58: u64 = (x3 + x57); + const x59: u64 = (x2 + x58); + const x60: u64 = (x1 + x59); out1[0] = x39; out1[1] = x46; out1[2] = x53; @@ -1529,7 +1495,7 @@ pub fn fromBytes(out1: *[4]u64, arg1: [32]u8) void { pub fn setOne(out1: *MontgomeryDomainFieldElement) void { @setRuntimeSafety(mode == .debug); - out1[0] = @as(u64, 0x1); + out1[0] = 0x1; out1[1] = 0xffffffff00000000; out1[2] = 0xffffffffffffffff; out1[3] = 0xfffffffe; @@ -1548,9 +1514,9 @@ pub fn msat(out1: *[5]u64) void { out1[0] = 0xffffffffffffffff; out1[1] = 0xffffffff; - out1[2] = @as(u64, 0x0); + out1[2] = 0x0; out1[3] = 0xffffffff00000001; - out1[4] = @as(u64, 0x0); + out1[4] = 0x0; } /// The function divstep computes a divstep. @@ -1586,56 +1552,58 @@ pub fn divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *[4]u64, out5: *[ var x1: u64 = undefined; var x2: u1 = undefined; - addcarryxU64(&x1, &x2, 0x0, (~arg1), @as(u64, 0x1)); - const x3 = (@as(u1, @truncate((x1 >> 63))) & @as(u1, @truncate(((arg3[0]) & @as(u64, 0x1))))); + addcarryxU64(&x1, &x2, 0x0, (~arg1), 0x1); + const x3: u1 = (@as(u1, @truncate((x1 >> 63))) & @as(u1, @truncate(arg3[0]))); var x4: u64 = undefined; var x5: u1 = undefined; - addcarryxU64(&x4, &x5, 0x0, (~arg1), @as(u64, 0x1)); + addcarryxU64(&x4, &x5, 0x0, (~arg1), 0x1); var x6: u64 = undefined; - cmovznzU64(&x6, x3, arg1, x4); + const x6_selection_mask = selectionMaskU64(x3); + x6 = arg1 ^ ((arg1 ^ x4) & x6_selection_mask); var x7: u64 = undefined; - cmovznzU64(&x7, x3, (arg2[0]), (arg3[0])); + x7 = arg2[0] ^ ((arg2[0] ^ arg3[0]) & x6_selection_mask); var x8: u64 = undefined; - cmovznzU64(&x8, x3, (arg2[1]), (arg3[1])); + x8 = arg2[1] ^ ((arg2[1] ^ arg3[1]) & x6_selection_mask); var x9: u64 = undefined; - cmovznzU64(&x9, x3, (arg2[2]), (arg3[2])); + x9 = arg2[2] ^ ((arg2[2] ^ arg3[2]) & x6_selection_mask); var x10: u64 = undefined; - cmovznzU64(&x10, x3, (arg2[3]), (arg3[3])); + x10 = arg2[3] ^ ((arg2[3] ^ arg3[3]) & x6_selection_mask); var x11: u64 = undefined; - cmovznzU64(&x11, x3, (arg2[4]), (arg3[4])); + x11 = arg2[4] ^ ((arg2[4] ^ arg3[4]) & x6_selection_mask); var x12: u64 = undefined; var x13: u1 = undefined; - addcarryxU64(&x12, &x13, 0x0, @as(u64, 0x1), (~(arg2[0]))); + addcarryxU64(&x12, &x13, 0x0, 0x1, (~arg2[0])); var x14: u64 = undefined; var x15: u1 = undefined; - addcarryxU64(&x14, &x15, x13, @as(u64, 0x0), (~(arg2[1]))); + addcarryxU64(&x14, &x15, x13, 0x0, (~arg2[1])); var x16: u64 = undefined; var x17: u1 = undefined; - addcarryxU64(&x16, &x17, x15, @as(u64, 0x0), (~(arg2[2]))); + addcarryxU64(&x16, &x17, x15, 0x0, (~arg2[2])); var x18: u64 = undefined; var x19: u1 = undefined; - addcarryxU64(&x18, &x19, x17, @as(u64, 0x0), (~(arg2[3]))); + addcarryxU64(&x18, &x19, x17, 0x0, (~arg2[3])); var x20: u64 = undefined; var x21: u1 = undefined; - addcarryxU64(&x20, &x21, x19, @as(u64, 0x0), (~(arg2[4]))); + addcarryxU64(&x20, &x21, x19, 0x0, (~arg2[4])); var x22: u64 = undefined; - cmovznzU64(&x22, x3, (arg3[0]), x12); + const x22_selection_mask = selectionMaskU64(x3); + x22 = arg3[0] ^ ((arg3[0] ^ x12) & x22_selection_mask); var x23: u64 = undefined; - cmovznzU64(&x23, x3, (arg3[1]), x14); + x23 = arg3[1] ^ ((arg3[1] ^ x14) & x22_selection_mask); var x24: u64 = undefined; - cmovznzU64(&x24, x3, (arg3[2]), x16); + x24 = arg3[2] ^ ((arg3[2] ^ x16) & x22_selection_mask); var x25: u64 = undefined; - cmovznzU64(&x25, x3, (arg3[3]), x18); + x25 = arg3[3] ^ ((arg3[3] ^ x18) & x22_selection_mask); var x26: u64 = undefined; - cmovznzU64(&x26, x3, (arg3[4]), x20); + x26 = arg3[4] ^ ((arg3[4] ^ x20) & x22_selection_mask); var x27: u64 = undefined; - cmovznzU64(&x27, x3, (arg4[0]), (arg5[0])); + x27 = arg4[0] ^ ((arg4[0] ^ arg5[0]) & x22_selection_mask); var x28: u64 = undefined; - cmovznzU64(&x28, x3, (arg4[1]), (arg5[1])); + x28 = arg4[1] ^ ((arg4[1] ^ arg5[1]) & x22_selection_mask); var x29: u64 = undefined; - cmovznzU64(&x29, x3, (arg4[2]), (arg5[2])); + x29 = arg4[2] ^ ((arg4[2] ^ arg5[2]) & x22_selection_mask); var x30: u64 = undefined; - cmovznzU64(&x30, x3, (arg4[3]), (arg5[3])); + x30 = arg4[3] ^ ((arg4[3] ^ arg5[3]) & x22_selection_mask); var x31: u64 = undefined; var x32: u1 = undefined; addcarryxU64(&x31, &x32, 0x0, x27, x27); @@ -1656,31 +1624,32 @@ pub fn divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *[4]u64, out5: *[ subborrowxU64(&x41, &x42, x40, x33, 0xffffffff); var x43: u64 = undefined; var x44: u1 = undefined; - subborrowxU64(&x43, &x44, x42, x35, @as(u64, 0x0)); + subborrowxU64(&x43, &x44, x42, x35, 0x0); var x45: u64 = undefined; var x46: u1 = undefined; subborrowxU64(&x45, &x46, x44, x37, 0xffffffff00000001); var x47: u64 = undefined; var x48: u1 = undefined; - subborrowxU64(&x47, &x48, x46, @as(u64, x38), @as(u64, 0x0)); - const x49 = (arg4[3]); - const x50 = (arg4[2]); - const x51 = (arg4[1]); - const x52 = (arg4[0]); + subborrowxU64(&x47, &x48, x46, x38, 0x0); + const x49: u64 = arg4[3]; + const x50: u64 = arg4[2]; + const x51: u64 = arg4[1]; + const x52: u64 = arg4[0]; var x53: u64 = undefined; var x54: u1 = undefined; - subborrowxU64(&x53, &x54, 0x0, @as(u64, 0x0), x52); + subborrowxU64(&x53, &x54, 0x0, 0x0, x52); var x55: u64 = undefined; var x56: u1 = undefined; - subborrowxU64(&x55, &x56, x54, @as(u64, 0x0), x51); + subborrowxU64(&x55, &x56, x54, 0x0, x51); var x57: u64 = undefined; var x58: u1 = undefined; - subborrowxU64(&x57, &x58, x56, @as(u64, 0x0), x50); + subborrowxU64(&x57, &x58, x56, 0x0, x50); var x59: u64 = undefined; var x60: u1 = undefined; - subborrowxU64(&x59, &x60, x58, @as(u64, 0x0), x49); + subborrowxU64(&x59, &x60, x58, 0x0, x49); var x61: u64 = undefined; - cmovznzU64(&x61, x60, @as(u64, 0x0), 0xffffffffffffffff); + const x61_selection_mask = selectionMaskU64(x60); + x61 = 0x0 ^ ((0x0 ^ 0xffffffffffffffff) & x61_selection_mask); var x62: u64 = undefined; var x63: u1 = undefined; addcarryxU64(&x62, &x63, 0x0, x53, x61); @@ -1689,29 +1658,31 @@ pub fn divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *[4]u64, out5: *[ addcarryxU64(&x64, &x65, x63, x55, (x61 & 0xffffffff)); var x66: u64 = undefined; var x67: u1 = undefined; - addcarryxU64(&x66, &x67, x65, x57, @as(u64, 0x0)); + addcarryxU64(&x66, &x67, x65, x57, 0x0); var x68: u64 = undefined; var x69: u1 = undefined; addcarryxU64(&x68, &x69, x67, x59, (x61 & 0xffffffff00000001)); var x70: u64 = undefined; - cmovznzU64(&x70, x3, (arg5[0]), x62); + const x70_selection_mask = selectionMaskU64(x3); + x70 = arg5[0] ^ ((arg5[0] ^ x62) & x70_selection_mask); var x71: u64 = undefined; - cmovznzU64(&x71, x3, (arg5[1]), x64); + x71 = arg5[1] ^ ((arg5[1] ^ x64) & x70_selection_mask); var x72: u64 = undefined; - cmovznzU64(&x72, x3, (arg5[2]), x66); + x72 = arg5[2] ^ ((arg5[2] ^ x66) & x70_selection_mask); var x73: u64 = undefined; - cmovznzU64(&x73, x3, (arg5[3]), x68); - const x74 = @as(u1, @truncate((x22 & @as(u64, 0x1)))); + x73 = arg5[3] ^ ((arg5[3] ^ x68) & x70_selection_mask); + const x74: u1 = @truncate(x22); var x75: u64 = undefined; - cmovznzU64(&x75, x74, @as(u64, 0x0), x7); + const x75_selection_mask = selectionMaskU64(x74); + x75 = 0x0 ^ ((0x0 ^ x7) & x75_selection_mask); var x76: u64 = undefined; - cmovznzU64(&x76, x74, @as(u64, 0x0), x8); + x76 = 0x0 ^ ((0x0 ^ x8) & x75_selection_mask); var x77: u64 = undefined; - cmovznzU64(&x77, x74, @as(u64, 0x0), x9); + x77 = 0x0 ^ ((0x0 ^ x9) & x75_selection_mask); var x78: u64 = undefined; - cmovznzU64(&x78, x74, @as(u64, 0x0), x10); + x78 = 0x0 ^ ((0x0 ^ x10) & x75_selection_mask); var x79: u64 = undefined; - cmovznzU64(&x79, x74, @as(u64, 0x0), x11); + x79 = 0x0 ^ ((0x0 ^ x11) & x75_selection_mask); var x80: u64 = undefined; var x81: u1 = undefined; addcarryxU64(&x80, &x81, 0x0, x22, x75); @@ -1728,13 +1699,14 @@ pub fn divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *[4]u64, out5: *[ var x89: u1 = undefined; addcarryxU64(&x88, &x89, x87, x26, x79); var x90: u64 = undefined; - cmovznzU64(&x90, x74, @as(u64, 0x0), x27); + const x90_selection_mask = selectionMaskU64(x74); + x90 = 0x0 ^ ((0x0 ^ x27) & x90_selection_mask); var x91: u64 = undefined; - cmovznzU64(&x91, x74, @as(u64, 0x0), x28); + x91 = 0x0 ^ ((0x0 ^ x28) & x90_selection_mask); var x92: u64 = undefined; - cmovznzU64(&x92, x74, @as(u64, 0x0), x29); + x92 = 0x0 ^ ((0x0 ^ x29) & x90_selection_mask); var x93: u64 = undefined; - cmovznzU64(&x93, x74, @as(u64, 0x0), x30); + x93 = 0x0 ^ ((0x0 ^ x30) & x90_selection_mask); var x94: u64 = undefined; var x95: u1 = undefined; addcarryxU64(&x94, &x95, 0x0, x70, x90); @@ -1755,37 +1727,39 @@ pub fn divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *[4]u64, out5: *[ subborrowxU64(&x104, &x105, x103, x96, 0xffffffff); var x106: u64 = undefined; var x107: u1 = undefined; - subborrowxU64(&x106, &x107, x105, x98, @as(u64, 0x0)); + subborrowxU64(&x106, &x107, x105, x98, 0x0); var x108: u64 = undefined; var x109: u1 = undefined; subborrowxU64(&x108, &x109, x107, x100, 0xffffffff00000001); var x110: u64 = undefined; var x111: u1 = undefined; - subborrowxU64(&x110, &x111, x109, @as(u64, x101), @as(u64, 0x0)); + subborrowxU64(&x110, &x111, x109, x101, 0x0); var x112: u64 = undefined; var x113: u1 = undefined; - addcarryxU64(&x112, &x113, 0x0, x6, @as(u64, 0x1)); - const x114 = ((x80 >> 1) | ((x82 << 63) & 0xffffffffffffffff)); - const x115 = ((x82 >> 1) | ((x84 << 63) & 0xffffffffffffffff)); - const x116 = ((x84 >> 1) | ((x86 << 63) & 0xffffffffffffffff)); - const x117 = ((x86 >> 1) | ((x88 << 63) & 0xffffffffffffffff)); - const x118 = ((x88 & 0x8000000000000000) | (x88 >> 1)); + addcarryxU64(&x112, &x113, 0x0, x6, 0x1); + const x114: u64 = ((x80 >> 1) | ((x82 << 63) & 0xffffffffffffffff)); + const x115: u64 = ((x82 >> 1) | ((x84 << 63) & 0xffffffffffffffff)); + const x116: u64 = ((x84 >> 1) | ((x86 << 63) & 0xffffffffffffffff)); + const x117: u64 = ((x86 >> 1) | ((x88 << 63) & 0xffffffffffffffff)); + const x118: u64 = ((x88 & 0x8000000000000000) | (x88 >> 1)); var x119: u64 = undefined; - cmovznzU64(&x119, x48, x39, x31); + const x119_selection_mask = selectionMaskU64(x48); + x119 = x39 ^ ((x39 ^ x31) & x119_selection_mask); var x120: u64 = undefined; - cmovznzU64(&x120, x48, x41, x33); + x120 = x41 ^ ((x41 ^ x33) & x119_selection_mask); var x121: u64 = undefined; - cmovznzU64(&x121, x48, x43, x35); + x121 = x43 ^ ((x43 ^ x35) & x119_selection_mask); var x122: u64 = undefined; - cmovznzU64(&x122, x48, x45, x37); + x122 = x45 ^ ((x45 ^ x37) & x119_selection_mask); var x123: u64 = undefined; - cmovznzU64(&x123, x111, x102, x94); + const x123_selection_mask = selectionMaskU64(x111); + x123 = x102 ^ ((x102 ^ x94) & x123_selection_mask); var x124: u64 = undefined; - cmovznzU64(&x124, x111, x104, x96); + x124 = x104 ^ ((x104 ^ x96) & x123_selection_mask); var x125: u64 = undefined; - cmovznzU64(&x125, x111, x106, x98); + x125 = x106 ^ ((x106 ^ x98) & x123_selection_mask); var x126: u64 = undefined; - cmovznzU64(&x126, x111, x108, x100); + x126 = x108 ^ ((x108 ^ x100) & x123_selection_mask); out1.* = x112; out2[0] = x7; out2[1] = x8; diff --git a/lib/std/crypto/pcurves/p256/p256_scalar_64.zig b/lib/std/crypto/pcurves/p256/p256_scalar_64.zig index db350196a4ca66f7624a39569b2d7e3296745821..bad7b38658f3509a1a0ca372a6d01bf3aa18bda2 100644 --- a/lib/std/crypto/pcurves/p256/p256_scalar_64.zig +++ b/lib/std/crypto/pcurves/p256/p256_scalar_64.zig @@ -13,42 +13,10 @@ // // Computed values: // eval z = z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) -// bytes_eval z = z[0] -// + (z[1] << 8) -// + (z[2] << 16) -// + (z[3] << 24) -// + (z[4] << 32) -// + (z[5] << 40) -// + (z[6] << 48) -// + (z[7] << 56) -// + (z[8] << 64) -// + (z[9] << 72) -// + (z[10] << 80) -// + (z[11] << 88) -// + (z[12] << 96) -// + (z[13] << 104) -// + (z[14] << 112) -// + (z[15] << 120) -// + (z[16] << 128) -// + (z[17] << 136) -// + (z[18] << 144) -// + (z[19] << 152) -// + (z[20] << 160) -// + (z[21] << 168) -// + (z[22] << 176) -// + (z[23] << 184) -// + (z[24] << 192) -// + (z[25] << 200) -// + (z[26] << 208) -// + (z[27] << 216) -// + (z[28] << 224) -// + (z[29] << 232) -// + (z[30] << 240) -// + (z[31] << 248) +// bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248) // twos_complement_eval z = let x1 := z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) in // if x1 & (2^256-1) < 2^255 then x1 & (2^256-1) else (x1 & (2^256-1)) - 2^256 -const std = @import("std"); const mode = @import("builtin").mode; // Checked arithmetic is disabled in non-debug modes to avoid side channels // The type MontgomeryDomainFieldElement is a field element in the Montgomery domain. @@ -59,80 +27,70 @@ pub const MontgomeryDomainFieldElement = [4]u64; // Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] pub const NonMontgomeryDomainFieldElement = [4]u64; -/// The function addcarryxU64 is an addition with carry. -/// -/// Postconditions: -/// out1 = (arg1 + arg2 + arg3) mod 2^64 -/// out2 = ⌊(arg1 + arg2 + arg3) / 2^64⌋ -/// -/// Input Bounds: -/// arg1: [0x0 ~> 0x1] -/// arg2: [0x0 ~> 0xffffffffffffffff] -/// arg3: [0x0 ~> 0xffffffffffffffff] -/// Output Bounds: -/// out1: [0x0 ~> 0xffffffffffffffff] -/// out2: [0x0 ~> 0x1] +/// Add two limbs and a carry bit, returning the sum modulo 2^64 and the carry bit. fn addcarryxU64(out1: *u64, out2: *u1, arg1: u1, arg2: u64, arg3: u64) void { - const x = @as(u128, arg2) +% arg3 +% arg1; - out1.* = @truncate(x); - out2.* = @truncate(x >> 64); + @setRuntimeSafety(mode == .debug); + + const x = @addWithOverflow(arg2, arg3); + const y = @addWithOverflow(x[0], arg1); + out1.* = y[0]; + out2.* = x[1] | y[1]; } -/// The function subborrowxU64 is a subtraction with borrow. -/// -/// Postconditions: -/// out1 = (-arg1 + arg2 + -arg3) mod 2^64 -/// out2 = -⌊(-arg1 + arg2 + -arg3) / 2^64⌋ -/// -/// Input Bounds: -/// arg1: [0x0 ~> 0x1] -/// arg2: [0x0 ~> 0xffffffffffffffff] -/// arg3: [0x0 ~> 0xffffffffffffffff] -/// Output Bounds: -/// out1: [0x0 ~> 0xffffffffffffffff] -/// out2: [0x0 ~> 0x1] +/// Subtract two limbs and a borrow bit, returning the difference modulo 2^64 and the borrow bit. fn subborrowxU64(out1: *u64, out2: *u1, arg1: u1, arg2: u64, arg3: u64) void { - const x = @as(u128, arg2) -% arg3 -% arg1; - out1.* = @truncate(x); - out2.* = @truncate(x >> 64); + @setRuntimeSafety(mode == .debug); + + const x = @subWithOverflow(arg2, arg3); + const y = @subWithOverflow(x[0], arg1); + out1.* = y[0]; + out2.* = x[1] | y[1]; } -/// The function mulxU64 is a multiplication, returning the full double-width result. -/// -/// Postconditions: -/// out1 = (arg1 * arg2) mod 2^64 -/// out2 = ⌊arg1 * arg2 / 2^64⌋ -/// -/// Input Bounds: -/// arg1: [0x0 ~> 0xffffffffffffffff] -/// arg2: [0x0 ~> 0xffffffffffffffff] -/// Output Bounds: -/// out1: [0x0 ~> 0xffffffffffffffff] -/// out2: [0x0 ~> 0xffffffffffffffff] +/// Multiply two limbs, returning the low and high halves of the product. fn mulxU64(out1: *u64, out2: *u64, arg1: u64, arg2: u64) void { @setRuntimeSafety(mode == .debug); - const x = @as(u128, arg1) * @as(u128, arg2); - out1.* = @as(u64, @truncate(x)); - out2.* = @as(u64, @truncate(x >> 64)); + const x = @as(u128, arg1) * arg2; + out1.* = @truncate(x); + out2.* = @intCast(x >> 64); } -/// The function cmovznzU64 is a single-word conditional move. -/// -/// Postconditions: -/// out1 = (if arg1 = 0 then arg2 else arg3) -/// -/// Input Bounds: -/// arg1: [0x0 ~> 0x1] -/// arg2: [0x0 ~> 0xffffffffffffffff] -/// arg3: [0x0 ~> 0xffffffffffffffff] -/// Output Bounds: -/// out1: [0x0 ~> 0xffffffffffffffff] +/// Keep selection masks opaque to the optimizer without adding instructions. +fn selectionMaskU64(arg1: u1) u64 { + @setRuntimeSafety(mode == .debug); + + const value: u64 = 0 -% @as(u64, arg1); + if (@inComptime()) return value; + switch (@import("builtin").zig_backend) { + .stage2_c, .stage2_wasm => return value, + else => {}, + } + if (@bitSizeOf(u64) <= @bitSizeOf(usize)) { + return asm ("" + : [mask] "=r" (-> u64), + : [value] "0" (value), + ); + } + var mask: u64 = 0; + inline for (0..@divExact(@bitSizeOf(u64), @bitSizeOf(usize))) |i| { + const shift = i * @bitSizeOf(usize); + const chunk: usize = @truncate(value >> shift); + const part = asm ("" + : [mask] "=r" (-> usize), + : [value] "0" (chunk), + ); + mask |= @as(u64, part) << shift; + } + return mask; +} + +/// Select arg2 when arg1 is zero and arg3 otherwise, using a bit mask. fn cmovznzU64(out1: *u64, arg1: u1, arg2: u64, arg3: u64) void { @setRuntimeSafety(mode == .debug); - const mask = 0 -% @as(u64, arg1); - out1.* = (mask & arg3) | ((~mask) & arg2); + const mask = selectionMaskU64(arg1); + out1.* = arg2 ^ ((arg2 ^ arg3) & mask); } /// The function mul multiplies two field elements in the Montgomery domain. @@ -147,22 +105,22 @@ fn cmovznzU64(out1: *u64, arg1: u1, arg2: u64, arg3: u64) void { pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldElement, arg2: MontgomeryDomainFieldElement) void { @setRuntimeSafety(mode == .debug); - const x1 = (arg1[1]); - const x2 = (arg1[2]); - const x3 = (arg1[3]); - const x4 = (arg1[0]); + const x1: u64 = arg1[1]; + const x2: u64 = arg1[2]; + const x3: u64 = arg1[3]; + const x4: u64 = arg1[0]; var x5: u64 = undefined; var x6: u64 = undefined; - mulxU64(&x5, &x6, x4, (arg2[3])); + mulxU64(&x5, &x6, x4, arg2[3]); var x7: u64 = undefined; var x8: u64 = undefined; - mulxU64(&x7, &x8, x4, (arg2[2])); + mulxU64(&x7, &x8, x4, arg2[2]); var x9: u64 = undefined; var x10: u64 = undefined; - mulxU64(&x9, &x10, x4, (arg2[1])); + mulxU64(&x9, &x10, x4, arg2[1]); var x11: u64 = undefined; var x12: u64 = undefined; - mulxU64(&x11, &x12, x4, (arg2[0])); + mulxU64(&x11, &x12, x4, arg2[0]); var x13: u64 = undefined; var x14: u1 = undefined; addcarryxU64(&x13, &x14, 0x0, x12, x9); @@ -172,7 +130,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x17: u64 = undefined; var x18: u1 = undefined; addcarryxU64(&x17, &x18, x16, x8, x5); - const x19 = (@as(u64, x18) + x6); + const x19: u64 = (x18 + x6); var x20: u64 = undefined; var x21: u64 = undefined; mulxU64(&x20, &x21, x11, 0xccd1c8aaee00bc4f); @@ -197,7 +155,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x34: u64 = undefined; var x35: u1 = undefined; addcarryxU64(&x34, &x35, x33, x25, x22); - const x36 = (@as(u64, x35) + x23); + const x36: u64 = (x35 + x23); var x37: u64 = undefined; var x38: u1 = undefined; addcarryxU64(&x37, &x38, 0x0, x11, x28); @@ -215,16 +173,16 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme addcarryxU64(&x45, &x46, x44, x19, x36); var x47: u64 = undefined; var x48: u64 = undefined; - mulxU64(&x47, &x48, x1, (arg2[3])); + mulxU64(&x47, &x48, x1, arg2[3]); var x49: u64 = undefined; var x50: u64 = undefined; - mulxU64(&x49, &x50, x1, (arg2[2])); + mulxU64(&x49, &x50, x1, arg2[2]); var x51: u64 = undefined; var x52: u64 = undefined; - mulxU64(&x51, &x52, x1, (arg2[1])); + mulxU64(&x51, &x52, x1, arg2[1]); var x53: u64 = undefined; var x54: u64 = undefined; - mulxU64(&x53, &x54, x1, (arg2[0])); + mulxU64(&x53, &x54, x1, arg2[0]); var x55: u64 = undefined; var x56: u1 = undefined; addcarryxU64(&x55, &x56, 0x0, x54, x51); @@ -234,7 +192,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x59: u64 = undefined; var x60: u1 = undefined; addcarryxU64(&x59, &x60, x58, x50, x47); - const x61 = (@as(u64, x60) + x48); + const x61: u64 = (x60 + x48); var x62: u64 = undefined; var x63: u1 = undefined; addcarryxU64(&x62, &x63, 0x0, x39, x53); @@ -249,7 +207,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme addcarryxU64(&x68, &x69, x67, x45, x59); var x70: u64 = undefined; var x71: u1 = undefined; - addcarryxU64(&x70, &x71, x69, @as(u64, x46), x61); + addcarryxU64(&x70, &x71, x69, x46, x61); var x72: u64 = undefined; var x73: u64 = undefined; mulxU64(&x72, &x73, x62, 0xccd1c8aaee00bc4f); @@ -274,7 +232,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x86: u64 = undefined; var x87: u1 = undefined; addcarryxU64(&x86, &x87, x85, x77, x74); - const x88 = (@as(u64, x87) + x75); + const x88: u64 = (x87 + x75); var x89: u64 = undefined; var x90: u1 = undefined; addcarryxU64(&x89, &x90, 0x0, x62, x80); @@ -290,19 +248,19 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x97: u64 = undefined; var x98: u1 = undefined; addcarryxU64(&x97, &x98, x96, x70, x88); - const x99 = (@as(u64, x98) + @as(u64, x71)); + const x99: u64 = (@as(u64, x98) + x71); var x100: u64 = undefined; var x101: u64 = undefined; - mulxU64(&x100, &x101, x2, (arg2[3])); + mulxU64(&x100, &x101, x2, arg2[3]); var x102: u64 = undefined; var x103: u64 = undefined; - mulxU64(&x102, &x103, x2, (arg2[2])); + mulxU64(&x102, &x103, x2, arg2[2]); var x104: u64 = undefined; var x105: u64 = undefined; - mulxU64(&x104, &x105, x2, (arg2[1])); + mulxU64(&x104, &x105, x2, arg2[1]); var x106: u64 = undefined; var x107: u64 = undefined; - mulxU64(&x106, &x107, x2, (arg2[0])); + mulxU64(&x106, &x107, x2, arg2[0]); var x108: u64 = undefined; var x109: u1 = undefined; addcarryxU64(&x108, &x109, 0x0, x107, x104); @@ -312,7 +270,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x112: u64 = undefined; var x113: u1 = undefined; addcarryxU64(&x112, &x113, x111, x103, x100); - const x114 = (@as(u64, x113) + x101); + const x114: u64 = (x113 + x101); var x115: u64 = undefined; var x116: u1 = undefined; addcarryxU64(&x115, &x116, 0x0, x91, x106); @@ -352,7 +310,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x139: u64 = undefined; var x140: u1 = undefined; addcarryxU64(&x139, &x140, x138, x130, x127); - const x141 = (@as(u64, x140) + x128); + const x141: u64 = (x140 + x128); var x142: u64 = undefined; var x143: u1 = undefined; addcarryxU64(&x142, &x143, 0x0, x115, x133); @@ -368,19 +326,19 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x150: u64 = undefined; var x151: u1 = undefined; addcarryxU64(&x150, &x151, x149, x123, x141); - const x152 = (@as(u64, x151) + @as(u64, x124)); + const x152: u64 = (@as(u64, x151) + x124); var x153: u64 = undefined; var x154: u64 = undefined; - mulxU64(&x153, &x154, x3, (arg2[3])); + mulxU64(&x153, &x154, x3, arg2[3]); var x155: u64 = undefined; var x156: u64 = undefined; - mulxU64(&x155, &x156, x3, (arg2[2])); + mulxU64(&x155, &x156, x3, arg2[2]); var x157: u64 = undefined; var x158: u64 = undefined; - mulxU64(&x157, &x158, x3, (arg2[1])); + mulxU64(&x157, &x158, x3, arg2[1]); var x159: u64 = undefined; var x160: u64 = undefined; - mulxU64(&x159, &x160, x3, (arg2[0])); + mulxU64(&x159, &x160, x3, arg2[0]); var x161: u64 = undefined; var x162: u1 = undefined; addcarryxU64(&x161, &x162, 0x0, x160, x157); @@ -390,7 +348,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x165: u64 = undefined; var x166: u1 = undefined; addcarryxU64(&x165, &x166, x164, x156, x153); - const x167 = (@as(u64, x166) + x154); + const x167: u64 = (x166 + x154); var x168: u64 = undefined; var x169: u1 = undefined; addcarryxU64(&x168, &x169, 0x0, x144, x159); @@ -430,7 +388,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x192: u64 = undefined; var x193: u1 = undefined; addcarryxU64(&x192, &x193, x191, x183, x180); - const x194 = (@as(u64, x193) + x181); + const x194: u64 = (x193 + x181); var x195: u64 = undefined; var x196: u1 = undefined; addcarryxU64(&x195, &x196, 0x0, x168, x186); @@ -446,7 +404,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x203: u64 = undefined; var x204: u1 = undefined; addcarryxU64(&x203, &x204, x202, x176, x194); - const x205 = (@as(u64, x204) + @as(u64, x177)); + const x205: u64 = (@as(u64, x204) + x177); var x206: u64 = undefined; var x207: u1 = undefined; subborrowxU64(&x206, &x207, 0x0, x197, 0xf3b9cac2fc632551); @@ -461,15 +419,16 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme subborrowxU64(&x212, &x213, x211, x203, 0xffffffff00000000); var x214: u64 = undefined; var x215: u1 = undefined; - subborrowxU64(&x214, &x215, x213, x205, @as(u64, 0x0)); + subborrowxU64(&x214, &x215, x213, x205, 0x0); var x216: u64 = undefined; - cmovznzU64(&x216, x215, x206, x197); + const x216_selection_mask = selectionMaskU64(x215); + x216 = x206 ^ ((x206 ^ x197) & x216_selection_mask); var x217: u64 = undefined; - cmovznzU64(&x217, x215, x208, x199); + x217 = x208 ^ ((x208 ^ x199) & x216_selection_mask); var x218: u64 = undefined; - cmovznzU64(&x218, x215, x210, x201); + x218 = x210 ^ ((x210 ^ x201) & x216_selection_mask); var x219: u64 = undefined; - cmovznzU64(&x219, x215, x212, x203); + x219 = x212 ^ ((x212 ^ x203) & x216_selection_mask); out1[0] = x216; out1[1] = x217; out1[2] = x218; @@ -487,22 +446,22 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldElement) void { @setRuntimeSafety(mode == .debug); - const x1 = (arg1[1]); - const x2 = (arg1[2]); - const x3 = (arg1[3]); - const x4 = (arg1[0]); + const x1: u64 = arg1[1]; + const x2: u64 = arg1[2]; + const x3: u64 = arg1[3]; + const x4: u64 = arg1[0]; var x5: u64 = undefined; var x6: u64 = undefined; - mulxU64(&x5, &x6, x4, (arg1[3])); + mulxU64(&x5, &x6, x4, arg1[3]); var x7: u64 = undefined; var x8: u64 = undefined; - mulxU64(&x7, &x8, x4, (arg1[2])); + mulxU64(&x7, &x8, x4, arg1[2]); var x9: u64 = undefined; var x10: u64 = undefined; - mulxU64(&x9, &x10, x4, (arg1[1])); + mulxU64(&x9, &x10, x4, arg1[1]); var x11: u64 = undefined; var x12: u64 = undefined; - mulxU64(&x11, &x12, x4, (arg1[0])); + mulxU64(&x11, &x12, x4, arg1[0]); var x13: u64 = undefined; var x14: u1 = undefined; addcarryxU64(&x13, &x14, 0x0, x12, x9); @@ -512,7 +471,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x17: u64 = undefined; var x18: u1 = undefined; addcarryxU64(&x17, &x18, x16, x8, x5); - const x19 = (@as(u64, x18) + x6); + const x19: u64 = (x18 + x6); var x20: u64 = undefined; var x21: u64 = undefined; mulxU64(&x20, &x21, x11, 0xccd1c8aaee00bc4f); @@ -537,7 +496,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x34: u64 = undefined; var x35: u1 = undefined; addcarryxU64(&x34, &x35, x33, x25, x22); - const x36 = (@as(u64, x35) + x23); + const x36: u64 = (x35 + x23); var x37: u64 = undefined; var x38: u1 = undefined; addcarryxU64(&x37, &x38, 0x0, x11, x28); @@ -555,16 +514,16 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl addcarryxU64(&x45, &x46, x44, x19, x36); var x47: u64 = undefined; var x48: u64 = undefined; - mulxU64(&x47, &x48, x1, (arg1[3])); + mulxU64(&x47, &x48, x1, arg1[3]); var x49: u64 = undefined; var x50: u64 = undefined; - mulxU64(&x49, &x50, x1, (arg1[2])); + mulxU64(&x49, &x50, x1, arg1[2]); var x51: u64 = undefined; var x52: u64 = undefined; - mulxU64(&x51, &x52, x1, (arg1[1])); + mulxU64(&x51, &x52, x1, arg1[1]); var x53: u64 = undefined; var x54: u64 = undefined; - mulxU64(&x53, &x54, x1, (arg1[0])); + mulxU64(&x53, &x54, x1, arg1[0]); var x55: u64 = undefined; var x56: u1 = undefined; addcarryxU64(&x55, &x56, 0x0, x54, x51); @@ -574,7 +533,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x59: u64 = undefined; var x60: u1 = undefined; addcarryxU64(&x59, &x60, x58, x50, x47); - const x61 = (@as(u64, x60) + x48); + const x61: u64 = (x60 + x48); var x62: u64 = undefined; var x63: u1 = undefined; addcarryxU64(&x62, &x63, 0x0, x39, x53); @@ -589,7 +548,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl addcarryxU64(&x68, &x69, x67, x45, x59); var x70: u64 = undefined; var x71: u1 = undefined; - addcarryxU64(&x70, &x71, x69, @as(u64, x46), x61); + addcarryxU64(&x70, &x71, x69, x46, x61); var x72: u64 = undefined; var x73: u64 = undefined; mulxU64(&x72, &x73, x62, 0xccd1c8aaee00bc4f); @@ -614,7 +573,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x86: u64 = undefined; var x87: u1 = undefined; addcarryxU64(&x86, &x87, x85, x77, x74); - const x88 = (@as(u64, x87) + x75); + const x88: u64 = (x87 + x75); var x89: u64 = undefined; var x90: u1 = undefined; addcarryxU64(&x89, &x90, 0x0, x62, x80); @@ -630,19 +589,19 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x97: u64 = undefined; var x98: u1 = undefined; addcarryxU64(&x97, &x98, x96, x70, x88); - const x99 = (@as(u64, x98) + @as(u64, x71)); + const x99: u64 = (@as(u64, x98) + x71); var x100: u64 = undefined; var x101: u64 = undefined; - mulxU64(&x100, &x101, x2, (arg1[3])); + mulxU64(&x100, &x101, x2, arg1[3]); var x102: u64 = undefined; var x103: u64 = undefined; - mulxU64(&x102, &x103, x2, (arg1[2])); + mulxU64(&x102, &x103, x2, arg1[2]); var x104: u64 = undefined; var x105: u64 = undefined; - mulxU64(&x104, &x105, x2, (arg1[1])); + mulxU64(&x104, &x105, x2, arg1[1]); var x106: u64 = undefined; var x107: u64 = undefined; - mulxU64(&x106, &x107, x2, (arg1[0])); + mulxU64(&x106, &x107, x2, arg1[0]); var x108: u64 = undefined; var x109: u1 = undefined; addcarryxU64(&x108, &x109, 0x0, x107, x104); @@ -652,7 +611,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x112: u64 = undefined; var x113: u1 = undefined; addcarryxU64(&x112, &x113, x111, x103, x100); - const x114 = (@as(u64, x113) + x101); + const x114: u64 = (x113 + x101); var x115: u64 = undefined; var x116: u1 = undefined; addcarryxU64(&x115, &x116, 0x0, x91, x106); @@ -692,7 +651,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x139: u64 = undefined; var x140: u1 = undefined; addcarryxU64(&x139, &x140, x138, x130, x127); - const x141 = (@as(u64, x140) + x128); + const x141: u64 = (x140 + x128); var x142: u64 = undefined; var x143: u1 = undefined; addcarryxU64(&x142, &x143, 0x0, x115, x133); @@ -708,19 +667,19 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x150: u64 = undefined; var x151: u1 = undefined; addcarryxU64(&x150, &x151, x149, x123, x141); - const x152 = (@as(u64, x151) + @as(u64, x124)); + const x152: u64 = (@as(u64, x151) + x124); var x153: u64 = undefined; var x154: u64 = undefined; - mulxU64(&x153, &x154, x3, (arg1[3])); + mulxU64(&x153, &x154, x3, arg1[3]); var x155: u64 = undefined; var x156: u64 = undefined; - mulxU64(&x155, &x156, x3, (arg1[2])); + mulxU64(&x155, &x156, x3, arg1[2]); var x157: u64 = undefined; var x158: u64 = undefined; - mulxU64(&x157, &x158, x3, (arg1[1])); + mulxU64(&x157, &x158, x3, arg1[1]); var x159: u64 = undefined; var x160: u64 = undefined; - mulxU64(&x159, &x160, x3, (arg1[0])); + mulxU64(&x159, &x160, x3, arg1[0]); var x161: u64 = undefined; var x162: u1 = undefined; addcarryxU64(&x161, &x162, 0x0, x160, x157); @@ -730,7 +689,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x165: u64 = undefined; var x166: u1 = undefined; addcarryxU64(&x165, &x166, x164, x156, x153); - const x167 = (@as(u64, x166) + x154); + const x167: u64 = (x166 + x154); var x168: u64 = undefined; var x169: u1 = undefined; addcarryxU64(&x168, &x169, 0x0, x144, x159); @@ -770,7 +729,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x192: u64 = undefined; var x193: u1 = undefined; addcarryxU64(&x192, &x193, x191, x183, x180); - const x194 = (@as(u64, x193) + x181); + const x194: u64 = (x193 + x181); var x195: u64 = undefined; var x196: u1 = undefined; addcarryxU64(&x195, &x196, 0x0, x168, x186); @@ -786,7 +745,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x203: u64 = undefined; var x204: u1 = undefined; addcarryxU64(&x203, &x204, x202, x176, x194); - const x205 = (@as(u64, x204) + @as(u64, x177)); + const x205: u64 = (@as(u64, x204) + x177); var x206: u64 = undefined; var x207: u1 = undefined; subborrowxU64(&x206, &x207, 0x0, x197, 0xf3b9cac2fc632551); @@ -801,15 +760,16 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl subborrowxU64(&x212, &x213, x211, x203, 0xffffffff00000000); var x214: u64 = undefined; var x215: u1 = undefined; - subborrowxU64(&x214, &x215, x213, x205, @as(u64, 0x0)); + subborrowxU64(&x214, &x215, x213, x205, 0x0); var x216: u64 = undefined; - cmovznzU64(&x216, x215, x206, x197); + const x216_selection_mask = selectionMaskU64(x215); + x216 = x206 ^ ((x206 ^ x197) & x216_selection_mask); var x217: u64 = undefined; - cmovznzU64(&x217, x215, x208, x199); + x217 = x208 ^ ((x208 ^ x199) & x216_selection_mask); var x218: u64 = undefined; - cmovznzU64(&x218, x215, x210, x201); + x218 = x210 ^ ((x210 ^ x201) & x216_selection_mask); var x219: u64 = undefined; - cmovznzU64(&x219, x215, x212, x203); + x219 = x212 ^ ((x212 ^ x203) & x216_selection_mask); out1[0] = x216; out1[1] = x217; out1[2] = x218; @@ -830,16 +790,16 @@ pub fn add(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x1: u64 = undefined; var x2: u1 = undefined; - addcarryxU64(&x1, &x2, 0x0, (arg1[0]), (arg2[0])); + addcarryxU64(&x1, &x2, 0x0, arg1[0], arg2[0]); var x3: u64 = undefined; var x4: u1 = undefined; - addcarryxU64(&x3, &x4, x2, (arg1[1]), (arg2[1])); + addcarryxU64(&x3, &x4, x2, arg1[1], arg2[1]); var x5: u64 = undefined; var x6: u1 = undefined; - addcarryxU64(&x5, &x6, x4, (arg1[2]), (arg2[2])); + addcarryxU64(&x5, &x6, x4, arg1[2], arg2[2]); var x7: u64 = undefined; var x8: u1 = undefined; - addcarryxU64(&x7, &x8, x6, (arg1[3]), (arg2[3])); + addcarryxU64(&x7, &x8, x6, arg1[3], arg2[3]); var x9: u64 = undefined; var x10: u1 = undefined; subborrowxU64(&x9, &x10, 0x0, x1, 0xf3b9cac2fc632551); @@ -854,15 +814,16 @@ pub fn add(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme subborrowxU64(&x15, &x16, x14, x7, 0xffffffff00000000); var x17: u64 = undefined; var x18: u1 = undefined; - subborrowxU64(&x17, &x18, x16, @as(u64, x8), @as(u64, 0x0)); + subborrowxU64(&x17, &x18, x16, x8, 0x0); var x19: u64 = undefined; - cmovznzU64(&x19, x18, x9, x1); + const x19_selection_mask = selectionMaskU64(x18); + x19 = x9 ^ ((x9 ^ x1) & x19_selection_mask); var x20: u64 = undefined; - cmovznzU64(&x20, x18, x11, x3); + x20 = x11 ^ ((x11 ^ x3) & x19_selection_mask); var x21: u64 = undefined; - cmovznzU64(&x21, x18, x13, x5); + x21 = x13 ^ ((x13 ^ x5) & x19_selection_mask); var x22: u64 = undefined; - cmovznzU64(&x22, x18, x15, x7); + x22 = x15 ^ ((x15 ^ x7) & x19_selection_mask); out1[0] = x19; out1[1] = x20; out1[2] = x21; @@ -883,18 +844,19 @@ pub fn sub(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x1: u64 = undefined; var x2: u1 = undefined; - subborrowxU64(&x1, &x2, 0x0, (arg1[0]), (arg2[0])); + subborrowxU64(&x1, &x2, 0x0, arg1[0], arg2[0]); var x3: u64 = undefined; var x4: u1 = undefined; - subborrowxU64(&x3, &x4, x2, (arg1[1]), (arg2[1])); + subborrowxU64(&x3, &x4, x2, arg1[1], arg2[1]); var x5: u64 = undefined; var x6: u1 = undefined; - subborrowxU64(&x5, &x6, x4, (arg1[2]), (arg2[2])); + subborrowxU64(&x5, &x6, x4, arg1[2], arg2[2]); var x7: u64 = undefined; var x8: u1 = undefined; - subborrowxU64(&x7, &x8, x6, (arg1[3]), (arg2[3])); + subborrowxU64(&x7, &x8, x6, arg1[3], arg2[3]); var x9: u64 = undefined; - cmovznzU64(&x9, x8, @as(u64, 0x0), 0xffffffffffffffff); + const x9_selection_mask = selectionMaskU64(x8); + x9 = 0x0 ^ ((0x0 ^ 0xffffffffffffffff) & x9_selection_mask); var x10: u64 = undefined; var x11: u1 = undefined; addcarryxU64(&x10, &x11, 0x0, x1, (x9 & 0xf3b9cac2fc632551)); @@ -926,18 +888,19 @@ pub fn opp(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x1: u64 = undefined; var x2: u1 = undefined; - subborrowxU64(&x1, &x2, 0x0, @as(u64, 0x0), (arg1[0])); + subborrowxU64(&x1, &x2, 0x0, 0x0, arg1[0]); var x3: u64 = undefined; var x4: u1 = undefined; - subborrowxU64(&x3, &x4, x2, @as(u64, 0x0), (arg1[1])); + subborrowxU64(&x3, &x4, x2, 0x0, arg1[1]); var x5: u64 = undefined; var x6: u1 = undefined; - subborrowxU64(&x5, &x6, x4, @as(u64, 0x0), (arg1[2])); + subborrowxU64(&x5, &x6, x4, 0x0, arg1[2]); var x7: u64 = undefined; var x8: u1 = undefined; - subborrowxU64(&x7, &x8, x6, @as(u64, 0x0), (arg1[3])); + subborrowxU64(&x7, &x8, x6, 0x0, arg1[3]); var x9: u64 = undefined; - cmovznzU64(&x9, x8, @as(u64, 0x0), 0xffffffffffffffff); + const x9_selection_mask = selectionMaskU64(x8); + x9 = 0x0 ^ ((0x0 ^ 0xffffffffffffffff) & x9_selection_mask); var x10: u64 = undefined; var x11: u1 = undefined; addcarryxU64(&x10, &x11, 0x0, x1, (x9 & 0xf3b9cac2fc632551)); @@ -967,7 +930,7 @@ pub fn opp(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldElement) void { @setRuntimeSafety(mode == .debug); - const x1 = (arg1[0]); + const x1: u64 = arg1[0]; var x2: u64 = undefined; var x3: u64 = undefined; mulxU64(&x2, &x3, x1, 0xccd1c8aaee00bc4f); @@ -997,22 +960,22 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo addcarryxU64(&x18, &x19, 0x0, x1, x10); var x20: u64 = undefined; var x21: u1 = undefined; - addcarryxU64(&x20, &x21, x19, @as(u64, 0x0), x12); + addcarryxU64(&x20, &x21, x19, 0x0, x12); var x22: u64 = undefined; var x23: u1 = undefined; - addcarryxU64(&x22, &x23, x21, @as(u64, 0x0), x14); + addcarryxU64(&x22, &x23, x21, 0x0, x14); var x24: u64 = undefined; var x25: u1 = undefined; - addcarryxU64(&x24, &x25, x23, @as(u64, 0x0), x16); + addcarryxU64(&x24, &x25, x23, 0x0, x16); var x26: u64 = undefined; var x27: u1 = undefined; - addcarryxU64(&x26, &x27, 0x0, x20, (arg1[1])); + addcarryxU64(&x26, &x27, 0x0, x20, arg1[1]); var x28: u64 = undefined; var x29: u1 = undefined; - addcarryxU64(&x28, &x29, x27, x22, @as(u64, 0x0)); + addcarryxU64(&x28, &x29, x27, x22, 0x0); var x30: u64 = undefined; var x31: u1 = undefined; - addcarryxU64(&x30, &x31, x29, x24, @as(u64, 0x0)); + addcarryxU64(&x30, &x31, x29, x24, 0x0); var x32: u64 = undefined; var x33: u64 = undefined; mulxU64(&x32, &x33, x26, 0xccd1c8aaee00bc4f); @@ -1048,16 +1011,16 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo addcarryxU64(&x52, &x53, x51, x30, x44); var x54: u64 = undefined; var x55: u1 = undefined; - addcarryxU64(&x54, &x55, x53, (@as(u64, x31) + (@as(u64, x25) + (@as(u64, x17) + x5))), x46); + addcarryxU64(&x54, &x55, x53, (x31 + (x25 + (x17 + x5))), x46); var x56: u64 = undefined; var x57: u1 = undefined; - addcarryxU64(&x56, &x57, 0x0, x50, (arg1[2])); + addcarryxU64(&x56, &x57, 0x0, x50, arg1[2]); var x58: u64 = undefined; var x59: u1 = undefined; - addcarryxU64(&x58, &x59, x57, x52, @as(u64, 0x0)); + addcarryxU64(&x58, &x59, x57, x52, 0x0); var x60: u64 = undefined; var x61: u1 = undefined; - addcarryxU64(&x60, &x61, x59, x54, @as(u64, 0x0)); + addcarryxU64(&x60, &x61, x59, x54, 0x0); var x62: u64 = undefined; var x63: u64 = undefined; mulxU64(&x62, &x63, x56, 0xccd1c8aaee00bc4f); @@ -1093,16 +1056,16 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo addcarryxU64(&x82, &x83, x81, x60, x74); var x84: u64 = undefined; var x85: u1 = undefined; - addcarryxU64(&x84, &x85, x83, (@as(u64, x61) + (@as(u64, x55) + (@as(u64, x47) + x35))), x76); + addcarryxU64(&x84, &x85, x83, (x61 + (x55 + (x47 + x35))), x76); var x86: u64 = undefined; var x87: u1 = undefined; - addcarryxU64(&x86, &x87, 0x0, x80, (arg1[3])); + addcarryxU64(&x86, &x87, 0x0, x80, arg1[3]); var x88: u64 = undefined; var x89: u1 = undefined; - addcarryxU64(&x88, &x89, x87, x82, @as(u64, 0x0)); + addcarryxU64(&x88, &x89, x87, x82, 0x0); var x90: u64 = undefined; var x91: u1 = undefined; - addcarryxU64(&x90, &x91, x89, x84, @as(u64, 0x0)); + addcarryxU64(&x90, &x91, x89, x84, 0x0); var x92: u64 = undefined; var x93: u64 = undefined; mulxU64(&x92, &x93, x86, 0xccd1c8aaee00bc4f); @@ -1138,8 +1101,8 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo addcarryxU64(&x112, &x113, x111, x90, x104); var x114: u64 = undefined; var x115: u1 = undefined; - addcarryxU64(&x114, &x115, x113, (@as(u64, x91) + (@as(u64, x85) + (@as(u64, x77) + x65))), x106); - const x116 = (@as(u64, x115) + (@as(u64, x107) + x95)); + addcarryxU64(&x114, &x115, x113, (x91 + (x85 + (x77 + x65))), x106); + const x116: u64 = (x115 + (x107 + x95)); var x117: u64 = undefined; var x118: u1 = undefined; subborrowxU64(&x117, &x118, 0x0, x110, 0xf3b9cac2fc632551); @@ -1154,15 +1117,16 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo subborrowxU64(&x123, &x124, x122, x116, 0xffffffff00000000); var x125: u64 = undefined; var x126: u1 = undefined; - subborrowxU64(&x125, &x126, x124, @as(u64, 0x0), @as(u64, 0x0)); + subborrowxU64(&x125, &x126, x124, 0x0, 0x0); var x127: u64 = undefined; - cmovznzU64(&x127, x126, x117, x110); + const x127_selection_mask = selectionMaskU64(x126); + x127 = x117 ^ ((x117 ^ x110) & x127_selection_mask); var x128: u64 = undefined; - cmovznzU64(&x128, x126, x119, x112); + x128 = x119 ^ ((x119 ^ x112) & x127_selection_mask); var x129: u64 = undefined; - cmovznzU64(&x129, x126, x121, x114); + x129 = x121 ^ ((x121 ^ x114) & x127_selection_mask); var x130: u64 = undefined; - cmovznzU64(&x130, x126, x123, x116); + x130 = x123 ^ ((x123 ^ x116) & x127_selection_mask); out1[0] = x127; out1[1] = x128; out1[2] = x129; @@ -1180,10 +1144,10 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDomainFieldElement) void { @setRuntimeSafety(mode == .debug); - const x1 = (arg1[1]); - const x2 = (arg1[2]); - const x3 = (arg1[3]); - const x4 = (arg1[0]); + const x1: u64 = arg1[1]; + const x2: u64 = arg1[2]; + const x3: u64 = arg1[3]; + const x4: u64 = arg1[0]; var x5: u64 = undefined; var x6: u64 = undefined; mulxU64(&x5, &x6, x4, 0x66e12d94f3d95620); @@ -1243,7 +1207,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma addcarryxU64(&x41, &x42, x40, x17, x33); var x43: u64 = undefined; var x44: u1 = undefined; - addcarryxU64(&x43, &x44, x42, (@as(u64, x18) + x6), (@as(u64, x34) + x22)); + addcarryxU64(&x43, &x44, x42, (x18 + x6), (x34 + x22)); var x45: u64 = undefined; var x46: u64 = undefined; mulxU64(&x45, &x46, x1, 0x66e12d94f3d95620); @@ -1315,7 +1279,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma addcarryxU64(&x89, &x90, x88, x65, x81); var x91: u64 = undefined; var x92: u1 = undefined; - addcarryxU64(&x91, &x92, x90, ((@as(u64, x66) + @as(u64, x44)) + (@as(u64, x58) + x46)), (@as(u64, x82) + x70)); + addcarryxU64(&x91, &x92, x90, ((@as(u64, x66) + x44) + (x58 + x46)), (x82 + x70)); var x93: u64 = undefined; var x94: u64 = undefined; mulxU64(&x93, &x94, x2, 0x66e12d94f3d95620); @@ -1387,7 +1351,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma addcarryxU64(&x137, &x138, x136, x113, x129); var x139: u64 = undefined; var x140: u1 = undefined; - addcarryxU64(&x139, &x140, x138, ((@as(u64, x114) + @as(u64, x92)) + (@as(u64, x106) + x94)), (@as(u64, x130) + x118)); + addcarryxU64(&x139, &x140, x138, ((@as(u64, x114) + x92) + (x106 + x94)), (x130 + x118)); var x141: u64 = undefined; var x142: u64 = undefined; mulxU64(&x141, &x142, x3, 0x66e12d94f3d95620); @@ -1459,7 +1423,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma addcarryxU64(&x185, &x186, x184, x161, x177); var x187: u64 = undefined; var x188: u1 = undefined; - addcarryxU64(&x187, &x188, x186, ((@as(u64, x162) + @as(u64, x140)) + (@as(u64, x154) + x142)), (@as(u64, x178) + x166)); + addcarryxU64(&x187, &x188, x186, ((@as(u64, x162) + x140) + (x154 + x142)), (x178 + x166)); var x189: u64 = undefined; var x190: u1 = undefined; subborrowxU64(&x189, &x190, 0x0, x181, 0xf3b9cac2fc632551); @@ -1474,15 +1438,16 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma subborrowxU64(&x195, &x196, x194, x187, 0xffffffff00000000); var x197: u64 = undefined; var x198: u1 = undefined; - subborrowxU64(&x197, &x198, x196, @as(u64, x188), @as(u64, 0x0)); + subborrowxU64(&x197, &x198, x196, x188, 0x0); var x199: u64 = undefined; - cmovznzU64(&x199, x198, x189, x181); + const x199_selection_mask = selectionMaskU64(x198); + x199 = x189 ^ ((x189 ^ x181) & x199_selection_mask); var x200: u64 = undefined; - cmovznzU64(&x200, x198, x191, x183); + x200 = x191 ^ ((x191 ^ x183) & x199_selection_mask); var x201: u64 = undefined; - cmovznzU64(&x201, x198, x193, x185); + x201 = x193 ^ ((x193 ^ x185) & x199_selection_mask); var x202: u64 = undefined; - cmovznzU64(&x202, x198, x195, x187); + x202 = x195 ^ ((x195 ^ x187) & x199_selection_mask); out1[0] = x199; out1[1] = x200; out1[2] = x201; @@ -1503,14 +1468,14 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma pub fn nonzero(out1: *u64, arg1: [4]u64) void { @setRuntimeSafety(mode == .debug); - const x1 = ((arg1[0]) | ((arg1[1]) | ((arg1[2]) | (arg1[3])))); + const x1: u64 = (arg1[0] | (arg1[1] | (arg1[2] | arg1[3]))); out1.