authorgravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2026-10-15 10:08:02+02:00
committergravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2026-10-15 10:08:02+02:00
logba450411c0e4086819d0790cc3ae4371823a323e
treec93345fc7cd8ed2ee881e84d2cb2ec3d10363b2d
parentf5f4063029f1cbedb1cde0048138c9b1a56fc114
parent23e2b25ca29604c93ef1b3cba1a6be041dcaad1f

Merge pull request 'std.crypto: update fiat-crypto generated code' (#37139) from jedisct1/zig:fiatupdate into master

Reviewed-on: https://codeberg.org/ziglang/zig/pulls/37139

6 files changed, 2574 insertions(+), 2606 deletions(-)

lib/std/crypto/pcurves/p256/p256_64.zig+399-425
......@@ -13,42 +13,10 @@
1313//
1414// Computed values:
1515// eval z = z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192)
16// bytes_eval z = z[0]
17// + (z[1] << 8)
18// + (z[2] << 16)
19// + (z[3] << 24)
20// + (z[4] << 32)
21// + (z[5] << 40)
22// + (z[6] << 48)
23// + (z[7] << 56)
24// + (z[8] << 64)
25// + (z[9] << 72)
26// + (z[10] << 80)
27// + (z[11] << 88)
28// + (z[12] << 96)
29// + (z[13] << 104)
30// + (z[14] << 112)
31// + (z[15] << 120)
32// + (z[16] << 128)
33// + (z[17] << 136)
34// + (z[18] << 144)
35// + (z[19] << 152)
36// + (z[20] << 160)
37// + (z[21] << 168)
38// + (z[22] << 176)
39// + (z[23] << 184)
40// + (z[24] << 192)
41// + (z[25] << 200)
42// + (z[26] << 208)
43// + (z[27] << 216)
44// + (z[28] << 224)
45// + (z[29] << 232)
46// + (z[30] << 240)
47// + (z[31] << 248)
16// bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248)
4817// twos_complement_eval z = let x1 := z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) in
4918// if x1 & (2^256-1) < 2^255 then x1 & (2^256-1) else (x1 & (2^256-1)) - 2^256
5019
51const std = @import("std");
5220const mode = @import("builtin").mode; // Checked arithmetic is disabled in non-debug modes to avoid side channels
5321
5422// The type MontgomeryDomainFieldElement is a field element in the Montgomery domain.
......@@ -59,80 +27,70 @@ pub const MontgomeryDomainFieldElement = [4]u64;
5927// Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
6028pub const NonMontgomeryDomainFieldElement = [4]u64;
6129
62/// The function addcarryxU64 is an addition with carry.
63///
64/// Postconditions:
65/// out1 = (arg1 + arg2 + arg3) mod 2^64
66/// out2 = ⌊(arg1 + arg2 + arg3) / 2^64⌋
67///
68/// Input Bounds:
69/// arg1: [0x0 ~> 0x1]
70/// arg2: [0x0 ~> 0xffffffffffffffff]
71/// arg3: [0x0 ~> 0xffffffffffffffff]
72/// Output Bounds:
73/// out1: [0x0 ~> 0xffffffffffffffff]
74/// out2: [0x0 ~> 0x1]
30/// Add two limbs and a carry bit, returning the sum modulo 2^64 and the carry bit.
7531fn addcarryxU64(out1: *u64, out2: *u1, arg1: u1, arg2: u64, arg3: u64) void {
76 const x = @as(u128, arg2) +% arg3 +% arg1;
77 out1.* = @truncate(x);
78 out2.* = @truncate(x >> 64);
32 @setRuntimeSafety(mode == .debug);
33
34 const x = @addWithOverflow(arg2, arg3);
35 const y = @addWithOverflow(x[0], arg1);
36 out1.* = y[0];
37 out2.* = x[1] | y[1];
7938}
8039
81/// The function subborrowxU64 is a subtraction with borrow.