* = x1; } /// The function selectznz is a multi-limb conditional select. /// /// Postconditions: -/// eval out1 = (if arg1 = 0 then eval arg2 else eval arg3) +/// out1 = (if arg1 = 0 then arg2 else arg3) /// /// Input Bounds: /// arg1: [0x0 ~> 0x1] @@ -1522,13 +1487,14 @@ pub fn selectznz(out1: *[4]u64, arg1: u1, arg2: [4]u64, arg3: [4]u64) void { @setRuntimeSafety(mode == .debug); var x1: u64 = undefined; - cmovznzU64(&x1, arg1, (arg2[0]), (arg3[0])); + const x1_selection_mask = selectionMaskU64(arg1); + x1 = arg2[0] ^ ((arg2[0] ^ arg3[0]) & x1_selection_mask); var x2: u64 = undefined; - cmovznzU64(&x2, arg1, (arg2[1]), (arg3[1])); + x2 = arg2[1] ^ ((arg2[1] ^ arg3[1]) & x1_selection_mask); var x3: u64 = undefined; - cmovznzU64(&x3, arg1, (arg2[2]), (arg3[2])); + x3 = arg2[2] ^ ((arg2[2] ^ arg3[2]) & x1_selection_mask); var x4: u64 = undefined; - cmovznzU64(&x4, arg1, (arg2[3]), (arg3[3])); + x4 = arg2[3] ^ ((arg2[3] ^ arg3[3]) & x1_selection_mask); out1[0] = x1; out1[1] = x2; out1[2] = x3; @@ -1549,66 +1515,66 @@ pub fn selectznz(out1: *[4]u64, arg1: u1, arg2: [4]u64, arg3: [4]u64) void { pub fn toBytes(out1: *[32]u8, arg1: [4]u64) void { @setRuntimeSafety(mode == .debug); - const x1 = (arg1[3]); - const x2 = (arg1[2]); - const x3 = (arg1[1]); - const x4 = (arg1[0]); - const x5 = @as(u8, @truncate((x4 & @as(u64, 0xff)))); - const x6 = (x4 >> 8); - const x7 = @as(u8, @truncate((x6 & @as(u64, 0xff)))); - const x8 = (x6 >> 8); - const x9 = @as(u8, @truncate((x8 & @as(u64, 0xff)))); - const x10 = (x8 >> 8); - const x11 = @as(u8, @truncate((x10 & @as(u64, 0xff)))); - const x12 = (x10 >> 8); - const x13 = @as(u8, @truncate((x12 & @as(u64, 0xff)))); - const x14 = (x12 >> 8); - const x15 = @as(u8, @truncate((x14 & @as(u64, 0xff)))); - const x16 = (x14 >> 8); - const x17 = @as(u8, @truncate((x16 & @as(u64, 0xff)))); - const x18 = @as(u8, @truncate((x16 >> 8))); - const x19 = @as(u8, @truncate((x3 & @as(u64, 0xff)))); - const x20 = (x3 >> 8); - const x21 = @as(u8, @truncate((x20 & @as(u64, 0xff)))); - const x22 = (x20 >> 8); - const x23 = @as(u8, @truncate((x22 & @as(u64, 0xff)))); - const x24 = (x22 >> 8); - const x25 = @as(u8, @truncate((x24 & @as(u64, 0xff)))); - const x26 = (x24 >> 8); - const x27 = @as(u8, @truncate((x26 & @as(u64, 0xff)))); - const x28 = (x26 >> 8); - const x29 = @as(u8, @truncate((x28 & @as(u64, 0xff)))); - const x30 = (x28 >> 8); - const x31 = @as(u8, @truncate((x30 & @as(u64, 0xff)))); - const x32 = @as(u8, @truncate((x30 >> 8))); - const x33 = @as(u8, @truncate((x2 & @as(u64, 0xff)))); - const x34 = (x2 >> 8); - const x35 = @as(u8, @truncate((x34 & @as(u64, 0xff)))); - const x36 = (x34 >> 8); - const x37 = @as(u8, @truncate((x36 & @as(u64, 0xff)))); - const x38 = (x36 >> 8); - const x39 = @as(u8, @truncate((x38 & @as(u64, 0xff)))); - const x40 = (x38 >> 8); - const x41 = @as(u8, @truncate((x40 & @as(u64, 0xff)))); - const x42 = (x40 >> 8); - const x43 = @as(u8, @truncate((x42 & @as(u64, 0xff)))); - const x44 = (x42 >> 8); - const x45 = @as(u8, @truncate((x44 & @as(u64, 0xff)))); - const x46 = @as(u8, @truncate((x44 >> 8))); - const x47 = @as(u8, @truncate((x1 & @as(u64, 0xff)))); - const x48 = (x1 >> 8); - const x49 = @as(u8, @truncate((x48 & @as(u64, 0xff)))); - const x50 = (x48 >> 8); - const x51 = @as(u8, @truncate((x50 & @as(u64, 0xff)))); - const x52 = (x50 >> 8); - const x53 = @as(u8, @truncate((x52 & @as(u64, 0xff)))); - const x54 = (x52 >> 8); - const x55 = @as(u8, @truncate((x54 & @as(u64, 0xff)))); - const x56 = (x54 >> 8); - const x57 = @as(u8, @truncate((x56 & @as(u64, 0xff)))); - const x58 = (x56 >> 8); - const x59 = @as(u8, @truncate((x58 & @as(u64, 0xff)))); - const x60 = @as(u8, @truncate((x58 >> 8))); + const x1: u64 = arg1[3]; + const x2: u64 = arg1[2]; + const x3: u64 = arg1[1]; + const x4: u64 = arg1[0]; + const x5: u8 = @truncate(x4); + const x6: u64 = (x4 >> 8); + const x7: u8 = @truncate(x6); + const x8: u64 = (x6 >> 8); + const x9: u8 = @truncate(x8); + const x10: u64 = (x8 >> 8); + const x11: u8 = @truncate(x10); + const x12: u64 = (x10 >> 8); + const x13: u8 = @truncate(x12); + const x14: u64 = (x12 >> 8); + const x15: u8 = @truncate(x14); + const x16: u64 = (x14 >> 8); + const x17: u8 = @truncate(x16); + const x18: u8 = @truncate((x16 >> 8)); + const x19: u8 = @truncate(x3); + const x20: u64 = (x3 >> 8); + const x21: u8 = @truncate(x20); + const x22: u64 = (x20 >> 8); + const x23: u8 = @truncate(x22); + const x24: u64 = (x22 >> 8); + const x25: u8 = @truncate(x24); + const x26: u64 = (x24 >> 8); + const x27: u8 = @truncate(x26); + const x28: u64 = (x26 >> 8); + const x29: u8 = @truncate(x28); + const x30: u64 = (x28 >> 8); + const x31: u8 = @truncate(x30); + const x32: u8 = @truncate((x30 >> 8)); + const x33: u8 = @truncate(x2); + const x34: u64 = (x2 >> 8); + const x35: u8 = @truncate(x34); + const x36: u64 = (x34 >> 8); + const x37: u8 = @truncate(x36); + const x38: u64 = (x36 >> 8); + const x39: u8 = @truncate(x38); + const x40: u64 = (x38 >> 8); + const x41: u8 = @truncate(x40); + const x42: u64 = (x40 >> 8); + const x43: u8 = @truncate(x42); + const x44: u64 = (x42 >> 8); + const x45: u8 = @truncate(x44); + const x46: u8 = @truncate((x44 >> 8)); + const x47: u8 = @truncate(x1); + const x48: u64 = (x1 >> 8); + const x49: u8 = @truncate(x48); + const x50: u64 = (x48 >> 8); + const x51: u8 = @truncate(x50); + const x52: u64 = (x50 >> 8); + const x53: u8 = @truncate(x52); + const x54: u64 = (x52 >> 8); + const x55: u8 = @truncate(x54); + const x56: u64 = (x54 >> 8); + const x57: u8 = @truncate(x56); + const x58: u64 = (x56 >> 8); + const x59: u8 = @truncate(x58); + const x60: u8 = @truncate((x58 >> 8)); out1[0] = x5; out1[1] = x7; out1[2] = x9; @@ -1658,66 +1624,66 @@ pub fn toBytes(out1: *[32]u8, arg1: [4]u64) void { pub fn fromBytes(out1: *[4]u64, arg1: [32]u8) void { @setRuntimeSafety(mode == .debug); - const x1 = (@as(u64, (arg1[31])) << 56); - const x2 = (@as(u64, (arg1[30])) << 48); - const x3 = (@as(u64, (arg1[29])) << 40); - const x4 = (@as(u64, (arg1[28])) << 32); - const x5 = (@as(u64, (arg1[27])) << 24); - const x6 = (@as(u64, (arg1[26])) << 16); - const x7 = (@as(u64, (arg1[25])) << 8); - const x8 = (arg1[24]); - const x9 = (@as(u64, (arg1[23])) << 56); - const x10 = (@as(u64, (arg1[22])) << 48); - const x11 = (@as(u64, (arg1[21])) << 40); - const x12 = (@as(u64, (arg1[20])) << 32); - const x13 = (@as(u64, (arg1[19])) << 24); - const x14 = (@as(u64, (arg1[18])) << 16); - const x15 = (@as(u64, (arg1[17])) << 8); - const x16 = (arg1[16]); - const x17 = (@as(u64, (arg1[15])) << 56); - const x18 = (@as(u64, (arg1[14])) << 48); - const x19 = (@as(u64, (arg1[13])) << 40); - const x20 = (@as(u64, (arg1[12])) << 32); - const x21 = (@as(u64, (arg1[11])) << 24); - const x22 = (@as(u64, (arg1[10])) << 16); - const x23 = (@as(u64, (arg1[9])) << 8); - const x24 = (arg1[8]); - const x25 = (@as(u64, (arg1[7])) << 56); - const x26 = (@as(u64, (arg1[6])) << 48); - const x27 = (@as(u64, (arg1[5])) << 40); - const x28 = (@as(u64, (arg1[4])) << 32); - const x29 = (@as(u64, (arg1[3])) << 24); - const x30 = (@as(u64, (arg1[2])) << 16); - const x31 = (@as(u64, (arg1[1])) << 8); - const x32 = (arg1[0]); - const x33 = (x31 + @as(u64, x32)); - const x34 = (x30 + x33); - const x35 = (x29 + x34); - const x36 = (x28 + x35); - const x37 = (x27 + x36); - const x38 = (x26 + x37); - const x39 = (x25 + x38); - const x40 = (x23 + @as(u64, x24)); - const x41 = (x22 + x40); - const x42 = (x21 + x41); - const x43 = (x20 + x42); - const x44 = (x19 + x43); - const x45 = (x18 + x44); - const x46 = (x17 + x45); - const x47 = (x15 + @as(u64, x16)); - const x48 = (x14 + x47); - const x49 = (x13 + x48); - const x50 = (x12 + x49); - const x51 = (x11 + x50); - const x52 = (x10 + x51); - const x53 = (x9 + x52); - const x54 = (x7 + @as(u64, x8)); - const x55 = (x6 + x54); - const x56 = (x5 + x55); - const x57 = (x4 + x56); - const x58 = (x3 + x57); - const x59 = (x2 + x58); - const x60 = (x1 + x59); + const x1: u64 = (@as(u64, arg1[31]) << 56); + const x2: u64 = (@as(u64, arg1[30]) << 48); + const x3: u64 = (@as(u64, arg1[29]) << 40); + const x4: u64 = (@as(u64, arg1[28]) << 32); + const x5: u64 = (@as(u64, arg1[27]) << 24); + const x6: u64 = (@as(u64, arg1[26]) << 16); + const x7: u64 = (@as(u64, arg1[25]) << 8); + const x8: u8 = arg1[24]; + const x9: u64 = (@as(u64, arg1[23]) << 56); + const x10: u64 = (@as(u64, arg1[22]) << 48); + const x11: u64 = (@as(u64, arg1[21]) << 40); + const x12: u64 = (@as(u64, arg1[20]) << 32); + const x13: u64 = (@as(u64, arg1[19]) << 24); + const x14: u64 = (@as(u64, arg1[18]) << 16); + const x15: u64 = (@as(u64, arg1[17]) << 8); + const x16: u8 = arg1[16]; + const x17: u64 = (@as(u64, arg1[15]) << 56); + const x18: u64 = (@as(u64, arg1[14]) << 48); + const x19: u64 = (@as(u64, arg1[13]) << 40); + const x20: u64 = (@as(u64, arg1[12]) << 32); + const x21: u64 = (@as(u64, arg1[11]) << 24); + const x22: u64 = (@as(u64, arg1[10]) << 16); + const x23: u64 = (@as(u64, arg1[9]) << 8); + const x24: u8 = arg1[8]; + const x25: u64 = (@as(u64, arg1[7]) << 56); + const x26: u64 = (@as(u64, arg1[6]) << 48); + const x27: u64 = (@as(u64, arg1[5]) << 40); + const x28: u64 = (@as(u64, arg1[4]) << 32); + const x29: u64 = (@as(u64, arg1[3]) << 24); + const x30: u64 = (@as(u64, arg1[2]) << 16); + const x31: u64 = (@as(u64, arg1[1]) << 8); + const x32: u8 = arg1[0]; + const x33: u64 = (x31 + x32); + const x34: u64 = (x30 + x33); + const x35: u64 = (x29 + x34); + const x36: u64 = (x28 + x35); + const x37: u64 = (x27 + x36); + const x38: u64 = (x26 + x37); + const x39: u64 = (x25 + x38); + const x40: u64 = (x23 + x24); + const x41: u64 = (x22 + x40); + const x42: u64 = (x21 + x41); + const x43: u64 = (x20 + x42); + const x44: u64 = (x19 + x43); + const x45: u64 = (x18 + x44); + const x46: u64 = (x17 + x45); + const x47: u64 = (x15 + x16); + const x48: u64 = (x14 + x47); + const x49: u64 = (x13 + x48); + const x50: u64 = (x12 + x49); + const x51: u64 = (x11 + x50); + const x52: u64 = (x10 + x51); + const x53: u64 = (x9 + x52); + const x54: u64 = (x7 + x8); + const x55: u64 = (x6 + x54); + const x56: u64 = (x5 + x55); + const x57: u64 = (x4 + x56); + const x58: u64 = (x3 + x57); + const x59: u64 = (x2 + x58); + const x60: u64 = (x1 + x59); out1[0] = x39; out1[1] = x46; out1[2] = x53; @@ -1735,7 +1701,7 @@ pub fn setOne(out1: *MontgomeryDomainFieldElement) void { out1[0] = 0xc46353d039cdaaf; out1[1] = 0x4319055258e8617b; - out1[2] = @as(u64, 0x0); + out1[2] = 0x0; out1[3] = 0xffffffff; } @@ -1754,7 +1720,7 @@ pub fn msat(out1: *[5]u64) void { out1[1] = 0xbce6faada7179e84; out1[2] = 0xffffffffffffffff; out1[3] = 0xffffffff00000000; - out1[4] = @as(u64, 0x0); + out1[4] = 0x0; } /// The function divstep computes a divstep. @@ -1790,56 +1756,58 @@ pub fn divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *[4]u64, out5: *[ var x1: u64 = undefined; var x2: u1 = undefined; - addcarryxU64(&x1, &x2, 0x0, (~arg1), @as(u64, 0x1)); - const x3 = @as(u1, @truncate((x1 >> 63))) & @as(u1, @truncate(((arg3[0]) & @as(u64, 0x1)))); + addcarryxU64(&x1, &x2, 0x0, (~arg1), 0x1); + const x3: u1 = (@as(u1, @truncate((x1 >> 63))) & @as(u1, @truncate(arg3[0]))); var x4: u64 = undefined; var x5: u1 = undefined; - addcarryxU64(&x4, &x5, 0x0, (~arg1), @as(u64, 0x1)); + addcarryxU64(&x4, &x5, 0x0, (~arg1), 0x1); var x6: u64 = undefined; - cmovznzU64(&x6, x3, arg1, x4); + const x6_selection_mask = selectionMaskU64(x3); + x6 = arg1 ^ ((arg1 ^ x4) & x6_selection_mask); var x7: u64 = undefined; - cmovznzU64(&x7, x3, (arg2[0]), (arg3[0])); + x7 = arg2[0] ^ ((arg2[0] ^ arg3[0]) & x6_selection_mask); var x8: u64 = undefined; - cmovznzU64(&x8, x3, (arg2[1]), (arg3[1])); + x8 = arg2[1] ^ ((arg2[1] ^ arg3[1]) & x6_selection_mask); var x9: u64 = undefined; - cmovznzU64(&x9, x3, (arg2[2]), (arg3[2])); + x9 = arg2[2] ^ ((arg2[2] ^ arg3[2]) & x6_selection_mask); var x10: u64 = undefined; - cmovznzU64(&x10, x3, (arg2[3]), (arg3[3])); + x10 = arg2[3] ^ ((arg2[3] ^ arg3[3]) & x6_selection_mask); var x11: u64 = undefined; - cmovznzU64(&x11, x3, (arg2[4]), (arg3[4])); + x11 = arg2[4] ^ ((arg2[4] ^ arg3[4]) & x6_selection_mask); var x12: u64 = undefined; var x13: u1 = undefined; - addcarryxU64(&x12, &x13, 0x0, @as(u64, 0x1), (~(arg2[0]))); + addcarryxU64(&x12, &x13, 0x0, 0x1, (~arg2[0])); var x14: u64 = undefined; var x15: u1 = undefined; - addcarryxU64(&x14, &x15, x13, @as(u64, 0x0), (~(arg2[1]))); + addcarryxU64(&x14, &x15, x13, 0x0, (~arg2[1])); var x16: u64 = undefined; var x17: u1 = undefined; - addcarryxU64(&x16, &x17, x15, @as(u64, 0x0), (~(arg2[2]))); + addcarryxU64(&x16, &x17, x15, 0x0, (~arg2[2])); var x18: u64 = undefined; var x19: u1 = undefined; - addcarryxU64(&x18, &x19, x17, @as(u64, 0x0), (~(arg2[3]))); + addcarryxU64(&x18, &x19, x17, 0x0, (~arg2[3])); var x20: u64 = undefined; var x21: u1 = undefined; - addcarryxU64(&x20, &x21, x19, @as(u64, 0x0), (~(arg2[4]))); + addcarryxU64(&x20, &x21, x19, 0x0, (~arg2[4])); var x22: u64 = undefined; - cmovznzU64(&x22, x3, (arg3[0]), x12); + const x22_selection_mask = selectionMaskU64(x3); + x22 = arg3[0] ^ ((arg3[0] ^ x12) & x22_selection_mask); var x23: u64 = undefined; - cmovznzU64(&x23, x3, (arg3[1]), x14); + x23 = arg3[1] ^ ((arg3[1] ^ x14) & x22_selection_mask); var x24: u64 = undefined; - cmovznzU64(&x24, x3, (arg3[2]), x16); + x24 = arg3[2] ^ ((arg3[2] ^ x16) & x22_selection_mask); var x25: u64 = undefined; - cmovznzU64(&x25, x3, (arg3[3]), x18); + x25 = arg3[3] ^ ((arg3[3] ^ x18) & x22_selection_mask); var x26: u64 = undefined; - cmovznzU64(&x26, x3, (arg3[4]), x20); + x26 = arg3[4] ^ ((arg3[4] ^ x20) & x22_selection_mask); var x27: u64 = undefined; - cmovznzU64(&x27, x3, (arg4[0]), (arg5[0])); + x27 = arg4[0] ^ ((arg4[0] ^ arg5[0]) & x22_selection_mask); var x28: u64 = undefined; - cmovznzU64(&x28, x3, (arg4[1]), (arg5[1])); + x28 = arg4[1] ^ ((arg4[1] ^ arg5[1]) & x22_selection_mask); var x29: u64 = undefined; - cmovznzU64(&x29, x3, (arg4[2]), (arg5[2])); + x29 = arg4[2] ^ ((arg4[2] ^ arg5[2]) & x22_selection_mask); var x30: u64 = undefined; - cmovznzU64(&x30, x3, (arg4[3]), (arg5[3])); + x30 = arg4[3] ^ ((arg4[3] ^ arg5[3]) & x22_selection_mask); var x31: u64 = undefined; var x32: u1 = undefined; addcarryxU64(&x31, &x32, 0x0, x27, x27); @@ -1866,25 +1834,26 @@ pub fn divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *[4]u64, out5: *[ subborrowxU64(&x45, &x46, x44, x37, 0xffffffff00000000); var x47: u64 = undefined; var x48: u1 = undefined; - subborrowxU64(&x47, &x48, x46, @as(u64, x38), @as(u64, 0x0)); - const x49 = (arg4[3]); - const x50 = (arg4[2]); - const x51 = (arg4[1]); - const x52 = (arg4[0]); + subborrowxU64(&x47, &x48, x46, x38, 0x0); + const x49: u64 = arg4[3]; + const x50: u64 = arg4[2]; + const x51: u64 = arg4[1]; + const x52: u64 = arg4[0]; var x53: u64 = undefined; var x54: u1 = undefined; - subborrowxU64(&x53, &x54, 0x0, @as(u64, 0x0), x52); + subborrowxU64(&x53, &x54, 0x0, 0x0, x52); var x55: u64 = undefined; var x56: u1 = undefined; - subborrowxU64(&x55, &x56, x54, @as(u64, 0x0), x51); + subborrowxU64(&x55, &x56, x54, 0x0, x51); var x57: u64 = undefined; var x58: u1 = undefined; - subborrowxU64(&x57, &x58, x56, @as(u64, 0x0), x50); + subborrowxU64(&x57, &x58, x56, 0x0, x50); var x59: u64 = undefined; var x60: u1 = undefined; - subborrowxU64(&x59, &x60, x58, @as(u64, 0x0), x49); + subborrowxU64(&x59, &x60, x58, 0x0, x49); var x61: u64 = undefined; - cmovznzU64(&x61, x60, @as(u64, 0x0), 0xffffffffffffffff); + const x61_selection_mask = selectionMaskU64(x60); + x61 = 0x0 ^ ((0x0 ^ 0xffffffffffffffff) & x61_selection_mask); var x62: u64 = undefined; var x63: u1 = undefined; addcarryxU64(&x62, &x63, 0x0, x53, (x61 & 0xf3b9cac2fc632551)); @@ -1898,24 +1867,26 @@ pub fn divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *[4]u64, out5: *[ var x69: u1 = undefined; addcarryxU64(&x68, &x69, x67, x59, (x61 & 0xffffffff00000000)); var x70: u64 = undefined; - cmovznzU64(&x70, x3, (arg5[0]), x62); + const x70_selection_mask = selectionMaskU64(x3); + x70 = arg5[0] ^ ((arg5[0] ^ x62) & x70_selection_mask); var x71: u64 = undefined; - cmovznzU64(&x71, x3, (arg5[1]), x64); + x71 = arg5[1] ^ ((arg5[1] ^ x64) & x70_selection_mask); var x72: u64 = undefined; - cmovznzU64(&x72, x3, (arg5[2]), x66); + x72 = arg5[2] ^ ((arg5[2] ^ x66) & x70_selection_mask); var x73: u64 = undefined; - cmovznzU64(&x73, x3, (arg5[3]), x68); - const x74 = @as(u1, @truncate((x22 & @as(u64, 0x1)))); + x73 = arg5[3] ^ ((arg5[3] ^ x68) & x70_selection_mask); + const x74: u1 = @truncate(x22); var x75: u64 = undefined; - cmovznzU64(&x75, x74, @as(u64, 0x0), x7); + const x75_selection_mask = selectionMaskU64(x74); + x75 = 0x0 ^ ((0x0 ^ x7) & x75_selection_mask); var x76: u64 = undefined; - cmovznzU64(&x76, x74, @as(u64, 0x0), x8); + x76 = 0x0 ^ ((0x0 ^ x8) & x75_selection_mask); var x77: u64 = undefined; - cmovznzU64(&x77, x74, @as(u64, 0x0), x9); + x77 = 0x0 ^ ((0x0 ^ x9) & x75_selection_mask); var x78: u64 = undefined; - cmovznzU64(&x78, x74, @as(u64, 0x0), x10); + x78 = 0x0 ^ ((0x0 ^ x10) & x75_selection_mask); var x79: u64 = undefined; - cmovznzU64(&x79, x74, @as(u64, 0x0), x11); + x79 = 0x0 ^ ((0x0 ^ x11) & x75_selection_mask); var x80: u64 = undefined; var x81: u1 = undefined; addcarryxU64(&x80, &x81, 0x0, x22, x75); @@ -1932,13 +1903,14 @@ pub fn divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *[4]u64, out5: *[ var x89: u1 = undefined; addcarryxU64(&x88, &x89, x87, x26, x79); var x90: u64 = undefined; - cmovznzU64(&x90, x74, @as(u64, 0x0), x27); + const x90_selection_mask = selectionMaskU64(x74); + x90 = 0x0 ^ ((0x0 ^ x27) & x90_selection_mask); var x91: u64 = undefined; - cmovznzU64(&x91, x74, @as(u64, 0x0), x28); + x91 = 0x0 ^ ((0x0 ^ x28) & x90_selection_mask); var x92: u64 = undefined; - cmovznzU64(&x92, x74, @as(u64, 0x0), x29); + x92 = 0x0 ^ ((0x0 ^ x29) & x90_selection_mask); var x93: u64 = undefined; - cmovznzU64(&x93, x74, @as(u64, 0x0), x30); + x93 = 0x0 ^ ((0x0 ^ x30) & x90_selection_mask); var x94: u64 = undefined; var x95: u1 = undefined; addcarryxU64(&x94, &x95, 0x0, x70, x90); @@ -1965,31 +1937,33 @@ pub fn divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *[4]u64, out5: *[ subborrowxU64(&x108, &x109, x107, x100, 0xffffffff00000000); var x110: u64 = undefined; var x111: u1 = undefined; - subborrowxU64(&x110, &x111, x109, @as(u64, x101), @as(u64, 0x0)); + subborrowxU64(&x110, &x111, x109, x101, 0x0); var x112: u64 = undefined; var x113: u1 = undefined; - addcarryxU64(&x112, &x113, 0x0, x6, @as(u64, 0x1)); - const x114 = ((x80 >> 1) | ((x82 << 63) & 0xffffffffffffffff)); - const x115 = ((x82 >> 1) | ((x84 << 63) & 0xffffffffffffffff)); - const x116 = ((x84 >> 1) | ((x86 << 63) & 0xffffffffffffffff)); - const x117 = ((x86 >> 1) | ((x88 << 63) & 0xffffffffffffffff)); - const x118 = ((x88 & 0x8000000000000000) | (x88 >> 1)); + addcarryxU64(&x112, &x113, 0x0, x6, 0x1); + const x114: u64 = ((x80 >> 1) | ((x82 << 63) & 0xffffffffffffffff)); + const x115: u64 = ((x82 >> 1) | ((x84 << 63) & 0xffffffffffffffff)); + const x116: u64 = ((x84 >> 1) | ((x86 << 63) & 0xffffffffffffffff)); + const x117: u64 = ((x86 >> 1) | ((x88 << 63) & 0xffffffffffffffff)); + const x118: u64 = ((x88 & 0x8000000000000000) | (x88 >> 1)); var x119: u64 = undefined; - cmovznzU64(&x119, x48, x39, x31); + const x119_selection_mask = selectionMaskU64(x48); + x119 = x39 ^ ((x39 ^ x31) & x119_selection_mask); var x120: u64 = undefined; - cmovznzU64(&x120, x48, x41, x33); + x120 = x41 ^ ((x41 ^ x33) & x119_selection_mask); var x121: u64 = undefined; - cmovznzU64(&x121, x48, x43, x35); + x121 = x43 ^ ((x43 ^ x35) & x119_selection_mask); var x122: u64 = undefined; - cmovznzU64(&x122, x48, x45, x37); + x122 = x45 ^ ((x45 ^ x37) & x119_selection_mask); var x123: u64 = undefined; - cmovznzU64(&x123, x111, x102, x94); + const x123_selection_mask = selectionMaskU64(x111); + x123 = x102 ^ ((x102 ^ x94) & x123_selection_mask); var x124: u64 = undefined; - cmovznzU64(&x124, x111, x104, x96); + x124 = x104 ^ ((x104 ^ x96) & x123_selection_mask); var x125: u64 = undefined; - cmovznzU64(&x125, x111, x106, x98); + x125 = x106 ^ ((x106 ^ x98) & x123_selection_mask); var x126: u64 = undefined; - cmovznzU64(&x126, x111, x108, x100); + x126 = x108 ^ ((x108 ^ x100) & x123_selection_mask); out1.* = x112; out2[0] = x7; out2[1] = x8; diff --git a/lib/std/crypto/pcurves/p384/p384_64.zig b/lib/std/crypto/pcurves/p384/p384_64.zig index 99d9dc82b2ba99d26de4c324c5c3ac239846a47a..b6e0c1e3f788d5934e78cf1146dae8e0d5ffc9fd 100644 --- a/lib/std/crypto/pcurves/p384/p384_64.zig +++ b/lib/std/crypto/pcurves/p384/p384_64.zig @@ -17,7 +17,6 @@ // twos_complement_eval z = let x1 := z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) + (z[4] << 256) + (z[5] << 0x140) in // if x1 & (2^384-1) < 2^383 then x1 & (2^384-1) else (x1 & (2^384-1)) - 2^384 -const std = @import("std"); const mode = @import("builtin").mode; // Checked arithmetic is disabled in non-debug modes to avoid side channels // The type MontgomeryDomainFieldElement is a field element in the Montgomery domain. @@ -28,80 +27,70 @@ pub const MontgomeryDomainFieldElement = [6]u64; // Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] pub const NonMontgomeryDomainFieldElement = [6]u64; -/// The function addcarryxU64 is an addition with carry. -/// -/// Postconditions: -/// out1 = (arg1 + arg2 + arg3) mod 2^64 -/// out2 = ⌊(arg1 + arg2 + arg3) / 2^64⌋ -/// -/// Input Bounds: -/// arg1: [0x0 ~> 0x1] -/// arg2: [0x0 ~> 0xffffffffffffffff] -/// arg3: [0x0 ~> 0xffffffffffffffff] -/// Output Bounds: -/// out1: [0x0 ~> 0xffffffffffffffff] -/// out2: [0x0 ~> 0x1] +/// Add two limbs and a carry bit, returning the sum modulo 2^64 and the carry bit. fn addcarryxU64(out1: *u64, out2: *u1, arg1: u1, arg2: u64, arg3: u64) void { - const x = @as(u128, arg2) +% arg3 +% arg1; - out1.* = @truncate(x); - out2.* = @truncate(x >> 64); + @setRuntimeSafety(mode == .debug); + + const x = @addWithOverflow(arg2, arg3); + const y = @addWithOverflow(x[0], arg1); + out1.* = y[0]; + out2.* = x[1] | y[1]; } -/// The function subborrowxU64 is a subtraction with borrow. -/// -/// Postconditions: -/// out1 = (-arg1 + arg2 + -arg3) mod 2^64 -/// out2 = -⌊(-arg1 + arg2 + -arg3) / 2^64⌋ -/// -/// Input Bounds: -/// arg1: [0x0 ~> 0x1] -/// arg2: [0x0 ~> 0xffffffffffffffff] -/// arg3: [0x0 ~> 0xffffffffffffffff] -/// Output Bounds: -/// out1: [0x0 ~> 0xffffffffffffffff] -/// out2: [0x0 ~> 0x1] +/// Subtract two limbs and a borrow bit, returning the difference modulo 2^64 and the borrow bit. fn subborrowxU64(out1: *u64, out2: *u1, arg1: u1, arg2: u64, arg3: u64) void { - const x = @as(u128, arg2) -% arg3 -% arg1; - out1.* = @truncate(x); - out2.* = @truncate(x >> 64); + @setRuntimeSafety(mode == .debug); + + const x = @subWithOverflow(arg2, arg3); + const y = @subWithOverflow(x[0], arg1); + out1.* = y[0]; + out2.* = x[1] | y[1]; } -/// The function mulxU64 is a multiplication, returning the full double-width result. -/// -/// Postconditions: -/// out1 = (arg1 * arg2) mod 2^64 -/// out2 = ⌊arg1 * arg2 / 2^64⌋ -/// -/// Input Bounds: -/// arg1: [0x0 ~> 0xffffffffffffffff] -/// arg2: [0x0 ~> 0xffffffffffffffff] -/// Output Bounds: -/// out1: [0x0 ~> 0xffffffffffffffff] -/// out2: [0x0 ~> 0xffffffffffffffff] +/// Multiply two limbs, returning the low and high halves of the product. fn mulxU64(out1: *u64, out2: *u64, arg1: u64, arg2: u64) void { @setRuntimeSafety(mode == .debug); - const x = @as(u128, arg1) * @as(u128, arg2); - out1.* = @as(u64, @truncate(x)); - out2.* = @as(u64, @truncate(x >> 64)); + const x = @as(u128, arg1) * arg2; + out1.* = @truncate(x); + out2.* = @intCast(x >> 64); } -/// The function cmovznzU64 is a single-word conditional move. -/// -/// Postconditions: -/// out1 = (if arg1 = 0 then arg2 else arg3) -/// -/// Input Bounds: -/// arg1: [0x0 ~> 0x1] -/// arg2: [0x0 ~> 0xffffffffffffffff] -/// arg3: [0x0 ~> 0xffffffffffffffff] -/// Output Bounds: -/// out1: [0x0 ~> 0xffffffffffffffff] +/// Keep selection masks opaque to the optimizer without adding instructions. +fn selectionMaskU64(arg1: u1) u64 { + @setRuntimeSafety(mode == .debug); + + const value: u64 = 0 -% @as(u64, arg1); + if (@inComptime()) return value; + switch (@import("builtin").zig_backend) { + .stage2_c, .stage2_wasm => return value, + else => {}, + } + if (@bitSizeOf(u64) <= @bitSizeOf(usize)) { + return asm ("" + : [mask] "=r" (-> u64), + : [value] "0" (value), + ); + } + var mask: u64 = 0; + inline for (0..@divExact(@bitSizeOf(u64), @bitSizeOf(usize))) |i| { + const shift = i * @bitSizeOf(usize); + const chunk: usize = @truncate(value >> shift); + const part = asm ("" + : [mask] "=r" (-> usize), + : [value] "0" (chunk), + ); + mask |= @as(u64, part) << shift; + } + return mask; +} + +/// Select arg2 when arg1 is zero and arg3 otherwise, using a bit mask. fn cmovznzU64(out1: *u64, arg1: u1, arg2: u64, arg3: u64) void { @setRuntimeSafety(mode == .debug); - const mask = 0 -% @as(u64, arg1); - out1.* = (mask & arg3) | ((~mask) & arg2); + const mask = selectionMaskU64(arg1); + out1.* = arg2 ^ ((arg2 ^ arg3) & mask); } /// The function mul multiplies two field elements in the Montgomery domain. @@ -116,30 +105,30 @@ fn cmovznzU64(out1: *u64, arg1: u1, arg2: u64, arg3: u64) void { pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldElement, arg2: MontgomeryDomainFieldElement) void { @setRuntimeSafety(mode == .debug); - const x1 = (arg1[1]); - const x2 = (arg1[2]); - const x3 = (arg1[3]); - const x4 = (arg1[4]); - const x5 = (arg1[5]); - const x6 = (arg1[0]); + const x1: u64 = arg1[1]; + const x2: u64 = arg1[2]; + const x3: u64 = arg1[3]; + const x4: u64 = arg1[4]; + const x5: u64 = arg1[5]; + const x6: u64 = arg1[0]; var x7: u64 = undefined; var x8: u64 = undefined; - mulxU64(&x7, &x8, x6, (arg2[5])); + mulxU64(&x7, &x8, x6, arg2[5]); var x9: u64 = undefined; var x10: u64 = undefined; - mulxU64(&x9, &x10, x6, (arg2[4])); + mulxU64(&x9, &x10, x6, arg2[4]); var x11: u64 = undefined; var x12: u64 = undefined; - mulxU64(&x11, &x12, x6, (arg2[3])); + mulxU64(&x11, &x12, x6, arg2[3]); var x13: u64 = undefined; var x14: u64 = undefined; - mulxU64(&x13, &x14, x6, (arg2[2])); + mulxU64(&x13, &x14, x6, arg2[2]); var x15: u64 = undefined; var x16: u64 = undefined; - mulxU64(&x15, &x16, x6, (arg2[1])); + mulxU64(&x15, &x16, x6, arg2[1]); var x17: u64 = undefined; var x18: u64 = undefined; - mulxU64(&x17, &x18, x6, (arg2[0])); + mulxU64(&x17, &x18, x6, arg2[0]); var x19: u64 = undefined; var x20: u1 = undefined; addcarryxU64(&x19, &x20, 0x0, x18, x15); @@ -155,7 +144,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x27: u64 = undefined; var x28: u1 = undefined; addcarryxU64(&x27, &x28, x26, x10, x7); - const x29 = (@as(u64, x28) + x8); + const x29: u64 = (x28 + x8); var x30: u64 = undefined; var x31: u64 = undefined; mulxU64(&x30, &x31, x17, 0x100000001); @@ -192,7 +181,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x52: u64 = undefined; var x53: u1 = undefined; addcarryxU64(&x52, &x53, x51, x35, x32); - const x54 = (@as(u64, x53) + x33); + const x54: u64 = (x53 + x33); var x55: u64 = undefined; var x56: u1 = undefined; addcarryxU64(&x55, &x56, 0x0, x17, x42); @@ -216,22 +205,22 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme addcarryxU64(&x67, &x68, x66, x29, x54); var x69: u64 = undefined; var x70: u64 = undefined; - mulxU64(&x69, &x70, x1, (arg2[5])); + mulxU64(&x69, &x70, x1, arg2[5]); var x71: u64 = undefined; var x72: u64 = undefined; - mulxU64(&x71, &x72, x1, (arg2[4])); + mulxU64(&x71, &x72, x1, arg2[4]); var x73: u64 = undefined; var x74: u64 = undefined; - mulxU64(&x73, &x74, x1, (arg2[3])); + mulxU64(&x73, &x74, x1, arg2[3]); var x75: u64 = undefined; var x76: u64 = undefined; - mulxU64(&x75, &x76, x1, (arg2[2])); + mulxU64(&x75, &x76, x1, arg2[2]); var x77: u64 = undefined; var x78: u64 = undefined; - mulxU64(&x77, &x78, x1, (arg2[1])); + mulxU64(&x77, &x78, x1, arg2[1]); var x79: u64 = undefined; var x80: u64 = undefined; - mulxU64(&x79, &x80, x1, (arg2[0])); + mulxU64(&x79, &x80, x1, arg2[0]); var x81: u64 = undefined; var x82: u1 = undefined; addcarryxU64(&x81, &x82, 0x0, x80, x77); @@ -247,7 +236,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x89: u64 = undefined; var x90: u1 = undefined; addcarryxU64(&x89, &x90, x88, x72, x69); - const x91 = (@as(u64, x90) + x70); + const x91: u64 = (x90 + x70); var x92: u64 = undefined; var x93: u1 = undefined; addcarryxU64(&x92, &x93, 0x0, x57, x79); @@ -268,7 +257,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme addcarryxU64(&x102, &x103, x101, x67, x89); var x104: u64 = undefined; var x105: u1 = undefined; - addcarryxU64(&x104, &x105, x103, @as(u64, x68), x91); + addcarryxU64(&x104, &x105, x103, x68, x91); var x106: u64 = undefined; var x107: u64 = undefined; mulxU64(&x106, &x107, x92, 0x100000001); @@ -305,7 +294,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x128: u64 = undefined; var x129: u1 = undefined; addcarryxU64(&x128, &x129, x127, x111, x108); - const x130 = (@as(u64, x129) + x109); + const x130: u64 = (x129 + x109); var x131: u64 = undefined; var x132: u1 = undefined; addcarryxU64(&x131, &x132, 0x0, x92, x118); @@ -327,25 +316,25 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x143: u64 = undefined; var x144: u1 = undefined; addcarryxU64(&x143, &x144, x142, x104, x130); - const x145 = (@as(u64, x144) + @as(u64, x105)); + const x145: u64 = (@as(u64, x144) + x105); var x146: u64 = undefined; var x147: u64 = undefined; - mulxU64(&x146, &x147, x2, (arg2[5])); + mulxU64(&x146, &x147, x2, arg2[5]); var x148: u64 = undefined; var x149: u64 = undefined; - mulxU64(&x148, &x149, x2, (arg2[4])); + mulxU64(&x148, &x149, x2, arg2[4]); var x150: u64 = undefined; var x151: u64 = undefined; - mulxU64(&x150, &x151, x2, (arg2[3])); + mulxU64(&x150, &x151, x2, arg2[3]); var x152: u64 = undefined; var x153: u64 = undefined; - mulxU64(&x152, &x153, x2, (arg2[2])); + mulxU64(&x152, &x153, x2, arg2[2]); var x154: u64 = undefined; var x155: u64 = undefined; - mulxU64(&x154, &x155, x2, (arg2[1])); + mulxU64(&x154, &x155, x2, arg2[1]); var x156: u64 = undefined; var x157: u64 = undefined; - mulxU64(&x156, &x157, x2, (arg2[0])); + mulxU64(&x156, &x157, x2, arg2[0]); var x158: u64 = undefined; var x159: u1 = undefined; addcarryxU64(&x158, &x159, 0x0, x157, x154); @@ -361,7 +350,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x166: u64 = undefined; var x167: u1 = undefined; addcarryxU64(&x166, &x167, x165, x149, x146); - const x168 = (@as(u64, x167) + x147); + const x168: u64 = (x167 + x147); var x169: u64 = undefined; var x170: u1 = undefined; addcarryxU64(&x169, &x170, 0x0, x133, x156); @@ -419,7 +408,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x205: u64 = undefined; var x206: u1 = undefined; addcarryxU64(&x205, &x206, x204, x188, x185); - const x207 = (@as(u64, x206) + x186); + const x207: u64 = (x206 + x186); var x208: u64 = undefined; var x209: u1 = undefined; addcarryxU64(&x208, &x209, 0x0, x169, x195); @@ -441,25 +430,25 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x220: u64 = undefined; var x221: u1 = undefined; addcarryxU64(&x220, &x221, x219, x181, x207); - const x222 = (@as(u64, x221) + @as(u64, x182)); + const x222: u64 = (@as(u64, x221) + x182); var x223: u64 = undefined; var x224: u64 = undefined; - mulxU64(&x223, &x224, x3, (arg2[5])); + mulxU64(&x223, &x224, x3, arg2[5]); var x225: u64 = undefined; var x226: u64 = undefined; - mulxU64(&x225, &x226, x3, (arg2[4])); + mulxU64(&x225, &x226, x3, arg2[4]); var x227: u64 = undefined; var x228: u64 = undefined; - mulxU64(&x227, &x228, x3, (arg2[3])); + mulxU64(&x227, &x228, x3, arg2[3]); var x229: u64 = undefined; var x230: u64 = undefined; - mulxU64(&x229, &x230, x3, (arg2[2])); + mulxU64(&x229, &x230, x3, arg2[2]); var x231: u64 = undefined; var x232: u64 = undefined; - mulxU64(&x231, &x232, x3, (arg2[1])); + mulxU64(&x231, &x232, x3, arg2[1]); var x233: u64 = undefined; var x234: u64 = undefined; - mulxU64(&x233, &x234, x3, (arg2[0])); + mulxU64(&x233, &x234, x3, arg2[0]); var x235: u64 = undefined; var x236: u1 = undefined; addcarryxU64(&x235, &x236, 0x0, x234, x231); @@ -475,7 +464,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x243: u64 = undefined; var x244: u1 = undefined; addcarryxU64(&x243, &x244, x242, x226, x223); - const x245 = (@as(u64, x244) + x224); + const x245: u64 = (x244 + x224); var x246: u64 = undefined; var x247: u1 = undefined; addcarryxU64(&x246, &x247, 0x0, x210, x233); @@ -533,7 +522,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x282: u64 = undefined; var x283: u1 = undefined; addcarryxU64(&x282, &x283, x281, x265, x262); - const x284 = (@as(u64, x283) + x263); + const x284: u64 = (x283 + x263); var x285: u64 = undefined; var x286: u1 = undefined; addcarryxU64(&x285, &x286, 0x0, x246, x272); @@ -555,25 +544,25 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x297: u64 = undefined; var x298: u1 = undefined; addcarryxU64(&x297, &x298, x296, x258, x284); - const x299 = (@as(u64, x298) + @as(u64, x259)); + const x299: u64 = (@as(u64, x298) + x259); var x300: u64 = undefined; var x301: u64 = undefined; - mulxU64(&x300, &x301, x4, (arg2[5])); + mulxU64(&x300, &x301, x4, arg2[5]); var x302: u64 = undefined; var x303: u64 = undefined; - mulxU64(&x302, &x303, x4, (arg2[4])); + mulxU64(&x302, &x303, x4, arg2[4]); var x304: u64 = undefined; var x305: u64 = undefined; - mulxU64(&x304, &x305, x4, (arg2[3])); + mulxU64(&x304, &x305, x4, arg2[3]); var x306: u64 = undefined; var x307: u64 = undefined; - mulxU64(&x306, &x307, x4, (arg2[2])); + mulxU64(&x306, &x307, x4, arg2[2]); var x308: u64 = undefined; var x309: u64 = undefined; - mulxU64(&x308, &x309, x4, (arg2[1])); + mulxU64(&x308, &x309, x4, arg2[1]); var x310: u64 = undefined; var x311: u64 = undefined; - mulxU64(&x310, &x311, x4, (arg2[0])); + mulxU64(&x310, &x311, x4, arg2[0]); var x312: u64 = undefined; var x313: u1 = undefined; addcarryxU64(&x312, &x313, 0x0, x311, x308); @@ -589,7 +578,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x320: u64 = undefined; var x321: u1 = undefined; addcarryxU64(&x320, &x321, x319, x303, x300); - const x322 = (@as(u64, x321) + x301); + const x322: u64 = (x321 + x301); var x323: u64 = undefined; var x324: u1 = undefined; addcarryxU64(&x323, &x324, 0x0, x287, x310); @@ -647,7 +636,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x359: u64 = undefined; var x360: u1 = undefined; addcarryxU64(&x359, &x360, x358, x342, x339); - const x361 = (@as(u64, x360) + x340); + const x361: u64 = (x360 + x340); var x362: u64 = undefined; var x363: u1 = undefined; addcarryxU64(&x362, &x363, 0x0, x323, x349); @@ -669,25 +658,25 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x374: u64 = undefined; var x375: u1 = undefined; addcarryxU64(&x374, &x375, x373, x335, x361); - const x376 = (@as(u64, x375) + @as(u64, x336)); + const x376: u64 = (@as(u64, x375) + x336); var x377: u64 = undefined; var x378: u64 = undefined; - mulxU64(&x377, &x378, x5, (arg2[5])); + mulxU64(&x377, &x378, x5, arg2[5]); var x379: u64 = undefined; var x380: u64 = undefined; - mulxU64(&x379, &x380, x5, (arg2[4])); + mulxU64(&x379, &x380, x5, arg2[4]); var x381: u64 = undefined; var x382: u64 = undefined; - mulxU64(&x381, &x382, x5, (arg2[3])); + mulxU64(&x381, &x382, x5, arg2[3]); var x383: u64 = undefined; var x384: u64 = undefined; - mulxU64(&x383, &x384, x5, (arg2[2])); + mulxU64(&x383, &x384, x5, arg2[2]); var x385: u64 = undefined; var x386: u64 = undefined; - mulxU64(&x385, &x386, x5, (arg2[1])); + mulxU64(&x385, &x386, x5, arg2[1]); var x387: u64 = undefined; var x388: u64 = undefined; - mulxU64(&x387, &x388, x5, (arg2[0])); + mulxU64(&x387, &x388, x5, arg2[0]); var x389: u64 = undefined; var x390: u1 = undefined; addcarryxU64(&x389, &x390, 0x0, x388, x385); @@ -703,7 +692,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x397: u64 = undefined; var x398: u1 = undefined; addcarryxU64(&x397, &x398, x396, x380, x377); - const x399 = (@as(u64, x398) + x378); + const x399: u64 = (x398 + x378); var x400: u64 = undefined; var x401: u1 = undefined; addcarryxU64(&x400, &x401, 0x0, x364, x387); @@ -761,7 +750,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x436: u64 = undefined; var x437: u1 = undefined; addcarryxU64(&x436, &x437, x435, x419, x416); - const x438 = (@as(u64, x437) + x417); + const x438: u64 = (x437 + x417); var x439: u64 = undefined; var x440: u1 = undefined; addcarryxU64(&x439, &x440, 0x0, x400, x426); @@ -783,7 +772,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x451: u64 = undefined; var x452: u1 = undefined; addcarryxU64(&x451, &x452, x450, x412, x438); - const x453 = (@as(u64, x452) + @as(u64, x413)); + const x453: u64 = (@as(u64, x452) + x413); var x454: u64 = undefined; var x455: u1 = undefined; subborrowxU64(&x454, &x455, 0x0, x441, 0xffffffff); @@ -806,17 +795,18 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x467: u1 = undefined; subborrowxU64(&x466, &x467, x465, x453, 0x0); var x468: u64 = undefined; - cmovznzU64(&x468, x467, x454, x441); + const x468_selection_mask = selectionMaskU64(x467); + x468 = x454 ^ ((x454 ^ x441) & x468_selection_mask); var x469: u64 = undefined; - cmovznzU64(&x469, x467, x456, x443); + x469 = x456 ^ ((x456 ^ x443) & x468_selection_mask); var x470: u64 = undefined; - cmovznzU64(&x470, x467, x458, x445); + x470 = x458 ^ ((x458 ^ x445) & x468_selection_mask); var x471: u64 = undefined; - cmovznzU64(&x471, x467, x460, x447); + x471 = x460 ^ ((x460 ^ x447) & x468_selection_mask); var x472: u64 = undefined; - cmovznzU64(&x472, x467, x462, x449); + x472 = x462 ^ ((x462 ^ x449) & x468_selection_mask); var x473: u64 = undefined; - cmovznzU64(&x473, x467, x464, x451); + x473 = x464 ^ ((x464 ^ x451) & x468_selection_mask); out1[0] = x468; out1[1] = x469; out1[2] = x470; @@ -836,30 +826,30 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldElement) void { @setRuntimeSafety(mode == .debug); - const x1 = (arg1[1]); - const x2 = (arg1[2]); - const x3 = (arg1[3]); - const x4 = (arg1[4]); - const x5 = (arg1[5]); - const x6 = (arg1[0]); + const x1: u64 = arg1[1]; + const x2: u64 = arg1[2]; + const x3: u64 = arg1[3]; + const x4: u64 = arg1[4]; + const x5: u64 = arg1[5]; + const x6: u64 = arg1[0]; var x7: u64 = undefined; var x8: u64 = undefined; - mulxU64(&x7, &x8, x6, (arg1[5])); + mulxU64(&x7, &x8, x6, arg1[5]); var x9: u64 = undefined; var x10: u64 = undefined; - mulxU64(&x9, &x10, x6, (arg1[4])); + mulxU64(&x9, &x10, x6, arg1[4]); var x11: u64 = undefined; var x12: u64 = undefined; - mulxU64(&x11, &x12, x6, (arg1[3])); + mulxU64(&x11, &x12, x6, arg1[3]); var x13: u64 = undefined; var x14: u64 = undefined; - mulxU64(&x13, &x14, x6, (arg1[2])); + mulxU64(&x13, &x14, x6, arg1[2]); var x15: u64 = undefined; var x16: u64 = undefined; - mulxU64(&x15, &x16, x6, (arg1[1])); + mulxU64(&x15, &x16, x6, arg1[1]); var x17: u64 = undefined; var x18: u64 = undefined; - mulxU64(&x17, &x18, x6, (arg1[0])); + mulxU64(&x17, &x18, x6, arg1[0]); var x19: u64 = undefined; var x20: u1 = undefined; addcarryxU64(&x19, &x20, 0x0, x18, x15); @@ -875,7 +865,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x27: u64 = undefined; var x28: u1 = undefined; addcarryxU64(&x27, &x28, x26, x10, x7); - const x29 = (@as(u64, x28) + x8); + const x29: u64 = (x28 + x8); var x30: u64 = undefined; var x31: u64 = undefined; mulxU64(&x30, &x31, x17, 0x100000001); @@ -912,7 +902,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x52: u64 = undefined; var x53: u1 = undefined; addcarryxU64(&x52, &x53, x51, x35, x32); - const x54 = (@as(u64, x53) + x33); + const x54: u64 = (x53 + x33); var x55: u64 = undefined; var x56: u1 = undefined; addcarryxU64(&x55, &x56, 0x0, x17, x42); @@ -936,22 +926,22 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl addcarryxU64(&x67, &x68, x66, x29, x54); var x69: u64 = undefined; var x70: u64 = undefined; - mulxU64(&x69, &x70, x1, (arg1[5])); + mulxU64(&x69, &x70, x1, arg1[5]); var x71: u64 = undefined; var x72: u64 = undefined; - mulxU64(&x71, &x72, x1, (arg1[4])); + mulxU64(&x71, &x72, x1, arg1[4]); var x73: u64 = undefined; var x74: u64 = undefined; - mulxU64(&x73, &x74, x1, (arg1[3])); + mulxU64(&x73, &x74, x1, arg1[3]); var x75: u64 = undefined; var x76: u64 = undefined; - mulxU64(&x75, &x76, x1, (arg1[2])); + mulxU64(&x75, &x76, x1, arg1[2]); var x77: u64 = undefined; var x78: u64 = undefined; - mulxU64(&x77, &x78, x1, (arg1[1])); + mulxU64(&x77, &x78, x1, arg1[1]); var x79: u64 = undefined; var x80: u64 = undefined; - mulxU64(&x79, &x80, x1, (arg1[0])); + mulxU64(&x79, &x80, x1, arg1[0]); var x81: u64 = undefined; var x82: u1 = undefined; addcarryxU64(&x81, &x82, 0x0, x80, x77); @@ -967,7 +957,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x89: u64 = undefined; var x90: u1 = undefined; addcarryxU64(&x89, &x90, x88, x72, x69); - const x91 = (@as(u64, x90) + x70); + const x91: u64 = (x90 + x70); var x92: u64 = undefined; var x93: u1 = undefined; addcarryxU64(&x92, &x93, 0x0, x57, x79); @@ -988,7 +978,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl addcarryxU64(&x102, &x103, x101, x67, x89); var x104: u64 = undefined; var x105: u1 = undefined; - addcarryxU64(&x104, &x105, x103, @as(u64, x68), x91); + addcarryxU64(&x104, &x105, x103, x68, x91); var x106: u64 = undefined; var x107: u64 = undefined; mulxU64(&x106, &x107, x92, 0x100000001); @@ -1025,7 +1015,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x128: u64 = undefined; var x129: u1 = undefined; addcarryxU64(&x128, &x129, x127, x111, x108); - const x130 = (@as(u64, x129) + x109); + const x130: u64 = (x129 + x109); var x131: u64 = undefined; var x132: u1 = undefined; addcarryxU64(&x131, &x132, 0x0, x92, x118); @@ -1047,25 +1037,25 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x143: u64 = undefined; var x144: u1 = undefined; addcarryxU64(&x143, &x144, x142, x104, x130); - const x145 = (@as(u64, x144) + @as(u64, x105)); + const x145: u64 = (@as(u64, x144) + x105); var x146: u64 = undefined; var x147: u64 = undefined; - mulxU64(&x146, &x147, x2, (arg1[5])); + mulxU64(&x146, &x147, x2, arg1[5]); var x148: u64 = undefined; var x149: u64 = undefined; - mulxU64(&x148, &x149, x2, (arg1[4])); + mulxU64(&x148, &x149, x2, arg1[4]); var x150: u64 = undefined; var x151: u64 = undefined; - mulxU64(&x150, &x151, x2, (arg1[3])); + mulxU64(&x150, &x151, x2, arg1[3]); var x152: u64 = undefined; var x153: u64 = undefined; - mulxU64(&x152, &x153, x2, (arg1[2])); + mulxU64(&x152, &x153, x2, arg1[2]); var x154: u64 = undefined; var x155: u64 = undefined; - mulxU64(&x154, &x155, x2, (arg1[1])); + mulxU64(&x154, &x155, x2, arg1[1]); var x156: u64 = undefined; var x157: u64 = undefined; - mulxU64(&x156, &x157, x2, (arg1[0])); + mulxU64(&x156, &x157, x2, arg1[0]); var x158: u64 = undefined; var x159: u1 = undefined; addcarryxU64(&x158, &x159, 0x0, x157, x154); @@ -1081,7 +1071,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x166: u64 = undefined; var x167: u1 = undefined; addcarryxU64(&x166, &x167, x165, x149, x146); - const x168 = (@as(u64, x167) + x147); + const x168: u64 = (x167 + x147); var x169: u64 = undefined; var x170: u1 = undefined; addcarryxU64(&x169, &x170, 0x0, x133, x156); @@ -1139,7 +1129,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x205: u64 = undefined; var x206: u1 = undefined; addcarryxU64(&x205, &x206, x204, x188, x185); - const x207 = (@as(u64, x206) + x186); + const x207: u64 = (x206 + x186); var x208: u64 = undefined; var x209: u1 = undefined; addcarryxU64(&x208, &x209, 0x0, x169, x195); @@ -1161,25 +1151,25 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x220: u64 = undefined; var x221: u1 = undefined; addcarryxU64(&x220, &x221, x219, x181, x207); - const x222 = (@as(u64, x221) + @as(u64, x182)); + const x222: u64 = (@as(u64, x221) + x182); var x223: u64 = undefined; var x224: u64 = undefined; - mulxU64(&x223, &x224, x3, (arg1[5])); + mulxU64(&x223, &x224, x3, arg1[5]); var x225: u64 = undefined; var x226: u64 = undefined; - mulxU64(&x225, &x226, x3, (arg1[4])); + mulxU64(&x225, &x226, x3, arg1[4]); var x227: u64 = undefined; var x228: u64 = undefined; - mulxU64(&x227, &x228, x3, (arg1[3])); + mulxU64(&x227, &x228, x3, arg1[3]); var x229: u64 = undefined; var x230: u64 = undefined; - mulxU64(&x229, &x230, x3, (arg1[2])); + mulxU64(&x229, &x230, x3, arg1[2]); var x231: u64 = undefined; var x232: u64 = undefined; - mulxU64(&x231, &x232, x3, (arg1[1])); + mulxU64(&x231, &x232, x3, arg1[1]); var x233: u64 = undefined; var x234: u64 = undefined; - mulxU64(&x233, &x234, x3, (arg1[0])); + mulxU64(&x233, &x234, x3, arg1[0]); var x235: u64 = undefined; var x236: u1 = undefined; addcarryxU64(&x235, &x236, 0x0, x234, x231); @@ -1195,7 +1185,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x243: u64 = undefined; var x244: u1 = undefined; addcarryxU64(&x243, &x244, x242, x226, x223); - const x245 = (@as(u64, x244) + x224); + const x245: u64 = (x244 + x224); var x246: u64 = undefined; var x247: u1 = undefined; addcarryxU64(&x246, &x247, 0x0, x210, x233); @@ -1253,7 +1243,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x282: u64 = undefined; var x283: u1 = undefined; addcarryxU64(&x282, &x283, x281, x265, x262); - const x284 = (@as(u64, x283) + x263); + const x284: u64 = (x283 + x263); var x285: u64 = undefined; var x286: u1 = undefined; addcarryxU64(&x285, &x286, 0x0, x246, x272); @@ -1275,25 +1265,25 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x297: u64 = undefined; var x298: u1 = undefined; addcarryxU64(&x297, &x298, x296, x258, x284); - const x299 = (@as(u64, x298) + @as(u64, x259)); + const x299: u64 = (@as(u64, x298) + x259); var x300: u64 = undefined; var x301: u64 = undefined; - mulxU64(&x300, &x301, x4, (arg1[5])); + mulxU64(&x300, &x301, x4, arg1[5]); var x302: u64 = undefined; var x303: u64 = undefined; - mulxU64(&x302, &x303, x4, (arg1[4])); + mulxU64(&x302, &x303, x4, arg1[4]); var x304: u64 = undefined; var x305: u64 = undefined; - mulxU64(&x304, &x305, x4, (arg1[3])); + mulxU64(&x304, &x305, x4, arg1[3]); var x306: u64 = undefined; var x307: u64 = undefined; - mulxU64(&x306, &x307, x4, (arg1[2])); + mulxU64(&x306, &x307, x4, arg1[2]); var x308: u64 = undefined; var x309: u64 = undefined; - mulxU64(&x308, &x309, x4, (arg1[1])); + mulxU64(&x308, &x309, x4, arg1[1]); var x310: u64 = undefined; var x311: u64 = undefined; - mulxU64(&x310, &x311, x4, (arg1[0])); + mulxU64(&x310, &x311, x4, arg1[0]); var x312: u64 = undefined; var x313: u1 = undefined; addcarryxU64(&x312, &x313, 0x0, x311, x308); @@ -1309,7 +1299,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x320: u64 = undefined; var x321: u1 = undefined; addcarryxU64(&x320, &x321, x319, x303, x300); - const x322 = (@as(u64, x321) + x301); + const x322: u64 = (x321 + x301); var x323: u64 = undefined; var x324: u1 = undefined; addcarryxU64(&x323, &x324, 0x0, x287, x310); @@ -1367,7 +1357,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x359: u64 = undefined; var x360: u1 = undefined; addcarryxU64(&x359, &x360, x358, x342, x339); - const x361 = (@as(u64, x360) + x340); + const x361: u64 = (x360 + x340); var x362: u64 = undefined; var x363: u1 = undefined; addcarryxU64(&x362, &x363, 0x0, x323, x349); @@ -1389,25 +1379,25 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x374: u64 = undefined; var x375: u1 = undefined; addcarryxU64(&x374, &x375, x373, x335, x361); - const x376 = (@as(u64, x375) + @as(u64, x336)); + const x376: u64 = (@as(u64, x375) + x336); var x377: u64 = undefined; var x378: u64 = undefined; - mulxU64(&x377, &x378, x5, (arg1[5])); + mulxU64(&x377, &x378, x5, arg1[5]); var x379: u64 = undefined; var x380: u64 = undefined; - mulxU64(&x379, &x380, x5, (arg1[4])); + mulxU64(&x379, &x380, x5, arg1[4]); var x381: u64 = undefined; var x382: u64 = undefined; - mulxU64(&x381, &x382, x5, (arg1[3])); + mulxU64(&x381, &x382, x5, arg1[3]); var x383: u64 = undefined; var x384: u64 = undefined; - mulxU64(&x383, &x384, x5, (arg1[2])); + mulxU64(&x383, &x384, x5, arg1[2]); var x385: u64 = undefined; var x386: u64 = undefined; - mulxU64(&x385, &x386, x5, (arg1[1])); + mulxU64(&x385, &x386, x5, arg1[1]); var x387: u64 = undefined; var x388: u64 = undefined; - mulxU64(&x387, &x388, x5, (arg1[0])); + mulxU64(&x387, &x388, x5, arg1[0]); var x389: u64 = undefined; var x390: u1 = undefined; addcarryxU64(&x389, &x390, 0x0, x388, x385); @@ -1423,7 +1413,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x397: u64 = undefined; var x398: u1 = undefined; addcarryxU64(&x397, &x398, x396, x380, x377); - const x399 = (@as(u64, x398) + x378); + const x399: u64 = (x398 + x378); var x400: u64 = undefined; var x401: u1 = undefined; addcarryxU64(&x400, &x401, 0x0, x364, x387); @@ -1481,7 +1471,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x436: u64 = undefined; var x437: u1 = undefined; addcarryxU64(&x436, &x437, x435, x419, x416); - const x438 = (@as(u64, x437) + x417); + const x438: u64 = (x437 + x417); var x439: u64 = undefined; var x440: u1 = undefined; addcarryxU64(&x439, &x440, 0x0, x400, x426); @@ -1503,7 +1493,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x451: u64 = undefined; var x452: u1 = undefined; addcarryxU64(&x451, &x452, x450, x412, x438); - const x453 = (@as(u64, x452) + @as(u64, x413)); + const x453: u64 = (@as(u64, x452) + x413); var x454: u64 = undefined; var x455: u1 = undefined; subborrowxU64(&x454, &x455, 0x0, x441, 0xffffffff); @@ -1526,17 +1516,18 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x467: u1 = undefined; subborrowxU64(&x466, &x467, x465, x453, 0x0); var x468: u64 = undefined; - cmovznzU64(&x468, x467, x454, x441); + const x468_selection_mask = selectionMaskU64(x467); + x468 = x454 ^ ((x454 ^ x441) & x468_selection_mask); var x469: u64 = undefined; - cmovznzU64(&x469, x467, x456, x443); + x469 = x456 ^ ((x456 ^ x443) & x468_selection_mask); var x470: u64 = undefined; - cmovznzU64(&x470, x467, x458, x445); + x470 = x458 ^ ((x458 ^ x445) & x468_selection_mask); var x471: u64 = undefined; - cmovznzU64(&x471, x467, x460, x447); + x471 = x460 ^ ((x460 ^ x447) & x468_selection_mask); var x472: u64 = undefined; - cmovznzU64(&x472, x467, x462, x449); + x472 = x462 ^ ((x462 ^ x449) & x468_selection_mask); var x473: u64 = undefined; - cmovznzU64(&x473, x467, x464, x451); + x473 = x464 ^ ((x464 ^ x451) & x468_selection_mask); out1[0] = x468; out1[1] = x469; out1[2] = x470; @@ -1559,22 +1550,22 @@ pub fn add(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x1: u64 = undefined; var x2: u1 = undefined; - addcarryxU64(&x1, &x2, 0x0, (arg1[0]), (arg2[0])); + addcarryxU64(&x1, &x2, 0x0, arg1[0], arg2[0]); var x3: u64 = undefined; var x4: u1 = undefined; - addcarryxU64(&x3, &x4, x2, (arg1[1]), (arg2[1])); + addcarryxU64(&x3, &x4, x2, arg1[1], arg2[1]); var x5: u64 = undefined; var x6: u1 = undefined; - addcarryxU64(&x5, &x6, x4, (arg1[2]), (arg2[2])); + addcarryxU64(&x5, &x6, x4, arg1[2], arg2[2]); var x7: u64 = undefined; var x8: u1 = undefined; - addcarryxU64(&x7, &x8, x6, (arg1[3]), (arg2[3])); + addcarryxU64(&x7, &x8, x6, arg1[3], arg2[3]); var x9: u64 = undefined; var x10: u1 = undefined; - addcarryxU64(&x9, &x10, x8, (arg1[4]), (arg2[4])); + addcarryxU64(&x9, &x10, x8, arg1[4], arg2[4]); var x11: u64 = undefined; var x12: u1 = undefined; - addcarryxU64(&x11, &x12, x10, (arg1[5]), (arg2[5])); + addcarryxU64(&x11, &x12, x10, arg1[5], arg2[5]); var x13: u64 = undefined; var x14: u1 = undefined; subborrowxU64(&x13, &x14, 0x0, x1, 0xffffffff); @@ -1595,19 +1586,20 @@ pub fn add(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme subborrowxU64(&x23, &x24, x22, x11, 0xffffffffffffffff); var x25: u64 = undefined; var x26: u1 = undefined; - subborrowxU64(&x25, &x26, x24, @as(u64, x12), 0x0); + subborrowxU64(&x25, &x26, x24, x12, 0x0); var x27: u64 = undefined; - cmovznzU64(&x27, x26, x13, x1); + const x27_selection_mask = selectionMaskU64(x26); + x27 = x13 ^ ((x13 ^ x1) & x27_selection_mask); var x28: u64 = undefined; - cmovznzU64(&x28, x26, x15, x3); + x28 = x15 ^ ((x15 ^ x3) & x27_selection_mask); var x29: u64 = undefined; - cmovznzU64(&x29, x26, x17, x5); + x29 = x17 ^ ((x17 ^ x5) & x27_selection_mask); var x30: u64 = undefined; - cmovznzU64(&x30, x26, x19, x7); + x30 = x19 ^ ((x19 ^ x7) & x27_selection_mask); var x31: u64 = undefined; - cmovznzU64(&x31, x26, x21, x9); + x31 = x21 ^ ((x21 ^ x9) & x27_selection_mask); var x32: u64 = undefined; - cmovznzU64(&x32, x26, x23, x11); + x32 = x23 ^ ((x23 ^ x11) & x27_selection_mask); out1[0] = x27; out1[1] = x28; out1[2] = x29; @@ -1630,24 +1622,25 @@ pub fn sub(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x1: u64 = undefined; var x2: u1 = undefined; - subborrowxU64(&x1, &x2, 0x0, (arg1[0]), (arg2[0])); + subborrowxU64(&x1, &x2, 0x0, arg1[0], arg2[0]); var x3: u64 = undefined; var x4: u1 = undefined; - subborrowxU64(&x3, &x4, x2, (arg1[1]), (arg2[1])); + subborrowxU64(&x3, &x4, x2, arg1[1], arg2[1]); var x5: u64 = undefined; var x6: u1 = undefined; - subborrowxU64(&x5, &x6, x4, (arg1[2]), (arg2[2])); + subborrowxU64(&x5, &x6, x4, arg1[2], arg2[2]); var x7: u64 = undefined; var x8: u1 = undefined; - subborrowxU64(&x7, &x8, x6, (arg1[3]), (arg2[3])); + subborrowxU64(&x7, &x8, x6, arg1[3], arg2[3]); var x9: u64 = undefined; var x10: u1 = undefined; - subborrowxU64(&x9, &x10, x8, (arg1[4]), (arg2[4])); + subborrowxU64(&x9, &x10, x8, arg1[4], arg2[4]); var x11: u64 = undefined; var x12: u1 = undefined; - subborrowxU64(&x11, &x12, x10, (arg1[5]), (arg2[5])); + subborrowxU64(&x11, &x12, x10, arg1[5], arg2[5]); var x13: u64 = undefined; - cmovznzU64(&x13, x12, 0x0, 0xffffffffffffffff); + const x13_selection_mask = selectionMaskU64(x12); + x13 = 0x0 ^ ((0x0 ^ 0xffffffffffffffff) & x13_selection_mask); var x14: u64 = undefined; var x15: u1 = undefined; addcarryxU64(&x14, &x15, 0x0, x1, (x13 & 0xffffffff)); @@ -1687,24 +1680,25 @@ pub fn opp(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x1: u64 = undefined; var x2: u1 = undefined; - subborrowxU64(&x1, &x2, 0x0, 0x0, (arg1[0])); + subborrowxU64(&x1, &x2, 0x0, 0x0, arg1[0]); var x3: u64 = undefined; var x4: u1 = undefined; - subborrowxU64(&x3, &x4, x2, 0x0, (arg1[1])); + subborrowxU64(&x3, &x4, x2, 0x0, arg1[1]); var x5: u64 = undefined; var x6: u1 = undefined; - subborrowxU64(&x5, &x6, x4, 0x0, (arg1[2])); + subborrowxU64(&x5, &x6, x4, 0x0, arg1[2]); var x7: u64 = undefined; var x8: u1 = undefined; - subborrowxU64(&x7, &x8, x6, 0x0, (arg1[3])); + subborrowxU64(&x7, &x8, x6, 0x0, arg1[3]); var x9: u64 = undefined; var x10: u1 = undefined; - subborrowxU64(&x9, &x10, x8, 0x0, (arg1[4])); + subborrowxU64(&x9, &x10, x8, 0x0, arg1[4]); var x11: u64 = undefined; var x12: u1 = undefined; - subborrowxU64(&x11, &x12, x10, 0x0, (arg1[5])); + subborrowxU64(&x11, &x12, x10, 0x0, arg1[5]); var x13: u64 = undefined; - cmovznzU64(&x13, x12, 0x0, 0xffffffffffffffff); + const x13_selection_mask = selectionMaskU64(x12); + x13 = 0x0 ^ ((0x0 ^ 0xffffffffffffffff) & x13_selection_mask); var x14: u64 = undefined; var x15: u1 = undefined; addcarryxU64(&x14, &x15, 0x0, x1, (x13 & 0xffffffff)); @@ -1742,7 +1736,7 @@ pub fn opp(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldElement) void { @setRuntimeSafety(mode == .debug); - const x1 = (arg1[0]); + const x1: u64 = arg1[0]; var x2: u64 = undefined; var x3: u64 = undefined; mulxU64(&x2, &x3, x1, 0x100000001); @@ -1799,10 +1793,10 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo addcarryxU64(&x36, &x37, x35, 0x0, x24); var x38: u64 = undefined; var x39: u1 = undefined; - addcarryxU64(&x38, &x39, x37, 0x0, (@as(u64, x25) + x5)); + addcarryxU64(&x38, &x39, x37, 0x0, (x25 + x5)); var x40: u64 = undefined; var x41: u1 = undefined; - addcarryxU64(&x40, &x41, 0x0, x28, (arg1[1])); + addcarryxU64(&x40, &x41, 0x0, x28, arg1[1]); var x42: u64 = undefined; var x43: u1 = undefined; addcarryxU64(&x42, &x43, x41, x30, 0x0); @@ -1874,10 +1868,10 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo addcarryxU64(&x86, &x87, x85, x50, x74); var x88: u64 = undefined; var x89: u1 = undefined; - addcarryxU64(&x88, &x89, x87, (@as(u64, x51) + @as(u64, x39)), (@as(u64, x75) + x55)); + addcarryxU64(&x88, &x89, x87, (@as(u64, x51) + x39), (x75 + x55)); var x90: u64 = undefined; var x91: u1 = undefined; - addcarryxU64(&x90, &x91, 0x0, x78, (arg1[2])); + addcarryxU64(&x90, &x91, 0x0, x78, arg1[2]); var x92: u64 = undefined; var x93: u1 = undefined; addcarryxU64(&x92, &x93, x91, x80, 0x0); @@ -1949,10 +1943,10 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo addcarryxU64(&x136, &x137, x135, x100, x124); var x138: u64 = undefined; var x139: u1 = undefined; - addcarryxU64(&x138, &x139, x137, (@as(u64, x101) + @as(u64, x89)), (@as(u64, x125) + x105)); + addcarryxU64(&x138, &x139, x137, (@as(u64, x101) + x89), (x125 + x105)); var x140: u64 = undefined; var x141: u1 = undefined; - addcarryxU64(&x140, &x141, 0x0, x128, (arg1[3])); + addcarryxU64(&x140, &x141, 0x0, x128, arg1[3]); var x142: u64 = undefined; var x143: u1 = undefined; addcarryxU64(&x142, &x143, x141, x130, 0x0); @@ -2024,10 +2018,10 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo addcarryxU64(&x186, &x187, x185, x150, x174); var x188: u64 = undefined; var x189: u1 = undefined; - addcarryxU64(&x188, &x189, x187, (@as(u64, x151) + @as(u64, x139)), (@as(u64, x175) + x155)); + addcarryxU64(&x188, &x189, x187, (@as(u64, x151) + x139), (x175 + x155)); var x190: u64 = undefined; var x191: u1 = undefined; - addcarryxU64(&x190, &x191, 0x0, x178, (arg1[4])); + addcarryxU64(&x190, &x191, 0x0, x178, arg1[4]); var x192: u64 = undefined; var x193: u1 = undefined; addcarryxU64(&x192, &x193, x191, x180, 0x0); @@ -2099,10 +2093,10 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo addcarryxU64(&x236, &x237, x235, x200, x224); var x238: u64 = undefined; var x239: u1 = undefined; - addcarryxU64(&x238, &x239, x237, (@as(u64, x201) + @as(u64, x189)), (@as(u64, x225) + x205)); + addcarryxU64(&x238, &x239, x237, (@as(u64, x201) + x189), (x225 + x205)); var x240: u64 = undefined; var x241: u1 = undefined; - addcarryxU64(&x240, &x241, 0x0, x228, (arg1[5])); + addcarryxU64(&x240, &x241, 0x0, x228, arg1[5]); var x242: u64 = undefined; var x243: u1 = undefined; addcarryxU64(&x242, &x243, x241, x230, 0x0); @@ -2174,7 +2168,7 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo addcarryxU64(&x286, &x287, x285, x250, x274); var x288: u64 = undefined; var x289: u1 = undefined; - addcarryxU64(&x288, &x289, x287, (@as(u64, x251) + @as(u64, x239)), (@as(u64, x275) + x255)); + addcarryxU64(&x288, &x289, x287, (@as(u64, x251) + x239), (x275 + x255)); var x290: u64 = undefined; var x291: u1 = undefined; subborrowxU64(&x290, &x291, 0x0, x278, 0xffffffff); @@ -2195,19 +2189,20 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo subborrowxU64(&x300, &x301, x299, x288, 0xffffffffffffffff); var x302: u64 = undefined; var x303: u1 = undefined; - subborrowxU64(&x302, &x303, x301, @as(u64, x289), 0x0); + subborrowxU64(&x302, &x303, x301, x289, 0x0); var x304: u64 = undefined; - cmovznzU64(&x304, x303, x290, x278); + const x304_selection_mask = selectionMaskU64(x303); + x304 = x290 ^ ((x290 ^ x278) & x304_selection_mask); var x305: u64 = undefined; - cmovznzU64(&x305, x303, x292, x280); + x305 = x292 ^ ((x292 ^ x280) & x304_selection_mask); var x306: u64 = undefined; - cmovznzU64(&x306, x303, x294, x282); + x306 = x294 ^ ((x294 ^ x282) & x304_selection_mask); var x307: u64 = undefined; - cmovznzU64(&x307, x303, x296, x284); + x307 = x296 ^ ((x296 ^ x284) & x304_selection_mask); var x308: u64 = undefined; - cmovznzU64(&x308, x303, x298, x286); + x308 = x298 ^ ((x298 ^ x286) & x304_selection_mask); var x309: u64 = undefined; - cmovznzU64(&x309, x303, x300, x288); + x309 = x300 ^ ((x300 ^ x288) & x304_selection_mask); out1[0] = x304; out1[1] = x305; out1[2] = x306; @@ -2227,12 +2222,12 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDomainFieldElement) void { @setRuntimeSafety(mode == .debug); - const x1 = (arg1[1]); - const x2 = (arg1[2]); - const x3 = (arg1[3]); - const x4 = (arg1[4]); - const x5 = (arg1[5]); - const x6 = (arg1[0]); + const x1: u64 = arg1[1]; + const x2: u64 = arg1[2]; + const x3: u64 = arg1[3]; + const x4: u64 = arg1[4]; + const x5: u64 = arg1[5]; + const x6: u64 = arg1[0]; var x7: u64 = undefined; var x8: u64 = undefined; mulxU64(&x7, &x8, x6, 0x200000000); @@ -2310,10 +2305,10 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma addcarryxU64(&x55, &x56, x54, x21, x43); var x57: u64 = undefined; var x58: u1 = undefined; - addcarryxU64(&x57, &x58, x56, @as(u64, x22), x45); + addcarryxU64(&x57, &x58, x56, x22, x45); var x59: u64 = undefined; var x60: u1 = undefined; - addcarryxU64(&x59, &x60, x58, 0x0, (@as(u64, x46) + x26)); + addcarryxU64(&x59, &x60, x58, 0x0, (x46 + x26)); var x61: u64 = undefined; var x62: u64 = undefined; mulxU64(&x61, &x62, x1, 0x200000000); @@ -2355,7 +2350,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma addcarryxU64(&x85, &x86, x84, x57, x75); var x87: u64 = undefined; var x88: u1 = undefined; - addcarryxU64(&x87, &x88, x86, x59, @as(u64, x76)); + addcarryxU64(&x87, &x88, x86, x59, x76); var x89: u64 = undefined; var x90: u64 = undefined; mulxU64(&x89, &x90, x77, 0x100000001); @@ -2412,7 +2407,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma addcarryxU64(&x123, &x124, x122, x87, x111); var x125: u64 = undefined; var x126: u1 = undefined; - addcarryxU64(&x125, &x126, x124, (@as(u64, x88) + @as(u64, x60)), (@as(u64, x112) + x92)); + addcarryxU64(&x125, &x126, x124, (@as(u64, x88) + x60), (x112 + x92)); var x127: u64 = undefined; var x128: u64 = undefined; mulxU64(&x127, &x128, x2, 0x200000000); @@ -2454,7 +2449,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma addcarryxU64(&x151, &x152, x150, x123, x141); var x153: u64 = undefined; var x154: u1 = undefined; - addcarryxU64(&x153, &x154, x152, x125, @as(u64, x142)); + addcarryxU64(&x153, &x154, x152, x125, x142); var x155: u64 = undefined; var x156: u64 = undefined; mulxU64(&x155, &x156, x143, 0x100000001); @@ -2511,7 +2506,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma addcarryxU64(&x189, &x190, x188, x153, x177); var x191: u64 = undefined; var x192: u1 = undefined; - addcarryxU64(&x191, &x192, x190, (@as(u64, x154) + @as(u64, x126)), (@as(u64, x178) + x158)); + addcarryxU64(&x191, &x192, x190, (@as(u64, x154) + x126), (x178 + x158)); var x193: u64 = undefined; var x194: u64 = undefined; mulxU64(&x193, &x194, x3, 0x200000000); @@ -2553,7 +2548,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma addcarryxU64(&x217, &x218, x216, x189, x207); var x219: u64 = undefined; var x220: u1 = undefined; - addcarryxU64(&x219, &x220, x218, x191, @as(u64, x208)); + addcarryxU64(&x219, &x220, x218, x191, x208); var x221: u64 = undefined; var x222: u64 = undefined; mulxU64(&x221, &x222, x209, 0x100000001); @@ -2610,7 +2605,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma addcarryxU64(&x255, &x256, x254, x219, x243); var x257: u64 = undefined; var x258: u1 = undefined; - addcarryxU64(&x257, &x258, x256, (@as(u64, x220) + @as(u64, x192)), (@as(u64, x244) + x224)); + addcarryxU64(&x257, &x258, x256, (@as(u64, x220) + x192), (x244 + x224)); var x259: u64 = undefined; var x260: u64 = undefined; mulxU64(&x259, &x260, x4, 0x200000000); @@ -2652,7 +2647,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma addcarryxU64(&x283, &x284, x282, x255, x273); var x285: u64 = undefined; var x286: u1 = undefined; - addcarryxU64(&x285, &x286, x284, x257, @as(u64, x274)); + addcarryxU64(&x285, &x286, x284, x257, x274); var x287: u64 = undefined; var x288: u64 = undefined; mulxU64(&x287, &x288, x275, 0x100000001); @@ -2709,7 +2704,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma addcarryxU64(&x321, &x322, x320, x285, x309); var x323: u64 = undefined; var x324: u1 = undefined; - addcarryxU64(&x323, &x324, x322, (@as(u64, x286) + @as(u64, x258)), (@as(u64, x310) + x290)); + addcarryxU64(&x323, &x324, x322, (@as(u64, x286) + x258), (x310 + x290)); var x325: u64 = undefined; var x326: u64 = undefined; mulxU64(&x325, &x326, x5, 0x200000000); @@ -2751,7 +2746,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma addcarryxU64(&x349, &x350, x348, x321, x339); var x351: u64 = undefined; var x352: u1 = undefined; - addcarryxU64(&x351, &x352, x350, x323, @as(u64, x340)); + addcarryxU64(&x351, &x352, x350, x323, x340); var x353: u64 = undefined; var x354: u64 = undefined; mulxU64(&x353, &x354, x341, 0x100000001); @@ -2808,7 +2803,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma addcarryxU64(&x387, &x388, x386, x351, x375); var x389: u64 = undefined; var x390: u1 = undefined; - addcarryxU64(&x389, &x390, x388, (@as(u64, x352) + @as(u64, x324)), (@as(u64, x376) + x356)); + addcarryxU64(&x389, &x390, x388, (@as(u64, x352) + x324), (x376 + x356)); var x391: u64 = undefined; var x392: u1 = undefined; subborrowxU64(&x391, &x392, 0x0, x379, 0xffffffff); @@ -2829,19 +2824,20 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma subborrowxU64(&x401, &x402, x400, x389, 0xffffffffffffffff); var x403: u64 = undefined; var x404: u1 = undefined; - subborrowxU64(&x403, &x404, x402, @as(u64, x390), 0x0); + subborrowxU64(&x403, &x404, x402, x390, 0x0); var x405: u64 = undefined; - cmovznzU64(&x405, x404, x391, x379); + const x405_selection_mask = selectionMaskU64(x404); + x405 = x391 ^ ((x391 ^ x379) & x405_selection_mask); var x406: u64 = undefined; - cmovznzU64(&x406, x404, x393, x381); + x406 = x393 ^ ((x393 ^ x381) & x405_selection_mask); var x407: u64 = undefined; - cmovznzU64(&x407, x404, x395, x383); + x407 = x395 ^ ((x395 ^ x383) & x405_selection_mask); var x408: u64 = undefined; - cmovznzU64(&x408, x404, x397, x385); + x408 = x397 ^ ((x397 ^ x385) & x405_selection_mask); var x409: u64 = undefined; - cmovznzU64(&x409, x404, x399, x387); + x409 = x399 ^ ((x399 ^ x387) & x405_selection_mask); var x410: u64 = undefined; - cmovznzU64(&x410, x404, x401, x389); + x410 = x401 ^ ((x401 ^ x389) & x405_selection_mask); out1[0] = x405; out1[1] = x406; out1[2] = x407; @@ -2864,7 +2860,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma pub fn nonzero(out1: *u64, arg1: [6]u64) void { @setRuntimeSafety(mode == .debug); - const x1 = ((arg1[0]) | ((arg1[1]) | ((arg1[2]) | ((arg1[3]) | ((arg1[4]) | (arg1[5])))))); + const x1: u64 = (arg1[0] | (arg1[1] | (arg1[2] | (arg1[3] | (arg1[4] | arg1[5]))))); out1.