82///
83/// Postconditions:
84/// out1 = (-arg1 + arg2 + -arg3) mod 2^64
85/// out2 = -⌊(-arg1 + arg2 + -arg3) / 2^64⌋
86///
87/// Input Bounds:
88/// arg1: [0x0 ~> 0x1]
89/// arg2: [0x0 ~> 0xffffffffffffffff]
90/// arg3: [0x0 ~> 0xffffffffffffffff]
91/// Output Bounds:
92/// out1: [0x0 ~> 0xffffffffffffffff]
93/// out2: [0x0 ~> 0x1]
40/// Subtract two limbs and a borrow bit, returning the difference modulo 2^64 and the borrow bit.
9441fn subborrowxU64(out1: *u64, out2: *u1, arg1: u1, arg2: u64, arg3: u64) void {
95 const x = @as(u128, arg2) -% arg3 -% arg1;
96 out1.* = @truncate(x);
97 out2.* = @truncate(x >> 64);
42 @setRuntimeSafety(mode == .debug);
43
44 const x = @subWithOverflow(arg2, arg3);
45 const y = @subWithOverflow(x[0], arg1);
46 out1.* = y[0];
47 out2.* = x[1] | y[1];
9848}
9949
100/// The function mulxU64 is a multiplication, returning the full double-width result.
101///
102/// Postconditions:
103/// out1 = (arg1 * arg2) mod 2^64
104/// out2 = ⌊arg1 * arg2 / 2^64⌋
105///
106/// Input Bounds:
107/// arg1: [0x0 ~> 0xffffffffffffffff]
108/// arg2: [0x0 ~> 0xffffffffffffffff]
109/// Output Bounds:
110/// out1: [0x0 ~> 0xffffffffffffffff]
111/// out2: [0x0 ~> 0xffffffffffffffff]
50/// Multiply two limbs, returning the low and high halves of the product.
11251fn mulxU64(out1: *u64, out2: *u64, arg1: u64, arg2: u64) void {
11352 @setRuntimeSafety(mode == .debug);
11453
115 const x = @as(u128, arg1) * @as(u128, arg2);
116 out1.* = @as(u64, @truncate(x));
117 out2.* = @as(u64, @truncate(x >> 64));
54 const x = @as(u128, arg1) * arg2;
55 out1.* = @truncate(x);
56 out2.* = @intCast(x >> 64);
11857}
11958
120/// The function cmovznzU64 is a single-word conditional move.
121///
122/// Postconditions:
123/// out1 = (if arg1 = 0 then arg2 else arg3)
124///
125/// Input Bounds:
126/// arg1: [0x0 ~> 0x1]
127/// arg2: [0x0 ~> 0xffffffffffffffff]
128/// arg3: [0x0 ~> 0xffffffffffffffff]
129/// Output Bounds:
130/// out1: [0x0 ~> 0xffffffffffffffff]
59/// Keep selection masks opaque to the optimizer without adding instructions.
60fn selectionMaskU64(arg1: u1) u64 {
61 @setRuntimeSafety(mode == .debug);
62
63 const value: u64 = 0 -% @as(u64, arg1);
64 if (@inComptime()) return value;
65 switch (@import("builtin").zig_backend) {
66 .stage2_c, .stage2_wasm => return value,
67 else => {},
68 }
69 if (@bitSizeOf(u64) <= @bitSizeOf(usize)) {
70 return asm (""
71 : [mask] "=r" (-> u64),
72 : [value] "0" (value),
73 );
74 }
75 var mask: u64 = 0;
76 inline for (0..@divExact(@bitSizeOf(u64), @bitSizeOf(usize))) |i| {
77 const shift = i * @bitSizeOf(usize);
78 const chunk: usize = @truncate(value >> shift);
79 const part = asm (""
80 : [mask] "=r" (-> usize),
81 : [value] "0" (chunk),
82 );
83 mask |= @as(u64, part) << shift;
84 }
85 return mask;
86}
87
88/// Select arg2 when arg1 is zero and arg3 otherwise, using a bit mask.