* = x1; } @@ -2883,17 +2879,18 @@ pub fn selectznz(out1: *[6]u64, arg1: u1, arg2: [6]u64, arg3: [6]u64) void { @setRuntimeSafety(mode == .debug); var x1: u64 = undefined; - cmovznzU64(&x1, arg1, (arg2[0]), (arg3[0])); + const x1_selection_mask = selectionMaskU64(arg1); + x1 = arg2[0] ^ ((arg2[0] ^ arg3[0]) & x1_selection_mask); var x2: u64 = undefined; - cmovznzU64(&x2, arg1, (arg2[1]), (arg3[1])); + x2 = arg2[1] ^ ((arg2[1] ^ arg3[1]) & x1_selection_mask); var x3: u64 = undefined; - cmovznzU64(&x3, arg1, (arg2[2]), (arg3[2])); + x3 = arg2[2] ^ ((arg2[2] ^ arg3[2]) & x1_selection_mask); var x4: u64 = undefined; - cmovznzU64(&x4, arg1, (arg2[3]), (arg3[3])); + x4 = arg2[3] ^ ((arg2[3] ^ arg3[3]) & x1_selection_mask); var x5: u64 = undefined; - cmovznzU64(&x5, arg1, (arg2[4]), (arg3[4])); + x5 = arg2[4] ^ ((arg2[4] ^ arg3[4]) & x1_selection_mask); var x6: u64 = undefined; - cmovznzU64(&x6, arg1, (arg2[5]), (arg3[5])); + x6 = arg2[5] ^ ((arg2[5] ^ arg3[5]) & x1_selection_mask); out1[0] = x1; out1[1] = x2; out1[2] = x3; @@ -2916,96 +2913,96 @@ pub fn selectznz(out1: *[6]u64, arg1: u1, arg2: [6]u64, arg3: [6]u64) void { pub fn toBytes(out1: *[48]u8, arg1: [6]u64) void { @setRuntimeSafety(mode == .debug); - const x1 = (arg1[5]); - const x2 = (arg1[4]); - const x3 = (arg1[3]); - const x4 = (arg1[2]); - const x5 = (arg1[1]); - const x6 = (arg1[0]); - const x7 = @as(u8, @truncate((x6 & 0xff))); - const x8 = (x6 >> 8); - const x9 = @as(u8, @truncate((x8 & 0xff))); - const x10 = (x8 >> 8); - const x11 = @as(u8, @truncate((x10 & 0xff))); - const x12 = (x10 >> 8); - const x13 = @as(u8, @truncate((x12 & 0xff))); - const x14 = (x12 >> 8); - const x15 = @as(u8, @truncate((x14 & 0xff))); - const x16 = (x14 >> 8); - const x17 = @as(u8, @truncate((x16 & 0xff))); - const x18 = (x16 >> 8); - const x19 = @as(u8, @truncate((x18 & 0xff))); - const x20 = @as(u8, @truncate((x18 >> 8))); - const x21 = @as(u8, @truncate((x5 & 0xff))); - const x22 = (x5 >> 8); - const x23 = @as(u8, @truncate((x22 & 0xff))); - const x24 = (x22 >> 8); - const x25 = @as(u8, @truncate((x24 & 0xff))); - const x26 = (x24 >> 8); - const x27 = @as(u8, @truncate((x26 & 0xff))); - const x28 = (x26 >> 8); - const x29 = @as(u8, @truncate((x28 & 0xff))); - const x30 = (x28 >> 8); - const x31 = @as(u8, @truncate((x30 & 0xff))); - const x32 = (x30 >> 8); - const x33 = @as(u8, @truncate((x32 & 0xff))); - const x34 = @as(u8, @truncate((x32 >> 8))); - const x35 = @as(u8, @truncate((x4 & 0xff))); - const x36 = (x4 >> 8); - const x37 = @as(u8, @truncate((x36 & 0xff))); - const x38 = (x36 >> 8); - const x39 = @as(u8, @truncate((x38 & 0xff))); - const x40 = (x38 >> 8); - const x41 = @as(u8, @truncate((x40 & 0xff))); - const x42 = (x40 >> 8); - const x43 = @as(u8, @truncate((x42 & 0xff))); - const x44 = (x42 >> 8); - const x45 = @as(u8, @truncate((x44 & 0xff))); - const x46 = (x44 >> 8); - const x47 = @as(u8, @truncate((x46 & 0xff))); - const x48 = @as(u8, @truncate((x46 >> 8))); - const x49 = @as(u8, @truncate((x3 & 0xff))); - const x50 = (x3 >> 8); - const x51 = @as(u8, @truncate((x50 & 0xff))); - const x52 = (x50 >> 8); - const x53 = @as(u8, @truncate((x52 & 0xff))); - const x54 = (x52 >> 8); - const x55 = @as(u8, @truncate((x54 & 0xff))); - const x56 = (x54 >> 8); - const x57 = @as(u8, @truncate((x56 & 0xff))); - const x58 = (x56 >> 8); - const x59 = @as(u8, @truncate((x58 & 0xff))); - const x60 = (x58 >> 8); - const x61 = @as(u8, @truncate((x60 & 0xff))); - const x62 = @as(u8, @truncate((x60 >> 8))); - const x63 = @as(u8, @truncate((x2 & 0xff))); - const x64 = (x2 >> 8); - const x65 = @as(u8, @truncate((x64 & 0xff))); - const x66 = (x64 >> 8); - const x67 = @as(u8, @truncate((x66 & 0xff))); - const x68 = (x66 >> 8); - const x69 = @as(u8, @truncate((x68 & 0xff))); - const x70 = (x68 >> 8); - const x71 = @as(u8, @truncate((x70 & 0xff))); - const x72 = (x70 >> 8); - const x73 = @as(u8, @truncate((x72 & 0xff))); - const x74 = (x72 >> 8); - const x75 = @as(u8, @truncate((x74 & 0xff))); - const x76 = @as(u8, @truncate((x74 >> 8))); - const x77 = @as(u8, @truncate((x1 & 0xff))); - const x78 = (x1 >> 8); - const x79 = @as(u8, @truncate((x78 & 0xff))); - const x80 = (x78 >> 8); - const x81 = @as(u8, @truncate((x80 & 0xff))); - const x82 = (x80 >> 8); - const x83 = @as(u8, @truncate((x82 & 0xff))); - const x84 = (x82 >> 8); - const x85 = @as(u8, @truncate((x84 & 0xff))); - const x86 = (x84 >> 8); - const x87 = @as(u8, @truncate((x86 & 0xff))); - const x88 = (x86 >> 8); - const x89 = @as(u8, @truncate((x88 & 0xff))); - const x90 = @as(u8, @truncate((x88 >> 8))); + const x1: u64 = arg1[5]; + const x2: u64 = arg1[4]; + const x3: u64 = arg1[3]; + const x4: u64 = arg1[2]; + const x5: u64 = arg1[1]; + const x6: u64 = arg1[0]; + const x7: u8 = @truncate(x6); + const x8: u64 = (x6 >> 8); + const x9: u8 = @truncate(x8); + const x10: u64 = (x8 >> 8); + const x11: u8 = @truncate(x10); + const x12: u64 = (x10 >> 8); + const x13: u8 = @truncate(x12); + const x14: u64 = (x12 >> 8); + const x15: u8 = @truncate(x14); + const x16: u64 = (x14 >> 8); + const x17: u8 = @truncate(x16); + const x18: u64 = (x16 >> 8); + const x19: u8 = @truncate(x18); + const x20: u8 = @truncate((x18 >> 8)); + const x21: u8 = @truncate(x5); + const x22: u64 = (x5 >> 8); + const x23: u8 = @truncate(x22); + const x24: u64 = (x22 >> 8); + const x25: u8 = @truncate(x24); + const x26: u64 = (x24 >> 8); + const x27: u8 = @truncate(x26); + const x28: u64 = (x26 >> 8); + const x29: u8 = @truncate(x28); + const x30: u64 = (x28 >> 8); + const x31: u8 = @truncate(x30); + const x32: u64 = (x30 >> 8); + const x33: u8 = @truncate(x32); + const x34: u8 = @truncate((x32 >> 8)); + const x35: u8 = @truncate(x4); + const x36: u64 = (x4 >> 8); + const x37: u8 = @truncate(x36); + const x38: u64 = (x36 >> 8); + const x39: u8 = @truncate(x38); + const x40: u64 = (x38 >> 8); + const x41: u8 = @truncate(x40); + const x42: u64 = (x40 >> 8); + const x43: u8 = @truncate(x42); + const x44: u64 = (x42 >> 8); + const x45: u8 = @truncate(x44); + const x46: u64 = (x44 >> 8); + const x47: u8 = @truncate(x46); + const x48: u8 = @truncate((x46 >> 8)); + const x49: u8 = @truncate(x3); + const x50: u64 = (x3 >> 8); + const x51: u8 = @truncate(x50); + const x52: u64 = (x50 >> 8); + const x53: u8 = @truncate(x52); + const x54: u64 = (x52 >> 8); + const x55: u8 = @truncate(x54); + const x56: u64 = (x54 >> 8); + const x57: u8 = @truncate(x56); + const x58: u64 = (x56 >> 8); + const x59: u8 = @truncate(x58); + const x60: u64 = (x58 >> 8); + const x61: u8 = @truncate(x60); + const x62: u8 = @truncate((x60 >> 8)); + const x63: u8 = @truncate(x2); + const x64: u64 = (x2 >> 8); + const x65: u8 = @truncate(x64); + const x66: u64 = (x64 >> 8); + const x67: u8 = @truncate(x66); + const x68: u64 = (x66 >> 8); + const x69: u8 = @truncate(x68); + const x70: u64 = (x68 >> 8); + const x71: u8 = @truncate(x70); + const x72: u64 = (x70 >> 8); + const x73: u8 = @truncate(x72); + const x74: u64 = (x72 >> 8); + const x75: u8 = @truncate(x74); + const x76: u8 = @truncate((x74 >> 8)); + const x77: u8 = @truncate(x1); + const x78: u64 = (x1 >> 8); + const x79: u8 = @truncate(x78); + const x80: u64 = (x78 >> 8); + const x81: u8 = @truncate(x80); + const x82: u64 = (x80 >> 8); + const x83: u8 = @truncate(x82); + const x84: u64 = (x82 >> 8); + const x85: u8 = @truncate(x84); + const x86: u64 = (x84 >> 8); + const x87: u8 = @truncate(x86); + const x88: u64 = (x86 >> 8); + const x89: u8 = @truncate(x88); + const x90: u8 = @truncate((x88 >> 8)); out1[0] = x7; out1[1] = x9; out1[2] = x11; @@ -3071,96 +3068,96 @@ pub fn toBytes(out1: *[48]u8, arg1: [6]u64) void { pub fn fromBytes(out1: *[6]u64, arg1: [48]u8) void { @setRuntimeSafety(mode == .debug); - const x1 = (@as(u64, (arg1[47])) << 56); - const x2 = (@as(u64, (arg1[46])) << 48); - const x3 = (@as(u64, (arg1[45])) << 40); - const x4 = (@as(u64, (arg1[44])) << 32); - const x5 = (@as(u64, (arg1[43])) << 24); - const x6 = (@as(u64, (arg1[42])) << 16); - const x7 = (@as(u64, (arg1[41])) << 8); - const x8 = (arg1[40]); - const x9 = (@as(u64, (arg1[39])) << 56); - const x10 = (@as(u64, (arg1[38])) << 48); - const x11 = (@as(u64, (arg1[37])) << 40); - const x12 = (@as(u64, (arg1[36])) << 32); - const x13 = (@as(u64, (arg1[35])) << 24); - const x14 = (@as(u64, (arg1[34])) << 16); - const x15 = (@as(u64, (arg1[33])) << 8); - const x16 = (arg1[32]); - const x17 = (@as(u64, (arg1[31])) << 56); - const x18 = (@as(u64, (arg1[30])) << 48); - const x19 = (@as(u64, (arg1[29])) << 40); - const x20 = (@as(u64, (arg1[28])) << 32); - const x21 = (@as(u64, (arg1[27])) << 24); - const x22 = (@as(u64, (arg1[26])) << 16); - const x23 = (@as(u64, (arg1[25])) << 8); - const x24 = (arg1[24]); - const x25 = (@as(u64, (arg1[23])) << 56); - const x26 = (@as(u64, (arg1[22])) << 48); - const x27 = (@as(u64, (arg1[21])) << 40); - const x28 = (@as(u64, (arg1[20])) << 32); - const x29 = (@as(u64, (arg1[19])) << 24); - const x30 = (@as(u64, (arg1[18])) << 16); - const x31 = (@as(u64, (arg1[17])) << 8); - const x32 = (arg1[16]); - const x33 = (@as(u64, (arg1[15])) << 56); - const x34 = (@as(u64, (arg1[14])) << 48); - const x35 = (@as(u64, (arg1[13])) << 40); - const x36 = (@as(u64, (arg1[12])) << 32); - const x37 = (@as(u64, (arg1[11])) << 24); - const x38 = (@as(u64, (arg1[10])) << 16); - const x39 = (@as(u64, (arg1[9])) << 8); - const x40 = (arg1[8]); - const x41 = (@as(u64, (arg1[7])) << 56); - const x42 = (@as(u64, (arg1[6])) << 48); - const x43 = (@as(u64, (arg1[5])) << 40); - const x44 = (@as(u64, (arg1[4])) << 32); - const x45 = (@as(u64, (arg1[3])) << 24); - const x46 = (@as(u64, (arg1[2])) << 16); - const x47 = (@as(u64, (arg1[1])) << 8); - const x48 = (arg1[0]); - const x49 = (x47 + @as(u64, x48)); - const x50 = (x46 + x49); - const x51 = (x45 + x50); - const x52 = (x44 + x51); - const x53 = (x43 + x52); - const x54 = (x42 + x53); - const x55 = (x41 + x54); - const x56 = (x39 + @as(u64, x40)); - const x57 = (x38 + x56); - const x58 = (x37 + x57); - const x59 = (x36 + x58); - const x60 = (x35 + x59); - const x61 = (x34 + x60); - const x62 = (x33 + x61); - const x63 = (x31 + @as(u64, x32)); - const x64 = (x30 + x63); - const x65 = (x29 + x64); - const x66 = (x28 + x65); - const x67 = (x27 + x66); - const x68 = (x26 + x67); - const x69 = (x25 + x68); - const x70 = (x23 + @as(u64, x24)); - const x71 = (x22 + x70); - const x72 = (x21 + x71); - const x73 = (x20 + x72); - const x74 = (x19 + x73); - const x75 = (x18 + x74); - const x76 = (x17 + x75); - const x77 = (x15 + @as(u64, x16)); - const x78 = (x14 + x77); - const x79 = (x13 + x78); - const x80 = (x12 + x79); - const x81 = (x11 + x80); - const x82 = (x10 + x81); - const x83 = (x9 + x82); - const x84 = (x7 + @as(u64, x8)); - const x85 = (x6 + x84); - const x86 = (x5 + x85); - const x87 = (x4 + x86); - const x88 = (x3 + x87); - const x89 = (x2 + x88); - const x90 = (x1 + x89); + const x1: u64 = (@as(u64, arg1[47]) << 56); + const x2: u64 = (@as(u64, arg1[46]) << 48); + const x3: u64 = (@as(u64, arg1[45]) << 40); + const x4: u64 = (@as(u64, arg1[44]) << 32); + const x5: u64 = (@as(u64, arg1[43]) << 24); + const x6: u64 = (@as(u64, arg1[42]) << 16); + const x7: u64 = (@as(u64, arg1[41]) << 8); + const x8: u8 = arg1[40]; + const x9: u64 = (@as(u64, arg1[39]) << 56); + const x10: u64 = (@as(u64, arg1[38]) << 48); + const x11: u64 = (@as(u64, arg1[37]) << 40); + const x12: u64 = (@as(u64, arg1[36]) << 32); + const x13: u64 = (@as(u64, arg1[35]) << 24); + const x14: u64 = (@as(u64, arg1[34]) << 16); + const x15: u64 = (@as(u64, arg1[33]) << 8); + const x16: u8 = arg1[32]; + const x17: u64 = (@as(u64, arg1[31]) << 56); + const x18: u64 = (@as(u64, arg1[30]) << 48); + const x19: u64 = (@as(u64, arg1[29]) << 40); + const x20: u64 = (@as(u64, arg1[28]) << 32); + const x21: u64 = (@as(u64, arg1[27]) << 24); + const x22: u64 = (@as(u64, arg1[26]) << 16); + const x23: u64 = (@as(u64, arg1[25]) << 8); + const x24: u8 = arg1[24]; + const x25: u64 = (@as(u64, arg1[23]) << 56); + const x26: u64 = (@as(u64, arg1[22]) << 48); + const x27: u64 = (@as(u64, arg1[21]) << 40); + const x28: u64 = (@as(u64, arg1[20]) << 32); + const x29: u64 = (@as(u64, arg1[19]) << 24); + const x30: u64 = (@as(u64, arg1[18]) << 16); + const x31: u64 = (@as(u64, arg1[17]) << 8); + const x32: u8 = arg1[16]; + const x33: u64 = (@as(u64, arg1[15]) << 56); + const x34: u64 = (@as(u64, arg1[14]) << 48); + const x35: u64 = (@as(u64, arg1[13]) << 40); + const x36: u64 = (@as(u64, arg1[12]) << 32); + const x37: u64 = (@as(u64, arg1[11]) << 24); + const x38: u64 = (@as(u64, arg1[10]) << 16); + const x39: u64 = (@as(u64, arg1[9]) << 8); + const x40: u8 = arg1[8]; + const x41: u64 = (@as(u64, arg1[7]) << 56); + const x42: u64 = (@as(u64, arg1[6]) << 48); + const x43: u64 = (@as(u64, arg1[5]) << 40); + const x44: u64 = (@as(u64, arg1[4]) << 32); + const x45: u64 = (@as(u64, arg1[3]) << 24); + const x46: u64 = (@as(u64, arg1[2]) << 16); + const x47: u64 = (@as(u64, arg1[1]) << 8); + const x48: u8 = arg1[0]; + const x49: u64 = (x47 + x48); + const x50: u64 = (x46 + x49); + const x51: u64 = (x45 + x50); + const x52: u64 = (x44 + x51); + const x53: u64 = (x43 + x52); + const x54: u64 = (x42 + x53); + const x55: u64 = (x41 + x54); + const x56: u64 = (x39 + x40); + const x57: u64 = (x38 + x56); + const x58: u64 = (x37 + x57); + const x59: u64 = (x36 + x58); + const x60: u64 = (x35 + x59); + const x61: u64 = (x34 + x60); + const x62: u64 = (x33 + x61); + const x63: u64 = (x31 + x32); + const x64: u64 = (x30 + x63); + const x65: u64 = (x29 + x64); + const x66: u64 = (x28 + x65); + const x67: u64 = (x27 + x66); + const x68: u64 = (x26 + x67); + const x69: u64 = (x25 + x68); + const x70: u64 = (x23 + x24); + const x71: u64 = (x22 + x70); + const x72: u64 = (x21 + x71); + const x73: u64 = (x20 + x72); + const x74: u64 = (x19 + x73); + const x75: u64 = (x18 + x74); + const x76: u64 = (x17 + x75); + const x77: u64 = (x15 + x16); + const x78: u64 = (x14 + x77); + const x79: u64 = (x13 + x78); + const x80: u64 = (x12 + x79); + const x81: u64 = (x11 + x80); + const x82: u64 = (x10 + x81); + const x83: u64 = (x9 + x82); + const x84: u64 = (x7 + x8); + const x85: u64 = (x6 + x84); + const x86: u64 = (x5 + x85); + const x87: u64 = (x4 + x86); + const x88: u64 = (x3 + x87); + const x89: u64 = (x2 + x88); + const x90: u64 = (x1 + x89); out1[0] = x55; out1[1] = x62; out1[2] = x69; @@ -3240,73 +3237,75 @@ pub fn divstep(out1: *u64, out2: *[7]u64, out3: *[7]u64, out4: *[6]u64, out5: *[ var x1: u64 = undefined; var x2: u1 = undefined; addcarryxU64(&x1, &x2, 0x0, (~arg1), 0x1); - const x3 = (@as(u1, @truncate((x1 >> 63))) & @as(u1, @truncate(((arg3[0]) & 0x1)))); + const x3: u1 = (@as(u1, @truncate((x1 >> 63))) & @as(u1, @truncate(arg3[0]))); var x4: u64 = undefined; var x5: u1 = undefined; addcarryxU64(&x4, &x5, 0x0, (~arg1), 0x1); var x6: u64 = undefined; - cmovznzU64(&x6, x3, arg1, x4); + const x6_selection_mask = selectionMaskU64(x3); + x6 = arg1 ^ ((arg1 ^ x4) & x6_selection_mask); var x7: u64 = undefined; - cmovznzU64(&x7, x3, (arg2[0]), (arg3[0])); + x7 = arg2[0] ^ ((arg2[0] ^ arg3[0]) & x6_selection_mask); var x8: u64 = undefined; - cmovznzU64(&x8, x3, (arg2[1]), (arg3[1])); + x8 = arg2[1] ^ ((arg2[1] ^ arg3[1]) & x6_selection_mask); var x9: u64 = undefined; - cmovznzU64(&x9, x3, (arg2[2]), (arg3[2])); + x9 = arg2[2] ^ ((arg2[2] ^ arg3[2]) & x6_selection_mask); var x10: u64 = undefined; - cmovznzU64(&x10, x3, (arg2[3]), (arg3[3])); + x10 = arg2[3] ^ ((arg2[3] ^ arg3[3]) & x6_selection_mask); var x11: u64 = undefined; - cmovznzU64(&x11, x3, (arg2[4]), (arg3[4])); + x11 = arg2[4] ^ ((arg2[4] ^ arg3[4]) & x6_selection_mask); var x12: u64 = undefined; - cmovznzU64(&x12, x3, (arg2[5]), (arg3[5])); + x12 = arg2[5] ^ ((arg2[5] ^ arg3[5]) & x6_selection_mask); var x13: u64 = undefined; - cmovznzU64(&x13, x3, (arg2[6]), (arg3[6])); + x13 = arg2[6] ^ ((arg2[6] ^ arg3[6]) & x6_selection_mask); var x14: u64 = undefined; var x15: u1 = undefined; - addcarryxU64(&x14, &x15, 0x0, 0x1, (~(arg2[0]))); + addcarryxU64(&x14, &x15, 0x0, 0x1, (~arg2[0])); var x16: u64 = undefined; var x17: u1 = undefined; - addcarryxU64(&x16, &x17, x15, 0x0, (~(arg2[1]))); + addcarryxU64(&x16, &x17, x15, 0x0, (~arg2[1])); var x18: u64 = undefined; var x19: u1 = undefined; - addcarryxU64(&x18, &x19, x17, 0x0, (~(arg2[2]))); + addcarryxU64(&x18, &x19, x17, 0x0, (~arg2[2])); var x20: u64 = undefined; var x21: u1 = undefined; - addcarryxU64(&x20, &x21, x19, 0x0, (~(arg2[3]))); + addcarryxU64(&x20, &x21, x19, 0x0, (~arg2[3])); var x22: u64 = undefined; var x23: u1 = undefined; - addcarryxU64(&x22, &x23, x21, 0x0, (~(arg2[4]))); + addcarryxU64(&x22, &x23, x21, 0x0, (~arg2[4])); var x24: u64 = undefined; var x25: u1 = undefined; - addcarryxU64(&x24, &x25, x23, 0x0, (~(arg2[5]))); + addcarryxU64(&x24, &x25, x23, 0x0, (~arg2[5])); var x26: u64 = undefined; var x27: u1 = undefined; - addcarryxU64(&x26, &x27, x25, 0x0, (~(arg2[6]))); + addcarryxU64(&x26, &x27, x25, 0x0, (~arg2[6])); var x28: u64 = undefined; - cmovznzU64(&x28, x3, (arg3[0]), x14); + const x28_selection_mask = selectionMaskU64(x3); + x28 = arg3[0] ^ ((arg3[0] ^ x14) & x28_selection_mask); var x29: u64 = undefined; - cmovznzU64(&x29, x3, (arg3[1]), x16); + x29 = arg3[1] ^ ((arg3[1] ^ x16) & x28_selection_mask); var x30: u64 = undefined; - cmovznzU64(&x30, x3, (arg3[2]), x18); + x30 = arg3[2] ^ ((arg3[2] ^ x18) & x28_selection_mask); var x31: u64 = undefined; - cmovznzU64(&x31, x3, (arg3[3]), x20); + x31 = arg3[3] ^ ((arg3[3] ^ x20) & x28_selection_mask); var x32: u64 = undefined; - cmovznzU64(&x32, x3, (arg3[4]), x22); + x32 = arg3[4] ^ ((arg3[4] ^ x22) & x28_selection_mask); var x33: u64 = undefined; - cmovznzU64(&x33, x3, (arg3[5]), x24); + x33 = arg3[5] ^ ((arg3[5] ^ x24) & x28_selection_mask); var x34: u64 = undefined; - cmovznzU64(&x34, x3, (arg3[6]), x26); + x34 = arg3[6] ^ ((arg3[6] ^ x26) & x28_selection_mask); var x35: u64 = undefined; - cmovznzU64(&x35, x3, (arg4[0]), (arg5[0])); + x35 = arg4[0] ^ ((arg4[0] ^ arg5[0]) & x28_selection_mask); var x36: u64 = undefined; - cmovznzU64(&x36, x3, (arg4[1]), (arg5[1])); + x36 = arg4[1] ^ ((arg4[1] ^ arg5[1]) & x28_selection_mask); var x37: u64 = undefined; - cmovznzU64(&x37, x3, (arg4[2]), (arg5[2])); + x37 = arg4[2] ^ ((arg4[2] ^ arg5[2]) & x28_selection_mask); var x38: u64 = undefined; - cmovznzU64(&x38, x3, (arg4[3]), (arg5[3])); + x38 = arg4[3] ^ ((arg4[3] ^ arg5[3]) & x28_selection_mask); var x39: u64 = undefined; - cmovznzU64(&x39, x3, (arg4[4]), (arg5[4])); + x39 = arg4[4] ^ ((arg4[4] ^ arg5[4]) & x28_selection_mask); var x40: u64 = undefined; - cmovznzU64(&x40, x3, (arg4[5]), (arg5[5])); + x40 = arg4[5] ^ ((arg4[5] ^ arg5[5]) & x28_selection_mask); var x41: u64 = undefined; var x42: u1 = undefined; addcarryxU64(&x41, &x42, 0x0, x35, x35); @@ -3345,13 +3344,13 @@ pub fn divstep(out1: *u64, out2: *[7]u64, out3: *[7]u64, out4: *[6]u64, out5: *[ subborrowxU64(&x63, &x64, x62, x51, 0xffffffffffffffff); var x65: u64 = undefined; var x66: u1 = undefined; - subborrowxU64(&x65, &x66, x64, @as(u64, x52), 0x0); - const x67 = (arg4[5]); - const x68 = (arg4[4]); - const x69 = (arg4[3]); - const x70 = (arg4[2]); - const x71 = (arg4[1]); - const x72 = (arg4[0]); + subborrowxU64(&x65, &x66, x64, x52, 0x0); + const x67: u64 = arg4[5]; + const x68: u64 = arg4[4]; + const x69: u64 = arg4[3]; + const x70: u64 = arg4[2]; + const x71: u64 = arg4[1]; + const x72: u64 = arg4[0]; var x73: u64 = undefined; var x74: u1 = undefined; subborrowxU64(&x73, &x74, 0x0, 0x0, x72); @@ -3371,7 +3370,8 @@ pub fn divstep(out1: *u64, out2: *[7]u64, out3: *[7]u64, out4: *[6]u64, out5: *[ var x84: u1 = undefined; subborrowxU64(&x83, &x84, x82, 0x0, x67); var x85: u64 = undefined; - cmovznzU64(&x85, x84, 0x0, 0xffffffffffffffff); + const x85_selection_mask = selectionMaskU64(x84); + x85 = 0x0 ^ ((0x0 ^ 0xffffffffffffffff) & x85_selection_mask); var x86: u64 = undefined; var x87: u1 = undefined; addcarryxU64(&x86, &x87, 0x0, x73, (x85 & 0xffffffff)); @@ -3391,32 +3391,34 @@ pub fn divstep(out1: *u64, out2: *[7]u64, out3: *[7]u64, out4: *[6]u64, out5: *[ var x97: u1 = undefined; addcarryxU64(&x96, &x97, x95, x83, x85); var x98: u64 = undefined; - cmovznzU64(&x98, x3, (arg5[0]), x86); + const x98_selection_mask = selectionMaskU64(x3); + x98 = arg5[0] ^ ((arg5[0] ^ x86) & x98_selection_mask); var x99: u64 = undefined; - cmovznzU64(&x99, x3, (arg5[1]), x88); + x99 = arg5[1] ^ ((arg5[1] ^ x88) & x98_selection_mask); var x100: u64 = undefined; - cmovznzU64(&x100, x3, (arg5[2]), x90); + x100 = arg5[2] ^ ((arg5[2] ^ x90) & x98_selection_mask); var x101: u64 = undefined; - cmovznzU64(&x101, x3, (arg5[3]), x92); + x101 = arg5[3] ^ ((arg5[3] ^ x92) & x98_selection_mask); var x102: u64 = undefined; - cmovznzU64(&x102, x3, (arg5[4]), x94); + x102 = arg5[4] ^ ((arg5[4] ^ x94) & x98_selection_mask); var x103: u64 = undefined; - cmovznzU64(&x103, x3, (arg5[5]), x96); - const x104 = @as(u1, @truncate((x28 & 0x1))); + x103 = arg5[5] ^ ((arg5[5] ^ x96) & x98_selection_mask); + const x104: u1 = @truncate(x28); var x105: u64 = undefined; - cmovznzU64(&x105, x104, 0x0, x7); + const x105_selection_mask = selectionMaskU64(x104); + x105 = 0x0 ^ ((0x0 ^ x7) & x105_selection_mask); var x106: u64 = undefined; - cmovznzU64(&x106, x104, 0x0, x8); + x106 = 0x0 ^ ((0x0 ^ x8) & x105_selection_mask); var x107: u64 = undefined; - cmovznzU64(&x107, x104, 0x0, x9); + x107 = 0x0 ^ ((0x0 ^ x9) & x105_selection_mask); var x108: u64 = undefined; - cmovznzU64(&x108, x104, 0x0, x10); + x108 = 0x0 ^ ((0x0 ^ x10) & x105_selection_mask); var x109: u64 = undefined; - cmovznzU64(&x109, x104, 0x0, x11); + x109 = 0x0 ^ ((0x0 ^ x11) & x105_selection_mask); var x110: u64 = undefined; - cmovznzU64(&x110, x104, 0x0, x12); + x110 = 0x0 ^ ((0x0 ^ x12) & x105_selection_mask); var x111: u64 = undefined; - cmovznzU64(&x111, x104, 0x0, x13); + x111 = 0x0 ^ ((0x0 ^ x13) & x105_selection_mask); var x112: u64 = undefined; var x113: u1 = undefined; addcarryxU64(&x112, &x113, 0x0, x28, x105); @@ -3439,17 +3441,18 @@ pub fn divstep(out1: *u64, out2: *[7]u64, out3: *[7]u64, out4: *[6]u64, out5: *[ var x125: u1 = undefined; addcarryxU64(&x124, &x125, x123, x34, x111); var x126: u64 = undefined; - cmovznzU64(&x126, x104, 0x0, x35); + const x126_selection_mask = selectionMaskU64(x104); + x126 = 0x0 ^ ((0x0 ^ x35) & x126_selection_mask); var x127: u64 = undefined; - cmovznzU64(&x127, x104, 0x0, x36); + x127 = 0x0 ^ ((0x0 ^ x36) & x126_selection_mask); var x128: u64 = undefined; - cmovznzU64(&x128, x104, 0x0, x37); + x128 = 0x0 ^ ((0x0 ^ x37) & x126_selection_mask); var x129: u64 = undefined; - cmovznzU64(&x129, x104, 0x0, x38); + x129 = 0x0 ^ ((0x0 ^ x38) & x126_selection_mask); var x130: u64 = undefined; - cmovznzU64(&x130, x104, 0x0, x39); + x130 = 0x0 ^ ((0x0 ^ x39) & x126_selection_mask); var x131: u64 = undefined; - cmovznzU64(&x131, x104, 0x0, x40); + x131 = 0x0 ^ ((0x0 ^ x40) & x126_selection_mask); var x132: u64 = undefined; var x133: u1 = undefined; addcarryxU64(&x132, &x133, 0x0, x98, x126); @@ -3488,41 +3491,43 @@ pub fn divstep(out1: *u64, out2: *[7]u64, out3: *[7]u64, out4: *[6]u64, out5: *[ subborrowxU64(&x154, &x155, x153, x142, 0xffffffffffffffff); var x156: u64 = undefined; var x157: u1 = undefined; - subborrowxU64(&x156, &x157, x155, @as(u64, x143), 0x0); + subborrowxU64(&x156, &x157, x155, x143, 0x0); var x158: u64 = undefined; var x159: u1 = undefined; addcarryxU64(&x158, &x159, 0x0, x6, 0x1); - const x160 = ((x112 >> 1) | ((x114 << 63) & 0xffffffffffffffff)); - const x161 = ((x114 >> 1) | ((x116 << 63) & 0xffffffffffffffff)); - const x162 = ((x116 >> 1) | ((x118 << 63) & 0xffffffffffffffff)); - const x163 = ((x118 >> 1) | ((x120 << 63) & 0xffffffffffffffff)); - const x164 = ((x120 >> 1) | ((x122 << 63) & 0xffffffffffffffff)); - const x165 = ((x122 >> 1) | ((x124 << 63) & 0xffffffffffffffff)); - const x166 = ((x124 & 0x8000000000000000) | (x124 >> 1)); + const x160: u64 = ((x112 >> 1) | ((x114 << 63) & 0xffffffffffffffff)); + const x161: u64 = ((x114 >> 1) | ((x116 << 63) & 0xffffffffffffffff)); + const x162: u64 = ((x116 >> 1) | ((x118 << 63) & 0xffffffffffffffff)); + const x163: u64 = ((x118 >> 1) | ((x120 << 63) & 0xffffffffffffffff)); + const x164: u64 = ((x120 >> 1) | ((x122 << 63) & 0xffffffffffffffff)); + const x165: u64 = ((x122 >> 1) | ((x124 << 63) & 0xffffffffffffffff)); + const x166: u64 = ((x124 & 0x8000000000000000) | (x124 >> 1)); var x167: u64 = undefined; - cmovznzU64(&x167, x66, x53, x41); + const x167_selection_mask = selectionMaskU64(x66); + x167 = x53 ^ ((x53 ^ x41) & x167_selection_mask); var x168: u64 = undefined; - cmovznzU64(&x168, x66, x55, x43); + x168 = x55 ^ ((x55 ^ x43) & x167_selection_mask); var x169: u64 = undefined; - cmovznzU64(&x169, x66, x57, x45); + x169 = x57 ^ ((x57 ^ x45) & x167_selection_mask); var x170: u64 = undefined; - cmovznzU64(&x170, x66, x59, x47); + x170 = x59 ^ ((x59 ^ x47) & x167_selection_mask); var x171: u64 = undefined; - cmovznzU64(&x171, x66, x61, x49); + x171 = x61 ^ ((x61 ^ x49) & x167_selection_mask); var x172: u64 = undefined; - cmovznzU64(&x172, x66, x63, x51); + x172 = x63 ^ ((x63 ^ x51) & x167_selection_mask); var x173: u64 = undefined; - cmovznzU64(&x173, x157, x144, x132); + const x173_selection_mask = selectionMaskU64(x157); + x173 = x144 ^ ((x144 ^ x132) & x173_selection_mask); var x174: u64 = undefined; - cmovznzU64(&x174, x157, x146, x134); + x174 = x146 ^ ((x146 ^ x134) & x173_selection_mask); var x175: u64 = undefined; - cmovznzU64(&x175, x157, x148, x136); + x175 = x148 ^ ((x148 ^ x136) & x173_selection_mask); var x176: u64 = undefined; - cmovznzU64(&x176, x157, x150, x138); + x176 = x150 ^ ((x150 ^ x138) & x173_selection_mask); var x177: u64 = undefined; - cmovznzU64(&x177, x157, x152, x140); + x177 = x152 ^ ((x152 ^ x140) & x173_selection_mask); var x178: u64 = undefined; - cmovznzU64(&x178, x157, x154, x142); + x178 = x154 ^ ((x154 ^ x142) & x173_selection_mask); out1.* = x158; out2[0] = x7; out2[1] = x8; diff --git a/lib/std/crypto/pcurves/p384/p384_scalar_64.zig b/lib/std/crypto/pcurves/p384/p384_scalar_64.zig index 0b618e615442dfccd128b264029302205c286ecd..893144c357b919b510aac1c38faac4f2ab2dfaff 100644 --- a/lib/std/crypto/pcurves/p384/p384_scalar_64.zig +++ b/lib/std/crypto/pcurves/p384/p384_scalar_64.zig @@ -17,7 +17,6 @@ // twos_complement_eval z = let x1 := z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) + (z[4] << 256) + (z[5] << 0x140) in // if x1 & (2^384-1) < 2^383 then x1 & (2^384-1) else (x1 & (2^384-1)) - 2^384 -const std = @import("std"); const mode = @import("builtin").mode; // Checked arithmetic is disabled in non-debug modes to avoid side channels // The type MontgomeryDomainFieldElement is a field element in the Montgomery domain. @@ -28,80 +27,70 @@ pub const MontgomeryDomainFieldElement = [6]u64; // Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] pub const NonMontgomeryDomainFieldElement = [6]u64; -/// The function addcarryxU64 is an addition with carry. -/// -/// Postconditions: -/// out1 = (arg1 + arg2 + arg3) mod 2^64 -/// out2 = ⌊(arg1 + arg2 + arg3) / 2^64⌋ -/// -/// Input Bounds: -/// arg1: [0x0 ~> 0x1] -/// arg2: [0x0 ~> 0xffffffffffffffff] -/// arg3: [0x0 ~> 0xffffffffffffffff] -/// Output Bounds: -/// out1: [0x0 ~> 0xffffffffffffffff] -/// out2: [0x0 ~> 0x1] +/// Add two limbs and a carry bit, returning the sum modulo 2^64 and the carry bit. fn addcarryxU64(out1: *u64, out2: *u1, arg1: u1, arg2: u64, arg3: u64) void { - const x = @as(u128, arg2) +% arg3 +% arg1; - out1.* = @truncate(x); - out2.* = @truncate(x >> 64); + @setRuntimeSafety(mode == .debug); + + const x = @addWithOverflow(arg2, arg3); + const y = @addWithOverflow(x[0], arg1); + out1.* = y[0]; + out2.* = x[1] | y[1]; } -/// The function subborrowxU64 is a subtraction with borrow. -/// -/// Postconditions: -/// out1 = (-arg1 + arg2 + -arg3) mod 2^64 -/// out2 = -⌊(-arg1 + arg2 + -arg3) / 2^64⌋ -/// -/// Input Bounds: -/// arg1: [0x0 ~> 0x1] -/// arg2: [0x0 ~> 0xffffffffffffffff] -/// arg3: [0x0 ~> 0xffffffffffffffff] -/// Output Bounds: -/// out1: [0x0 ~> 0xffffffffffffffff] -/// out2: [0x0 ~> 0x1] +/// Subtract two limbs and a borrow bit, returning the difference modulo 2^64 and the borrow bit. fn subborrowxU64(out1: *u64, out2: *u1, arg1: u1, arg2: u64, arg3: u64) void { - const x = @as(u128, arg2) -% arg3 -% arg1; - out1.* = @truncate(x); - out2.* = @truncate(x >> 64); + @setRuntimeSafety(mode == .debug); + + const x = @subWithOverflow(arg2, arg3); + const y = @subWithOverflow(x[0], arg1); + out1.* = y[0]; + out2.* = x[1] | y[1]; } -/// The function mulxU64 is a multiplication, returning the full double-width result. -/// -/// Postconditions: -/// out1 = (arg1 * arg2) mod 2^64 -/// out2 = ⌊arg1 * arg2 / 2^64⌋ -/// -/// Input Bounds: -/// arg1: [0x0 ~> 0xffffffffffffffff] -/// arg2: [0x0 ~> 0xffffffffffffffff] -/// Output Bounds: -/// out1: [0x0 ~> 0xffffffffffffffff] -/// out2: [0x0 ~> 0xffffffffffffffff] +/// Multiply two limbs, returning the low and high halves of the product. fn mulxU64(out1: *u64, out2: *u64, arg1: u64, arg2: u64) void { @setRuntimeSafety(mode == .debug); - const x = @as(u128, arg1) * @as(u128, arg2); - out1.* = @as(u64, @truncate(x)); - out2.* = @as(u64, @truncate(x >> 64)); + const x = @as(u128, arg1) * arg2; + out1.* = @truncate(x); + out2.* = @intCast(x >> 64); } -/// The function cmovznzU64 is a single-word conditional move. -/// -/// Postconditions: -/// out1 = (if arg1 = 0 then arg2 else arg3) -/// -/// Input Bounds: -/// arg1: [0x0 ~> 0x1] -/// arg2: [0x0 ~> 0xffffffffffffffff] -/// arg3: [0x0 ~> 0xffffffffffffffff] -/// Output Bounds: -/// out1: [0x0 ~> 0xffffffffffffffff] +/// Keep selection masks opaque to the optimizer without adding instructions. +fn selectionMaskU64(arg1: u1) u64 { + @setRuntimeSafety(mode == .debug); + + const value: u64 = 0 -% @as(u64, arg1); + if (@inComptime()) return value; + switch (@import("builtin").zig_backend) { + .stage2_c, .stage2_wasm => return value, + else => {}, + } + if (@bitSizeOf(u64) <= @bitSizeOf(usize)) { + return asm ("" + : [mask] "=r" (-> u64), + : [value] "0" (value), + ); + } + var mask: u64 = 0; + inline for (0..@divExact(@bitSizeOf(u64), @bitSizeOf(usize))) |i| { + const shift = i * @bitSizeOf(usize); + const chunk: usize = @truncate(value >> shift); + const part = asm ("" + : [mask] "=r" (-> usize), + : [value] "0" (chunk), + ); + mask |= @as(u64, part) << shift; + } + return mask; +} + +/// Select arg2 when arg1 is zero and arg3 otherwise, using a bit mask. fn cmovznzU64(out1: *u64, arg1: u1, arg2: u64, arg3: u64) void { @setRuntimeSafety(mode == .debug); - const mask = 0 -% @as(u64, arg1); - out1.* = (mask & arg3) | ((~mask) & arg2); + const mask = selectionMaskU64(arg1); + out1.* = arg2 ^ ((arg2 ^ arg3) & mask); } /// The function mul multiplies two field elements in the Montgomery domain. @@ -116,30 +105,30 @@ fn cmovznzU64(out1: *u64, arg1: u1, arg2: u64, arg3: u64) void { pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldElement, arg2: MontgomeryDomainFieldElement) void { @setRuntimeSafety(mode == .debug); - const x1 = (arg1[1]); - const x2 = (arg1[2]); - const x3 = (arg1[3]); - const x4 = (arg1[4]); - const x5 = (arg1[5]); - const x6 = (arg1[0]); + const x1: u64 = arg1[1]; + const x2: u64 = arg1[2]; + const x3: u64 = arg1[3]; + const x4: u64 = arg1[4]; + const x5: u64 = arg1[5]; + const x6: u64 = arg1[0]; var x7: u64 = undefined; var x8: u64 = undefined; - mulxU64(&x7, &x8, x6, (arg2[5])); + mulxU64(&x7, &x8, x6, arg2[5]); var x9: u64 = undefined; var x10: u64 = undefined; - mulxU64(&x9, &x10, x6, (arg2[4])); + mulxU64(&x9, &x10, x6, arg2[4]); var x11: u64 = undefined; var x12: u64 = undefined; - mulxU64(&x11, &x12, x6, (arg2[3])); + mulxU64(&x11, &x12, x6, arg2[3]); var x13: u64 = undefined; var x14: u64 = undefined; - mulxU64(&x13, &x14, x6, (arg2[2])); + mulxU64(&x13, &x14, x6, arg2[2]); var x15: u64 = undefined; var x16: u64 = undefined; - mulxU64(&x15, &x16, x6, (arg2[1])); + mulxU64(&x15, &x16, x6, arg2[1]); var x17: u64 = undefined; var x18: u64 = undefined; - mulxU64(&x17, &x18, x6, (arg2[0])); + mulxU64(&x17, &x18, x6, arg2[0]); var x19: u64 = undefined; var x20: u1 = undefined; addcarryxU64(&x19, &x20, 0x0, x18, x15); @@ -155,7 +144,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x27: u64 = undefined; var x28: u1 = undefined; addcarryxU64(&x27, &x28, x26, x10, x7); - const x29 = (@as(u64, x28) + x8); + const x29: u64 = (x28 + x8); var x30: u64 = undefined; var x31: u64 = undefined; mulxU64(&x30, &x31, x17, 0x6ed46089e88fdc45); @@ -192,7 +181,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x52: u64 = undefined; var x53: u1 = undefined; addcarryxU64(&x52, &x53, x51, x35, x32); - const x54 = (@as(u64, x53) + x33); + const x54: u64 = (x53 + x33); var x55: u64 = undefined; var x56: u1 = undefined; addcarryxU64(&x55, &x56, 0x0, x17, x42); @@ -216,22 +205,22 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme addcarryxU64(&x67, &x68, x66, x29, x54); var x69: u64 = undefined; var x70: u64 = undefined; - mulxU64(&x69, &x70, x1, (arg2[5])); + mulxU64(&x69, &x70, x1, arg2[5]); var x71: u64 = undefined; var x72: u64 = undefined; - mulxU64(&x71, &x72, x1, (arg2[4])); + mulxU64(&x71, &x72, x1, arg2[4]); var x73: u64 = undefined; var x74: u64 = undefined; - mulxU64(&x73, &x74, x1, (arg2[3])); + mulxU64(&x73, &x74, x1, arg2[3]); var x75: u64 = undefined; var x76: u64 = undefined; - mulxU64(&x75, &x76, x1, (arg2[2])); + mulxU64(&x75, &x76, x1, arg2[2]); var x77: u64 = undefined; var x78: u64 = undefined; - mulxU64(&x77, &x78, x1, (arg2[1])); + mulxU64(&x77, &x78, x1, arg2[1]); var x79: u64 = undefined; var x80: u64 = undefined; - mulxU64(&x79, &x80, x1, (arg2[0])); + mulxU64(&x79, &x80, x1, arg2[0]); var x81: u64 = undefined; var x82: u1 = undefined; addcarryxU64(&x81, &x82, 0x0, x80, x77); @@ -247,7 +236,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x89: u64 = undefined; var x90: u1 = undefined; addcarryxU64(&x89, &x90, x88, x72, x69); - const x91 = (@as(u64, x90) + x70); + const x91: u64 = (x90 + x70); var x92: u64 = undefined; var x93: u1 = undefined; addcarryxU64(&x92, &x93, 0x0, x57, x79); @@ -268,7 +257,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme addcarryxU64(&x102, &x103, x101, x67, x89); var x104: u64 = undefined; var x105: u1 = undefined; - addcarryxU64(&x104, &x105, x103, @as(u64, x68), x91); + addcarryxU64(&x104, &x105, x103, x68, x91); var x106: u64 = undefined; var x107: u64 = undefined; mulxU64(&x106, &x107, x92, 0x6ed46089e88fdc45); @@ -305,7 +294,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x128: u64 = undefined; var x129: u1 = undefined; addcarryxU64(&x128, &x129, x127, x111, x108); - const x130 = (@as(u64, x129) + x109); + const x130: u64 = (x129 + x109); var x131: u64 = undefined; var x132: u1 = undefined; addcarryxU64(&x131, &x132, 0x0, x92, x118); @@ -327,25 +316,25 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x143: u64 = undefined; var x144: u1 = undefined; addcarryxU64(&x143, &x144, x142, x104, x130); - const x145 = (@as(u64, x144) + @as(u64, x105)); + const x145: u64 = (@as(u64, x144) + x105); var x146: u64 = undefined; var x147: u64 = undefined; - mulxU64(&x146, &x147, x2, (arg2[5])); + mulxU64(&x146, &x147, x2, arg2[5]); var x148: u64 = undefined; var x149: u64 = undefined; - mulxU64(&x148, &x149, x2, (arg2[4])); + mulxU64(&x148, &x149, x2, arg2[4]); var x150: u64 = undefined; var x151: u64 = undefined; - mulxU64(&x150, &x151, x2, (arg2[3])); + mulxU64(&x150, &x151, x2, arg2[3]); var x152: u64 = undefined; var x153: u64 = undefined; - mulxU64(&x152, &x153, x2, (arg2[2])); + mulxU64(&x152, &x153, x2, arg2[2]); var x154: u64 = undefined; var x155: u64 = undefined; - mulxU64(&x154, &x155, x2, (arg2[1])); + mulxU64(&x154, &x155, x2, arg2[1]); var x156: u64 = undefined; var x157: u64 = undefined; - mulxU64(&x156, &x157, x2, (arg2[0])); + mulxU64(&x156, &x157, x2, arg2[0]); var x158: u64 = undefined; var x159: u1 = undefined; addcarryxU64(&x158, &x159, 0x0, x157, x154); @@ -361,7 +350,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x166: u64 = undefined; var x167: u1 = undefined; addcarryxU64(&x166, &x167, x165, x149, x146); - const x168 = (@as(u64, x167) + x147); + const x168: u64 = (x167 + x147); var x169: u64 = undefined; var x170: u1 = undefined; addcarryxU64(&x169, &x170, 0x0, x133, x156); @@ -419,7 +408,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x205: u64 = undefined; var x206: u1 = undefined; addcarryxU64(&x205, &x206, x204, x188, x185); - const x207 = (@as(u64, x206) + x186); + const x207: u64 = (x206 + x186); var x208: u64 = undefined; var x209: u1 = undefined; addcarryxU64(&x208, &x209, 0x0, x169, x195); @@ -441,25 +430,25 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x220: u64 = undefined; var x221: u1 = undefined; addcarryxU64(&x220, &x221, x219, x181, x207); - const x222 = (@as(u64, x221) + @as(u64, x182)); + const x222: u64 = (@as(u64, x221) + x182); var x223: u64 = undefined; var x224: u64 = undefined; - mulxU64(&x223, &x224, x3, (arg2[5])); + mulxU64(&x223, &x224, x3, arg2[5]); var x225: u64 = undefined; var x226: u64 = undefined; - mulxU64(&x225, &x226, x3, (arg2[4])); + mulxU64(&x225, &x226, x3, arg2[4]); var x227: u64 = undefined; var x228: u64 = undefined; - mulxU64(&x227, &x228, x3, (arg2[3])); + mulxU64(&x227, &x228, x3, arg2[3]); var x229: u64 = undefined; var x230: u64 = undefined; - mulxU64(&x229, &x230, x3, (arg2[2])); + mulxU64(&x229, &x230, x3, arg2[2]); var x231: u64 = undefined; var x232: u64 = undefined; - mulxU64(&x231, &x232, x3, (arg2[1])); + mulxU64(&x231, &x232, x3, arg2[1]); var x233: u64 = undefined; var x234: u64 = undefined; - mulxU64(&x233, &x234, x3, (arg2[0])); + mulxU64(&x233, &x234, x3, arg2[0]); var x235: u64 = undefined; var x236: u1 = undefined; addcarryxU64(&x235, &x236, 0x0, x234, x231); @@ -475,7 +464,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x243: u64 = undefined; var x244: u1 = undefined; addcarryxU64(&x243, &x244, x242, x226, x223); - const x245 = (@as(u64, x244) + x224); + const x245: u64 = (x244 + x224); var x246: u64 = undefined; var x247: u1 = undefined; addcarryxU64(&x246, &x247, 0x0, x210, x233); @@ -533,7 +522,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x282: u64 = undefined; var x283: u1 = undefined; addcarryxU64(&x282, &x283, x281, x265, x262); - const x284 = (@as(u64, x283) + x263); + const x284: u64 = (x283 + x263); var x285: u64 = undefined; var x286: u1 = undefined; addcarryxU64(&x285, &x286, 0x0, x246, x272); @@ -555,25 +544,25 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x297: u64 = undefined; var x298: u1 = undefined; addcarryxU64(&x297, &x298, x296, x258, x284); - const x299 = (@as(u64, x298) + @as(u64, x259)); + const x299: u64 = (@as(u64, x298) + x259); var x300: u64 = undefined; var x301: u64 = undefined; - mulxU64(&x300, &x301, x4, (arg2[5])); + mulxU64(&x300, &x301, x4, arg2[5]); var x302: u64 = undefined; var x303: u64 = undefined; - mulxU64(&x302, &x303, x4, (arg2[4])); + mulxU64(&x302, &x303, x4, arg2[4]); var x304: u64 = undefined; var x305: u64 = undefined; - mulxU64(&x304, &x305, x4, (arg2[3])); + mulxU64(&x304, &x305, x4, arg2[3]); var x306: u64 = undefined; var x307: u64 = undefined; - mulxU64(&x306, &x307, x4, (arg2[2])); + mulxU64(&x306, &x307, x4, arg2[2]); var x308: u64 = undefined; var x309: u64 = undefined; - mulxU64(&x308, &x309, x4, (arg2[1])); + mulxU64(&x308, &x309, x4, arg2[1]); var x310: u64 = undefined; var x311: u64 = undefined; - mulxU64(&x310, &x311, x4, (arg2[0])); + mulxU64(&x310, &x311, x4, arg2[0]); var x312: u64 = undefined; var x313: u1 = undefined; addcarryxU64(&x312, &x313, 0x0, x311, x308); @@ -589,7 +578,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x320: u64 = undefined; var x321: u1 = undefined; addcarryxU64(&x320, &x321, x319, x303, x300); - const x322 = (@as(u64, x321) + x301); + const x322: u64 = (x321 + x301); var x323: u64 = undefined; var x324: u1 = undefined; addcarryxU64(&x323, &x324, 0x0, x287, x310); @@ -647,7 +636,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x359: u64 = undefined; var x360: u1 = undefined; addcarryxU64(&x359, &x360, x358, x342, x339); - const x361 = (@as(u64, x360) + x340); + const x361: u64 = (x360 + x340); var x362: u64 = undefined; var x363: u1 = undefined; addcarryxU64(&x362, &x363, 0x0, x323, x349); @@ -669,25 +658,25 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x374: u64 = undefined; var x375: u1 = undefined; addcarryxU64(&x374, &x375, x373, x335, x361); - const x376 = (@as(u64, x375) + @as(u64, x336)); + const x376: u64 = (@as(u64, x375) + x336); var x377: u64 = undefined; var x378: u64 = undefined; - mulxU64(&x377, &x378, x5, (arg2[5])); + mulxU64(&x377, &x378, x5, arg2[5]); var x379: u64 = undefined; var x380: u64 = undefined; - mulxU64(&x379, &x380, x5, (arg2[4])); + mulxU64(&x379, &x380, x5, arg2[4]); var x381: u64 = undefined; var x382: u64 = undefined; - mulxU64(&x381, &x382, x5, (arg2[3])); + mulxU64(&x381, &x382, x5, arg2[3]); var x383: u64 = undefined; var x384: u64 = undefined; - mulxU64(&x383, &x384, x5, (arg2[2])); + mulxU64(&x383, &x384, x5, arg2[2]); var x385: u64 = undefined; var x386: u64 = undefined; - mulxU64(&x385, &x386, x5, (arg2[1])); + mulxU64(&x385, &x386, x5, arg2[1]); var x387: u64 = undefined; var x388: u64 = undefined; - mulxU64(&x387, &x388, x5, (arg2[0])); + mulxU64(&x387, &x388, x5, arg2[0]); var x389: u64 = undefined; var x390: u1 = undefined; addcarryxU64(&x389, &x390, 0x0, x388, x385); @@ -703,7 +692,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x397: u64 = undefined; var x398: u1 = undefined; addcarryxU64(&x397, &x398, x396, x380, x377); - const x399 = (@as(u64, x398) + x378); + const x399: u64 = (x398 + x378); var x400: u64 = undefined; var x401: u1 = undefined; addcarryxU64(&x400, &x401, 0x0, x364, x387); @@ -761,7 +750,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x436: u64 = undefined; var x437: u1 = undefined; addcarryxU64(&x436, &x437, x435, x419, x416); - const x438 = (@as(u64, x437) + x417); + const x438: u64 = (x437 + x417); var x439: u64 = undefined; var x440: u1 = undefined; addcarryxU64(&x439, &x440, 0x0, x400, x426); @@ -783,7 +772,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x451: u64 = undefined; var x452: u1 = undefined; addcarryxU64(&x451, &x452, x450, x412, x438); - const x453 = (@as(u64, x452) + @as(u64, x413)); + const x453: u64 = (@as(u64, x452) + x413); var x454: u64 = undefined; var x455: u1 = undefined; subborrowxU64(&x454, &x455, 0x0, x441, 0xecec196accc52973); @@ -806,17 +795,18 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x467: u1 = undefined; subborrowxU64(&x466, &x467, x465, x453, 0x0); var x468: u64 = undefined; - cmovznzU64(&x468, x467, x454, x441); + const x468_selection_mask = selectionMaskU64(x467); + x468 = x454 ^ ((x454 ^ x441) & x468_selection_mask); var x469: u64 = undefined; - cmovznzU64(&x469, x467, x456, x443); + x469 = x456 ^ ((x456 ^ x443) & x468_selection_mask); var x470: u64 = undefined; - cmovznzU64(&x470, x467, x458, x445); + x470 = x458 ^ ((x458 ^ x445) & x468_selection_mask); var x471: u64 = undefined; - cmovznzU64(&x471, x467, x460, x447); + x471 = x460 ^ ((x460 ^ x447) & x468_selection_mask); var x472: u64 = undefined; - cmovznzU64(&x472, x467, x462, x449); + x472 = x462 ^ ((x462 ^ x449) & x468_selection_mask); var x473: u64 = undefined; - cmovznzU64(&x473, x467, x464, x451); + x473 = x464 ^ ((x464 ^ x451) & x468_selection_mask); out1[0] = x468; out1[1] = x469; out1[2] = x470; @@ -836,30 +826,30 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldElement) void { @setRuntimeSafety(mode == .debug); - const x1 = (arg1[1]); - const x2 = (arg1[2]); - const x3 = (arg1[3]); - const x4 = (arg1[4]); - const x5 = (arg1[5]); - const x6 = (arg1[0]); + const x1: u64 = arg1[1]; + const x2: u64 = arg1[2]; + const x3: u64 = arg1[3]; + const x4: u64 = arg1[4]; + const x5: u64 = arg1[5]; + const x6: u64 = arg1[0]; var x7: u64 = undefined; var x8: u64 = undefined; - mulxU64(&x7, &x8, x6, (arg1[5])); + mulxU64(&x7, &x8, x6, arg1[5]); var x9: u64 = undefined; var x10: u64 = undefined; - mulxU64(&x9, &x10, x6, (arg1[4])); + mulxU64(&x9, &x10, x6, arg1[4]); var x11: u64 = undefined; var x12: u64 = undefined; - mulxU64(&x11, &x12, x6, (arg1[3])); + mulxU64(&x11, &x12, x6, arg1[3]); var x13: u64 = undefined; var x14: u64 = undefined; - mulxU64(&x13, &x14, x6, (arg1[2])); + mulxU64(&x13, &x14, x6, arg1[2]); var x15: u64 = undefined; var x16: u64 = undefined; - mulxU64(&x15, &x16, x6, (arg1[1])); + mulxU64(&x15, &x16, x6, arg1[1]); var x17: u64 = undefined; var x18: u64 = undefined; - mulxU64(&x17, &x18, x6, (arg1[0])); + mulxU64(&x17, &x18, x6, arg1[0]); var x19: u64 = undefined; var x20: u1 = undefined; addcarryxU64(&x19, &x20, 0x0, x18, x15); @@ -875,7 +865,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x27: u64 = undefined; var x28: u1 = undefined; addcarryxU64(&x27, &x28, x26, x10, x7); - const x29 = (@as(u64, x28) + x8); + const x29: u64 = (x28 + x8); var x30: u64 = undefined; var x31: u64 = undefined; mulxU64(&x30, &x31, x17, 0x6ed46089e88fdc45); @@ -912,7 +902,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x52: u64 = undefined; var x53: u1 = undefined; addcarryxU64(&x52, &x53, x51, x35, x32); - const x54 = (@as(u64, x53) + x33); + const x54: u64 = (x53 + x33); var x55: u64 = undefined; var x56: u1 = undefined; addcarryxU64(&x55, &x56, 0x0, x17, x42); @@ -936,22 +926,22 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl addcarryxU64(&x67, &x68, x66, x29, x54); var x69: u64 = undefined; var x70: u64 = undefined; - mulxU64(&x69, &x70, x1, (arg1[5])); + mulxU64(&x69, &x70, x1, arg1[5]); var x71: u64 = undefined; var x72: u64 = undefined; - mulxU64(&x71, &x72, x1, (arg1[4])); + mulxU64(&x71, &x72, x1, arg1[4]); var x73: u64 = undefined; var x74: u64 = undefined; - mulxU64(&x73, &x74, x1, (arg1[3])); + mulxU64(&x73, &x74, x1, arg1[3]); var x75: u64 = undefined; var x76: u64 = undefined; - mulxU64(&x75, &x76, x1, (arg1[2])); + mulxU64(&x75, &x76, x1, arg1[2]); var x77: u64 = undefined; var x78: u64 = undefined; - mulxU64(&x77, &x78, x1, (arg1[1])); + mulxU64(&x77, &x78, x1, arg1[1]); var x79: u64 = undefined; var x80: u64 = undefined; - mulxU64(&x79, &x80, x1, (arg1[0])); + mulxU64(&x79, &x80, x1, arg1[0]); var x81: u64 = undefined; var x82: u1 = undefined; addcarryxU64(&x81, &x82, 0x0, x80, x77); @@ -967,7 +957,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x89: u64 = undefined; var x90: u1 = undefined; addcarryxU64(&x89, &x90, x88, x72, x69); - const x91 = (@as(u64, x90) + x70); + const x91: u64 = (x90 + x70); var x92: u64 = undefined; var x93: u1 = undefined; addcarryxU64(&x92, &x93, 0x0, x57, x79); @@ -988,7 +978,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl addcarryxU64(&x102, &x103, x101, x67, x89); var x104: u64 = undefined; var x105: u1 = undefined; - addcarryxU64(&x104, &x105, x103, @as(u64, x68), x91); + addcarryxU64(&x104, &x105, x103, x68, x91); var x106: u64 = undefined; var x107: u64 = undefined; mulxU64(&x106, &x107, x92, 0x6ed46089e88fdc45); @@ -1025,7 +1015,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x128: u64 = undefined; var x129: u1 = undefined; addcarryxU64(&x128, &x129, x127, x111, x108); - const x130 = (@as(u64, x129) + x109); + const x130: u64 = (x129 + x109); var x131: u64 = undefined; var x132: u1 = undefined; addcarryxU64(&x131, &x132, 0x0, x92, x118); @@ -1047,25 +1037,25 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x143: u64 = undefined; var x144: u1 = undefined; addcarryxU64(&x143, &x144, x142, x104, x130); - const x145 = (@as(u64, x144) + @as(u64, x105)); + const x145: u64 = (@as(u64, x144) + x105); var x146: u64 = undefined; var x147: u64 = undefined; - mulxU64(&x146, &x147, x2, (arg1[5])); + mulxU64(&x146, &x147, x2, arg1[5]); var x148: u64 = undefined; var x149: u64 = undefined; - mulxU64(&x148, &x149, x2, (arg1[4])); + mulxU64(&x148, &x149, x2, arg1[4]); var x150: u64 = undefined; var x151: u64 = undefined; - mulxU64(&x150, &x151, x2, (arg1[3])); + mulxU64(&x150, &x151, x2, arg1[3]); var x152: u64 = undefined; var x153: u64 = undefined; - mulxU64(&x152, &x153, x2, (arg1[2])); + mulxU64(&x152, &x153, x2, arg1[2]); var x154: u64 = undefined; var x155: u64 = undefined; - mulxU64(&x154, &x155, x2, (arg1[1])); + mulxU64(&x154, &x155, x2, arg1[1]); var x156: u64 = undefined; var x157: u64 = undefined; - mulxU64(&x156, &x157, x2, (arg1[0])); + mulxU64(&x156, &x157, x2, arg1[0]); var x158: u64 = undefined; var x159: u1 = undefined; addcarryxU64(&x158, &x159, 0x0, x157, x154); @@ -1081,7 +1071,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x166: u64 = undefined; var x167: u1 = undefined; addcarryxU64(&x166, &x167, x165, x149, x146); - const x168 = (@as(u64, x167) + x147); + const x168: u64 = (x167 + x147); var x169: u64 = undefined; var x170: u1 = undefined; addcarryxU64(&x169, &x170, 0x0, x133, x156); @@ -1139,7 +1129,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x205: u64 = undefined; var x206: u1 = undefined; addcarryxU64(&x205, &x206, x204, x188, x185); - const x207 = (@as(u64, x206) + x186); + const x207: u64 = (x206 + x186); var x208: u64 = undefined; var x209: u1 = undefined; addcarryxU64(&x208, &x209, 0x0, x169, x195); @@ -1161,25 +1151,25 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x220: u64 = undefined; var x221: u1 = undefined; addcarryxU64(&x220, &x221, x219, x181, x207); - const x222 = (@as(u64, x221) + @as(u64, x182)); + const x222: u64 = (@as(u64, x221) + x182); var x223: u64 = undefined; var x224: u64 = undefined; - mulxU64(&x223, &x224, x3, (arg1[5])); + mulxU64(&x223, &x224, x3, arg1[5]); var x225: u64 = undefined; var x226: u64 = undefined; - mulxU64(&x225, &x226, x3, (arg1[4])); + mulxU64(&x225, &x226, x3, arg1[4]); var x227: u64 = undefined; var x228: u64 = undefined; - mulxU64(&x227, &x228, x3, (arg1[3])); + mulxU64(&x227, &x228, x3, arg1[3]); var x229: u64 = undefined; var x230: u64 = undefined; - mulxU64(&x229, &x230, x3, (arg1[2])); + mulxU64(&x229, &x230, x3, arg1[2]); var x231: u64 = undefined; var x232: u64 = undefined; - mulxU64(&x231, &x232, x3, (arg1[1])); + mulxU64(&x231, &x232, x3, arg1[1]); var x233: u64 = undefined; var x234: u64 = undefined; - mulxU64(&x233, &x234, x3, (arg1[0])); + mulxU64(&x233, &x234, x3, arg1[0]); var x235: u64 = undefined; var x236: u1 = undefined; addcarryxU64(&x235, &x236, 0x0, x234, x231); @@ -1195,7 +1185,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x243: u64 = undefined; var x244: u1 = undefined; addcarryxU64(&x243, &x244, x242, x226, x223); - const x245 = (@as(u64, x244) + x224); + const x245: u64 = (x244 + x224); var x246: u64 = undefined; var x247: u1 = undefined; addcarryxU64(&x246, &x247, 0x0, x210, x233); @@ -1253,7 +1243,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x282: u64 = undefined; var x283: u1 = undefined; addcarryxU64(&x282, &x283, x281, x265, x262); - const x284 = (@as(u64, x283) + x263); + const x284: u64 = (x283 + x263); var x285: u64 = undefined; var x286: u1 = undefined; addcarryxU64(&x285, &x286, 0x0, x246, x272); @@ -1275,25 +1265,25 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x297: u64 = undefined; var x298: u1 = undefined; addcarryxU64(&x297, &x298, x296, x258, x284); - const x299 = (@as(u64, x298) + @as(u64, x259)); + const x299: u64 = (@as(u64, x298) + x259); var x300: u64 = undefined; var x301: u64 = undefined; - mulxU64(&x300, &x301, x4, (arg1[5])); + mulxU64(&x300, &x301, x4, arg1[5]); var x302: u64 = undefined; var x303: u64 = undefined; - mulxU64(&x302, &x303, x4, (arg1[4])); + mulxU64(&x302, &x303, x4, arg1[4]); var x304: u64 = undefined; var x305: u64 = undefined; - mulxU64(&x304, &x305, x4, (arg1[3])); + mulxU64(&x304, &x305, x4, arg1[3]); var x306: u64 = undefined; var x307: u64 = undefined; - mulxU64(&x306, &x307, x4, (arg1[2])); + mulxU64(&x306, &x307, x4, arg1[2]); var x308: u64 = undefined; var x309: u64 = undefined; - mulxU64(&x308, &x309, x4, (arg1[1])); + mulxU64(&x308, &x309, x4, arg1[1]); var x310: u64 = undefined; var x311: u64 = undefined; - mulxU64(&x310, &x311, x4, (arg1[0])); + mulxU64(&x310, &x311, x4, arg1[0]); var x312: u64 = undefined; var x313: u1 = undefined; addcarryxU64(&x312, &x313, 0x0, x311, x308); @@ -1309,7 +1299,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x320: u64 = undefined; var x321: u1 = undefined; addcarryxU64(&x320, &x321, x319, x303, x300); - const x322 = (@as(u64, x321) + x301); + const x322: u64 = (x321 + x301); var x323: u64 = undefined; var x324: u1 = undefined; addcarryxU64(&x323, &x324, 0x0, x287, x310); @@ -1367,7 +1357,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x359: u64 = undefined; var x360: u1 = undefined; addcarryxU64(&x359, &x360, x358, x342, x339); - const x361 = (@as(u64, x360) + x340); + const x361: u64 = (x360 + x340); var x362: u64 = undefined; var x363: u1 = undefined; addcarryxU64(&x362, &x363, 0x0, x323, x349); @@ -1389,25 +1379,25 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x374: u64 = undefined; var x375: u1 = undefined; addcarryxU64(&x374, &x375, x373, x335, x361); - const x376 = (@as(u64, x375) + @as(u64, x336)); + const x376: u64 = (@as(u64, x375) + x336); var x377: u64 = undefined; var x378: u64 = undefined; - mulxU64(&x377, &x378, x5, (arg1[5])); + mulxU64(&x377, &x378, x5, arg1[5]); var x379: u64 = undefined; var x380: u64 = undefined; - mulxU64(&x379, &x380, x5, (arg1[4])); + mulxU64(&x379, &x380, x5, arg1[4]); var x381: u64 = undefined; var x382: u64 = undefined; - mulxU64(&x381, &x382, x5, (arg1[3])); + mulxU64(&x381, &x382, x5, arg1[3]); var x383: u64 = undefined; var x384: u64 = undefined; - mulxU64(&x383, &x384, x5, (arg1[2])); + mulxU64(&x383, &x384, x5, arg1[2]); var x385: u64 = undefined; var x386: u64 = undefined; - mulxU64(&x385, &x386, x5, (arg1[1])); + mulxU64(&x385, &x386, x5, arg1[1]); var x387: u64 = undefined; var x388: u64 = undefined; - mulxU64(&x387, &x388, x5, (arg1[0])); + mulxU64(&x387, &x388, x5, arg1[0]); var x389: u64 = undefined; var x390: u1 = undefined; addcarryxU64(&x389, &x390, 0x0, x388, x385); @@ -1423,7 +1413,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x397: u64 = undefined; var x398: u1 = undefined; addcarryxU64(&x397, &x398, x396, x380, x377); - const x399 = (@as(u64, x398) + x378); + const x399: u64 = (x398 + x378); var x400: u64 = undefined; var x401: u1 = undefined; addcarryxU64(&x400, &x401, 0x0, x364, x387); @@ -1481,7 +1471,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x436: u64 = undefined; var x437: u1 = undefined; addcarryxU64(&x436, &x437, x435, x419, x416); - const x438 = (@as(u64, x437) + x417); + const x438: u64 = (x437 + x417); var x439: u64 = undefined; var x440: u1 = undefined; addcarryxU64(&x439, &x440, 0x0, x400, x426); @@ -1503,7 +1493,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x451: u64 = undefined; var x452: u1 = undefined; addcarryxU64(&x451, &x452, x450, x412, x438); - const x453 = (@as(u64, x452) + @as(u64, x413)); + const x453: u64 = (@as(u64, x452) + x413); var x454: u64 = undefined; var x455: u1 = undefined; subborrowxU64(&x454, &x455, 0x0, x441, 0xecec196accc52973); @@ -1526,17 +1516,18 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x467: u1 = undefined; subborrowxU64(&x466, &x467, x465, x453, 0x0); var x468: u64 = undefined; - cmovznzU64(&x468, x467, x454, x441); + const x468_selection_mask = selectionMaskU64(x467); + x468 = x454 ^ ((x454 ^ x441) & x468_selection_mask); var x469: u64 = undefined; - cmovznzU64(&x469, x467, x456, x443); + x469 = x456 ^ ((x456 ^ x443) & x468_selection_mask); var x470: u64 = undefined; - cmovznzU64(&x470, x467, x458, x445); + x470 = x458 ^ ((x458 ^ x445) & x468_selection_mask); var x471: u64 = undefined; - cmovznzU64(&x471, x467, x460, x447); + x471 = x460 ^ ((x460 ^ x447) & x468_selection_mask); var x472: u64 = undefined; - cmovznzU64(&x472, x467, x462, x449); + x472 = x462 ^ ((x462 ^ x449) & x468_selection_mask); var x473: u64 = undefined; - cmovznzU64(&x473, x467, x464, x451); + x473 = x464 ^ ((x464 ^ x451) & x468_selection_mask); out1[0] = x468; out1[1] = x469; out1[2] = x470; @@ -1559,22 +1550,22 @@ pub fn add(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x1: u64 = undefined; var x2: u1 = undefined; - addcarryxU64(&x1, &x2, 0x0, (arg1[0]), (arg2[0])); + addcarryxU64(&x1, &x2, 0x0, arg1[0], arg2[0]); var x3: u64 = undefined; var x4: u1 = undefined; - addcarryxU64(&x3, &x4, x2, (arg1[1]), (arg2[1])); + addcarryxU64(&x3, &x4, x2, arg1[1], arg2[1]); var x5: u64 = undefined; var x6: u1 = undefined; - addcarryxU64(&x5, &x6, x4, (arg1[2]), (arg2[2])); + addcarryxU64(&x5, &x6, x4, arg1[2], arg2[2]); var x7: u64 = undefined; var x8: u1 = undefined; - addcarryxU64(&x7, &x8, x6, (arg1[3]), (arg2[3])); + addcarryxU64(&x7, &x8, x6, arg1[3], arg2[3]); var x9: u64 = undefined; var x10: u1 = undefined; - addcarryxU64(&x9, &x10, x8, (arg1[4]), (arg2[4])); + addcarryxU64(&x9, &x10, x8, arg1[4], arg2[4]); var x11: u64 = undefined; var x12: u1 = undefined; - addcarryxU64(&x11, &x12, x10, (arg1[5]), (arg2[5])); + addcarryxU64(&x11, &x12, x10, arg1[5], arg2[5]); var x13: u64 = undefined; var x14: u1 = undefined; subborrowxU64(&x13, &x14, 0x0, x1, 0xecec196accc52973); @@ -1595,19 +1586,20 @@ pub fn add(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme subborrowxU64(&x23, &x24, x22, x11, 0xffffffffffffffff); var x25: u64 = undefined; var x26: u1 = undefined; - subborrowxU64(&x25, &x26, x24, @as(u64, x12), 0x0); + subborrowxU64(&x25, &x26, x24, x12, 0x0); var x27: u64 = undefined; - cmovznzU64(&x27, x26, x13, x1); + const x27_selection_mask = selectionMaskU64(x26); + x27 = x13 ^ ((x13 ^ x1) & x27_selection_mask); var x28: u64 = undefined; - cmovznzU64(&x28, x26, x15, x3); + x28 = x15 ^ ((x15 ^ x3) & x27_selection_mask); var x29: u64 = undefined; - cmovznzU64(&x29, x26, x17, x5); + x29 = x17 ^ ((x17 ^ x5) & x27_selection_mask); var x30: u64 = undefined; - cmovznzU64(&x30, x26, x19, x7); + x30 = x19 ^ ((x19 ^ x7) & x27_selection_mask); var x31: u64 = undefined; - cmovznzU64(&x31, x26, x21, x9); + x31 = x21 ^ ((x21 ^ x9) & x27_selection_mask); var x32: u64 = undefined; - cmovznzU64(&x32, x26, x23, x11); + x32 = x23 ^ ((x23 ^ x11) & x27_selection_mask); out1[0] = x27; out1[1] = x28; out1[2] = x29; @@ -1630,24 +1622,25 @@ pub fn sub(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x1: u64 = undefined; var x2: u1 = undefined; - subborrowxU64(&x1, &x2, 0x0, (arg1[0]), (arg2[0])); + subborrowxU64(&x1, &x2, 0x0, arg1[0], arg2[0]); var x3: u64 = undefined; var x4: u1 = undefined; - subborrowxU64(&x3, &x4, x2, (arg1[1]), (arg2[1])); + subborrowxU64(&x3, &x4, x2, arg1[1], arg2[1]); var x5: u64 = undefined; var x6: u1 = undefined; - subborrowxU64(&x5, &x6, x4, (arg1[2]), (arg2[2])); + subborrowxU64(&x5, &x6, x4, arg1[2], arg2[2]); var x7: u64 = undefined; var x8: u1 = undefined; - subborrowxU64(&x7, &x8, x6, (arg1[3]), (arg2[3])); + subborrowxU64(&x7, &x8, x6, arg1[3], arg2[3]); var x9: u64 = undefined; var x10: u1 = undefined; - subborrowxU64(&x9, &x10, x8, (arg1[4]), (arg2[4])); + subborrowxU64(&x9, &x10, x8, arg1[4], arg2[4]); var x11: u64 = undefined; var x12: u1 = undefined; - subborrowxU64(&x11, &x12, x10, (arg1[5]), (arg2[5])); + subborrowxU64(&x11, &x12, x10, arg1[5], arg2[5]); var x13: u64 = undefined; - cmovznzU64(&x13, x12, 0x0, 0xffffffffffffffff); + const x13_selection_mask = selectionMaskU64(x12); + x13 = 0x0 ^ ((0x0 ^ 0xffffffffffffffff) & x13_selection_mask); var x14: u64 = undefined; var x15: u1 = undefined; addcarryxU64(&x14, &x15, 0x0, x1, (x13 & 0xecec196accc52973)); @@ -1687,24 +1680,25 @@ pub fn opp(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x1: u64 = undefined; var x2: u1 = undefined; - subborrowxU64(&x1, &x2, 0x0, 0x0, (arg1[0])); + subborrowxU64(&x1, &x2, 0x0, 0x0, arg1[0]); var x3: u64 = undefined; var x4: u1 = undefined; - subborrowxU64(&x3, &x4, x2, 0x0, (arg1[1])); + subborrowxU64(&x3, &x4, x2, 0x0, arg1[1]); var x5: u64 = undefined; var x6: u1 = undefined; - subborrowxU64(&x5, &x6, x4, 0x0, (arg1[2])); + subborrowxU64(&x5, &x6, x4, 0x0, arg1[2]); var x7: u64 = undefined; var x8: u1 = undefined; - subborrowxU64(&x7, &x8, x6, 0x0, (arg1[3])); + subborrowxU64(&x7, &x8, x6, 0x0, arg1[3]); var x9: u64 = undefined; var x10: u1 = undefined; - subborrowxU64(&x9, &x10, x8, 0x0, (arg1[4])); + subborrowxU64(&x9, &x10, x8, 0x0, arg1[4]); var x11: u64 = undefined; var x12: u1 = undefined; - subborrowxU64(&x11, &x12, x10, 0x0, (arg1[5])); + subborrowxU64(&x11, &x12, x10, 0x0, arg1[5]); var x13: u64 = undefined; - cmovznzU64(&x13, x12, 0x0, 0xffffffffffffffff); + const x13_selection_mask = selectionMaskU64(x12); + x13 = 0x0 ^ ((0x0 ^ 0xffffffffffffffff) & x13_selection_mask); var x14: u64 = undefined; var x15: u1 = undefined; addcarryxU64(&x14, &x15, 0x0, x1, (x13 & 0xecec196accc52973)); @@ -1742,7 +1736,7 @@ pub fn opp(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldElement) void { @setRuntimeSafety(mode == .debug); - const x1 = (arg1[0]); + const x1: u64 = arg1[0]; var x2: u64 = undefined; var x3: u64 = undefined; mulxU64(&x2, &x3, x1, 0x6ed46089e88fdc45); @@ -1799,10 +1793,10 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo addcarryxU64(&x36, &x37, x35, 0x0, x24); var x38: u64 = undefined; var x39: u1 = undefined; - addcarryxU64(&x38, &x39, x37, 0x0, (@as(u64, x25) + x5)); + addcarryxU64(&x38, &x39, x37, 0x0, (x25 + x5)); var x40: u64 = undefined; var x41: u1 = undefined; - addcarryxU64(&x40, &x41, 0x0, x28, (arg1[1])); + addcarryxU64(&x40, &x41, 0x0, x28, arg1[1]); var x42: u64 = undefined; var x43: u1 = undefined; addcarryxU64(&x42, &x43, x41, x30, 0x0); @@ -1874,10 +1868,10 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo addcarryxU64(&x86, &x87, x85, x50, x74); var x88: u64 = undefined; var x89: u1 = undefined; - addcarryxU64(&x88, &x89, x87, (@as(u64, x51) + @as(u64, x39)), (@as(u64, x75) + x55)); + addcarryxU64(&x88, &x89, x87, (@as(u64, x51) + x39), (x75 + x55)); var x90: u64 = undefined; var x91: u1 = undefined; - addcarryxU64(&x90, &x91, 0x0, x78, (arg1[2])); + addcarryxU64(&x90, &x91, 0x0, x78, arg1[2]); var x92: u64 = undefined; var x93: u1 = undefined; addcarryxU64(&x92, &x93, x91, x80, 0x0); @@ -1949,10 +1943,10 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo addcarryxU64(&x136, &x137, x135, x100, x124); var x138: u64 = undefined; var x139: u1 = undefined; - addcarryxU64(&x138, &x139, x137, (@as(u64, x101) + @as(u64, x89)), (@as(u64, x125) + x105)); + addcarryxU64(&x138, &x139, x137, (@as(u64, x101) + x89), (x125 + x105)); var x140: u64 = undefined; var x141: u1 = undefined; - addcarryxU64(&x140, &x141, 0x0, x128, (arg1[3])); + addcarryxU64(&x140, &x141, 0x0, x128, arg1[3]); var x142: u64 = undefined; var x143: u1 = undefined; addcarryxU64(&x142, &x143, x141, x130, 0x0); @@ -2024,10 +2018,10 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo addcarryxU64(&x186, &x187, x185, x150, x174); var x188: u64 = undefined; var x189: u1 = undefined; - addcarryxU64(&x188, &x189, x187, (@as(u64, x151) + @as(u64, x139)), (@as(u64, x175) + x155)); + addcarryxU64(&x188, &x189, x187, (@as(u64, x151) + x139), (x175 + x155)); var x190: u64 = undefined; var x191: u1 = undefined; - addcarryxU64(&x190, &x191, 0x0, x178, (arg1[4])); + addcarryxU64(&x190, &x191, 0x0, x178, arg1[4]); var x192: u64 = undefined; var x193: u1 = undefined; addcarryxU64(&x192, &x193, x191, x180, 0x0); @@ -2099,10 +2093,10 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo addcarryxU64(&x236, &x237, x235, x200, x224); var x238: u64 = undefined; var x239: u1 = undefined; - addcarryxU64(&x238, &x239, x237, (@as(u64, x201) + @as(u64, x189)), (@as(u64, x225) + x205)); + addcarryxU64(&x238, &x239, x237, (@as(u64, x201) + x189), (x225 + x205)); var x240: u64 = undefined; var x241: u1 = undefined; - addcarryxU64(&x240, &x241, 0x0, x228, (arg1[5])); + addcarryxU64(&x240, &x241, 0x0, x228, arg1[5]); var x242: u64 = undefined; var x243: u1 = undefined; addcarryxU64(&x242, &x243, x241, x230, 0x0); @@ -2174,7 +2168,7 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo addcarryxU64(&x286, &x287, x285, x250, x274); var x288: u64 = undefined; var x289: u1 = undefined; - addcarryxU64(&x288, &x289, x287, (@as(u64, x251) + @as(u64, x239)), (@as(u64, x275) + x255)); + addcarryxU64(&x288, &x289, x287, (@as(u64, x251) + x239), (x275 + x255)); var x290: u64 = undefined; var x291: u1 = undefined; subborrowxU64(&x290, &x291, 0x0, x278, 0xecec196accc52973); @@ -2195,19 +2189,20 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo subborrowxU64(&x300, &x301, x299, x288, 0xffffffffffffffff); var x302: u64 = undefined; var x303: u1 = undefined; - subborrowxU64(&x302, &x303, x301, @as(u64, x289), 0x0); + subborrowxU64(&x302, &x303, x301, x289, 0x0); var x304: u64 = undefined; - cmovznzU64(&x304, x303, x290, x278); + const x304_selection_mask = selectionMaskU64(x303); + x304 = x290 ^ ((x290 ^ x278) & x304_selection_mask); var x305: u64 = undefined; - cmovznzU64(&x305, x303, x292, x280); + x305 = x292 ^ ((x292 ^ x280) & x304_selection_mask); var x306: u64 = undefined; - cmovznzU64(&x306, x303, x294, x282); + x306 = x294 ^ ((x294 ^ x282) & x304_selection_mask); var x307: u64 = undefined; - cmovznzU64(&x307, x303, x296, x284); + x307 = x296 ^ ((x296 ^ x284) & x304_selection_mask); var x308: u64 = undefined; - cmovznzU64(&x308, x303, x298, x286); + x308 = x298 ^ ((x298 ^ x286) & x304_selection_mask); var x309: u64 = undefined; - cmovznzU64(&x309, x303, x300, x288); + x309 = x300 ^ ((x300 ^ x288) & x304_selection_mask); out1[0] = x304; out1[1] = x305; out1[2] = x306; @@ -2227,12 +2222,12 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDomainFieldElement) void { @setRuntimeSafety(mode == .debug); - const x1 = (arg1[1]); - const x2 = (arg1[2]); - const x3 = (arg1[3]); - const x4 = (arg1[4]); - const x5 = (arg1[5]); - const x6 = (arg1[0]); + const x1: u64 = arg1[1]; + const x2: u64 = arg1[2]; + const x3: u64 = arg1[3]; + const x4: u64 = arg1[4]; + const x5: u64 = arg1[5]; + const x6: u64 = arg1[0]; var x7: u64 = undefined; var x8: u64 = undefined; mulxU64(&x7, &x8, x6, 0xc84ee012b39bf21); @@ -2322,7 +2317,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma addcarryxU64(&x63, &x64, x62, x27, x51); var x65: u64 = undefined; var x66: u1 = undefined; - addcarryxU64(&x65, &x66, x64, (@as(u64, x28) + x8), (@as(u64, x52) + x32)); + addcarryxU64(&x65, &x66, x64, (x28 + x8), (x52 + x32)); var x67: u64 = undefined; var x68: u64 = undefined; mulxU64(&x67, &x68, x1, 0xc84ee012b39bf21); @@ -2430,7 +2425,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma addcarryxU64(&x135, &x136, x134, x99, x123); var x137: u64 = undefined; var x138: u1 = undefined; - addcarryxU64(&x137, &x138, x136, ((@as(u64, x100) + @as(u64, x66)) + (@as(u64, x88) + x68)), (@as(u64, x124) + x104)); + addcarryxU64(&x137, &x138, x136, ((@as(u64, x100) + x66) + (x88 + x68)), (x124 + x104)); var x139: u64 = undefined; var x140: u64 = undefined; mulxU64(&x139, &x140, x2, 0xc84ee012b39bf21); @@ -2538,7 +2533,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma addcarryxU64(&x207, &x208, x206, x171, x195); var x209: u64 = undefined; var x210: u1 = undefined; - addcarryxU64(&x209, &x210, x208, ((@as(u64, x172) + @as(u64, x138)) + (@as(u64, x160) + x140)), (@as(u64, x196) + x176)); + addcarryxU64(&x209, &x210, x208, ((@as(u64, x172) + x138) + (x160 + x140)), (x196 + x176)); var x211: u64 = undefined; var x212: u64 = undefined; mulxU64(&x211, &x212, x3, 0xc84ee012b39bf21); @@ -2646,7 +2641,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma addcarryxU64(&x279, &x280, x278, x243, x267); var x281: u64 = undefined; var x282: u1 = undefined; - addcarryxU64(&x281, &x282, x280, ((@as(u64, x244) + @as(u64, x210)) + (@as(u64, x232) + x212)), (@as(u64, x268) + x248)); + addcarryxU64(&x281, &x282, x280, ((@as(u64, x244) + x210) + (x232 + x212)), (x268 + x248)); var x283: u64 = undefined; var x284: u64 = undefined; mulxU64(&x283, &x284, x4, 0xc84ee012b39bf21); @@ -2754,7 +2749,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma addcarryxU64(&x351, &x352, x350, x315, x339); var x353: u64 = undefined; var x354: u1 = undefined; - addcarryxU64(&x353, &x354, x352, ((@as(u64, x316) + @as(u64, x282)) + (@as(u64, x304) + x284)), (@as(u64, x340) + x320)); + addcarryxU64(&x353, &x354, x352, ((@as(u64, x316) + x282) + (x304 + x284)), (x340 + x320)); var x355: u64 = undefined; var x356: u64 = undefined; mulxU64(&x355, &x356, x5, 0xc84ee012b39bf21); @@ -2862,7 +2857,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma addcarryxU64(&x423, &x424, x422, x387, x411); var x425: u64 = undefined; var x426: u1 = undefined; - addcarryxU64(&x425, &x426, x424, ((@as(u64, x388) + @as(u64, x354)) + (@as(u64, x376) + x356)), (@as(u64, x412) + x392)); + addcarryxU64(&x425, &x426, x424, ((@as(u64, x388) + x354) + (x376 + x356)), (x412 + x392)); var x427: u64 = undefined; var x428: u1 = undefined; subborrowxU64(&x427, &x428, 0x0, x415, 0xecec196accc52973); @@ -2883,19 +2878,20 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma subborrowxU64(&x437, &x438, x436, x425, 0xffffffffffffffff); var x439: u64 = undefined; var x440: u1 = undefined; - subborrowxU64(&x439, &x440, x438, @as(u64, x426), 0x0); + subborrowxU64(&x439, &x440, x438, x426, 0x0); var x441: u64 = undefined; - cmovznzU64(&x441, x440, x427, x415); + const x441_selection_mask = selectionMaskU64(x440); + x441 = x427 ^ ((x427 ^ x415) & x441_selection_mask); var x442: u64 = undefined; - cmovznzU64(&x442, x440, x429, x417); + x442 = x429 ^ ((x429 ^ x417) & x441_selection_mask); var x443: u64 = undefined; - cmovznzU64(&x443, x440, x431, x419); + x443 = x431 ^ ((x431 ^ x419) & x441_selection_mask); var x444: u64 = undefined; - cmovznzU64(&x444, x440, x433, x421); + x444 = x433 ^ ((x433 ^ x421) & x441_selection_mask); var x445: u64 = undefined; - cmovznzU64(&x445, x440, x435, x423); + x445 = x435 ^ ((x435 ^ x423) & x441_selection_mask); var x446: u64 = undefined; - cmovznzU64(&x446, x440, x437, x425); + x446 = x437 ^ ((x437 ^ x425) & x441_selection_mask); out1[0] = x441; out1[1] = x442; out1[2] = x443; @@ -2918,7 +2914,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma pub fn nonzero(out1: *u64, arg1: [6]u64) void { @setRuntimeSafety(mode == .debug); - const x1 = ((arg1[0]) | ((arg1[1]) | ((arg1[2]) | ((arg1[3]) | ((arg1[4]) | (arg1[5])))))); + const x1: u64 = (arg1[0] | (arg1[1] | (arg1[2] | (arg1[3] | (arg1[4] | arg1[5]))))); out1.* = x1; } @@ -2937,17 +2933,18 @@ pub fn selectznz(out1: *[6]u64, arg1: u1, arg2: [6]u64, arg3: [6]u64) void { @setRuntimeSafety(mode == .debug); var x1: u64 = undefined; - cmovznzU64(&x1, arg1, (arg2[0]), (arg3[0])); + const x1_selection_mask = selectionMaskU64(arg1); + x1 = arg2[0] ^ ((arg2[0] ^ arg3[0]) & x1_selection_mask); var x2: u64 = undefined; - cmovznzU64(&x2, arg1, (arg2[1]), (arg3[1])); + x2 = arg2[1] ^ ((arg2[1] ^ arg3[1]) & x1_selection_mask); var x3: u64 = undefined; - cmovznzU64(&x3, arg1, (arg2[2]), (arg3[2])); + x3 = arg2[2] ^ ((arg2[2] ^ arg3[2]) & x1_selection_mask); var x4: u64 = undefined; - cmovznzU64(&x4, arg1, (arg2[3]), (arg3[3])); + x4 = arg2[3] ^ ((arg2[3] ^ arg3[3]) & x1_selection_mask); var x5: u64 = undefined; - cmovznzU64(&x5, arg1, (arg2[4]), (arg3[4])); + x5 = arg2[4] ^ ((arg2[4] ^ arg3[4]) & x1_selection_mask); var x6: u64 = undefined; - cmovznzU64(&x6, arg1, (arg2[5]), (arg3[5])); + x6 = arg2[5] ^ ((arg2[5] ^ arg3[5]) & x1_selection_mask); out1[0] = x1; out1[1] = x2; out1[2] = x3; @@ -2970,96 +2967,96 @@ pub fn selectznz(out1: *[6]u64, arg1: u1, arg2: [6]u64, arg3: [6]u64) void { pub fn toBytes(out1: *[48]u8, arg1: [6]u64) void { @setRuntimeSafety(mode == .debug); - const x1 = (arg1[5]); - const x2 = (arg1[4]); - const x3 = (arg1[3]); - const x4 = (arg1[2]); - const x5 = (arg1[1]); - const x6 = (arg1[0]); - const x7 = @as(u8, @truncate((x6 & 0xff))); - const x8 = (x6 >> 8); - const x9 = @as(u8, @truncate((x8 & 0xff))); - const x10 = (x8 >> 8); - const x11 = @as(u8, @truncate((x10 & 0xff))); - const x12 = (x10 >> 8); - const x13 = @as(u8, @truncate((x12 & 0xff))); - const x14 = (x12 >> 8); - const x15 = @as(u8, @truncate((x14 & 0xff))); - const x16 = (x14 >> 8); - const x17 = @as(u8, @truncate((x16 & 0xff))); - const x18 = (x16 >> 8); - const x19 = @as(u8, @truncate((x18 & 0xff))); - const x20 = @as(u8, @truncate((x18 >> 8))); - const x21 = @as(u8, @truncate((x5 & 0xff))); - const x22 = (x5 >> 8); - const x23 = @as(u8, @truncate((x22 & 0xff))); - const x24 = (x22 >> 8); - const x25 = @as(u8, @truncate((x24 & 0xff))); - const x26 = (x24 >> 8); - const x27 = @as(u8, @truncate((x26 & 0xff))); - const x28 = (x26 >> 8); - const x29 = @as(u8, @truncate((x28 & 0xff))); - const x30 = (x28 >> 8); - const x31 = @as(u8, @truncate((x30 & 0xff))); - const x32 = (x30 >> 8); - const x33 = @as(u8, @truncate((x32 & 0xff))); - const x34 = @as(u8, @truncate((x32 >> 8))); - const x35 = @as(u8, @truncate((x4 & 0xff))); - const x36 = (x4 >> 8); - const x37 = @as(u8, @truncate((x36 & 0xff))); - const x38 = (x36 >> 8); - const x39 = @as(u8, @truncate((x38 & 0xff))); - const x40 = (x38 >> 8); - const x41 = @as(u8, @truncate((x40 & 0xff))); - const x42 = (x40 >> 8); - const x43 = @as(u8, @truncate((x42 & 0xff))); - const x44 = (x42 >> 8); - const x45 = @as(u8, @truncate((x44 & 0xff))); - const x46 = (x44 >> 8); - const x47 = @as(u8, @truncate((x46 & 0xff))); - const x48 = @as(u8, @truncate((x46 >> 8))); - const x49 = @as(u8, @truncate((x3 & 0xff))); - const x50 = (x3 >> 8); - const x51 = @as(u8, @truncate((x50 & 0xff))); - const x52 = (x50 >> 8); - const x53 = @as(u8, @truncate((x52 & 0xff))); - const x54 = (x52 >> 8); - const x55 = @as(u8, @truncate((x54 & 0xff))); - const x56 = (x54 >> 8); - const x57 = @as(u8, @truncate((x56 & 0xff))); - const x58 = (x56 >> 8); - const x59 = @as(u8, @truncate((x58 & 0xff))); - const x60 = (x58 >> 8); - const x61 = @as(u8, @truncate((x60 & 0xff))); - const x62 = @as(u8, @truncate((x60 >> 8))); - const x63 = @as(u8, @truncate((x2 & 0xff))); - const x64 = (x2 >> 8); - const x65 = @as(u8, @truncate((x64 & 0xff))); - const x66 = (x64 >> 8); - const x67 = @as(u8, @truncate((x66 & 0xff))); - const x68 = (x66 >> 8); - const x69 = @as(u8, @truncate((x68 & 0xff))); - const x70 = (x68 >> 8); - const x71 = @as(u8, @truncate((x70 & 0xff))); - const x72 = (x70 >> 8); - const x73 = @as(u8, @truncate((x72 & 0xff))); - const x74 = (x72 >> 8); - const x75 = @as(u8, @truncate((x74 & 0xff))); - const x76 = @as(u8, @truncate((x74 >> 8))); - const x77 = @as(u8, @truncate((x1 & 0xff))); - const x78 = (x1 >> 8); - const x79 = @as(u8, @truncate((x78 & 0xff))); - const x80 = (x78 >> 8); - const x81 = @as(u8, @truncate((x80 & 0xff))); - const x82 = (x80 >> 8); - const x83 = @as(u8, @truncate((x82 & 0xff))); - const x84 = (x82 >> 8); - const x85 = @as(u8, @truncate((x84 & 0xff))); - const x86 = (x84 >> 8); - const x87 = @as(u8, @truncate((x86 & 0xff))); - const x88 = (x86 >> 8); - const x89 = @as(u8, @truncate((x88 & 0xff))); - const x90 = @as(u8, @truncate((x88 >> 8))); + const x1: u64 = arg1[5]; + const x2: u64 = arg1[4]; + const x3: u64 = arg1[3]; + const x4: u64 = arg1[2]; + const x5: u64 = arg1[1]; + const x6: u64 = arg1[0]; + const x7: u8 = @truncate(x6); + const x8: u64 = (x6 >> 8); + const x9: u8 = @truncate(x8); + const x10: u64 = (x8 >> 8); + const x11: u8 = @truncate(x10); + const x12: u64 = (x10 >> 8); + const x13: u8 = @truncate(x12); + const x14: u64 = (x12 >> 8); + const x15: u8 = @truncate(x14); + const x16: u64 = (x14 >> 8); + const x17: u8 = @truncate(x16); + const x18: u64 = (x16 >> 8); + const x19: u8 = @truncate(x18); + const x20: u8 = @truncate((x18 >> 8)); + const x21: u8 = @truncate(x5); + const x22: u64 = (x5 >> 8); + const x23: u8 = @truncate(x22); + const x24: u64 = (x22 >> 8); + const x25: u8 = @truncate(x24); + const x26: u64 = (x24 >> 8); + const x27: u8 = @truncate(x26); + const x28: u64 = (x26 >> 8); + const x29: u8 = @truncate(x28); + const x30: u64 = (x28 >> 8); + const x31: u8 = @truncate(x30); + const x32: u64 = (x30 >> 8); + const x33: u8 = @truncate(x32); + const x34: u8 = @truncate((x32 >> 8)); + const x35: u8 = @truncate(x4); + const x36: u64 = (x4 >> 8); + const x37: u8 = @truncate(x36); + const x38: u64 = (x36 >> 8); + const x39: u8 = @truncate(x38); + const x40: u64 = (x38 >> 8); + const x41: u8 = @truncate(x40); + const x42: u64 = (x40 >> 8); + const x43: u8 = @truncate(x42); + const x44: u64 = (x42 >> 8); + const x45: u8 = @truncate(x44); + const x46: u64 = (x44 >> 8); + const x47: u8 = @truncate(x46); + const x48: u8 = @truncate((x46 >> 8)); + const x49: u8 = @truncate(x3); + const x50: u64 = (x3 >> 8); + const x51: u8 = @truncate(x50); + const x52: u64 = (x50 >> 8); + const x53: u8 = @truncate(x52); + const x54: u64 = (x52 >> 8); + const x55: u8 = @truncate(x54); + const x56: u64 = (x54 >> 8); + const x57: u8 = @truncate(x56); + const x58: u64 = (x56 >> 8); + const x59: u8 = @truncate(x58); + const x60: u64 = (x58 >> 8); + const x61: u8 = @truncate(x60); + const x62: u8 = @truncate((x60 >> 8)); + const x63: u8 = @truncate(x2); + const x64: u64 = (x2 >> 8); + const x65: u8 = @truncate(x64); + const x66: u64 = (x64 >> 8); + const x67: u8 = @truncate(x66); + const x68: u64 = (x66 >> 8); + const x69: u8 = @truncate(x68); + const x70: u64 = (x68 >> 8); + const x71: u8 = @truncate(x70); + const x72: u64 = (x70 >> 8); + const x73: u8 = @truncate(x72); + const x74: u64 = (x72 >> 8); + const x75: u8 = @truncate(x74); + const x76: u8 = @truncate((x74 >> 8)); + const x77: u8 = @truncate(x1); + const x78: u64 = (x1 >> 8); + const x79: u8 = @truncate(x78); + const x80: u64 = (x78 >> 8); + const x81: u8 = @truncate(x80); + const x82: u64 = (x80 >> 8); + const x83: u8 = @truncate(x82); + const x84: u64 = (x82 >> 8); + const x85: u8 = @truncate(x84); + const x86: u64 = (x84 >> 8); + const x87: u8 = @truncate(x86); + const x88: u64 = (x86 >> 8); + const x89: u8 = @truncate(x88); + const x90: u8 = @truncate((x88 >> 8)); out1[0] = x7; out1[1] = x9; out1[2] = x11; @@ -3125,96 +3122,96 @@ pub fn toBytes(out1: *[48]u8, arg1: [6]u64) void { pub fn fromBytes(out1: *[6]u64, arg1: [48]u8) void { @setRuntimeSafety(mode == .debug); - const x1 = (@as(u64, (arg1[47])) << 56); - const x2 = (@as(u64, (arg1[46])) << 48); - const x3 = (@as(u64, (arg1[45])) << 40); - const x4 = (@as(u64, (arg1[44])) << 32); - const x5 = (@as(u64, (arg1[43])) << 24); - const x6 = (@as(u64, (arg1[42])) << 16); - const x7 = (@as(u64, (arg1[41])) << 8); - const x8 = (arg1[40]); - const x9 = (@as(u64, (arg1[39])) << 56); - const x10 = (@as(u64, (arg1[38])) << 48); - const x11 = (@as(u64, (arg1[37])) << 40); - const x12 = (@as(u64, (arg1[36])) << 32); - const x13 = (@as(u64, (arg1[35])) << 24); - const x14 = (@as(u64, (arg1[34])) << 16); - const x15 = (@as(u64, (arg1[33])) << 8); - const x16 = (arg1[32]); - const x17 = (@as(u64, (arg1[31])) << 56); - const x18 = (@as(u64, (arg1[30])) << 48); - const x19 = (@as(u64, (arg1[29])) << 40); - const x20 = (@as(u64, (arg1[28])) << 32); - const x21 = (@as(u64, (arg1[27])) << 24); - const x22 = (@as(u64, (arg1[26])) << 16); - const x23 = (@as(u64, (arg1[25])) << 8); - const x24 = (arg1[24]); - const x25 = (@as(u64, (arg1[23])) << 56); - const x26 = (@as(u64, (arg1[22])) << 48); - const x27 = (@as(u64, (arg1[21])) << 40); - const x28 = (@as(u64, (arg1[20])) << 32); - const x29 = (@as(u64, (arg1[19])) << 24); - const x30 = (@as(u64, (arg1[18])) << 16); - const x31 = (@as(u64, (arg1[17])) << 8); - const x32 = (arg1[16]); - const x33 = (@as(u64, (arg1[15])) << 56); - const x34 = (@as(u64, (arg1[14])) << 48); - const x35 = (@as(u64, (arg1[13])) << 40); - const x36 = (@as(u64, (arg1[12])) << 32); - const x37 = (@as(u64, (arg1[11])) << 24); - const x38 = (@as(u64, (arg1[10])) << 16); - const x39 = (@as(u64, (arg1[9])) << 8); - const x40 = (arg1[8]); - const x41 = (@as(u64, (arg1[7])) << 56); - const x42 = (@as(u64, (arg1[6])) << 48); - const x43 = (@as(u64, (arg1[5])) << 40); - const x44 = (@as(u64, (arg1[4])) << 32); - const x45 = (@as(u64, (arg1[3])) << 24); - const x46 = (@as(u64, (arg1[2])) << 16); - const x47 = (@as(u64, (arg1[1])) << 8); - const x48 = (arg1[0]); - const x49 = (x47 + @as(u64, x48)); - const x50 = (x46 + x49); - const x51 = (x45 + x50); - const x52 = (x44 + x51); - const x53 = (x43 + x52); - const x54 = (x42 + x53); - const x55 = (x41 + x54); - const x56 = (x39 + @as(u64, x40)); - const x57 = (x38 + x56); - const x58 = (x37 + x57); - const x59 = (x36 + x58); - const x60 = (x35 + x59); - const x61 = (x34 + x60); - const x62 = (x33 + x61); - const x63 = (x31 + @as(u64, x32)); - const x64 = (x30 + x63); - const x65 = (x29 + x64); - const x66 = (x28 + x65); - const x67 = (x27 + x66); - const x68 = (x26 + x67); - const x69 = (x25 + x68); - const x70 = (x23 + @as(u64, x24)); - const x71 = (x22 + x70); - const x72 = (x21 + x71); - const x73 = (x20 + x72); - const x74 = (x19 + x73); - const x75 = (x18 + x74); - const x76 = (x17 + x75); - const x77 = (x15 + @as(u64, x16)); - const x78 = (x14 + x77); - const x79 = (x13 + x78); - const x80 = (x12 + x79); - const x81 = (x11 + x80); - const x82 = (x10 + x81); - const x83 = (x9 + x82); - const x84 = (x7 + @as(u64, x8)); - const x85 = (x6 + x84); - const x86 = (x5 + x85); - const x87 = (x4 + x86); - const x88 = (x3 + x87); - const x89 = (x2 + x88); - const x90 = (x1 + x89); + const x1: u64 = (@as(u64, arg1[47]) << 56); + const x2: u64 = (@as(u64, arg1[46]) << 48); + const x3: u64 = (@as(u64, arg1[45]) << 40); + const x4: u64 = (@as(u64, arg1[44]) << 32); + const x5: u64 = (@as(u64, arg1[43]) << 24); + const x6: u64 = (@as(u64, arg1[42]) << 16); + const x7: u64 = (@as(u64, arg1[41]) << 8); + const x8: u8 = arg1[40]; + const x9: u64 = (@as(u64, arg1[39]) << 56); + const x10: u64 = (@as(u64, arg1[38]) << 48); + const x11: u64 = (@as(u64, arg1[37]) << 40); + const x12: u64 = (@as(u64, arg1[36]) << 32); + const x13: u64 = (@as(u64, arg1[35]) << 24); + const x14: u64 = (@as(u64, arg1[34]) << 16); + const x15: u64 = (@as(u64, arg1[33]) << 8); + const x16: u8 = arg1[32]; + const x17: u64 = (@as(u64, arg1[31]) << 56); + const x18: u64 = (@as(u64, arg1[30]) << 48); + const x19: u64 = (@as(u64, arg1[29]) << 40); + const x20: u64 = (@as(u64, arg1[28]) << 32); + const x21: u64 = (@as(u64, arg1[27]) << 24); + const x22: u64 = (@as(u64, arg1[26]) << 16); + const x23: u64 = (@as(u64, arg1[25]) << 8); + const x24: u8 = arg1[24]; + const x25: u64 = (@as(u64, arg1[23]) << 56); + const x26: u64 = (@as(u64, arg1[22]) << 48); + const x27: u64 = (@as(u64, arg1[21]) << 40); + const x28: u64 = (@as(u64, arg1[20]) << 32); + const x29: u64 = (@as(u64, arg1[19]) << 24); + const x30: u64 = (@as(u64, arg1[18]) << 16); + const x31: u64 = (@as(u64, arg1[17]) << 8); + const x32: u8 = arg1[16]; + const x33: u64 = (@as(u64, arg1[15]) << 56); + const x34: u64 = (@as(u64, arg1[14]) << 48); + const x35: u64 = (@as(u64, arg1[13]) << 40); + const x36: u64 = (@as(u64, arg1[12]) << 32); + const x37: u64 = (@as(u64, arg1[11]) << 24); + const x38: u64 = (@as(u64, arg1[10]) << 16); + const x39: u64 = (@as(u64, arg1[9]) << 8); + const x40: u8 = arg1[8]; + const x41: u64 = (@as(u64, arg1[7]) << 56); + const x42: u64 = (@as(u64, arg1[6]) << 48); + const x43: u64 = (@as(u64, arg1[5]) << 40); + const x44: u64 = (@as(u64, arg1[4]) << 32); + const x45: u64 = (@as(u64, arg1[3]) << 24); + const x46: u64 = (@as(u64, arg1[2]) << 16); + const x47: u64 = (@as(u64, arg1[1]) << 8); + const x48: u8 = arg1[0]; + const x49: u64 = (x47 + x48); + const x50: u64 = (x46 + x49); + const x51: u64 = (x45 + x50); + const x52: u64 = (x44 + x51); + const x53: u64 = (x43 + x52); + const x54: u64 = (x42 + x53); + const x55: u64 = (x41 + x54); + const x56: u64 = (x39 + x40); + const x57: u64 = (x38 + x56); + const x58: u64 = (x37 + x57); + const x59: u64 = (x36 + x58); + const x60: u64 = (x35 + x59); + const x61: u64 = (x34 + x60); + const x62: u64 = (x33 + x61); + const x63: u64 = (x31 + x32); + const x64: u64 = (x30 + x63); + const x65: u64 = (x29 + x64); + const x66: u64 = (x28 + x65); + const x67: u64 = (x27 + x66); + const x68: u64 = (x26 + x67); + const x69: u64 = (x25 + x68); + const x70: u64 = (x23 + x24); + const x71: u64 = (x22 + x70); + const x72: u64 = (x21 + x71); + const x73: u64 = (x20 + x72); + const x74: u64 = (x19 + x73); + const x75: u64 = (x18 + x74); + const x76: u64 = (x17 + x75); + const x77: u64 = (x15 + x16); + const x78: u64 = (x14 + x77); + const x79: u64 = (x13 + x78); + const x80: u64 = (x12 + x79); + const x81: u64 = (x11 + x80); + const x82: u64 = (x10 + x81); + const x83: u64 = (x9 + x82); + const x84: u64 = (x7 + x8); + const x85: u64 = (x6 + x84); + const x86: u64 = (x5 + x85); + const x87: u64 = (x4 + x86); + const x88: u64 = (x3 + x87); + const x89: u64 = (x2 + x88); + const x90: u64 = (x1 + x89); out1[0] = x55; out1[1] = x62; out1[2] = x69; @@ -3294,73 +3291,75 @@ pub fn divstep(out1: *u64, out2: *[7]u64, out3: *[7]u64, out4: *[6]u64, out5: *[ var x1: u64 = undefined; var x2: u1 = undefined; addcarryxU64(&x1, &x2, 0x0, (~arg1), 0x1); - const x3 = (@as(u1, @truncate((x1 >> 63))) & @as(u1, @truncate(((arg3[0]) & 0x1)))); + const x3: u1 = (@as(u1, @truncate((x1 >> 63))) & @as(u1, @truncate(arg3[0]))); var x4: u64 = undefined; var x5: u1 = undefined; addcarryxU64(&x4, &x5, 0x0, (~arg1), 0x1); var x6: u64 = undefined; - cmovznzU64(&x6, x3, arg1, x4); + const x6_selection_mask = selectionMaskU64(x3); + x6 = arg1 ^ ((arg1 ^ x4) & x6_selection_mask); var x7: u64 = undefined; - cmovznzU64(&x7, x3, (arg2[0]), (arg3[0])); + x7 = arg2[0] ^ ((arg2[0] ^ arg3[0]) & x6_selection_mask); var x8: u64 = undefined; - cmovznzU64(&x8, x3, (arg2[1]), (arg3[1])); + x8 = arg2[1] ^ ((arg2[1] ^ arg3[1]) & x6_selection_mask); var x9: u64 = undefined; - cmovznzU64(&x9, x3, (arg2[2]), (arg3[2])); + x9 = arg2[2] ^ ((arg2[2] ^ arg3[2]) & x6_selection_mask); var x10: u64 = undefined; - cmovznzU64(&x10, x3, (arg2[3]), (arg3[3])); + x10 = arg2[3] ^ ((arg2[3] ^ arg3[3]) & x6_selection_mask); var x11: u64 = undefined; - cmovznzU64(&x11, x3, (arg2[4]), (arg3[4])); + x11 = arg2[4] ^ ((arg2[4] ^ arg3[4]) & x6_selection_mask); var x12: u64 = undefined; - cmovznzU64(&x12, x3, (arg2[5]), (arg3[5])); + x12 = arg2[5] ^ ((arg2[5] ^ arg3[5]) & x6_selection_mask); var x13: u64 = undefined; - cmovznzU64(&x13, x3, (arg2[6]), (arg3[6])); + x13 = arg2[6] ^ ((arg2[6] ^ arg3[6]) & x6_selection_mask); var x14: u64 = undefined; var x15: u1 = undefined; - addcarryxU64(&x14, &x15, 0x0, 0x1, (~(arg2[0]))); + addcarryxU64(&x14, &x15, 0x0, 0x1, (~arg2[0])); var x16: u64 = undefined; var x17: u1 = undefined; - addcarryxU64(&x16, &x17, x15, 0x0, (~(arg2[1]))); + addcarryxU64(&x16, &x17, x15, 0x0, (~arg2[1])); var x18: u64 = undefined; var x19: u1 = undefined; - addcarryxU64(&x18, &x19, x17, 0x0, (~(arg2[2]))); + addcarryxU64(&x18, &x19, x17, 0x0, (~arg2[2])); var x20: u64 = undefined; var x21: u1 = undefined; - addcarryxU64(&x20, &x21, x19, 0x0, (~(arg2[3]))); + addcarryxU64(&x20, &x21, x19, 0x0, (~arg2[3])); var x22: u64 = undefined; var x23: u1 = undefined; - addcarryxU64(&x22, &x23, x21, 0x0, (~(arg2[4]))); + addcarryxU64(&x22, &x23, x21, 0x0, (~arg2[4])); var x24: u64 = undefined; var x25: u1 = undefined; - addcarryxU64(&x24, &x25, x23, 0x0, (~(arg2[5]))); + addcarryxU64(&x24, &x25, x23, 0x0, (~arg2[5])); var x26: u64 = undefined; var x27: u1 = undefined; - addcarryxU64(&x26, &x27, x25, 0x0, (~(arg2[6]))); + addcarryxU64(&x26, &x27, x25, 0x0, (~arg2[6])); var x28: u64 = undefined; - cmovznzU64(&x28, x3, (arg3[0]), x14); + const x28_selection_mask = selectionMaskU64(x3); + x28 = arg3[0] ^ ((arg3[0] ^ x14) & x28_selection_mask); var x29: u64 = undefined; - cmovznzU64(&x29, x3, (arg3[1]), x16); + x29 = arg3[1] ^ ((arg3[1] ^ x16) & x28_selection_mask); var x30: u64 = undefined; - cmovznzU64(&x30, x3, (arg3[2]), x18); + x30 = arg3[2] ^ ((arg3[2] ^ x18) & x28_selection_mask); var x31: u64 = undefined; - cmovznzU64(&x31, x3, (arg3[3]), x20); + x31 = arg3[3] ^ ((arg3[3] ^ x20) & x28_selection_mask); var x32: u64 = undefined; - cmovznzU64(&x32, x3, (arg3[4]), x22); + x32 = arg3[4] ^ ((arg3[4] ^ x22) & x28_selection_mask); var x33: u64 = undefined; - cmovznzU64(&x33, x3, (arg3[5]), x24); + x33 = arg3[5] ^ ((arg3[5] ^ x24) & x28_selection_mask); var x34: u64 = undefined; - cmovznzU64(&x34, x3, (arg3[6]), x26); + x34 = arg3[6] ^ ((arg3[6] ^ x26) & x28_selection_mask); var x35: u64 = undefined; - cmovznzU64(&x35, x3, (arg4[0]), (arg5[0])); + x35 = arg4[0] ^ ((arg4[0] ^ arg5[0]) & x28_selection_mask); var x36: u64 = undefined; - cmovznzU64(&x36, x3, (arg4[1]), (arg5[1])); + x36 = arg4[1] ^ ((arg4[1] ^ arg5[1]) & x28_selection_mask); var x37: u64 = undefined; - cmovznzU64(&x37, x3, (arg4[2]), (arg5[2])); + x37 = arg4[2] ^ ((arg4[2] ^ arg5[2]) & x28_selection_mask); var x38: u64 = undefined; - cmovznzU64(&x38, x3, (arg4[3]), (arg5[3])); + x38 = arg4[3] ^ ((arg4[3] ^ arg5[3]) & x28_selection_mask); var x39: u64 = undefined; - cmovznzU64(&x39, x3, (arg4[4]), (arg5[4])); + x39 = arg4[4] ^ ((arg4[4] ^ arg5[4]) & x28_selection_mask); var x40: u64 = undefined; - cmovznzU64(&x40, x3, (arg4[5]), (arg5[5])); + x40 = arg4[5] ^ ((arg4[5] ^ arg5[5]) & x28_selection_mask); var x41: u64 = undefined; var x42: u1 = undefined; addcarryxU64(&x41, &x42, 0x0, x35, x35); @@ -3399,13 +3398,13 @@ pub fn divstep(out1: *u64, out2: *[7]u64, out3: *[7]u64, out4: *[6]u64, out5: *[ subborrowxU64(&x63, &x64, x62, x51, 0xffffffffffffffff); var x65: u64 = undefined; var x66: u1 = undefined; - subborrowxU64(&x65, &x66, x64, @as(u64, x52), 0x0); - const x67 = (arg4[5]); - const x68 = (arg4[4]); - const x69 = (arg4[3]); - const x70 = (arg4[2]); - const x71 = (arg4[1]); - const x72 = (arg4[0]); + subborrowxU64(&x65, &x66, x64, x52, 0x0); + const x67: u64 = arg4[5]; + const x68: u64 = arg4[4]; + const x69: u64 = arg4[3]; + const x70: u64 = arg4[2]; + const x71: u64 = arg4[1]; + const x72: u64 = arg4[0]; var x73: u64 = undefined; var x74: u1 = undefined; subborrowxU64(&x73, &x74, 0x0, 0x0, x72); @@ -3425,7 +3424,8 @@ pub fn divstep(out1: *u64, out2: *[7]u64, out3: *[7]u64, out4: *[6]u64, out5: *[ var x84: u1 = undefined; subborrowxU64(&x83, &x84, x82, 0x0, x67); var x85: u64 = undefined; - cmovznzU64(&x85, x84, 0x0, 0xffffffffffffffff); + const x85_selection_mask = selectionMaskU64(x84); + x85 = 0x0 ^ ((0x0 ^ 0xffffffffffffffff) & x85_selection_mask); var x86: u64 = undefined; var x87: u1 = undefined; addcarryxU64(&x86, &x87, 0x0, x73, (x85 & 0xecec196accc52973)); @@ -3445,32 +3445,34 @@ pub fn divstep(out1: *u64, out2: *[7]u64, out3: *[7]u64, out4: *[6]u64, out5: *[ var x97: u1 = undefined; addcarryxU64(&x96, &x97, x95, x83, x85); var x98: u64 = undefined; - cmovznzU64(&x98, x3, (arg5[0]), x86); + const x98_selection_mask = selectionMaskU64(x3); + x98 = arg5[0] ^ ((arg5[0] ^ x86) & x98_selection_mask); var x99: u64 = undefined; - cmovznzU64(&x99, x3, (arg5[1]), x88); + x99 = arg5[1] ^ ((arg5[1] ^ x88) & x98_selection_mask); var x100: u64 = undefined; - cmovznzU64(&x100, x3, (arg5[2]), x90); + x100 = arg5[2] ^ ((arg5[2] ^ x90) & x98_selection_mask); var x101: u64 = undefined; - cmovznzU64(&x101, x3, (arg5[3]), x92); + x101 = arg5[3] ^ ((arg5[3] ^ x92) & x98_selection_mask); var x102: u64 = undefined; - cmovznzU64(&x102, x3, (arg5[4]), x94); + x102 = arg5[4] ^ ((arg5[4] ^ x94) & x98_selection_mask); var x103: u64 = undefined; - cmovznzU64(&x103, x3, (arg5[5]), x96); - const x104 = @as(u1, @truncate((x28 & 0x1))); + x103 = arg5[5] ^ ((arg5[5] ^ x96) & x98_selection_mask); + const x104: u1 = @truncate(x28); var x105: u64 = undefined; - cmovznzU64(&x105, x104, 0x0, x7); + const x105_selection_mask = selectionMaskU64(x104); + x105 = 0x0 ^ ((0x0 ^ x7) & x105_selection_mask); var x106: u64 = undefined; - cmovznzU64(&x106, x104, 0x0, x8); + x106 = 0x0 ^ ((0x0 ^ x8) & x105_selection_mask); var x107: u64 = undefined; - cmovznzU64(&x107, x104, 0x0, x9); + x107 = 0x0 ^ ((0x0 ^ x9) & x105_selection_mask); var x108: u64 = undefined; - cmovznzU64(&x108, x104, 0x0, x10); + x108 = 0x0 ^ ((0x0 ^ x10) & x105_selection_mask); var x109: u64 = undefined; - cmovznzU64(&x109, x104, 0x0, x11); + x109 = 0x0 ^ ((0x0 ^ x11) & x105_selection_mask); var x110: u64 = undefined; - cmovznzU64(&x110, x104, 0x0, x12); + x110 = 0x0 ^ ((0x0 ^ x12) & x105_selection_mask); var x111: u64 = undefined; - cmovznzU64(&x111, x104, 0x0, x13); + x111 = 0x0 ^ ((0x0 ^ x13) & x105_selection_mask); var x112: u64 = undefined; var x113: u1 = undefined; addcarryxU64(&x112, &x113, 0x0, x28, x105); @@ -3493,17 +3495,18 @@ pub fn divstep(out1: *u64, out2: *[7]u64, out3: *[7]u64, out4: *[6]u64, out5: *[ var x125: u1 = undefined; addcarryxU64(&x124, &x125, x123, x34, x111); var x126: u64 = undefined; - cmovznzU64(&x126, x104, 0x0, x35); + const x126_selection_mask = selectionMaskU64(x104); + x126 = 0x0 ^ ((0x0 ^ x35) & x126_selection_mask); var x127: u64 = undefined; - cmovznzU64(&x127, x104, 0x0, x36); + x127 = 0x0 ^ ((0x0 ^ x36) & x126_selection_mask); var x128: u64 = undefined; - cmovznzU64(&x128, x104, 0x0, x37); + x128 = 0x0 ^ ((0x0 ^ x37) & x126_selection_mask); var x129: u64 = undefined; - cmovznzU64(&x129, x104, 0x0, x38); + x129 = 0x0 ^ ((0x0 ^ x38) & x126_selection_mask); var x130: u64 = undefined; - cmovznzU64(&x130, x104, 0x0, x39); + x130 = 0x0 ^ ((0x0 ^ x39) & x126_selection_mask); var x131: u64 = undefined; - cmovznzU64(&x131, x104, 0x0, x40); + x131 = 0x0 ^ ((0x0 ^ x40) & x126_selection_mask); var x132: u64 = undefined; var x133: u1 = undefined; addcarryxU64(&x132, &x133, 0x0, x98, x126); @@ -3542,41 +3545,43 @@ pub fn divstep(out1: *u64, out2: *[7]u64, out3: *[7]u64, out4: *[6]u64, out5: *[ subborrowxU64(&x154, &x155, x153, x142, 0xffffffffffffffff); var x156: u64 = undefined; var x157: u1 = undefined; - subborrowxU64(&x156, &x157, x155, @as(u64, x143), 0x0); + subborrowxU64(&x156, &x157, x155, x143, 0x0); var x158: u64 = undefined; var x159: u1 = undefined; addcarryxU64(&x158, &x159, 0x0, x6, 0x1); - const x160 = ((x112 >> 1) | ((x114 << 63) & 0xffffffffffffffff)); - const x161 = ((x114 >> 1) | ((x116 << 63) & 0xffffffffffffffff)); - const x162 = ((x116 >> 1) | ((x118 << 63) & 0xffffffffffffffff)); - const x163 = ((x118 >> 1) | ((x120 << 63) & 0xffffffffffffffff)); - const x164 = ((x120 >> 1) | ((x122 << 63) & 0xffffffffffffffff)); - const x165 = ((x122 >> 1) | ((x124 << 63) & 0xffffffffffffffff)); - const x166 = ((x124 & 0x8000000000000000) | (x124 >> 1)); + const x160: u64 = ((x112 >> 1) | ((x114 << 63) & 0xffffffffffffffff)); + const x161: u64 = ((x114 >> 1) | ((x116 << 63) & 0xffffffffffffffff)); + const x162: u64 = ((x116 >> 1) | ((x118 << 63) & 0xffffffffffffffff)); + const x163: u64 = ((x118 >> 1) | ((x120 << 63) & 0xffffffffffffffff)); + const x164: u64 = ((x120 >> 1) | ((x122 << 63) & 0xffffffffffffffff)); + const x165: u64 = ((x122 >> 1) | ((x124 << 63) & 0xffffffffffffffff)); + const x166: u64 = ((x124 & 0x8000000000000000) | (x124 >> 1)); var x167: u64 = undefined; - cmovznzU64(&x167, x66, x53, x41); + const x167_selection_mask = selectionMaskU64(x66); + x167 = x53 ^ ((x53 ^ x41) & x167_selection_mask); var x168: u64 = undefined; - cmovznzU64(&x168, x66, x55, x43); + x168 = x55 ^ ((x55 ^ x43) & x167_selection_mask); var x169: u64 = undefined; - cmovznzU64(&x169, x66, x57, x45); + x169 = x57 ^ ((x57 ^ x45) & x167_selection_mask); var x170: u64 = undefined; - cmovznzU64(&x170, x66, x59, x47); + x170 = x59 ^ ((x59 ^ x47) & x167_selection_mask); var x171: u64 = undefined; - cmovznzU64(&x171, x66, x61, x49); + x171 = x61 ^ ((x61 ^ x49) & x167_selection_mask); var x172: u64 = undefined; - cmovznzU64(&x172, x66, x63, x51); + x172 = x63 ^ ((x63 ^ x51) & x167_selection_mask); var x173: u64 = undefined; - cmovznzU64(&x173, x157, x144, x132); + const x173_selection_mask = selectionMaskU64(x157); + x173 = x144 ^ ((x144 ^ x132) & x173_selection_mask); var x174: u64 = undefined; - cmovznzU64(&x174, x157, x146, x134); + x174 = x146 ^ ((x146 ^ x134) & x173_selection_mask); var x175: u64 = undefined; - cmovznzU64(&x175, x157, x148, x136); + x175 = x148 ^ ((x148 ^ x136) & x173_selection_mask); var x176: u64 = undefined; - cmovznzU64(&x176, x157, x150, x138); + x176 = x150 ^ ((x150 ^ x138) & x173_selection_mask); var x177: u64 = undefined; - cmovznzU64(&x177, x157, x152, x140); + x177 = x152 ^ ((x152 ^ x140) & x173_selection_mask); var x178: u64 = undefined; - cmovznzU64(&x178, x157, x154, x142); + x178 = x154 ^ ((x154 ^ x142) & x173_selection_mask); out1.* = x158; out2[0] = x7; out2[1] = x8; diff --git a/lib/std/crypto/pcurves/secp256k1/secp256k1_64.zig b/lib/std/crypto/pcurves/secp256k1/secp256k1_64.zig index 8decda2f2525f288583ced40b12c7413862ebf6d..af645f9254e2ecc5c1e032e848174b129ab1e168 100644 --- a/lib/std/crypto/pcurves/secp256k1/secp256k1_64.zig +++ b/lib/std/crypto/pcurves/secp256k1/secp256k1_64.zig @@ -17,7 +17,6 @@ // twos_complement_eval z = let x1 := z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) in // if x1 & (2^256-1) < 2^255 then x1 & (2^256-1) else (x1 & (2^256-1)) - 2^256 -const std = @import("std"); const mode = @import("builtin").mode; // Checked arithmetic is disabled in non-debug modes to avoid side channels // The type MontgomeryDomainFieldElement is a field element in the Montgomery domain. @@ -28,80 +27,70 @@ pub const MontgomeryDomainFieldElement = [4]u64; // Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] pub const NonMontgomeryDomainFieldElement = [4]u64; -/// The function addcarryxU64 is an addition with carry. -/// -/// Postconditions: -/// out1 = (arg1 + arg2 + arg3) mod 2^64 -/// out2 = ⌊(arg1 + arg2 + arg3) / 2^64⌋ -/// -/// Input Bounds: -/// arg1: [0x0 ~> 0x1] -/// arg2: [0x0 ~> 0xffffffffffffffff] -/// arg3: [0x0 ~> 0xffffffffffffffff] -/// Output Bounds: -/// out1: [0x0 ~> 0xffffffffffffffff] -/// out2: [0x0 ~> 0x1] +/// Add two limbs and a carry bit, returning the sum modulo 2^64 and the carry bit. fn addcarryxU64(out1: *u64, out2: *u1, arg1: u1, arg2: u64, arg3: u64) void { - const x = @as(u128, arg2) +% arg3 +% arg1; - out1.* = @truncate(x); - out2.* = @truncate(x >> 64); + @setRuntimeSafety(mode == .debug); + + const x = @addWithOverflow(arg2, arg3); + const y = @addWithOverflow(x[0], arg1); + out1.* = y[0]; + out2.* = x[1] | y[1]; } -/// The function subborrowxU64 is a subtraction with borrow. -/// -/// Postconditions: -/// out1 = (-arg1 + arg2 + -arg3) mod 2^64 -/// out2 = -⌊(-arg1 + arg2 + -arg3) / 2^64⌋ -/// -/// Input Bounds: -/// arg1: [0x0 ~> 0x1] -/// arg2: [0x0 ~> 0xffffffffffffffff] -/// arg3: [0x0 ~> 0xffffffffffffffff] -/// Output Bounds: -/// out1: [0x0 ~> 0xffffffffffffffff] -/// out2: [0x0 ~> 0x1] +/// Subtract two limbs and a borrow bit, returning the difference modulo 2^64 and the borrow bit. fn subborrowxU64(out1: *u64, out2: *u1, arg1: u1, arg2: u64, arg3: u64) void { - const x = @as(u128, arg2) -% arg3 -% arg1; - out1.* = @truncate(x); - out2.* = @truncate(x >> 64); + @setRuntimeSafety(mode == .debug); + + const x = @subWithOverflow(arg2, arg3); + const y = @subWithOverflow(x[0], arg1); + out1.* = y[0]; + out2.* = x[1] | y[1]; } -/// The function mulxU64 is a multiplication, returning the full double-width result. -/// -/// Postconditions: -/// out1 = (arg1 * arg2) mod 2^64 -/// out2 = ⌊arg1 * arg2 / 2^64⌋ -/// -/// Input Bounds: -/// arg1: [0x0 ~> 0xffffffffffffffff] -/// arg2: [0x0 ~> 0xffffffffffffffff] -/// Output Bounds: -/// out1: [0x0 ~> 0xffffffffffffffff] -/// out2: [0x0 ~> 0xffffffffffffffff] +/// Multiply two limbs, returning the low and high halves of the product. fn mulxU64(out1: *u64, out2: *u64, arg1: u64, arg2: u64) void { @setRuntimeSafety(mode == .debug); - const x = @as(u128, arg1) * @as(u128, arg2); - out1.* = @as(u64, @truncate(x)); - out2.* = @as(u64, @truncate(x >> 64)); + const x = @as(u128, arg1) * arg2; + out1.* = @truncate(x); + out2.* = @intCast(x >> 64); } -/// The function cmovznzU64 is a single-word conditional move. -/// -/// Postconditions: -/// out1 = (if arg1 = 0 then arg2 else arg3) -/// -/// Input Bounds: -/// arg1: [0x0 ~> 0x1] -/// arg2: [0x0 ~> 0xffffffffffffffff] -/// arg3: [0x0 ~> 0xffffffffffffffff] -/// Output Bounds: -/// out1: [0x0 ~> 0xffffffffffffffff] +/// Keep selection masks opaque to the optimizer without adding instructions. +fn selectionMaskU64(arg1: u1) u64 { + @setRuntimeSafety(mode == .debug); + + const value: u64 = 0 -% @as(u64, arg1); + if (@inComptime()) return value; + switch (@import("builtin").zig_backend) { + .stage2_c, .stage2_wasm => return value, + else => {}, + } + if (@bitSizeOf(u64) <= @bitSizeOf(usize)) { + return asm ("" + : [mask] "=r" (-> u64), + : [value] "0" (value), + ); + } + var mask: u64 = 0; + inline for (0..@divExact(@bitSizeOf(u64), @bitSizeOf(usize))) |i| { + const shift = i * @bitSizeOf(usize); + const chunk: usize = @truncate(value >> shift); + const part = asm ("" + : [mask] "=r" (-> usize), + : [value] "0" (chunk), + ); + mask |= @as(u64, part) << shift; + } + return mask; +} + +/// Select arg2 when arg1 is zero and arg3 otherwise, using a bit mask. fn cmovznzU64(out1: *u64, arg1: u1, arg2: u64, arg3: u64) void { @setRuntimeSafety(mode == .debug); - const mask = 0 -% @as(u64, arg1); - out1.* = (mask & arg3) | ((~mask) & arg2); + const mask = selectionMaskU64(arg1); + out1.* = arg2 ^ ((arg2 ^ arg3) & mask); } /// The function mul multiplies two field elements in the Montgomery domain. @@ -116,22 +105,22 @@ fn cmovznzU64(out1: *u64, arg1: u1, arg2: u64, arg3: u64) void { pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldElement, arg2: MontgomeryDomainFieldElement) void { @setRuntimeSafety(mode == .debug); - const x1 = (arg1[1]); - const x2 = (arg1[2]); - const x3 = (arg1[3]); - const x4 = (arg1[0]); + const x1: u64 = arg1[1]; + const x2: u64 = arg1[2]; + const x3: u64 = arg1[3]; + const x4: u64 = arg1[0]; var x5: u64 = undefined; var x6: u64 = undefined; - mulxU64(&x5, &x6, x4, (arg2[3])); + mulxU64(&x5, &x6, x4, arg2[3]); var x7: u64 = undefined; var x8: u64 = undefined; - mulxU64(&x7, &x8, x4, (arg2[2])); + mulxU64(&x7, &x8, x4, arg2[2]); var x9: u64 = undefined; var x10: u64 = undefined; - mulxU64(&x9, &x10, x4, (arg2[1])); + mulxU64(&x9, &x10, x4, arg2[1]); var x11: u64 = undefined; var x12: u64 = undefined; - mulxU64(&x11, &x12, x4, (arg2[0])); + mulxU64(&x11, &x12, x4, arg2[0]); var x13: u64 = undefined; var x14: u1 = undefined; addcarryxU64(&x13, &x14, 0x0, x12, x9); @@ -141,7 +130,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x17: u64 = undefined; var x18: u1 = undefined; addcarryxU64(&x17, &x18, x16, x8, x5); - const x19 = (@as(u64, x18) + x6); + const x19: u64 = (x18 + x6); var x20: u64 = undefined; var x21: u64 = undefined; mulxU64(&x20, &x21, x11, 0xd838091dd2253531); @@ -166,7 +155,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x34: u64 = undefined; var x35: u1 = undefined; addcarryxU64(&x34, &x35, x33, x25, x22); - const x36 = (@as(u64, x35) + x23); + const x36: u64 = (x35 + x23); var x37: u64 = undefined; var x38: u1 = undefined; addcarryxU64(&x37, &x38, 0x0, x11, x28); @@ -184,16 +173,16 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme addcarryxU64(&x45, &x46, x44, x19, x36); var x47: u64 = undefined; var x48: u64 = undefined; - mulxU64(&x47, &x48, x1, (arg2[3])); + mulxU64(&x47, &x48, x1, arg2[3]); var x49: u64 = undefined; var x50: u64 = undefined; - mulxU64(&x49, &x50, x1, (arg2[2])); + mulxU64(&x49, &x50, x1, arg2[2]); var x51: u64 = undefined; var x52: u64 = undefined; - mulxU64(&x51, &x52, x1, (arg2[1])); + mulxU64(&x51, &x52, x1, arg2[1]); var x53: u64 = undefined; var x54: u64 = undefined; - mulxU64(&x53, &x54, x1, (arg2[0])); + mulxU64(&x53, &x54, x1, arg2[0]); var x55: u64 = undefined; var x56: u1 = undefined; addcarryxU64(&x55, &x56, 0x0, x54, x51); @@ -203,7 +192,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x59: u64 = undefined; var x60: u1 = undefined; addcarryxU64(&x59, &x60, x58, x50, x47); - const x61 = (@as(u64, x60) + x48); + const x61: u64 = (x60 + x48); var x62: u64 = undefined; var x63: u1 = undefined; addcarryxU64(&x62, &x63, 0x0, x39, x53); @@ -218,7 +207,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme addcarryxU64(&x68, &x69, x67, x45, x59); var x70: u64 = undefined; var x71: u1 = undefined; - addcarryxU64(&x70, &x71, x69, @as(u64, x46), x61); + addcarryxU64(&x70, &x71, x69, x46, x61); var x72: u64 = undefined; var x73: u64 = undefined; mulxU64(&x72, &x73, x62, 0xd838091dd2253531); @@ -243,7 +232,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x86: u64 = undefined; var x87: u1 = undefined; addcarryxU64(&x86, &x87, x85, x77, x74); - const x88 = (@as(u64, x87) + x75); + const x88: u64 = (x87 + x75); var x89: u64 = undefined; var x90: u1 = undefined; addcarryxU64(&x89, &x90, 0x0, x62, x80); @@ -259,19 +248,19 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x97: u64 = undefined; var x98: u1 = undefined; addcarryxU64(&x97, &x98, x96, x70, x88); - const x99 = (@as(u64, x98) + @as(u64, x71)); + const x99: u64 = (@as(u64, x98) + x71); var x100: u64 = undefined; var x101: u64 = undefined; - mulxU64(&x100, &x101, x2, (arg2[3])); + mulxU64(&x100, &x101, x2, arg2[3]); var x102: u64 = undefined; var x103: u64 = undefined; - mulxU64(&x102, &x103, x2, (arg2[2])); + mulxU64(&x102, &x103, x2, arg2[2]); var x104: u64 = undefined; var x105: u64 = undefined; - mulxU64(&x104, &x105, x2, (arg2[1])); + mulxU64(&x104, &x105, x2, arg2[1]); var x106: u64 = undefined; var x107: u64 = undefined; - mulxU64(&x106, &x107, x2, (arg2[0])); + mulxU64(&x106, &x107, x2, arg2[0]); var x108: u64 = undefined; var x109: u1 = undefined; addcarryxU64(&x108, &x109, 0x0, x107, x104); @@ -281,7 +270,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x112: u64 = undefined; var x113: u1 = undefined; addcarryxU64(&x112, &x113, x111, x103, x100); - const x114 = (@as(u64, x113) + x101); + const x114: u64 = (x113 + x101); var x115: u64 = undefined; var x116: u1 = undefined; addcarryxU64(&x115, &x116, 0x0, x91, x106); @@ -321,7 +310,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x139: u64 = undefined; var x140: u1 = undefined; addcarryxU64(&x139, &x140, x138, x130, x127); - const x141 = (@as(u64, x140) + x128); + const x141: u64 = (x140 + x128); var x142: u64 = undefined; var x143: u1 = undefined; addcarryxU64(&x142, &x143, 0x0, x115, x133); @@ -337,19 +326,19 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x150: u64 = undefined; var x151: u1 = undefined; addcarryxU64(&x150, &x151, x149, x123, x141); - const x152 = (@as(u64, x151) + @as(u64, x124)); + const x152: u64 = (@as(u64, x151) + x124); var x153: u64 = undefined; var x154: u64 = undefined; - mulxU64(&x153, &x154, x3, (arg2[3])); + mulxU64(&x153, &x154, x3, arg2[3]); var x155: u64 = undefined; var x156: u64 = undefined; - mulxU64(&x155, &x156, x3, (arg2[2])); + mulxU64(&x155, &x156, x3, arg2[2]); var x157: u64 = undefined; var x158: u64 = undefined; - mulxU64(&x157, &x158, x3, (arg2[1])); + mulxU64(&x157, &x158, x3, arg2[1]); var x159: u64 = undefined; var x160: u64 = undefined; - mulxU64(&x159, &x160, x3, (arg2[0])); + mulxU64(&x159, &x160, x3, arg2[0]); var x161: u64 = undefined; var x162: u1 = undefined; addcarryxU64(&x161, &x162, 0x0, x160, x157); @@ -359,7 +348,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x165: u64 = undefined; var x166: u1 = undefined; addcarryxU64(&x165, &x166, x164, x156, x153); - const x167 = (@as(u64, x166) + x154); + const x167: u64 = (x166 + x154); var x168: u64 = undefined; var x169: u1 = undefined; addcarryxU64(&x168, &x169, 0x0, x144, x159); @@ -399,7 +388,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x192: u64 = undefined; var x193: u1 = undefined; addcarryxU64(&x192, &x193, x191, x183, x180); - const x194 = (@as(u64, x193) + x181); + const x194: u64 = (x193 + x181); var x195: u64 = undefined; var x196: u1 = undefined; addcarryxU64(&x195, &x196, 0x0, x168, x186); @@ -415,7 +404,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x203: u64 = undefined; var x204: u1 = undefined; addcarryxU64(&x203, &x204, x202, x176, x194); - const x205 = (@as(u64, x204) + @as(u64, x177)); + const x205: u64 = (@as(u64, x204) + x177); var x206: u64 = undefined; var x207: u1 = undefined; subborrowxU64(&x206, &x207, 0x0, x197, 0xfffffffefffffc2f); @@ -432,13 +421,14 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x215: u1 = undefined; subborrowxU64(&x214, &x215, x213, x205, 0x0); var x216: u64 = undefined; - cmovznzU64(&x216, x215, x206, x197); + const x216_selection_mask = selectionMaskU64(x215); + x216 = x206 ^ ((x206 ^ x197) & x216_selection_mask); var x217: u64 = undefined; - cmovznzU64(&x217, x215, x208, x199); + x217 = x208 ^ ((x208 ^ x199) & x216_selection_mask); var x218: u64 = undefined; - cmovznzU64(&x218, x215, x210, x201); + x218 = x210 ^ ((x210 ^ x201) & x216_selection_mask); var x219: u64 = undefined; - cmovznzU64(&x219, x215, x212, x203); + x219 = x212 ^ ((x212 ^ x203) & x216_selection_mask); out1[0] = x216; out1[1] = x217; out1[2] = x218; @@ -456,22 +446,22 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldElement) void { @setRuntimeSafety(mode == .debug); - const x1 = (arg1[1]); - const x2 = (arg1[2]); - const x3 = (arg1[3]); - const x4 = (arg1[0]); + const x1: u64 = arg1[1]; + const x2: u64 = arg1[2]; + const x3: u64 = arg1[3]; + const x4: u64 = arg1[0]; var x5: u64 = undefined; var x6: u64 = undefined; - mulxU64(&x5, &x6, x4, (arg1[3])); + mulxU64(&x5, &x6, x4, arg1[3]); var x7: u64 = undefined; var x8: u64 = undefined; - mulxU64(&x7, &x8, x4, (arg1[2])); + mulxU64(&x7, &x8, x4, arg1[2]); var x9: u64 = undefined; var x10: u64 = undefined; - mulxU64(&x9, &x10, x4, (arg1[1])); + mulxU64(&x9, &x10, x4, arg1[1]); var x11: u64 = undefined; var x12: u64 = undefined; - mulxU64(&x11, &x12, x4, (arg1[0])); + mulxU64(&x11, &x12, x4, arg1[0]); var x13: u64 = undefined; var x14: u1 = undefined; addcarryxU64(&x13, &x14, 0x0, x12, x9); @@ -481,7 +471,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x17: u64 = undefined; var x18: u1 = undefined; addcarryxU64(&x17, &x18, x16, x8, x5); - const x19 = (@as(u64, x18) + x6); + const x19: u64 = (x18 + x6); var x20: u64 = undefined; var x21: u64 = undefined; mulxU64(&x20, &x21, x11, 0xd838091dd2253531); @@ -506,7 +496,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x34: u64 = undefined; var x35: u1 = undefined; addcarryxU64(&x34, &x35, x33, x25, x22); - const x36 = (@as(u64, x35) + x23); + const x36: u64 = (x35 + x23); var x37: u64 = undefined; var x38: u1 = undefined; addcarryxU64(&x37, &x38, 0x0, x11, x28); @@ -524,16 +514,16 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl addcarryxU64(&x45, &x46, x44, x19, x36); var x47: u64 = undefined; var x48: u64 = undefined; - mulxU64(&x47, &x48, x1, (arg1[3])); + mulxU64(&x47, &x48, x1, arg1[3]); var x49: u64 = undefined; var x50: u64 = undefined; - mulxU64(&x49, &x50, x1, (arg1[2])); + mulxU64(&x49, &x50, x1, arg1[2]); var x51: u64 = undefined; var x52: u64 = undefined; - mulxU64(&x51, &x52, x1, (arg1[1])); + mulxU64(&x51, &x52, x1, arg1[1]); var x53: u64 = undefined; var x54: u64 = undefined; - mulxU64(&x53, &x54, x1, (arg1[0])); + mulxU64(&x53, &x54, x1, arg1[0]); var x55: u64 = undefined; var x56: u1 = undefined; addcarryxU64(&x55, &x56, 0x0, x54, x51); @@ -543,7 +533,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x59: u64 = undefined; var x60: u1 = undefined; addcarryxU64(&x59, &x60, x58, x50, x47); - const x61 = (@as(u64, x60) + x48); + const x61: u64 = (x60 + x48); var x62: u64 = undefined; var x63: u1 = undefined; addcarryxU64(&x62, &x63, 0x0, x39, x53); @@ -558,7 +548,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl addcarryxU64(&x68, &x69, x67, x45, x59); var x70: u64 = undefined; var x71: u1 = undefined; - addcarryxU64(&x70, &x71, x69, @as(u64, x46), x61); + addcarryxU64(&x70, &x71, x69, x46, x61); var x72: u64 = undefined; var x73: u64 = undefined; mulxU64(&x72, &x73, x62, 0xd838091dd2253531); @@ -583,7 +573,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x86: u64 = undefined; var x87: u1 = undefined; addcarryxU64(&x86, &x87, x85, x77, x74); - const x88 = (@as(u64, x87) + x75); + const x88: u64 = (x87 + x75); var x89: u64 = undefined; var x90: u1 = undefined; addcarryxU64(&x89, &x90, 0x0, x62, x80); @@ -599,19 +589,19 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x97: u64 = undefined; var x98: u1 = undefined; addcarryxU64(&x97, &x98, x96, x70, x88); - const x99 = (@as(u64, x98) + @as(u64, x71)); + const x99: u64 = (@as(u64, x98) + x71); var x100: u64 = undefined; var x101: u64 = undefined; - mulxU64(&x100, &x101, x2, (arg1[3])); + mulxU64(&x100, &x101, x2, arg1[3]); var x102: u64 = undefined; var x103: u64 = undefined; - mulxU64(&x102, &x103, x2, (arg1[2])); + mulxU64(&x102, &x103, x2, arg1[2]); var x104: u64 = undefined; var x105: u64 = undefined; - mulxU64(&x104, &x105, x2, (arg1[1])); + mulxU64(&x104, &x105, x2, arg1[1]); var x106: u64 = undefined; var x107: u64 = undefined; - mulxU64(&x106, &x107, x2, (arg1[0])); + mulxU64(&x106, &x107, x2, arg1[0]); var x108: u64 = undefined; var x109: u1 = undefined; addcarryxU64(&x108, &x109, 0x0, x107, x104); @@ -621,7 +611,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x112: u64 = undefined; var x113: u1 = undefined; addcarryxU64(&x112, &x113, x111, x103, x100); - const x114 = (@as(u64, x113) + x101); + const x114: u64 = (x113 + x101); var x115: u64 = undefined; var x116: u1 = undefined; addcarryxU64(&x115, &x116, 0x0, x91, x106); @@ -661,7 +651,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x139: u64 = undefined; var x140: u1 = undefined; addcarryxU64(&x139, &x140, x138, x130, x127); - const x141 = (@as(u64, x140) + x128); + const x141: u64 = (x140 + x128); var x142: u64 = undefined; var x143: u1 = undefined; addcarryxU64(&x142, &x143, 0x0, x115, x133); @@ -677,19 +667,19 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x150: u64 = undefined; var x151: u1 = undefined; addcarryxU64(&x150, &x151, x149, x123, x141); - const x152 = (@as(u64, x151) + @as(u64, x124)); + const x152: u64 = (@as(u64, x151) + x124); var x153: u64 = undefined; var x154: u64 = undefined; - mulxU64(&x153, &x154, x3, (arg1[3])); + mulxU64(&x153, &x154, x3, arg1[3]); var x155: u64 = undefined; var x156: u64 = undefined; - mulxU64(&x155, &x156, x3, (arg1[2])); + mulxU64(&x155, &x156, x3, arg1[2]); var x157: u64 = undefined; var x158: u64 = undefined; - mulxU64(&x157, &x158, x3, (arg1[1])); + mulxU64(&x157, &x158, x3, arg1[1]); var x159: u64 = undefined; var x160: u64 = undefined; - mulxU64(&x159, &x160, x3, (arg1[0])); + mulxU64(&x159, &x160, x3, arg1[0]); var x161: u64 = undefined; var x162: u1 = undefined; addcarryxU64(&x161, &x162, 0x0, x160, x157); @@ -699,7 +689,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x165: u64 = undefined; var x166: u1 = undefined; addcarryxU64(&x165, &x166, x164, x156, x153); - const x167 = (@as(u64, x166) + x154); + const x167: u64 = (x166 + x154); var x168: u64 = undefined; var x169: u1 = undefined; addcarryxU64(&x168, &x169, 0x0, x144, x159); @@ -739,7 +729,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x192: u64 = undefined; var x193: u1 = undefined; addcarryxU64(&x192, &x193, x191, x183, x180); - const x194 = (@as(u64, x193) + x181); + const x194: u64 = (x193 + x181); var x195: u64 = undefined; var x196: u1 = undefined; addcarryxU64(&x195, &x196, 0x0, x168, x186); @@ -755,7 +745,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x203: u64 = undefined; var x204: u1 = undefined; addcarryxU64(&x203, &x204, x202, x176, x194); - const x205 = (@as(u64, x204) + @as(u64, x177)); + const x205: u64 = (@as(u64, x204) + x177); var x206: u64 = undefined; var x207: u1 = undefined; subborrowxU64(&x206, &x207, 0x0, x197, 0xfffffffefffffc2f); @@ -772,13 +762,14 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x215: u1 = undefined; subborrowxU64(&x214, &x215, x213, x205, 0x0); var x216: u64 = undefined; - cmovznzU64(&x216, x215, x206, x197); + const x216_selection_mask = selectionMaskU64(x215); + x216 = x206 ^ ((x206 ^ x197) & x216_selection_mask); var x217: u64 = undefined; - cmovznzU64(&x217, x215, x208, x199); + x217 = x208 ^ ((x208 ^ x199) & x216_selection_mask); var x218: u64 = undefined; - cmovznzU64(&x218, x215, x210, x201); + x218 = x210 ^ ((x210 ^ x201) & x216_selection_mask); var x219: u64 = undefined; - cmovznzU64(&x219, x215, x212, x203); + x219 = x212 ^ ((x212 ^ x203) & x216_selection_mask); out1[0] = x216; out1[1] = x217; out1[2] = x218; @@ -799,16 +790,16 @@ pub fn add(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x1: u64 = undefined; var x2: u1 = undefined; - addcarryxU64(&x1, &x2, 0x0, (arg1[0]), (arg2[0])); + addcarryxU64(&x1, &x2, 0x0, arg1[0], arg2[0]); var x3: u64 = undefined; var x4: u1 = undefined; - addcarryxU64(&x3, &x4, x2, (arg1[1]), (arg2[1])); + addcarryxU64(&x3, &x4, x2, arg1[1], arg2[1]); var x5: u64 = undefined; var x6: u1 = undefined; - addcarryxU64(&x5, &x6, x4, (arg1[2]), (arg2[2])); + addcarryxU64(&x5, &x6, x4, arg1[2], arg2[2]); var x7: u64 = undefined; var x8: u1 = undefined; - addcarryxU64(&x7, &x8, x6, (arg1[3]), (arg2[3])); + addcarryxU64(&x7, &x8, x6, arg1[3], arg2[3]); var x9: u64 = undefined; var x10: u1 = undefined; subborrowxU64(&x9, &x10, 0x0, x1, 0xfffffffefffffc2f); @@ -823,15 +814,16 @@ pub fn add(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme subborrowxU64(&x15, &x16, x14, x7, 0xffffffffffffffff); var x17: u64 = undefined; var x18: u1 = undefined; - subborrowxU64(&x17, &x18, x16, @as(u64, x8), 0x0); + subborrowxU64(&x17, &x18, x16, x8, 0x0); var x19: u64 = undefined; - cmovznzU64(&x19, x18, x9, x1); + const x19_selection_mask = selectionMaskU64(x18); + x19 = x9 ^ ((x9 ^ x1) & x19_selection_mask); var x20: u64 = undefined; - cmovznzU64(&x20, x18, x11, x3); + x20 = x11 ^ ((x11 ^ x3) & x19_selection_mask); var x21: u64 = undefined; - cmovznzU64(&x21, x18, x13, x5); + x21 = x13 ^ ((x13 ^ x5) & x19_selection_mask); var x22: u64 = undefined; - cmovznzU64(&x22, x18, x15, x7); + x22 = x15 ^ ((x15 ^ x7) & x19_selection_mask); out1[0] = x19; out1[1] = x20; out1[2] = x21; @@ -852,18 +844,19 @@ pub fn sub(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x1: u64 = undefined; var x2: u1 = undefined; - subborrowxU64(&x1, &x2, 0x0, (arg1[0]), (arg2[0])); + subborrowxU64(&x1, &x2, 0x0, arg1[0], arg2[0]); var x3: u64 = undefined; var x4: u1 = undefined; - subborrowxU64(&x3, &x4, x2, (arg1[1]), (arg2[1])); + subborrowxU64(&x3, &x4, x2, arg1[1], arg2[1]); var x5: u64 = undefined; var x6: u1 = undefined; - subborrowxU64(&x5, &x6, x4, (arg1[2]), (arg2[2])); + subborrowxU64(&x5, &x6, x4, arg1[2], arg2[2]); var x7: u64 = undefined; var x8: u1 = undefined; - subborrowxU64(&x7, &x8, x6, (arg1[3]), (arg2[3])); + subborrowxU64(&x7, &x8, x6, arg1[3], arg2[3]); var x9: u64 = undefined; - cmovznzU64(&x9, x8, 0x0, 0xffffffffffffffff); + const x9_selection_mask = selectionMaskU64(x8); + x9 = 0x0 ^ ((0x0 ^ 0xffffffffffffffff) & x9_selection_mask); var x10: u64 = undefined; var x11: u1 = undefined; addcarryxU64(&x10, &x11, 0x0, x1, (x9 & 0xfffffffefffffc2f)); @@ -895,18 +888,19 @@ pub fn opp(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x1: u64 = undefined; var x2: u1 = undefined; - subborrowxU64(&x1, &x2, 0x0, 0x0, (arg1[0])); + subborrowxU64(&x1, &x2, 0x0, 0x0, arg1[0]); var x3: u64 = undefined; var x4: u1 = undefined; - subborrowxU64(&x3, &x4, x2, 0x0, (arg1[1])); + subborrowxU64(&x3, &x4, x2, 0x0, arg1[1]); var x5: u64 = undefined; var x6: u1 = undefined; - subborrowxU64(&x5, &x6, x4, 0x0, (arg1[2])); + subborrowxU64(&x5, &x6, x4, 0x0, arg1[2]); var x7: u64 = undefined; var x8: u1 = undefined; - subborrowxU64(&x7, &x8, x6, 0x0, (arg1[3])); + subborrowxU64(&x7, &x8, x6, 0x0, arg1[3]); var x9: u64 = undefined; - cmovznzU64(&x9, x8, 0x0, 0xffffffffffffffff); + const x9_selection_mask = selectionMaskU64(x8); + x9 = 0x0 ^ ((0x0 ^ 0xffffffffffffffff) & x9_selection_mask); var x10: u64 = undefined; var x11: u1 = undefined; addcarryxU64(&x10, &x11, 0x0, x1, (x9 & 0xfffffffefffffc2f)); @@ -936,7 +930,7 @@ pub fn opp(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldElement) void { @setRuntimeSafety(mode == .debug); - const x1 = (arg1[0]); + const x1: u64 = arg1[0]; var x2: u64 = undefined; var x3: u64 = undefined; mulxU64(&x2, &x3, x1, 0xd838091dd2253531); @@ -975,10 +969,10 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo addcarryxU64(&x24, &x25, x23, 0x0, x16); var x26: u64 = undefined; var x27: u1 = undefined; - addcarryxU64(&x26, &x27, x25, 0x0, (@as(u64, x17) + x5)); + addcarryxU64(&x26, &x27, x25, 0x0, (x17 + x5)); var x28: u64 = undefined; var x29: u1 = undefined; - addcarryxU64(&x28, &x29, 0x0, x20, (arg1[1])); + addcarryxU64(&x28, &x29, 0x0, x20, arg1[1]); var x30: u64 = undefined; var x31: u1 = undefined; addcarryxU64(&x30, &x31, x29, x22, 0x0); @@ -1026,10 +1020,10 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo addcarryxU64(&x58, &x59, x57, x34, x50); var x60: u64 = undefined; var x61: u1 = undefined; - addcarryxU64(&x60, &x61, x59, (@as(u64, x35) + @as(u64, x27)), (@as(u64, x51) + x39)); + addcarryxU64(&x60, &x61, x59, (@as(u64, x35) + x27), (x51 + x39)); var x62: u64 = undefined; var x63: u1 = undefined; - addcarryxU64(&x62, &x63, 0x0, x54, (arg1[2])); + addcarryxU64(&x62, &x63, 0x0, x54, arg1[2]); var x64: u64 = undefined; var x65: u1 = undefined; addcarryxU64(&x64, &x65, x63, x56, 0x0); @@ -1077,10 +1071,10 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo addcarryxU64(&x92, &x93, x91, x68, x84); var x94: u64 = undefined; var x95: u1 = undefined; - addcarryxU64(&x94, &x95, x93, (@as(u64, x69) + @as(u64, x61)), (@as(u64, x85) + x73)); + addcarryxU64(&x94, &x95, x93, (@as(u64, x69) + x61), (x85 + x73)); var x96: u64 = undefined; var x97: u1 = undefined; - addcarryxU64(&x96, &x97, 0x0, x88, (arg1[3])); + addcarryxU64(&x96, &x97, 0x0, x88, arg1[3]); var x98: u64 = undefined; var x99: u1 = undefined; addcarryxU64(&x98, &x99, x97, x90, 0x0); @@ -1128,7 +1122,7 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo addcarryxU64(&x126, &x127, x125, x102, x118); var x128: u64 = undefined; var x129: u1 = undefined; - addcarryxU64(&x128, &x129, x127, (@as(u64, x103) + @as(u64, x95)), (@as(u64, x119) + x107)); + addcarryxU64(&x128, &x129, x127, (@as(u64, x103) + x95), (x119 + x107)); var x130: u64 = undefined; var x131: u1 = undefined; subborrowxU64(&x130, &x131, 0x0, x122, 0xfffffffefffffc2f); @@ -1143,15 +1137,16 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo subborrowxU64(&x136, &x137, x135, x128, 0xffffffffffffffff); var x138: u64 = undefined; var x139: u1 = undefined; - subborrowxU64(&x138, &x139, x137, @as(u64, x129), 0x0); + subborrowxU64(&x138, &x139, x137, x129, 0x0); var x140: u64 = undefined; - cmovznzU64(&x140, x139, x130, x122); + const x140_selection_mask = selectionMaskU64(x139); + x140 = x130 ^ ((x130 ^ x122) & x140_selection_mask); var x141: u64 = undefined; - cmovznzU64(&x141, x139, x132, x124); + x141 = x132 ^ ((x132 ^ x124) & x140_selection_mask); var x142: u64 = undefined; - cmovznzU64(&x142, x139, x134, x126); + x142 = x134 ^ ((x134 ^ x126) & x140_selection_mask); var x143: u64 = undefined; - cmovznzU64(&x143, x139, x136, x128); + x143 = x136 ^ ((x136 ^ x128) & x140_selection_mask); out1[0] = x140; out1[1] = x141; out1[2] = x142; @@ -1169,10 +1164,10 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDomainFieldElement) void { @setRuntimeSafety(mode == .debug); - const x1 = (arg1[1]); - const x2 = (arg1[2]); - const x3 = (arg1[3]); - const x4 = (arg1[0]); + const x1: u64 = arg1[1]; + const x2: u64 = arg1[2]; + const x3: u64 = arg1[3]; + const x4: u64 = arg1[0]; var x5: u64 = undefined; var x6: u64 = undefined; mulxU64(&x5, &x6, x4, 0x7a2000e90a1); @@ -1211,13 +1206,13 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma addcarryxU64(&x27, &x28, x26, x7, x19); var x29: u64 = undefined; var x30: u1 = undefined; - addcarryxU64(&x29, &x30, x28, @as(u64, x8), x21); + addcarryxU64(&x29, &x30, x28, x8, x21); var x31: u64 = undefined; var x32: u1 = undefined; addcarryxU64(&x31, &x32, x30, 0x0, x23); var x33: u64 = undefined; var x34: u1 = undefined; - addcarryxU64(&x33, &x34, x32, 0x0, (@as(u64, x24) + x12)); + addcarryxU64(&x33, &x34, x32, 0x0, (x24 + x12)); var x35: u64 = undefined; var x36: u64 = undefined; mulxU64(&x35, &x36, x1, 0x7a2000e90a1); @@ -1232,7 +1227,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma addcarryxU64(&x41, &x42, x40, x29, x37); var x43: u64 = undefined; var x44: u1 = undefined; - addcarryxU64(&x43, &x44, x42, x31, @as(u64, x38)); + addcarryxU64(&x43, &x44, x42, x31, x38); var x45: u64 = undefined; var x46: u1 = undefined; addcarryxU64(&x45, &x46, x44, x33, 0x0); @@ -1274,7 +1269,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma addcarryxU64(&x69, &x70, x68, x45, x61); var x71: u64 = undefined; var x72: u1 = undefined; - addcarryxU64(&x71, &x72, x70, (@as(u64, x46) + @as(u64, x34)), (@as(u64, x62) + x50)); + addcarryxU64(&x71, &x72, x70, (@as(u64, x46) + x34), (x62 + x50)); var x73: u64 = undefined; var x74: u64 = undefined; mulxU64(&x73, &x74, x2, 0x7a2000e90a1); @@ -1289,7 +1284,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma addcarryxU64(&x79, &x80, x78, x67, x75); var x81: u64 = undefined; var x82: u1 = undefined; - addcarryxU64(&x81, &x82, x80, x69, @as(u64, x76)); + addcarryxU64(&x81, &x82, x80, x69, x76); var x83: u64 = undefined; var x84: u1 = undefined; addcarryxU64(&x83, &x84, x82, x71, 0x0); @@ -1331,7 +1326,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma addcarryxU64(&x107, &x108, x106, x83, x99); var x109: u64 = undefined; var x110: u1 = undefined; - addcarryxU64(&x109, &x110, x108, (@as(u64, x84) + @as(u64, x72)), (@as(u64, x100) + x88)); + addcarryxU64(&x109, &x110, x108, (@as(u64, x84) + x72), (x100 + x88)); var x111: u64 = undefined; var x112: u64 = undefined; mulxU64(&x111, &x112, x3, 0x7a2000e90a1); @@ -1346,7 +1341,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma addcarryxU64(&x117, &x118, x116, x105, x113); var x119: u64 = undefined; var x120: u1 = undefined; - addcarryxU64(&x119, &x120, x118, x107, @as(u64, x114)); + addcarryxU64(&x119, &x120, x118, x107, x114); var x121: u64 = undefined; var x122: u1 = undefined; addcarryxU64(&x121, &x122, x120, x109, 0x0); @@ -1388,7 +1383,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma addcarryxU64(&x145, &x146, x144, x121, x137); var x147: u64 = undefined; var x148: u1 = undefined; - addcarryxU64(&x147, &x148, x146, (@as(u64, x122) + @as(u64, x110)), (@as(u64, x138) + x126)); + addcarryxU64(&x147, &x148, x146, (@as(u64, x122) + x110), (x138 + x126)); var x149: u64 = undefined; var x150: u1 = undefined; subborrowxU64(&x149, &x150, 0x0, x141, 0xfffffffefffffc2f); @@ -1403,15 +1398,16 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma subborrowxU64(&x155, &x156, x154, x147, 0xffffffffffffffff); var x157: u64 = undefined; var x158: u1 = undefined; - subborrowxU64(&x157, &x158, x156, @as(u64, x148), 0x0); + subborrowxU64(&x157, &x158, x156, x148, 0x0); var x159: u64 = undefined; - cmovznzU64(&x159, x158, x149, x141); + const x159_selection_mask = selectionMaskU64(x158); + x159 = x149 ^ ((x149 ^ x141) & x159_selection_mask); var x160: u64 = undefined; - cmovznzU64(&x160, x158, x151, x143); + x160 = x151 ^ ((x151 ^ x143) & x159_selection_mask); var x161: u64 = undefined; - cmovznzU64(&x161, x158, x153, x145); + x161 = x153 ^ ((x153 ^ x145) & x159_selection_mask); var x162: u64 = undefined; - cmovznzU64(&x162, x158, x155, x147); + x162 = x155 ^ ((x155 ^ x147) & x159_selection_mask); out1[0] = x159; out1[1] = x160; out1[2] = x161; @@ -1432,7 +1428,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma pub fn nonzero(out1: *u64, arg1: [4]u64) void { @setRuntimeSafety(mode == .debug); - const x1 = ((arg1[0]) | ((arg1[1]) | ((arg1[2]) | (arg1[3])))); + const x1: u64 = (arg1[0] | (arg1[1] | (arg1[2] | arg1[3]))); out1.* = x1; } @@ -1451,13 +1447,14 @@ pub fn selectznz(out1: *[4]u64, arg1: u1, arg2: [4]u64, arg3: [4]u64) void { @setRuntimeSafety(mode == .debug); var x1: u64 = undefined; - cmovznzU64(&x1, arg1, (arg2[0]), (arg3[0])); + const x1_selection_mask = selectionMaskU64(arg1); + x1 = arg2[0] ^ ((arg2[0] ^ arg3[0]) & x1_selection_mask); var x2: u64 = undefined; - cmovznzU64(&x2, arg1, (arg2[1]), (arg3[1])); + x2 = arg2[1] ^ ((arg2[1] ^ arg3[1]) & x1_selection_mask); var x3: u64 = undefined; - cmovznzU64(&x3, arg1, (arg2[2]), (arg3[2])); + x3 = arg2[2] ^ ((arg2[2] ^ arg3[2]) & x1_selection_mask); var x4: u64 = undefined; - cmovznzU64(&x4, arg1, (arg2[3]), (arg3[3])); + x4 = arg2[3] ^ ((arg2[3] ^ arg3[3]) & x1_selection_mask); out1[0] = x1; out1[1] = x2; out1[2] = x3; @@ -1478,66 +1475,66 @@ pub fn selectznz(out1: *[4]u64, arg1: u1, arg2: [4]u64, arg3: [4]u64) void { pub fn toBytes(out1: *[32]u8, arg1: [4]u64) void { @setRuntimeSafety(mode == .debug); - const x1 = (arg1[3]); - const x2 = (arg1[2]); - const x3 = (arg1[1]); - const x4 = (arg1[0]); - const x5 = @as(u8, @truncate((x4 & 0xff))); - const x6 = (x4 >> 8); - const x7 = @as(u8, @truncate((x6 & 0xff))); - const x8 = (x6 >> 8); - const x9 = @as(u8, @truncate((x8 & 0xff))); - const x10 = (x8 >> 8); - const x11 = @as(u8, @truncate((x10 & 0xff))); - const x12 = (x10 >> 8); - const x13 = @as(u8, @truncate((x12 & 0xff))); - const x14 = (x12 >> 8); - const x15 = @as(u8, @truncate((x14 & 0xff))); - const x16 = (x14 >> 8); - const x17 = @as(u8, @truncate((x16 & 0xff))); - const x18 = @as(u8, @truncate((x16 >> 8))); - const x19 = @as(u8, @truncate((x3 & 0xff))); - const x20 = (x3 >> 8); - const x21 = @as(u8, @truncate((x20 & 0xff))); - const x22 = (x20 >> 8); - const x23 = @as(u8, @truncate((x22 & 0xff))); - const x24 = (x22 >> 8); - const x25 = @as(u8, @truncate((x24 & 0xff))); - const x26 = (x24 >> 8); - const x27 = @as(u8, @truncate((x26 & 0xff))); - const x28 = (x26 >> 8); - const x29 = @as(u8, @truncate((x28 & 0xff))); - const x30 = (x28 >> 8); - const x31 = @as(u8, @truncate((x30 & 0xff))); - const x32 = @as(u8, @truncate((x30 >> 8))); - const x33 = @as(u8, @truncate((x2 & 0xff))); - const x34 = (x2 >> 8); - const x35 = @as(u8, @truncate((x34 & 0xff))); - const x36 = (x34 >> 8); - const x37 = @as(u8, @truncate((x36 & 0xff))); - const x38 = (x36 >> 8); - const x39 = @as(u8, @truncate((x38 & 0xff))); - const x40 = (x38 >> 8); - const x41 = @as(u8, @truncate((x40 & 0xff))); - const x42 = (x40 >> 8); - const x43 = @as(u8, @truncate((x42 & 0xff))); - const x44 = (x42 >> 8); - const x45 = @as(u8, @truncate((x44 & 0xff))); - const x46 = @as(u8, @truncate((x44 >> 8))); - const x47 = @as(u8, @truncate((x1 & 0xff))); - const x48 = (x1 >> 8); - const x49 = @as(u8, @truncate((x48 & 0xff))); - const x50 = (x48 >> 8); - const x51 = @as(u8, @truncate((x50 & 0xff))); - const x52 = (x50 >> 8); - const x53 = @as(u8, @truncate((x52 & 0xff))); - const x54 = (x52 >> 8); - const x55 = @as(u8, @truncate((x54 & 0xff))); - const x56 = (x54 >> 8); - const x57 = @as(u8, @truncate((x56 & 0xff))); - const x58 = (x56 >> 8); - const x59 = @as(u8, @truncate((x58 & 0xff))); - const x60 = @as(u8, @truncate((x58 >> 8))); + const x1: u64 = arg1[3]; + const x2: u64 = arg1[2]; + const x3: u64 = arg1[1]; + const x4: u64 = arg1[0]; + const x5: u8 = @truncate(x4); + const x6: u64 = (x4 >> 8); + const x7: u8 = @truncate(x6); + const x8: u64 = (x6 >> 8); + const x9: u8 = @truncate(x8); + const x10: u64 = (x8 >> 8); + const x11: u8 = @truncate(x10); + const x12: u64 = (x10 >> 8); + const x13: u8 = @truncate(x12); + const x14: u64 = (x12 >> 8); + const x15: u8 = @truncate(x14); + const x16: u64 = (x14 >> 8); + const x17: u8 = @truncate(x16); + const x18: u8 = @truncate((x16 >> 8)); + const x19: u8 = @truncate(x3); + const x20: u64 = (x3 >> 8); + const x21: u8 = @truncate(x20); + const x22: u64 = (x20 >> 8); + const x23: u8 = @truncate(x22); + const x24: u64 = (x22 >> 8); + const x25: u8 = @truncate(x24); + const x26: u64 = (x24 >> 8); + const x27: u8 = @truncate(x26); + const x28: u64 = (x26 >> 8); + const x29: u8 = @truncate(x28); + const x30: u64 = (x28 >> 8); + const x31: u8 = @truncate(x30); + const x32: u8 = @truncate((x30 >> 8)); + const x33: u8 = @truncate(x2); + const x34: u64 = (x2 >> 8); + const x35: u8 = @truncate(x34); + const x36: u64 = (x34 >> 8); + const x37: u8 = @truncate(x36); + const x38: u64 = (x36 >> 8); + const x39: u8 = @truncate(x38); + const x40: u64 = (x38 >> 8); + const x41: u8 = @truncate(x40); + const x42: u64 = (x40 >> 8); + const x43: u8 = @truncate(x42); + const x44: u64 = (x42 >> 8); + const x45: u8 = @truncate(x44); + const x46: u8 = @truncate((x44 >> 8)); + const x47: u8 = @truncate(x1); + const x48: u64 = (x1 >> 8); + const x49: u8 = @truncate(x48); + const x50: u64 = (x48 >> 8); + const x51: u8 = @truncate(x50); + const x52: u64 = (x50 >> 8); + const x53: u8 = @truncate(x52); + const x54: u64 = (x52 >> 8); + const x55: u8 = @truncate(x54); + const x56: u64 = (x54 >> 8); + const x57: u8 = @truncate(x56); + const x58: u64 = (x56 >> 8); + const x59: u8 = @truncate(x58); + const x60: u8 = @truncate((x58 >> 8)); out1[0] = x5; out1[1] = x7; out1[2] = x9; @@ -1587,66 +1584,66 @@ pub fn toBytes(out1: *[32]u8, arg1: [4]u64) void { pub fn fromBytes(out1: *[4]u64, arg1: [32]u8) void { @setRuntimeSafety(mode == .debug); - const x1 = (@as(u64, (arg1[31])) << 56); - const x2 = (@as(u64, (arg1[30])) << 48); - const x3 = (@as(u64, (arg1[29])) << 40); - const x4 = (@as(u64, (arg1[28])) << 32); - const x5 = (@as(u64, (arg1[27])) << 24); - const x6 = (@as(u64, (arg1[26])) << 16); - const x7 = (@as(u64, (arg1[25])) << 8); - const x8 = (arg1[24]); - const x9 = (@as(u64, (arg1[23])) << 56); - const x10 = (@as(u64, (arg1[22])) << 48); - const x11 = (@as(u64, (arg1[21])) << 40); - const x12 = (@as(u64, (arg1[20])) << 32); - const x13 = (@as(u64, (arg1[19])) << 24); - const x14 = (@as(u64, (arg1[18])) << 16); - const x15 = (@as(u64, (arg1[17])) << 8); - const x16 = (arg1[16]); - const x17 = (@as(u64, (arg1[15])) << 56); - const x18 = (@as(u64, (arg1[14])) << 48); - const x19 = (@as(u64, (arg1[13])) << 40); - const x20 = (@as(u64, (arg1[12])) << 32); - const x21 = (@as(u64, (arg1[11])) << 24); - const x22 = (@as(u64, (arg1[10])) << 16); - const x23 = (@as(u64, (arg1[9])) << 8); - const x24 = (arg1[8]); - const x25 = (@as(u64, (arg1[7])) << 56); - const x26 = (@as(u64, (arg1[6])) << 48); - const x27 = (@as(u64, (arg1[5])) << 40); - const x28 = (@as(u64, (arg1[4])) << 32); - const x29 = (@as(u64, (arg1[3])) << 24); - const x30 = (@as(u64, (arg1[2])) << 16); - const x31 = (@as(u64, (arg1[1])) << 8); - const x32 = (arg1[0]); - const x33 = (x31 + @as(u64, x32)); - const x34 = (x30 + x33); - const x35 = (x29 + x34); - const x36 = (x28 + x35); - const x37 = (x27 + x36); - const x38 = (x26 + x37); - const x39 = (x25 + x38); - const x40 = (x23 + @as(u64, x24)); - const x41 = (x22 + x40); - const x42 = (x21 + x41); - const x43 = (x20 + x42); - const x44 = (x19 + x43); - const x45 = (x18 + x44); - const x46 = (x17 + x45); - const x47 = (x15 + @as(u64, x16)); - const x48 = (x14 + x47); - const x49 = (x13 + x48); - const x50 = (x12 + x49); - const x51 = (x11 + x50); - const x52 = (x10 + x51); - const x53 = (x9 + x52); - const x54 = (x7 + @as(u64, x8)); - const x55 = (x6 + x54); - const x56 = (x5 + x55); - const x57 = (x4 + x56); - const x58 = (x3 + x57); - const x59 = (x2 + x58); - const x60 = (x1 + x59); + const x1: u64 = (@as(u64, arg1[31]) << 56); + const x2: u64 = (@as(u64, arg1[30]) << 48); + const x3: u64 = (@as(u64, arg1[29]) << 40); + const x4: u64 = (@as(u64, arg1[28]) << 32); + const x5: u64 = (@as(u64, arg1[27]) << 24); + const x6: u64 = (@as(u64, arg1[26]) << 16); + const x7: u64 = (@as(u64, arg1[25]) << 8); + const x8: u8 = arg1[24]; + const x9: u64 = (@as(u64, arg1[23]) << 56); + const x10: u64 = (@as(u64, arg1[22]) << 48); + const x11: u64 = (@as(u64, arg1[21]) << 40); + const x12: u64 = (@as(u64, arg1[20]) << 32); + const x13: u64 = (@as(u64, arg1[19]) << 24); + const x14: u64 = (@as(u64, arg1[18]) << 16); + const x15: u64 = (@as(u64, arg1[17]) << 8); + const x16: u8 = arg1[16]; + const x17: u64 = (@as(u64, arg1[15]) << 56); + const x18: u64 = (@as(u64, arg1[14]) << 48); + const x19: u64 = (@as(u64, arg1[13]) << 40); + const x20: u64 = (@as(u64, arg1[12]) << 32); + const x21: u64 = (@as(u64, arg1[11]) << 24); + const x22: u64 = (@as(u64, arg1[10]) << 16); + const x23: u64 = (@as(u64, arg1[9]) << 8); + const x24: u8 = arg1[8]; + const x25: u64 = (@as(u64, arg1[7]) << 56); + const x26: u64 = (@as(u64, arg1[6]) << 48); + const x27: u64 = (@as(u64, arg1[5]) << 40); + const x28: u64 = (@as(u64, arg1[4]) << 32); + const x29: u64 = (@as(u64, arg1[3]) << 24); + const x30: u64 = (@as(u64, arg1[2]) << 16); + const x31: u64 = (@as(u64, arg1[1]) << 8); + const x32: u8 = arg1[0]; + const x33: u64 = (x31 + x32); + const x34: u64 = (x30 + x33); + const x35: u64 = (x29 + x34); + const x36: u64 = (x28 + x35); + const x37: u64 = (x27 + x36); + const x38: u64 = (x26 + x37); + const x39: u64 = (x25 + x38); + const x40: u64 = (x23 + x24); + const x41: u64 = (x22 + x40); + const x42: u64 = (x21 + x41); + const x43: u64 = (x20 + x42); + const x44: u64 = (x19 + x43); + const x45: u64 = (x18 + x44); + const x46: u64 = (x17 + x45); + const x47: u64 = (x15 + x16); + const x48: u64 = (x14 + x47); + const x49: u64 = (x13 + x48); + const x50: u64 = (x12 + x49); + const x51: u64 = (x11 + x50); + const x52: u64 = (x10 + x51); + const x53: u64 = (x9 + x52); + const x54: u64 = (x7 + x8); + const x55: u64 = (x6 + x54); + const x56: u64 = (x5 + x55); + const x57: u64 = (x4 + x56); + const x58: u64 = (x3 + x57); + const x59: u64 = (x2 + x58); + const x60: u64 = (x1 + x59); out1[0] = x39; out1[1] = x46; out1[2] = x53; @@ -1720,55 +1717,57 @@ pub fn divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *[4]u64, out5: *[ var x1: u64 = undefined; var x2: u1 = undefined; addcarryxU64(&x1, &x2, 0x0, (~arg1), 0x1); - const x3 = (@as(u1, @truncate((x1 >> 63))) & @as(u1, @truncate(((arg3[0]) & 0x1)))); + const x3: u1 = (@as(u1, @truncate((x1 >> 63))) & @as(u1, @truncate(arg3[0]))); var x4: u64 = undefined; var x5: u1 = undefined; addcarryxU64(&x4, &x5, 0x0, (~arg1), 0x1); var x6: u64 = undefined; - cmovznzU64(&x6, x3, arg1, x4); + const x6_selection_mask = selectionMaskU64(x3); + x6 = arg1 ^ ((arg1 ^ x4) & x6_selection_mask); var x7: u64 = undefined; - cmovznzU64(&x7, x3, (arg2[0]), (arg3[0])); + x7 = arg2[0] ^ ((arg2[0] ^ arg3[0]) & x6_selection_mask); var x8: u64 = undefined; - cmovznzU64(&x8, x3, (arg2[1]), (arg3[1])); + x8 = arg2[1] ^ ((arg2[1] ^ arg3[1]) & x6_selection_mask); var x9: u64 = undefined; - cmovznzU64(&x9, x3, (arg2[2]), (arg3[2])); + x9 = arg2[2] ^ ((arg2[2] ^ arg3[2]) & x6_selection_mask); var x10: u64 = undefined; - cmovznzU64(&x10, x3, (arg2[3]), (arg3[3])); + x10 = arg2[3] ^ ((arg2[3] ^ arg3[3]) & x6_selection_mask); var x11: u64 = undefined; - cmovznzU64(&x11, x3, (arg2[4]), (arg3[4])); + x11 = arg2[4] ^ ((arg2[4] ^ arg3[4]) & x6_selection_mask); var x12: u64 = undefined; var x13: u1 = undefined; - addcarryxU64(&x12, &x13, 0x0, 0x1, (~(arg2[0]))); + addcarryxU64(&x12, &x13, 0x0, 0x1, (~arg2[0])); var x14: u64 = undefined; var x15: u1 = undefined; - addcarryxU64(&x14, &x15, x13, 0x0, (~(arg2[1]))); + addcarryxU64(&x14, &x15, x13, 0x0, (~arg2[1])); var x16: u64 = undefined; var x17: u1 = undefined; - addcarryxU64(&x16, &x17, x15, 0x0, (~(arg2[2]))); + addcarryxU64(&x16, &x17, x15, 0x0, (~arg2[2])); var x18: u64 = undefined; var x19: u1 = undefined; - addcarryxU64(&x18, &x19, x17, 0x0, (~(arg2[3]))); + addcarryxU64(&x18, &x19, x17, 0x0, (~arg2[3])); var x20: u64 = undefined; var x21: u1 = undefined; - addcarryxU64(&x20, &x21, x19, 0x0, (~(arg2[4]))); + addcarryxU64(&x20, &x21, x19, 0x0, (~arg2[4])); var x22: u64 = undefined; - cmovznzU64(&x22, x3, (arg3[0]), x12); + const x22_selection_mask = selectionMaskU64(x3); + x22 = arg3[0] ^ ((arg3[0] ^ x12) & x22_selection_mask); var x23: u64 = undefined; - cmovznzU64(&x23, x3, (arg3[1]), x14); + x23 = arg3[1] ^ ((arg3[1] ^ x14) & x22_selection_mask); var x24: u64 = undefined; - cmovznzU64(&x24, x3, (arg3[2]), x16); + x24 = arg3[2] ^ ((arg3[2] ^ x16) & x22_selection_mask); var x25: u64 = undefined; - cmovznzU64(&x25, x3, (arg3[3]), x18); + x25 = arg3[3] ^ ((arg3[3] ^ x18) & x22_selection_mask); var x26: u64 = undefined; - cmovznzU64(&x26, x3, (arg3[4]), x20); + x26 = arg3[4] ^ ((arg3[4] ^ x20) & x22_selection_mask); var x27: u64 = undefined; - cmovznzU64(&x27, x3, (arg4[0]), (arg5[0])); + x27 = arg4[0] ^ ((arg4[0] ^ arg5[0]) & x22_selection_mask); var x28: u64 = undefined; - cmovznzU64(&x28, x3, (arg4[1]), (arg5[1])); + x28 = arg4[1] ^ ((arg4[1] ^ arg5[1]) & x22_selection_mask); var x29: u64 = undefined; - cmovznzU64(&x29, x3, (arg4[2]), (arg5[2])); + x29 = arg4[2] ^ ((arg4[2] ^ arg5[2]) & x22_selection_mask); var x30: u64 = undefined; - cmovznzU64(&x30, x3, (arg4[3]), (arg5[3])); + x30 = arg4[3] ^ ((arg4[3] ^ arg5[3]) & x22_selection_mask); var x31: u64 = undefined; var x32: u1 = undefined; addcarryxU64(&x31, &x32, 0x0, x27, x27); @@ -1795,11 +1794,11 @@ pub fn divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *[4]u64, out5: *[ subborrowxU64(&x45, &x46, x44, x37, 0xffffffffffffffff); var x47: u64 = undefined; var x48: u1 = undefined; - subborrowxU64(&x47, &x48, x46, @as(u64, x38), 0x0); - const x49 = (arg4[3]); - const x50 = (arg4[2]); - const x51 = (arg4[1]); - const x52 = (arg4[0]); + subborrowxU64(&x47, &x48, x46, x38, 0x0); + const x49: u64 = arg4[3]; + const x50: u64 = arg4[2]; + const x51: u64 = arg4[1]; + const x52: u64 = arg4[0]; var x53: u64 = undefined; var x54: u1 = undefined; subborrowxU64(&x53, &x54, 0x0, 0x0, x52); @@ -1813,7 +1812,8 @@ pub fn divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *[4]u64, out5: *[ var x60: u1 = undefined; subborrowxU64(&x59, &x60, x58, 0x0, x49); var x61: u64 = undefined; - cmovznzU64(&x61, x60, 0x0, 0xffffffffffffffff); + const x61_selection_mask = selectionMaskU64(x60); + x61 = 0x0 ^ ((0x0 ^ 0xffffffffffffffff) & x61_selection_mask); var x62: u64 = undefined; var x63: u1 = undefined; addcarryxU64(&x62, &x63, 0x0, x53, (x61 & 0xfffffffefffffc2f)); @@ -1827,24 +1827,26 @@ pub fn divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *[4]u64, out5: *[ var x69: u1 = undefined; addcarryxU64(&x68, &x69, x67, x59, x61); var x70: u64 = undefined; - cmovznzU64(&x70, x3, (arg5[0]), x62); + const x70_selection_mask = selectionMaskU64(x3); + x70 = arg5[0] ^ ((arg5[0] ^ x62) & x70_selection_mask); var x71: u64 = undefined; - cmovznzU64(&x71, x3, (arg5[1]), x64); + x71 = arg5[1] ^ ((arg5[1] ^ x64) & x70_selection_mask); var x72: u64 = undefined; - cmovznzU64(&x72, x3, (arg5[2]), x66); + x72 = arg5[2] ^ ((arg5[2] ^ x66) & x70_selection_mask); var x73: u64 = undefined; - cmovznzU64(&x73, x3, (arg5[3]), x68); - const x74 = @as(u1, @truncate((x22 & 0x1))); + x73 = arg5[3] ^ ((arg5[3] ^ x68) & x70_selection_mask); + const x74: u1 = @truncate(x22); var x75: u64 = undefined; - cmovznzU64(&x75, x74, 0x0, x7); + const x75_selection_mask = selectionMaskU64(x74); + x75 = 0x0 ^ ((0x0 ^ x7) & x75_selection_mask); var x76: u64 = undefined; - cmovznzU64(&x76, x74, 0x0, x8); + x76 = 0x0 ^ ((0x0 ^ x8) & x75_selection_mask); var x77: u64 = undefined; - cmovznzU64(&x77, x74, 0x0, x9); + x77 = 0x0 ^ ((0x0 ^ x9) & x75_selection_mask); var x78: u64 = undefined; - cmovznzU64(&x78, x74, 0x0, x10); + x78 = 0x0 ^ ((0x0 ^ x10) & x75_selection_mask); var x79: u64 = undefined; - cmovznzU64(&x79, x74, 0x0, x11); + x79 = 0x0 ^ ((0x0 ^ x11) & x75_selection_mask); var x80: u64 = undefined; var x81: u1 = undefined; addcarryxU64(&x80, &x81, 0x0, x22, x75); @@ -1861,13 +1863,14 @@ pub fn divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *[4]u64, out5: *[ var x89: u1 = undefined; addcarryxU64(&x88, &x89, x87, x26, x79); var x90: u64 = undefined; - cmovznzU64(&x90, x74, 0x0, x27); + const x90_selection_mask = selectionMaskU64(x74); + x90 = 0x0 ^ ((0x0 ^ x27) & x90_selection_mask); var x91: u64 = undefined; - cmovznzU64(&x91, x74, 0x0, x28); + x91 = 0x0 ^ ((0x0 ^ x28) & x90_selection_mask); var x92: u64 = undefined; - cmovznzU64(&x92, x74, 0x0, x29); + x92 = 0x0 ^ ((0x0 ^ x29) & x90_selection_mask); var x93: u64 = undefined; - cmovznzU64(&x93, x74, 0x0, x30); + x93 = 0x0 ^ ((0x0 ^ x30) & x90_selection_mask); var x94: u64 = undefined; var x95: u1 = undefined; addcarryxU64(&x94, &x95, 0x0, x70, x90); @@ -1894,31 +1897,33 @@ pub fn divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *[4]u64, out5: *[ subborrowxU64(&x108, &x109, x107, x100, 0xffffffffffffffff); var x110: u64 = undefined; var x111: u1 = undefined; - subborrowxU64(&x110, &x111, x109, @as(u64, x101), 0x0); + subborrowxU64(&x110, &x111, x109, x101, 0x0); var x112: u64 = undefined; var x113: u1 = undefined; addcarryxU64(&x112, &x113, 0x0, x6, 0x1); - const x114 = ((x80 >> 1) | ((x82 << 63) & 0xffffffffffffffff)); - const x115 = ((x82 >> 1) | ((x84 << 63) & 0xffffffffffffffff)); - const x116 = ((x84 >> 1) | ((x86 << 63) & 0xffffffffffffffff)); - const x117 = ((x86 >> 1) | ((x88 << 63) & 0xffffffffffffffff)); - const x118 = ((x88 & 0x8000000000000000) | (x88 >> 1)); + const x114: u64 = ((x80 >> 1) | ((x82 << 63) & 0xffffffffffffffff)); + const x115: u64 = ((x82 >> 1) | ((x84 << 63) & 0xffffffffffffffff)); + const x116: u64 = ((x84 >> 1) | ((x86 << 63) & 0xffffffffffffffff)); + const x117: u64 = ((x86 >> 1) | ((x88 << 63) & 0xffffffffffffffff)); + const x118: u64 = ((x88 & 0x8000000000000000) | (x88 >> 1)); var x119: u64 = undefined; - cmovznzU64(&x119, x48, x39, x31); + const x119_selection_mask = selectionMaskU64(x48); + x119 = x39 ^ ((x39 ^ x31) & x119_selection_mask); var x120: u64 = undefined; - cmovznzU64(&x120, x48, x41, x33); + x120 = x41 ^ ((x41 ^ x33) & x119_selection_mask); var x121: u64 = undefined; - cmovznzU64(&x121, x48, x43, x35); + x121 = x43 ^ ((x43 ^ x35) & x119_selection_mask); var x122: u64 = undefined; - cmovznzU64(&x122, x48, x45, x37); + x122 = x45 ^ ((x45 ^ x37) & x119_selection_mask); var x123: u64 = undefined; - cmovznzU64(&x123, x111, x102, x94); + const x123_selection_mask = selectionMaskU64(x111); + x123 = x102 ^ ((x102 ^ x94) & x123_selection_mask); var x124: u64 = undefined; - cmovznzU64(&x124, x111, x104, x96); + x124 = x104 ^ ((x104 ^ x96) & x123_selection_mask); var x125: u64 = undefined; - cmovznzU64(&x125, x111, x106, x98); + x125 = x106 ^ ((x106 ^ x98) & x123_selection_mask); var x126: u64 = undefined; - cmovznzU64(&x126, x111, x108, x100); + x126 = x108 ^ ((x108 ^ x100) & x123_selection_mask); out1.* = x112; out2[0] = x7; out2[1] = x8; diff --git a/lib/std/crypto/pcurves/secp256k1/secp256k1_scalar_64.zig b/lib/std/crypto/pcurves/secp256k1/secp256k1_scalar_64.zig index 09bfc15a10d44970b38d7f51b802a28cb908afe5..e4c99385b5e392e74f543d5a80b7abaf9ddf5d9b 100644 --- a/lib/std/crypto/pcurves/secp256k1/secp256k1_scalar_64.zig +++ b/lib/std/crypto/pcurves/secp256k1/secp256k1_scalar_64.zig @@ -17,7 +17,6 @@ // twos_complement_eval z = let x1 := z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) in // if x1 & (2^256-1) < 2^255 then x1 & (2^256-1) else (x1 & (2^256-1)) - 2^256 -const std = @import("std"); const mode = @import("builtin").mode; // Checked arithmetic is disabled in non-debug modes to avoid side channels // The type MontgomeryDomainFieldElement is a field element in the Montgomery domain. @@ -28,80 +27,70 @@ pub const MontgomeryDomainFieldElement = [4]u64; // Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] pub const NonMontgomeryDomainFieldElement = [4]u64; -/// The function addcarryxU64 is an addition with carry. -/// -/// Postconditions: -/// out1 = (arg1 + arg2 + arg3) mod 2^64 -/// out2 = ⌊(arg1 + arg2 + arg3) / 2^64⌋ -/// -/// Input Bounds: -/// arg1: [0x0 ~> 0x1] -/// arg2: [0x0 ~> 0xffffffffffffffff] -/// arg3: [0x0 ~> 0xffffffffffffffff] -/// Output Bounds: -/// out1: [0x0 ~> 0xffffffffffffffff] -/// out2: [0x0 ~> 0x1] +/// Add two limbs and a carry bit, returning the sum modulo 2^64 and the carry bit. fn addcarryxU64(out1: *u64, out2: *u1, arg1: u1, arg2: u64, arg3: u64) void { - const x = @as(u128, arg2) +% arg3 +% arg1; - out1.* = @truncate(x); - out2.* = @truncate(x >> 64); + @setRuntimeSafety(mode == .debug); + + const x = @addWithOverflow(arg2, arg3); + const y = @addWithOverflow(x[0], arg1); + out1.* = y[0]; + out2.* = x[1] | y[1]; } -/// The function subborrowxU64 is a subtraction with borrow. -/// -/// Postconditions: -/// out1 = (-arg1 + arg2 + -arg3) mod 2^64 -/// out2 = -⌊(-arg1 + arg2 + -arg3) / 2^64⌋ -/// -/// Input Bounds: -/// arg1: [0x0 ~> 0x1] -/// arg2: [0x0 ~> 0xffffffffffffffff] -/// arg3: [0x0 ~> 0xffffffffffffffff] -/// Output Bounds: -/// out1: [0x0 ~> 0xffffffffffffffff] -/// out2: [0x0 ~> 0x1] +/// Subtract two limbs and a borrow bit, returning the difference modulo 2^64 and the borrow bit. fn subborrowxU64(out1: *u64, out2: *u1, arg1: u1, arg2: u64, arg3: u64) void { - const x = @as(u128, arg2) -% arg3 -% arg1; - out1.* = @truncate(x); - out2.* = @truncate(x >> 64); + @setRuntimeSafety(mode == .debug); + + const x = @subWithOverflow(arg2, arg3); + const y = @subWithOverflow(x[0], arg1); + out1.* = y[0]; + out2.* = x[1] | y[1]; } -/// The function mulxU64 is a multiplication, returning the full double-width result. -/// -/// Postconditions: -/// out1 = (arg1 * arg2) mod 2^64 -/// out2 = ⌊arg1 * arg2 / 2^64⌋ -/// -/// Input Bounds: -/// arg1: [0x0 ~> 0xffffffffffffffff] -/// arg2: [0x0 ~> 0xffffffffffffffff] -/// Output Bounds: -/// out1: [0x0 ~> 0xffffffffffffffff] -/// out2: [0x0 ~> 0xffffffffffffffff] +/// Multiply two limbs, returning the low and high halves of the product. fn mulxU64(out1: *u64, out2: *u64, arg1: u64, arg2: u64) void { @setRuntimeSafety(mode == .debug); - const x = @as(u128, arg1) * @as(u128, arg2); - out1.* = @as(u64, @truncate(x)); - out2.* = @as(u64, @truncate(x >> 64)); + const x = @as(u128, arg1) * arg2; + out1.* = @truncate(x); + out2.* = @intCast(x >> 64); } -/// The function cmovznzU64 is a single-word conditional move. -/// -/// Postconditions: -/// out1 = (if arg1 = 0 then arg2 else arg3) -/// -/// Input Bounds: -/// arg1: [0x0 ~> 0x1] -/// arg2: [0x0 ~> 0xffffffffffffffff] -/// arg3: [0x0 ~> 0xffffffffffffffff] -/// Output Bounds: -/// out1: [0x0 ~> 0xffffffffffffffff] +/// Keep selection masks opaque to the optimizer without adding instructions. +fn selectionMaskU64(arg1: u1) u64 { + @setRuntimeSafety(mode == .debug); + + const value: u64 = 0 -% @as(u64, arg1); + if (@inComptime()) return value; + switch (@import("builtin").zig_backend) { + .stage2_c, .stage2_wasm => return value, + else => {}, + } + if (@bitSizeOf(u64) <= @bitSizeOf(usize)) { + return asm ("" + : [mask] "=r" (-> u64), + : [value] "0" (value), + ); + } + var mask: u64 = 0; + inline for (0..@divExact(@bitSizeOf(u64), @bitSizeOf(usize))) |i| { + const shift = i * @bitSizeOf(usize); + const chunk: usize = @truncate(value >> shift); + const part = asm ("" + : [mask] "=r" (-> usize), + : [value] "0" (chunk), + ); + mask |= @as(u64, part) << shift; + } + return mask; +} + +/// Select arg2 when arg1 is zero and arg3 otherwise, using a bit mask. fn cmovznzU64(out1: *u64, arg1: u1, arg2: u64, arg3: u64) void { @setRuntimeSafety(mode == .debug); - const mask = 0 -% @as(u64, arg1); - out1.* = (mask & arg3) | ((~mask) & arg2); + const mask = selectionMaskU64(arg1); + out1.* = arg2 ^ ((arg2 ^ arg3) & mask); } /// The function mul multiplies two field elements in the Montgomery domain. @@ -116,22 +105,22 @@ fn cmovznzU64(out1: *u64, arg1: u1, arg2: u64, arg3: u64) void { pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldElement, arg2: MontgomeryDomainFieldElement) void { @setRuntimeSafety(mode == .debug); - const x1 = (arg1[1]); - const x2 = (arg1[2]); - const x3 = (arg1[3]); - const x4 = (arg1[0]); + const x1: u64 = arg1[1]; + const x2: u64 = arg1[2]; + const x3: u64 = arg1[3]; + const x4: u64 = arg1[0]; var x5: u64 = undefined; var x6: u64 = undefined; - mulxU64(&x5, &x6, x4, (arg2[3])); + mulxU64(&x5, &x6, x4, arg2[3]); var x7: u64 = undefined; var x8: u64 = undefined; - mulxU64(&x7, &x8, x4, (arg2[2])); + mulxU64(&x7, &x8, x4, arg2[2]); var x9: u64 = undefined; var x10: u64 = undefined; - mulxU64(&x9, &x10, x4, (arg2[1])); + mulxU64(&x9, &x10, x4, arg2[1]); var x11: u64 = undefined; var x12: u64 = undefined; - mulxU64(&x11, &x12, x4, (arg2[0])); + mulxU64(&x11, &x12, x4, arg2[0]); var x13: u64 = undefined; var x14: u1 = undefined; addcarryxU64(&x13, &x14, 0x0, x12, x9); @@ -141,7 +130,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x17: u64 = undefined; var x18: u1 = undefined; addcarryxU64(&x17, &x18, x16, x8, x5); - const x19 = (@as(u64, x18) + x6); + const x19: u64 = (x18 + x6); var x20: u64 = undefined; var x21: u64 = undefined; mulxU64(&x20, &x21, x11, 0x4b0dff665588b13f); @@ -166,7 +155,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x34: u64 = undefined; var x35: u1 = undefined; addcarryxU64(&x34, &x35, x33, x25, x22); - const x36 = (@as(u64, x35) + x23); + const x36: u64 = (x35 + x23); var x37: u64 = undefined; var x38: u1 = undefined; addcarryxU64(&x37, &x38, 0x0, x11, x28); @@ -184,16 +173,16 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme addcarryxU64(&x45, &x46, x44, x19, x36); var x47: u64 = undefined; var x48: u64 = undefined; - mulxU64(&x47, &x48, x1, (arg2[3])); + mulxU64(&x47, &x48, x1, arg2[3]); var x49: u64 = undefined; var x50: u64 = undefined; - mulxU64(&x49, &x50, x1, (arg2[2])); + mulxU64(&x49, &x50, x1, arg2[2]); var x51: u64 = undefined; var x52: u64 = undefined; - mulxU64(&x51, &x52, x1, (arg2[1])); + mulxU64(&x51, &x52, x1, arg2[1]); var x53: u64 = undefined; var x54: u64 = undefined; - mulxU64(&x53, &x54, x1, (arg2[0])); + mulxU64(&x53, &x54, x1, arg2[0]); var x55: u64 = undefined; var x56: u1 = undefined; addcarryxU64(&x55, &x56, 0x0, x54, x51); @@ -203,7 +192,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x59: u64 = undefined; var x60: u1 = undefined; addcarryxU64(&x59, &x60, x58, x50, x47); - const x61 = (@as(u64, x60) + x48); + const x61: u64 = (x60 + x48); var x62: u64 = undefined; var x63: u1 = undefined; addcarryxU64(&x62, &x63, 0x0, x39, x53); @@ -218,7 +207,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme addcarryxU64(&x68, &x69, x67, x45, x59); var x70: u64 = undefined; var x71: u1 = undefined; - addcarryxU64(&x70, &x71, x69, @as(u64, x46), x61); + addcarryxU64(&x70, &x71, x69, x46, x61); var x72: u64 = undefined; var x73: u64 = undefined; mulxU64(&x72, &x73, x62, 0x4b0dff665588b13f); @@ -243,7 +232,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x86: u64 = undefined; var x87: u1 = undefined; addcarryxU64(&x86, &x87, x85, x77, x74); - const x88 = (@as(u64, x87) + x75); + const x88: u64 = (x87 + x75); var x89: u64 = undefined; var x90: u1 = undefined; addcarryxU64(&x89, &x90, 0x0, x62, x80); @@ -259,19 +248,19 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x97: u64 = undefined; var x98: u1 = undefined; addcarryxU64(&x97, &x98, x96, x70, x88); - const x99 = (@as(u64, x98) + @as(u64, x71)); + const x99: u64 = (@as(u64, x98) + x71); var x100: u64 = undefined; var x101: u64 = undefined; - mulxU64(&x100, &x101, x2, (arg2[3])); + mulxU64(&x100, &x101, x2, arg2[3]); var x102: u64 = undefined; var x103: u64 = undefined; - mulxU64(&x102, &x103, x2, (arg2[2])); + mulxU64(&x102, &x103, x2, arg2[2]); var x104: u64 = undefined; var x105: u64 = undefined; - mulxU64(&x104, &x105, x2, (arg2[1])); + mulxU64(&x104, &x105, x2, arg2[1]); var x106: u64 = undefined; var x107: u64 = undefined; - mulxU64(&x106, &x107, x2, (arg2[0])); + mulxU64(&x106, &x107, x2, arg2[0]); var x108: u64 = undefined; var x109: u1 = undefined; addcarryxU64(&x108, &x109, 0x0, x107, x104); @@ -281,7 +270,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x112: u64 = undefined; var x113: u1 = undefined; addcarryxU64(&x112, &x113, x111, x103, x100); - const x114 = (@as(u64, x113) + x101); + const x114: u64 = (x113 + x101); var x115: u64 = undefined; var x116: u1 = undefined; addcarryxU64(&x115, &x116, 0x0, x91, x106); @@ -321,7 +310,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x139: u64 = undefined; var x140: u1 = undefined; addcarryxU64(&x139, &x140, x138, x130, x127); - const x141 = (@as(u64, x140) + x128); + const x141: u64 = (x140 + x128); var x142: u64 = undefined; var x143: u1 = undefined; addcarryxU64(&x142, &x143, 0x0, x115, x133); @@ -337,19 +326,19 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x150: u64 = undefined; var x151: u1 = undefined; addcarryxU64(&x150, &x151, x149, x123, x141); - const x152 = (@as(u64, x151) + @as(u64, x124)); + const x152: u64 = (@as(u64, x151) + x124); var x153: u64 = undefined; var x154: u64 = undefined; - mulxU64(&x153, &x154, x3, (arg2[3])); + mulxU64(&x153, &x154, x3, arg2[3]); var x155: u64 = undefined; var x156: u64 = undefined; - mulxU64(&x155, &x156, x3, (arg2[2])); + mulxU64(&x155, &x156, x3, arg2[2]); var x157: u64 = undefined; var x158: u64 = undefined; - mulxU64(&x157, &x158, x3, (arg2[1])); + mulxU64(&x157, &x158, x3, arg2[1]); var x159: u64 = undefined; var x160: u64 = undefined; - mulxU64(&x159, &x160, x3, (arg2[0])); + mulxU64(&x159, &x160, x3, arg2[0]); var x161: u64 = undefined; var x162: u1 = undefined; addcarryxU64(&x161, &x162, 0x0, x160, x157); @@ -359,7 +348,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x165: u64 = undefined; var x166: u1 = undefined; addcarryxU64(&x165, &x166, x164, x156, x153); - const x167 = (@as(u64, x166) + x154); + const x167: u64 = (x166 + x154); var x168: u64 = undefined; var x169: u1 = undefined; addcarryxU64(&x168, &x169, 0x0, x144, x159); @@ -399,7 +388,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x192: u64 = undefined; var x193: u1 = undefined; addcarryxU64(&x192, &x193, x191, x183, x180); - const x194 = (@as(u64, x193) + x181); + const x194: u64 = (x193 + x181); var x195: u64 = undefined; var x196: u1 = undefined; addcarryxU64(&x195, &x196, 0x0, x168, x186); @@ -415,7 +404,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x203: u64 = undefined; var x204: u1 = undefined; addcarryxU64(&x203, &x204, x202, x176, x194); - const x205 = (@as(u64, x204) + @as(u64, x177)); + const x205: u64 = (@as(u64, x204) + x177); var x206: u64 = undefined; var x207: u1 = undefined; subborrowxU64(&x206, &x207, 0x0, x197, 0xbfd25e8cd0364141); @@ -432,13 +421,14 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x215: u1 = undefined; subborrowxU64(&x214, &x215, x213, x205, 0x0); var x216: u64 = undefined; - cmovznzU64(&x216, x215, x206, x197); + const x216_selection_mask = selectionMaskU64(x215); + x216 = x206 ^ ((x206 ^ x197) & x216_selection_mask); var x217: u64 = undefined; - cmovznzU64(&x217, x215, x208, x199); + x217 = x208 ^ ((x208 ^ x199) & x216_selection_mask); var x218: u64 = undefined; - cmovznzU64(&x218, x215, x210, x201); + x218 = x210 ^ ((x210 ^ x201) & x216_selection_mask); var x219: u64 = undefined; - cmovznzU64(&x219, x215, x212, x203); + x219 = x212 ^ ((x212 ^ x203) & x216_selection_mask); out1[0] = x216; out1[1] = x217; out1[2] = x218; @@ -456,22 +446,22 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldElement) void { @setRuntimeSafety(mode == .debug); - const x1 = (arg1[1]); - const x2 = (arg1[2]); - const x3 = (arg1[3]); - const x4 = (arg1[0]); + const x1: u64 = arg1[1]; + const x2: u64 = arg1[2]; + const x3: u64 = arg1[3]; + const x4: u64 = arg1[0]; var x5: u64 = undefined; var x6: u64 = undefined; - mulxU64(&x5, &x6, x4, (arg1[3])); + mulxU64(&x5, &x6, x4, arg1[3]); var x7: u64 = undefined; var x8: u64 = undefined; - mulxU64(&x7, &x8, x4, (arg1[2])); + mulxU64(&x7, &x8, x4, arg1[2]); var x9: u64 = undefined; var x10: u64 = undefined; - mulxU64(&x9, &x10, x4, (arg1[1])); + mulxU64(&x9, &x10, x4, arg1[1]); var x11: u64 = undefined; var x12: u64 = undefined; - mulxU64(&x11, &x12, x4, (arg1[0])); + mulxU64(&x11, &x12, x4, arg1[0]); var x13: u64 = undefined; var x14: u1 = undefined; addcarryxU64(&x13, &x14, 0x0, x12, x9); @@ -481,7 +471,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x17: u64 = undefined; var x18: u1 = undefined; addcarryxU64(&x17, &x18, x16, x8, x5); - const x19 = (@as(u64, x18) + x6); + const x19: u64 = (x18 + x6); var x20: u64 = undefined; var x21: u64 = undefined; mulxU64(&x20, &x21, x11, 0x4b0dff665588b13f); @@ -506,7 +496,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x34: u64 = undefined; var x35: u1 = undefined; addcarryxU64(&x34, &x35, x33, x25, x22); - const x36 = (@as(u64, x35) + x23); + const x36: u64 = (x35 + x23); var x37: u64 = undefined; var x38: u1 = undefined; addcarryxU64(&x37, &x38, 0x0, x11, x28); @@ -524,16 +514,16 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl addcarryxU64(&x45, &x46, x44, x19, x36); var x47: u64 = undefined; var x48: u64 = undefined; - mulxU64(&x47, &x48, x1, (arg1[3])); + mulxU64(&x47, &x48, x1, arg1[3]); var x49: u64 = undefined; var x50: u64 = undefined; - mulxU64(&x49, &x50, x1, (arg1[2])); + mulxU64(&x49, &x50, x1, arg1[2]); var x51: u64 = undefined; var x52: u64 = undefined; - mulxU64(&x51, &x52, x1, (arg1[1])); + mulxU64(&x51, &x52, x1, arg1[1]); var x53: u64 = undefined; var x54: u64 = undefined; - mulxU64(&x53, &x54, x1, (arg1[0])); + mulxU64(&x53, &x54, x1, arg1[0]); var x55: u64 = undefined; var x56: u1 = undefined; addcarryxU64(&x55, &x56, 0x0, x54, x51); @@ -543,7 +533,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x59: u64 = undefined; var x60: u1 = undefined; addcarryxU64(&x59, &x60, x58, x50, x47); - const x61 = (@as(u64, x60) + x48); + const x61: u64 = (x60 + x48); var x62: u64 = undefined; var x63: u1 = undefined; addcarryxU64(&x62, &x63, 0x0, x39, x53); @@ -558,7 +548,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl addcarryxU64(&x68, &x69, x67, x45, x59); var x70: u64 = undefined; var x71: u1 = undefined; - addcarryxU64(&x70, &x71, x69, @as(u64, x46), x61); + addcarryxU64(&x70, &x71, x69, x46, x61); var x72: u64 = undefined; var x73: u64 = undefined; mulxU64(&x72, &x73, x62, 0x4b0dff665588b13f); @@ -583,7 +573,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x86: u64 = undefined; var x87: u1 = undefined; addcarryxU64(&x86, &x87, x85, x77, x74); - const x88 = (@as(u64, x87) + x75); + const x88: u64 = (x87 + x75); var x89: u64 = undefined; var x90: u1 = undefined; addcarryxU64(&x89, &x90, 0x0, x62, x80); @@ -599,19 +589,19 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x97: u64 = undefined; var x98: u1 = undefined; addcarryxU64(&x97, &x98, x96, x70, x88); - const x99 = (@as(u64, x98) + @as(u64, x71)); + const x99: u64 = (@as(u64, x98) + x71); var x100: u64 = undefined; var x101: u64 = undefined; - mulxU64(&x100, &x101, x2, (arg1[3])); + mulxU64(&x100, &x101, x2, arg1[3]); var x102: u64 = undefined; var x103: u64 = undefined; - mulxU64(&x102, &x103, x2, (arg1[2])); + mulxU64(&x102, &x103, x2, arg1[2]); var x104: u64 = undefined; var x105: u64 = undefined; - mulxU64(&x104, &x105, x2, (arg1[1])); + mulxU64(&x104, &x105, x2, arg1[1]); var x106: u64 = undefined; var x107: u64 = undefined; - mulxU64(&x106, &x107, x2, (arg1[0])); + mulxU64(&x106, &x107, x2, arg1[0]); var x108: u64 = undefined; var x109: u1 = undefined; addcarryxU64(&x108, &x109, 0x0, x107, x104); @@ -621,7 +611,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x112: u64 = undefined; var x113: u1 = undefined; addcarryxU64(&x112, &x113, x111, x103, x100); - const x114 = (@as(u64, x113) + x101); + const x114: u64 = (x113 + x101); var x115: u64 = undefined; var x116: u1 = undefined; addcarryxU64(&x115, &x116, 0x0, x91, x106); @@ -661,7 +651,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x139: u64 = undefined; var x140: u1 = undefined; addcarryxU64(&x139, &x140, x138, x130, x127); - const x141 = (@as(u64, x140) + x128); + const x141: u64 = (x140 + x128); var x142: u64 = undefined; var x143: u1 = undefined; addcarryxU64(&x142, &x143, 0x0, x115, x133); @@ -677,19 +667,19 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x150: u64 = undefined; var x151: u1 = undefined; addcarryxU64(&x150, &x151, x149, x123, x141); - const x152 = (@as(u64, x151) + @as(u64, x124)); + const x152: u64 = (@as(u64, x151) + x124); var x153: u64 = undefined; var x154: u64 = undefined; - mulxU64(&x153, &x154, x3, (arg1[3])); + mulxU64(&x153, &x154, x3, arg1[3]); var x155: u64 = undefined; var x156: u64 = undefined; - mulxU64(&x155, &x156, x3, (arg1[2])); + mulxU64(&x155, &x156, x3, arg1[2]); var x157: u64 = undefined; var x158: u64 = undefined; - mulxU64(&x157, &x158, x3, (arg1[1])); + mulxU64(&x157, &x158, x3, arg1[1]); var x159: u64 = undefined; var x160: u64 = undefined; - mulxU64(&x159, &x160, x3, (arg1[0])); + mulxU64(&x159, &x160, x3, arg1[0]); var x161: u64 = undefined; var x162: u1 = undefined; addcarryxU64(&x161, &x162, 0x0, x160, x157); @@ -699,7 +689,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x165: u64 = undefined; var x166: u1 = undefined; addcarryxU64(&x165, &x166, x164, x156, x153); - const x167 = (@as(u64, x166) + x154); + const x167: u64 = (x166 + x154); var x168: u64 = undefined; var x169: u1 = undefined; addcarryxU64(&x168, &x169, 0x0, x144, x159); @@ -739,7 +729,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x192: u64 = undefined; var x193: u1 = undefined; addcarryxU64(&x192, &x193, x191, x183, x180); - const x194 = (@as(u64, x193) + x181); + const x194: u64 = (x193 + x181); var x195: u64 = undefined; var x196: u1 = undefined; addcarryxU64(&x195, &x196, 0x0, x168, x186); @@ -755,7 +745,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x203: u64 = undefined; var x204: u1 = undefined; addcarryxU64(&x203, &x204, x202, x176, x194); - const x205 = (@as(u64, x204) + @as(u64, x177)); + const x205: u64 = (@as(u64, x204) + x177); var x206: u64 = undefined; var x207: u1 = undefined; subborrowxU64(&x206, &x207, 0x0, x197, 0xbfd25e8cd0364141); @@ -772,13 +762,14 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl var x215: u1 = undefined; subborrowxU64(&x214, &x215, x213, x205, 0x0); var x216: u64 = undefined; - cmovznzU64(&x216, x215, x206, x197); + const x216_selection_mask = selectionMaskU64(x215); + x216 = x206 ^ ((x206 ^ x197) & x216_selection_mask); var x217: u64 = undefined; - cmovznzU64(&x217, x215, x208, x199); + x217 = x208 ^ ((x208 ^ x199) & x216_selection_mask); var x218: u64 = undefined; - cmovznzU64(&x218, x215, x210, x201); + x218 = x210 ^ ((x210 ^ x201) & x216_selection_mask); var x219: u64 = undefined; - cmovznzU64(&x219, x215, x212, x203); + x219 = x212 ^ ((x212 ^ x203) & x216_selection_mask); out1[0] = x216; out1[1] = x217; out1[2] = x218; @@ -799,16 +790,16 @@ pub fn add(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x1: u64 = undefined; var x2: u1 = undefined; - addcarryxU64(&x1, &x2, 0x0, (arg1[0]), (arg2[0])); + addcarryxU64(&x1, &x2, 0x0, arg1[0], arg2[0]); var x3: u64 = undefined; var x4: u1 = undefined; - addcarryxU64(&x3, &x4, x2, (arg1[1]), (arg2[1])); + addcarryxU64(&x3, &x4, x2, arg1[1], arg2[1]); var x5: u64 = undefined; var x6: u1 = undefined; - addcarryxU64(&x5, &x6, x4, (arg1[2]), (arg2[2])); + addcarryxU64(&x5, &x6, x4, arg1[2], arg2[2]); var x7: u64 = undefined; var x8: u1 = undefined; - addcarryxU64(&x7, &x8, x6, (arg1[3]), (arg2[3])); + addcarryxU64(&x7, &x8, x6, arg1[3], arg2[3]); var x9: u64 = undefined; var x10: u1 = undefined; subborrowxU64(&x9, &x10, 0x0, x1, 0xbfd25e8cd0364141); @@ -823,15 +814,16 @@ pub fn add(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme subborrowxU64(&x15, &x16, x14, x7, 0xffffffffffffffff); var x17: u64 = undefined; var x18: u1 = undefined; - subborrowxU64(&x17, &x18, x16, @as(u64, x8), 0x0); + subborrowxU64(&x17, &x18, x16, x8, 0x0); var x19: u64 = undefined; - cmovznzU64(&x19, x18, x9, x1); + const x19_selection_mask = selectionMaskU64(x18); + x19 = x9 ^ ((x9 ^ x1) & x19_selection_mask); var x20: u64 = undefined; - cmovznzU64(&x20, x18, x11, x3); + x20 = x11 ^ ((x11 ^ x3) & x19_selection_mask); var x21: u64 = undefined; - cmovznzU64(&x21, x18, x13, x5); + x21 = x13 ^ ((x13 ^ x5) & x19_selection_mask); var x22: u64 = undefined; - cmovznzU64(&x22, x18, x15, x7); + x22 = x15 ^ ((x15 ^ x7) & x19_selection_mask); out1[0] = x19; out1[1] = x20; out1[2] = x21; @@ -852,18 +844,19 @@ pub fn sub(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x1: u64 = undefined; var x2: u1 = undefined; - subborrowxU64(&x1, &x2, 0x0, (arg1[0]), (arg2[0])); + subborrowxU64(&x1, &x2, 0x0, arg1[0], arg2[0]); var x3: u64 = undefined; var x4: u1 = undefined; - subborrowxU64(&x3, &x4, x2, (arg1[1]), (arg2[1])); + subborrowxU64(&x3, &x4, x2, arg1[1], arg2[1]); var x5: u64 = undefined; var x6: u1 = undefined; - subborrowxU64(&x5, &x6, x4, (arg1[2]), (arg2[2])); + subborrowxU64(&x5, &x6, x4, arg1[2], arg2[2]); var x7: u64 = undefined; var x8: u1 = undefined; - subborrowxU64(&x7, &x8, x6, (arg1[3]), (arg2[3])); + subborrowxU64(&x7, &x8, x6, arg1[3], arg2[3]); var x9: u64 = undefined; - cmovznzU64(&x9, x8, 0x0, 0xffffffffffffffff); + const x9_selection_mask = selectionMaskU64(x8); + x9 = 0x0 ^ ((0x0 ^ 0xffffffffffffffff) & x9_selection_mask); var x10: u64 = undefined; var x11: u1 = undefined; addcarryxU64(&x10, &x11, 0x0, x1, (x9 & 0xbfd25e8cd0364141)); @@ -895,18 +888,19 @@ pub fn opp(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme var x1: u64 = undefined; var x2: u1 = undefined; - subborrowxU64(&x1, &x2, 0x0, 0x0, (arg1[0])); + subborrowxU64(&x1, &x2, 0x0, 0x0, arg1[0]); var x3: u64 = undefined; var x4: u1 = undefined; - subborrowxU64(&x3, &x4, x2, 0x0, (arg1[1])); + subborrowxU64(&x3, &x4, x2, 0x0, arg1[1]); var x5: u64 = undefined; var x6: u1 = undefined; - subborrowxU64(&x5, &x6, x4, 0x0, (arg1[2])); + subborrowxU64(&x5, &x6, x4, 0x0, arg1[2]); var x7: u64 = undefined; var x8: u1 = undefined; - subborrowxU64(&x7, &x8, x6, 0x0, (arg1[3])); + subborrowxU64(&x7, &x8, x6, 0x0, arg1[3]); var x9: u64 = undefined; - cmovznzU64(&x9, x8, 0x0, 0xffffffffffffffff); + const x9_selection_mask = selectionMaskU64(x8); + x9 = 0x0 ^ ((0x0 ^ 0xffffffffffffffff) & x9_selection_mask); var x10: u64 = undefined; var x11: u1 = undefined; addcarryxU64(&x10, &x11, 0x0, x1, (x9 & 0xbfd25e8cd0364141)); @@ -936,7 +930,7 @@ pub fn opp(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldElement) void { @setRuntimeSafety(mode == .debug); - const x1 = (arg1[0]); + const x1: u64 = arg1[0]; var x2: u64 = undefined; var x3: u64 = undefined; mulxU64(&x2, &x3, x1, 0x4b0dff665588b13f); @@ -975,10 +969,10 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo addcarryxU64(&x24, &x25, x23, 0x0, x16); var x26: u64 = undefined; var x27: u1 = undefined; - addcarryxU64(&x26, &x27, x25, 0x0, (@as(u64, x17) + x5)); + addcarryxU64(&x26, &x27, x25, 0x0, (x17 + x5)); var x28: u64 = undefined; var x29: u1 = undefined; - addcarryxU64(&x28, &x29, 0x0, x20, (arg1[1])); + addcarryxU64(&x28, &x29, 0x0, x20, arg1[1]); var x30: u64 = undefined; var x31: u1 = undefined; addcarryxU64(&x30, &x31, x29, x22, 0x0); @@ -1026,10 +1020,10 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo addcarryxU64(&x58, &x59, x57, x34, x50); var x60: u64 = undefined; var x61: u1 = undefined; - addcarryxU64(&x60, &x61, x59, (@as(u64, x35) + @as(u64, x27)), (@as(u64, x51) + x39)); + addcarryxU64(&x60, &x61, x59, (@as(u64, x35) + x27), (x51 + x39)); var x62: u64 = undefined; var x63: u1 = undefined; - addcarryxU64(&x62, &x63, 0x0, x54, (arg1[2])); + addcarryxU64(&x62, &x63, 0x0, x54, arg1[2]); var x64: u64 = undefined; var x65: u1 = undefined; addcarryxU64(&x64, &x65, x63, x56, 0x0); @@ -1077,10 +1071,10 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo addcarryxU64(&x92, &x93, x91, x68, x84); var x94: u64 = undefined; var x95: u1 = undefined; - addcarryxU64(&x94, &x95, x93, (@as(u64, x69) + @as(u64, x61)), (@as(u64, x85) + x73)); + addcarryxU64(&x94, &x95, x93, (@as(u64, x69) + x61), (x85 + x73)); var x96: u64 = undefined; var x97: u1 = undefined; - addcarryxU64(&x96, &x97, 0x0, x88, (arg1[3])); + addcarryxU64(&x96, &x97, 0x0, x88, arg1[3]); var x98: u64 = undefined; var x99: u1 = undefined; addcarryxU64(&x98, &x99, x97, x90, 0x0); @@ -1128,7 +1122,7 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo addcarryxU64(&x126, &x127, x125, x102, x118); var x128: u64 = undefined; var x129: u1 = undefined; - addcarryxU64(&x128, &x129, x127, (@as(u64, x103) + @as(u64, x95)), (@as(u64, x119) + x107)); + addcarryxU64(&x128, &x129, x127, (@as(u64, x103) + x95), (x119 + x107)); var x130: u64 = undefined; var x131: u1 = undefined; subborrowxU64(&x130, &x131, 0x0, x122, 0xbfd25e8cd0364141); @@ -1143,15 +1137,16 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo subborrowxU64(&x136, &x137, x135, x128, 0xffffffffffffffff); var x138: u64 = undefined; var x139: u1 = undefined; - subborrowxU64(&x138, &x139, x137, @as(u64, x129), 0x0); + subborrowxU64(&x138, &x139, x137, x129, 0x0); var x140: u64 = undefined; - cmovznzU64(&x140, x139, x130, x122); + const x140_selection_mask = selectionMaskU64(x139); + x140 = x130 ^ ((x130 ^ x122) & x140_selection_mask); var x141: u64 = undefined; - cmovznzU64(&x141, x139, x132, x124); + x141 = x132 ^ ((x132 ^ x124) & x140_selection_mask); var x142: u64 = undefined; - cmovznzU64(&x142, x139, x134, x126); + x142 = x134 ^ ((x134 ^ x126) & x140_selection_mask); var x143: u64 = undefined; - cmovznzU64(&x143, x139, x136, x128); + x143 = x136 ^ ((x136 ^ x128) & x140_selection_mask); out1[0] = x140; out1[1] = x141; out1[2] = x142; @@ -1169,10 +1164,10 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDomainFieldElement) void { @setRuntimeSafety(mode == .debug); - const x1 = (arg1[1]); - const x2 = (arg1[2]); - const x3 = (arg1[3]); - const x4 = (arg1[0]); + const x1: u64 = arg1[1]; + const x2: u64 = arg1[2]; + const x3: u64 = arg1[3]; + const x4: u64 = arg1[0]; var x5: u64 = undefined; var x6: u64 = undefined; mulxU64(&x5, &x6, x4, 0x9d671cd581c69bc5); @@ -1232,7 +1227,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma addcarryxU64(&x41, &x42, x40, x17, x33); var x43: u64 = undefined; var x44: u1 = undefined; - addcarryxU64(&x43, &x44, x42, (@as(u64, x18) + x6), (@as(u64, x34) + x22)); + addcarryxU64(&x43, &x44, x42, (x18 + x6), (x34 + x22)); var x45: u64 = undefined; var x46: u64 = undefined; mulxU64(&x45, &x46, x1, 0x9d671cd581c69bc5); @@ -1304,7 +1299,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma addcarryxU64(&x89, &x90, x88, x65, x81); var x91: u64 = undefined; var x92: u1 = undefined; - addcarryxU64(&x91, &x92, x90, ((@as(u64, x66) + @as(u64, x44)) + (@as(u64, x58) + x46)), (@as(u64, x82) + x70)); + addcarryxU64(&x91, &x92, x90, ((@as(u64, x66) + x44) + (x58 + x46)), (x82 + x70)); var x93: u64 = undefined; var x94: u64 = undefined; mulxU64(&x93, &x94, x2, 0x9d671cd581c69bc5); @@ -1376,7 +1371,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma addcarryxU64(&x137, &x138, x136, x113, x129); var x139: u64 = undefined; var x140: u1 = undefined; - addcarryxU64(&x139, &x140, x138, ((@as(u64, x114) + @as(u64, x92)) + (@as(u64, x106) + x94)), (@as(u64, x130) + x118)); + addcarryxU64(&x139, &x140, x138, ((@as(u64, x114) + x92) + (x106 + x94)), (x130 + x118)); var x141: u64 = undefined; var x142: u64 = undefined; mulxU64(&x141, &x142, x3, 0x9d671cd581c69bc5); @@ -1448,7 +1443,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma addcarryxU64(&x185, &x186, x184, x161, x177); var x187: u64 = undefined; var x188: u1 = undefined; - addcarryxU64(&x187, &x188, x186, ((@as(u64, x162) + @as(u64, x140)) + (@as(u64, x154) + x142)), (@as(u64, x178) + x166)); + addcarryxU64(&x187, &x188, x186, ((@as(u64, x162) + x140) + (x154 + x142)), (x178 + x166)); var x189: u64 = undefined; var x190: u1 = undefined; subborrowxU64(&x189, &x190, 0x0, x181, 0xbfd25e8cd0364141); @@ -1463,15 +1458,16 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma subborrowxU64(&x195, &x196, x194, x187, 0xffffffffffffffff); var x197: u64 = undefined; var x198: u1 = undefined; - subborrowxU64(&x197, &x198, x196, @as(u64, x188), 0x0); + subborrowxU64(&x197, &x198, x196, x188, 0x0); var x199: u64 = undefined; - cmovznzU64(&x199, x198, x189, x181); + const x199_selection_mask = selectionMaskU64(x198); + x199 = x189 ^ ((x189 ^ x181) & x199_selection_mask); var x200: u64 = undefined; - cmovznzU64(&x200, x198, x191, x183); + x200 = x191 ^ ((x191 ^ x183) & x199_selection_mask); var x201: u64 = undefined; - cmovznzU64(&x201, x198, x193, x185); + x201 = x193 ^ ((x193 ^ x185) & x199_selection_mask); var x202: u64 = undefined; - cmovznzU64(&x202, x198, x195, x187); + x202 = x195 ^ ((x195 ^ x187) & x199_selection_mask); out1[0] = x199; out1[1] = x200; out1[2] = x201; @@ -1492,7 +1488,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma pub fn nonzero(out1: *u64, arg1: [4]u64) void { @setRuntimeSafety(mode == .debug); - const x1 = ((arg1[0]) | ((arg1[1]) | ((arg1[2]) | (arg1[3])))); + const x1: u64 = (arg1[0] | (arg1[1] | (arg1[2] | arg1[3]))); out1.* = x1; } @@ -1511,13 +1507,14 @@ pub fn selectznz(out1: *[4]u64, arg1: u1, arg2: [4]u64, arg3: [4]u64) void { @setRuntimeSafety(mode == .debug); var x1: u64 = undefined; - cmovznzU64(&x1, arg1, (arg2[0]), (arg3[0])); + const x1_selection_mask = selectionMaskU64(arg1); + x1 = arg2[0] ^ ((arg2[0] ^ arg3[0]) & x1_selection_mask); var x2: u64 = undefined; - cmovznzU64(&x2, arg1, (arg2[1]), (arg3[1])); + x2 = arg2[1] ^ ((arg2[1] ^ arg3[1]) & x1_selection_mask); var x3: u64 = undefined; - cmovznzU64(&x3, arg1, (arg2[2]), (arg3[2])); + x3 = arg2[2] ^ ((arg2[2] ^ arg3[2]) & x1_selection_mask); var x4: u64 = undefined; - cmovznzU64(&x4, arg1, (arg2[3]), (arg3[3])); + x4 = arg2[3] ^ ((arg2[3] ^ arg3[3]) & x1_selection_mask); out1[0] = x1; out1[1] = x2; out1[2] = x3; @@ -1538,66 +1535,66 @@ pub fn selectznz(out1: *[4]u64, arg1: u1, arg2: [4]u64, arg3: [4]u64) void { pub fn toBytes(out1: *[32]u8, arg1: [4]u64) void { @setRuntimeSafety(mode == .debug); - const x1 = (arg1[3]); - const x2 = (arg1[2]); - const x3 = (arg1[1]); - const x4 = (arg1[0]); - const x5 = @as(u8, @truncate((x4 & 0xff))); - const x6 = (x4 >> 8); - const x7 = @as(u8, @truncate((x6 & 0xff))); - const x8 = (x6 >> 8); - const x9 = @as(u8, @truncate((x8 & 0xff))); - const x10 = (x8 >> 8); - const x11 = @as(u8, @truncate((x10 & 0xff))); - const x12 = (x10 >> 8); - const x13 = @as(u8, @truncate((x12 & 0xff))); - const x14 = (x12 >> 8); - const x15 = @as(u8, @truncate((x14 & 0xff))); - const x16 = (x14 >> 8); - const x17 = @as(u8, @truncate((x16 & 0xff))); - const x18 = @as(u8, @truncate((x16 >> 8))); - const x19 = @as(u8, @truncate((x3 & 0xff))); - const x20 = (x3 >> 8); - const x21 = @as(u8, @truncate((x20 & 0xff))); - const x22 = (x20 >> 8); - const x23 = @as(u8, @truncate((x22 & 0xff))); - const x24 = (x22 >> 8); - const x25 = @as(u8, @truncate((x24 & 0xff))); - const x26 = (x24 >> 8); - const x27 = @as(u8, @truncate((x26 & 0xff))); - const x28 = (x26 >> 8); - const x29 = @as(u8, @truncate((x28 & 0xff))); - const x30 = (x28 >> 8); - const x31 = @as(u8, @truncate((x30 & 0xff))); - const x32 = @as(u8, @truncate((x30 >> 8))); - const x33 = @as(u8, @truncate((x2 & 0xff))); - const x34 = (x2 >> 8); - const x35 = @as(u8, @truncate((x34 & 0xff))); - const x36 = (x34 >> 8); - const x37 = @as(u8, @truncate((x36 & 0xff))); - const x38 = (x36 >> 8); - const x39 = @as(u8, @truncate((x38 & 0xff))); - const x40 = (x38 >> 8); - const x41 = @as(u8, @truncate((x40 & 0xff))); - const x42 = (x40 >> 8); - const x43 = @as(u8, @truncate((x42 & 0xff))); - const x44 = (x42 >> 8); - const x45 = @as(u8, @truncate((x44 & 0xff))); - const x46 = @as(u8, @truncate((x44 >> 8))); - const x47 = @as(u8, @truncate((x1 & 0xff))); - const x48 = (x1 >> 8); - const x49 = @as(u8, @truncate((x48 & 0xff))); - const x50 = (x48 >> 8); - const x51 = @as(u8, @truncate((x50 & 0xff))); - const x52 = (x50 >> 8); - const x53 = @as(u8, @truncate((x52 & 0xff))); - const x54 = (x52 >> 8); - const x55 = @as(u8, @truncate((x54 & 0xff))); - const x56 = (x54 >> 8); - const x57 = @as(u8, @truncate((x56 & 0xff))); - const x58 = (x56 >> 8); - const x59 = @as(u8, @truncate((x58 & 0xff))); - const x60 = @as(u8, @truncate((x58 >> 8))); + const x1: u64 = arg1[3]; + const x2: u64 = arg1[2]; + const x3: u64 = arg1[1]; + const x4: u64 = arg1[0]; + const x5: u8 = @truncate(x4); + const x6: u64 = (x4 >> 8); + const x7: u8 = @truncate(x6); + const x8: u64 = (x6 >> 8); + const x9: u8 = @truncate(x8); + const x10: u64 = (x8 >> 8); + const x11: u8 = @truncate(x10); + const x12: u64 = (x10 >> 8); + const x13: u8 = @truncate(x12); + const x14: u64 = (x12 >> 8); + const x15: u8 = @truncate(x14); + const x16: u64 = (x14 >> 8); + const x17: u8 = @truncate(x16); + const x18: u8 = @truncate((x16 >> 8)); + const x19: u8 = @truncate(x3); + const x20: u64 = (x3 >> 8); + const x21: u8 = @truncate(x20); + const x22: u64 = (x20 >> 8); + const x23: u8 = @truncate(x22); + const x24: u64 = (x22 >> 8); + const x25: u8 = @truncate(x24); + const x26: u64 = (x24 >> 8); + const x27: u8 = @truncate(x26); + const x28: u64 = (x26 >> 8); + const x29: u8 = @truncate(x28); + const x30: u64 = (x28 >> 8); + const x31: u8 = @truncate(x30); + const x32: u8 = @truncate((x30 >> 8)); + const x33: u8 = @truncate(x2); + const x34: u64 = (x2 >> 8); + const x35: u8 = @truncate(x34); + const x36: u64 = (x34 >> 8); + const x37: u8 = @truncate(x36); + const x38: u64 = (x36 >> 8); + const x39: u8 = @truncate(x38); + const x40: u64 = (x38 >> 8); + const x41: u8 = @truncate(x40); + const x42: u64 = (x40 >> 8); + const x43: u8 = @truncate(x42); + const x44: u64 = (x42 >> 8); + const x45: u8 = @truncate(x44); + const x46: u8 = @truncate((x44 >> 8)); + const x47: u8 = @truncate(x1); + const x48: u64 = (x1 >> 8); + const x49: u8 = @truncate(x48); + const x50: u64 = (x48 >> 8); + const x51: u8 = @truncate(x50); + const x52: u64 = (x50 >> 8); + const x53: u8 = @truncate(x52); + const x54: u64 = (x52 >> 8); + const x55: u8 = @truncate(x54); + const x56: u64 = (x54 >> 8); + const x57: u8 = @truncate(x56); + const x58: u64 = (x56 >> 8); + const x59: u8 = @truncate(x58); + const x60: u8 = @truncate((x58 >> 8)); out1[0] = x5; out1[1] = x7; out1[2] = x9; @@ -1647,66 +1644,66 @@ pub fn toBytes(out1: *[32]u8, arg1: [4]u64) void { pub fn fromBytes(out1: *[4]u64, arg1: [32]u8) void { @setRuntimeSafety(mode == .debug); - const x1 = (@as(u64, (arg1[31])) << 56); - const x2 = (@as(u64, (arg1[30])) << 48); - const x3 = (@as(u64, (arg1[29])) << 40); - const x4 = (@as(u64, (arg1[28])) << 32); - const x5 = (@as(u64, (arg1[27])) << 24); - const x6 = (@as(u64, (arg1[26])) << 16); - const x7 = (@as(u64, (arg1[25])) << 8); - const x8 = (arg1[24]); - const x9 = (@as(u64, (arg1[23])) << 56); - const x10 = (@as(u64, (arg1[22])) << 48); - const x11 = (@as(u64, (arg1[21])) << 40); - const x12 = (@as(u64, (arg1[20])) << 32); - const x13 = (@as(u64, (arg1[19])) << 24); - const x14 = (@as(u64, (arg1[18])) << 16); - const x15 = (@as(u64, (arg1[17])) << 8); - const x16 = (arg1[16]); - const x17 = (@as(u64, (arg1[15])) << 56); - const x18 = (@as(u64, (arg1[14])) << 48); - const x19 = (@as(u64, (arg1[13])) << 40); - const x20 = (@as(u64, (arg1[12])) << 32); - const x21 = (@as(u64, (arg1[11])) << 24); - const x22 = (@as(u64, (arg1[10])) << 16); - const x23 = (@as(u64, (arg1[9])) << 8); - const x24 = (arg1[8]); - const x25 = (@as(u64, (arg1[7])) << 56); - const x26 = (@as(u64, (arg1[6])) << 48); - const x27 = (@as(u64, (arg1[5])) << 40); - const x28 = (@as(u64, (arg1[4])) << 32); - const x29 = (@as(u64, (arg1[3])) << 24); - const x30 = (@as(u64, (arg1[2])) << 16); - const x31 = (@as(u64, (arg1[1])) << 8); - const x32 = (arg1[0]); - const x33 = (x31 + @as(u64, x32)); - const x34 = (x30 + x33); - const x35 = (x29 + x34); - const x36 = (x28 + x35); - const x37 = (x27 + x36); - const x38 = (x26 + x37); - const x39 = (x25 + x38); - const x40 = (x23 + @as(u64, x24)); - const x41 = (x22 + x40); - const x42 = (x21 + x41); - const x43 = (x20 + x42); - const x44 = (x19 + x43); - const x45 = (x18 + x44); - const x46 = (x17 + x45); - const x47 = (x15 + @as(u64, x16)); - const x48 = (x14 + x47); - const x49 = (x13 + x48); - const x50 = (x12 + x49); - const x51 = (x11 + x50); - const x52 = (x10 + x51); - const x53 = (x9 + x52); - const x54 = (x7 + @as(u64, x8)); - const x55 = (x6 + x54); - const x56 = (x5 + x55); - const x57 = (x4 + x56); - const x58 = (x3 + x57); - const x59 = (x2 + x58); - const x60 = (x1 + x59); + const x1: u64 = (@as(u64, arg1[31]) << 56); + const x2: u64 = (@as(u64, arg1[30]) << 48); + const x3: u64 = (@as(u64, arg1[29]) << 40); + const x4: u64 = (@as(u64, arg1[28]) << 32); + const x5: u64 = (@as(u64, arg1[27]) << 24); + const x6: u64 = (@as(u64, arg1[26]) << 16); + const x7: u64 = (@as(u64, arg1[25]) << 8); + const x8: u8 = arg1[24]; + const x9: u64 = (@as(u64, arg1[23]) << 56); + const x10: u64 = (@as(u64, arg1[22]) << 48); + const x11: u64 = (@as(u64, arg1[21]) << 40); + const x12: u64 = (@as(u64, arg1[20]) << 32); + const x13: u64 = (@as(u64, arg1[19]) << 24); + const x14: u64 = (@as(u64, arg1[18]) << 16); + const x15: u64 = (@as(u64, arg1[17]) << 8); + const x16: u8 = arg1[16]; + const x17: u64 = (@as(u64, arg1[15]) << 56); + const x18: u64 = (@as(u64, arg1[14]) << 48); + const x19: u64 = (@as(u64, arg1[13]) << 40); + const x20: u64 = (@as(u64, arg1[12]) << 32); + const x21: u64 = (@as(u64, arg1[11]) << 24); + const x22: u64 = (@as(u64, arg1[10]) << 16); + const x23: u64 = (@as(u64, arg1[9]) << 8); + const x24: u8 = arg1[8]; + const x25: u64 = (@as(u64, arg1[7]) << 56); + const x26: u64 = (@as(u64, arg1[6]) << 48); + const x27: u64 = (@as(u64, arg1[5]) << 40); + const x28: u64 = (@as(u64, arg1[4]) << 32); + const x29: u64 = (@as(u64, arg1[3]) << 24); + const x30: u64 = (@as(u64, arg1[2]) << 16); + const x31: u64 = (@as(u64, arg1[1]) << 8); + const x32: u8 = arg1[0]; + const x33: u64 = (x31 + x32); + const x34: u64 = (x30 + x33); + const x35: u64 = (x29 + x34); + const x36: u64 = (x28 + x35); + const x37: u64 = (x27 + x36); + const x38: u64 = (x26 + x37); + const x39: u64 = (x25 + x38); + const x40: u64 = (x23 + x24); + const x41: u64 = (x22 + x40); + const x42: u64 = (x21 + x41); + const x43: u64 = (x20 + x42); + const x44: u64 = (x19 + x43); + const x45: u64 = (x18 + x44); + const x46: u64 = (x17 + x45); + const x47: u64 = (x15 + x16); + const x48: u64 = (x14 + x47); + const x49: u64 = (x13 + x48); + const x50: u64 = (x12 + x49); + const x51: u64 = (x11 + x50); + const x52: u64 = (x10 + x51); + const x53: u64 = (x9 + x52); + const x54: u64 = (x7 + x8); + const x55: u64 = (x6 + x54); + const x56: u64 = (x5 + x55); + const x57: u64 = (x4 + x56); + const x58: u64 = (x3 + x57); + const x59: u64 = (x2 + x58); + const x60: u64 = (x1 + x59); out1[0] = x39; out1[1] = x46; out1[2] = x53; @@ -1780,55 +1777,57 @@ pub fn divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *[4]u64, out5: *[ var x1: u64 = undefined; var x2: u1 = undefined; addcarryxU64(&x1, &x2, 0x0, (~arg1), 0x1); - const x3 = (@as(u1, @truncate((x1 >> 63))) & @as(u1, @truncate(((arg3[0]) & 0x1)))); + const x3: u1 = (@as(u1, @truncate((x1 >> 63))) & @as(u1, @truncate(arg3[0]))); var x4: u64 = undefined; var x5: u1 = undefined; addcarryxU64(&x4, &x5, 0x0, (~arg1), 0x1); var x6: u64 = undefined; - cmovznzU64(&x6, x3, arg1, x4); + const x6_selection_mask = selectionMaskU64(x3); + x6 = arg1 ^ ((arg1 ^ x4) & x6_selection_mask); var x7: u64 = undefined; - cmovznzU64(&x7, x3, (arg2[0]), (arg3[0])); + x7 = arg2[0] ^ ((arg2[0] ^ arg3[0]) & x6_selection_mask); var x8: u64 = undefined; - cmovznzU64(&x8, x3, (arg2[1]), (arg3[1])); + x8 = arg2[1] ^ ((arg2[1] ^ arg3[1]) & x6_selection_mask); var x9: u64 = undefined; - cmovznzU64(&x9, x3, (arg2[2]), (arg3[2])); + x9 = arg2[2] ^ ((arg2[2] ^ arg3[2]) & x6_selection_mask); var x10: u64 = undefined; - cmovznzU64(&x10, x3, (arg2[3]), (arg3[3])); + x10 = arg2[3] ^ ((arg2[3] ^ arg3[3]) & x6_selection_mask); var x11: u64 = undefined; - cmovznzU64(&x11, x3, (arg2[4]), (arg3[4])); + x11 = arg2[4] ^ ((arg2[4] ^ arg3[4]) & x6_selection_mask); var x12: u64 = undefined; var x13: u1 = undefined; - addcarryxU64(&x12, &x13, 0x0, 0x1, (~(arg2[0]))); + addcarryxU64(&x12, &x13, 0x0, 0x1, (~arg2[0])); var x14: u64 = undefined; var x15: u1 = undefined; - addcarryxU64(&x14, &x15, x13, 0x0, (~(arg2[1]))); + addcarryxU64(&x14, &x15, x13, 0x0, (~arg2[1])); var x16: u64 = undefined; var x17: u1 = undefined; - addcarryxU64(&x16, &x17, x15, 0x0, (~(arg2[2]))); + addcarryxU64(&x16, &x17, x15, 0x0, (~arg2[2])); var x18: u64 = undefined; var x19: u1 = undefined; - addcarryxU64(&x18, &x19, x17, 0x0, (~(arg2[3]))); + addcarryxU64(&x18, &x19, x17, 0x0, (~arg2[3])); var x20: u64 = undefined; var x21: u1 = undefined; - addcarryxU64(&x20, &x21, x19, 0x0, (~(arg2[4]))); + addcarryxU64(&x20, &x21, x19, 0x0, (~arg2[4])); var x22: u64 = undefined; - cmovznzU64(&x22, x3, (arg3[0]), x12); + const x22_selection_mask = selectionMaskU64(x3); + x22 = arg3[0] ^ ((arg3[0] ^ x12) & x22_selection_mask); var x23: u64 = undefined; - cmovznzU64(&x23, x3, (arg3[1]), x14); + x23 = arg3[1] ^ ((arg3[1] ^ x14) & x22_selection_mask); var x24: u64 = undefined; - cmovznzU64(&x24, x3, (arg3[2]), x16); + x24 = arg3[2] ^ ((arg3[2] ^ x16) & x22_selection_mask); var x25: u64 = undefined; - cmovznzU64(&x25, x3, (arg3[3]), x18); + x25 = arg3[3] ^ ((arg3[3] ^ x18) & x22_selection_mask); var x26: u64 = undefined; - cmovznzU64(&x26, x3, (arg3[4]), x20); + x26 = arg3[4] ^ ((arg3[4] ^ x20) & x22_selection_mask); var x27: u64 = undefined; - cmovznzU64(&x27, x3, (arg4[0]), (arg5[0])); + x27 = arg4[0] ^ ((arg4[0] ^ arg5[0]) & x22_selection_mask); var x28: u64 = undefined; - cmovznzU64(&x28, x3, (arg4[1]), (arg5[1])); + x28 = arg4[1] ^ ((arg4[1] ^ arg5[1]) & x22_selection_mask); var x29: u64 = undefined; - cmovznzU64(&x29, x3, (arg4[2]), (arg5[2])); + x29 = arg4[2] ^ ((arg4[2] ^ arg5[2]) & x22_selection_mask); var x30: u64 = undefined; - cmovznzU64(&x30, x3, (arg4[3]), (arg5[3])); + x30 = arg4[3] ^ ((arg4[3] ^ arg5[3]) & x22_selection_mask); var x31: u64 = undefined; var x32: u1 = undefined; addcarryxU64(&x31, &x32, 0x0, x27, x27); @@ -1855,11 +1854,11 @@ pub fn divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *[4]u64, out5: *[ subborrowxU64(&x45, &x46, x44, x37, 0xffffffffffffffff); var x47: u64 = undefined; var x48: u1 = undefined; - subborrowxU64(&x47, &x48, x46, @as(u64, x38), 0x0); - const x49 = (arg4[3]); - const x50 = (arg4[2]); - const x51 = (arg4[1]); - const x52 = (arg4[0]); + subborrowxU64(&x47, &x48, x46, x38, 0x0); + const x49: u64 = arg4[3]; + const x50: u64 = arg4[2]; + const x51: u64 = arg4[1]; + const x52: u64 = arg4[0]; var x53: u64 = undefined; var x54: u1 = undefined; subborrowxU64(&x53, &x54, 0x0, 0x0, x52); @@ -1873,7 +1872,8 @@ pub fn divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *[4]u64, out5: *[ var x60: u1 = undefined; subborrowxU64(&x59, &x60, x58, 0x0, x49); var x61: u64 = undefined; - cmovznzU64(&x61, x60, 0x0, 0xffffffffffffffff); + const x61_selection_mask = selectionMaskU64(x60); + x61 = 0x0 ^ ((0x0 ^ 0xffffffffffffffff) & x61_selection_mask); var x62: u64 = undefined; var x63: u1 = undefined; addcarryxU64(&x62, &x63, 0x0, x53, (x61 & 0xbfd25e8cd0364141)); @@ -1887,24 +1887,26 @@ pub fn divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *[4]u64, out5: *[ var x69: u1 = undefined; addcarryxU64(&x68, &x69, x67, x59, x61); var x70: u64 = undefined; - cmovznzU64(&x70, x3, (arg5[0]), x62); + const x70_selection_mask = selectionMaskU64(x3); + x70 = arg5[0] ^ ((arg5[0] ^ x62) & x70_selection_mask); var x71: u64 = undefined; - cmovznzU64(&x71, x3, (arg5[1]), x64); + x71 = arg5[1] ^ ((arg5[1] ^ x64) & x70_selection_mask); var x72: u64 = undefined; - cmovznzU64(&x72, x3, (arg5[2]), x66); + x72 = arg5[2] ^ ((arg5[2] ^ x66) & x70_selection_mask); var x73: u64 = undefined; - cmovznzU64(&x73, x3, (arg5[3]), x68); - const x74 = @as(u1, @truncate((x22 & 0x1))); + x73 = arg5[3] ^ ((arg5[3] ^ x68) & x70_selection_mask); + const x74: u1 = @truncate(x22); var x75: u64 = undefined; - cmovznzU64(&x75, x74, 0x0, x7); + const x75_selection_mask = selectionMaskU64(x74); + x75 = 0x0 ^ ((0x0 ^ x7) & x75_selection_mask); var x76: u64 = undefined; - cmovznzU64(&x76, x74, 0x0, x8); + x76 = 0x0 ^ ((0x0 ^ x8) & x75_selection_mask); var x77: u64 = undefined; - cmovznzU64(&x77, x74, 0x0, x9); + x77 = 0x0 ^ ((0x0 ^ x9) & x75_selection_mask); var x78: u64 = undefined; - cmovznzU64(&x78, x74, 0x0, x10); + x78 = 0x0 ^ ((0x0 ^ x10) & x75_selection_mask); var x79: u64 = undefined; - cmovznzU64(&x79, x74, 0x0, x11); + x79 = 0x0 ^ ((0x0 ^ x11) & x75_selection_mask); var x80: u64 = undefined; var x81: u1 = undefined; addcarryxU64(&x80, &x81, 0x0, x22, x75); @@ -1921,13 +1923,14 @@ pub fn divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *[4]u64, out5: *[ var x89: u1 = undefined; addcarryxU64(&x88, &x89, x87, x26, x79); var x90: u64 = undefined; - cmovznzU64(&x90, x74, 0x0, x27); + const x90_selection_mask = selectionMaskU64(x74); + x90 = 0x0 ^ ((0x0 ^ x27) & x90_selection_mask); var x91: u64 = undefined; - cmovznzU64(&x91, x74, 0x0, x28); + x91 = 0x0 ^ ((0x0 ^ x28) & x90_selection_mask); var x92: u64 = undefined; - cmovznzU64(&x92, x74, 0x0, x29); + x92 = 0x0 ^ ((0x0 ^ x29) & x90_selection_mask); var x93: u64 = undefined; - cmovznzU64(&x93, x74, 0x0, x30); + x93 = 0x0 ^ ((0x0 ^ x30) & x90_selection_mask); var x94: u64 = undefined; var x95: u1 = undefined; addcarryxU64(&x94, &x95, 0x0, x70, x90); @@ -1954,31 +1957,33 @@ pub fn divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *[4]u64, out5: *[ subborrowxU64(&x108, &x109, x107, x100, 0xffffffffffffffff); var x110: u64 = undefined; var x111: u1 = undefined; - subborrowxU64(&x110, &x111, x109, @as(u64, x101), 0x0); + subborrowxU64(&x110, &x111, x109, x101, 0x0); var x112: u64 = undefined; var x113: u1 = undefined; addcarryxU64(&x112, &x113, 0x0, x6, 0x1); - const x114 = ((x80 >> 1) | ((x82 << 63) & 0xffffffffffffffff)); - const x115 = ((x82 >> 1) | ((x84 << 63) & 0xffffffffffffffff)); - const x116 = ((x84 >> 1) | ((x86 << 63) & 0xffffffffffffffff)); - const x117 = ((x86 >> 1) | ((x88 << 63) & 0xffffffffffffffff)); - const x118 = ((x88 & 0x8000000000000000) | (x88 >> 1)); + const x114: u64 = ((x80 >> 1) | ((x82 << 63) & 0xffffffffffffffff)); + const x115: u64 = ((x82 >> 1) | ((x84 << 63) & 0xffffffffffffffff)); + const x116: u64 = ((x84 >> 1) | ((x86 << 63) & 0xffffffffffffffff)); + const x117: u64 = ((x86 >> 1) | ((x88 << 63) & 0xffffffffffffffff)); + const x118: u64 = ((x88 & 0x8000000000000000) | (x88 >> 1)); var x119: u64 = undefined; - cmovznzU64(&x119, x48, x39, x31); + const x119_selection_mask = selectionMaskU64(x48); + x119 = x39 ^ ((x39 ^ x31) & x119_selection_mask); var x120: u64 = undefined; - cmovznzU64(&x120, x48, x41, x33); + x120 = x41 ^ ((x41 ^ x33) & x119_selection_mask); var x121: u64 = undefined; - cmovznzU64(&x121, x48, x43, x35); + x121 = x43 ^ ((x43 ^ x35) & x119_selection_mask); var x122: u64 = undefined; - cmovznzU64(&x122, x48, x45, x37); + x122 = x45 ^ ((x45 ^ x37) & x119_selection_mask); var x123: u64 = undefined; - cmovznzU64(&x123, x111, x102, x94); + const x123_selection_mask = selectionMaskU64(x111); + x123 = x102 ^ ((x102 ^ x94) & x123_selection_mask); var x124: u64 = undefined; - cmovznzU64(&x124, x111, x104, x96); + x124 = x104 ^ ((x104 ^ x96) & x123_selection_mask); var x125: u64 = undefined; - cmovznzU64(&x125, x111, x106, x98); + x125 = x106 ^ ((x106 ^ x98) & x123_selection_mask); var x126: u64 = undefined; - cmovznzU64(&x126, x111, x108, x100); + x126 = x108 ^ ((x108 ^ x100) & x123_selection_mask); out1.* = x112; out2[0] = x7; out2[1] = x8; -- 2.54.0