13189fn cmovznzU64(out1: *u64, arg1: u1, arg2: u64, arg3: u64) void {
13290 @setRuntimeSafety(mode == .debug);
13391
134 const mask = 0 -% @as(u64, arg1);
135 out1.* = (mask & arg3) | ((~mask) & arg2);
92 const mask = selectionMaskU64(arg1);
93 out1.* = arg2 ^ ((arg2 ^ arg3) & mask);
13694}
13795
13896/// The function mul multiplies two field elements in the Montgomery domain.
......@@ -147,22 +105,22 @@ fn cmovznzU64(out1: *u64, arg1: u1, arg2: u64, arg3: u64) void {
147105pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldElement, arg2: MontgomeryDomainFieldElement) void {
148106 @setRuntimeSafety(mode == .debug);
149107
150 const x1 = (arg1[1]);
151 const x2 = (arg1[2]);
152 const x3 = (arg1[3]);
153 const x4 = (arg1[0]);
108 const x1: u64 = arg1[1];
109 const x2: u64 = arg1[2];
110 const x3: u64 = arg1[3];
111 const x4: u64 = arg1[0];
154112 var x5: u64 = undefined;
155113 var x6: u64 = undefined;
156 mulxU64(&x5, &x6, x4, (arg2[3]));
114 mulxU64(&x5, &x6, x4, arg2[3]);
157115 var x7: u64 = undefined;
158116 var x8: u64 = undefined;
159 mulxU64(&x7, &x8, x4, (arg2[2]));
117 mulxU64(&x7, &x8, x4, arg2[2]);
160118 var x9: u64 = undefined;
161119 var x10: u64 = undefined;
162 mulxU64(&x9, &x10, x4, (arg2[1]));
120 mulxU64(&x9, &x10, x4, arg2[1]);
163121 var x11: u64 = undefined;
164122 var x12: u64 = undefined;
165 mulxU64(&x11, &x12, x4, (arg2[0]));
123 mulxU64(&x11, &x12, x4, arg2[0]);
166124 var x13: u64 = undefined;
167125 var x14: u1 = undefined;
168126 addcarryxU64(&x13, &x14, 0x0, x12, x9);
......@@ -172,7 +130,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
172130 var x17: u64 = undefined;
173131 var x18: u1 = undefined;
174132 addcarryxU64(&x17, &x18, x16, x8, x5);
175 const x19 = (@as(u64, x18) + x6);
133 const x19: u64 = (x18 + x6);
176134 var x20: u64 = undefined;
177135 var x21: u64 = undefined;
178136 mulxU64(&x20, &x21, x11, 0xffffffff00000001);
......@@ -185,7 +143,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
185143 var x26: u64 = undefined;
186144 var x27: u1 = undefined;
187145 addcarryxU64(&x26, &x27, 0x0, x25, x22);
188 const x28 = (@as(u64, x27) + x23);
146 const x28: u64 = (x27 + x23);
189147 var x29: u64 = undefined;
190148 var x30: u1 = undefined;
191149 addcarryxU64(&x29, &x30, 0x0, x11, x24);
......@@ -203,16 +161,16 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
203161 addcarryxU64(&x37, &x38, x36, x19, x21);
204162 var x39: u64 = undefined;
205163 var x40: u64 = undefined;
206 mulxU64(&x39, &x40, x1, (arg2[3]));
164 mulxU64(&x39, &x40, x1, arg2[3]);
207165 var x41: u64 = undefined;
208166 var x42: u64 = undefined;
209 mulxU64(&x41, &x42, x1, (arg2[2]));
167 mulxU64(&x41, &x42, x1, arg2[2]);
210168 var x43: u64 = undefined;
211169 var x44: u64 = undefined;
212 mulxU64(&x43, &x44, x1, (arg2[1]));
170 mulxU64(&x43, &x44, x1, arg2[1]);
213171 var x45: u64 = undefined;
214172 var x46: u64 = undefined;
215 mulxU64(&x45, &x46, x1, (arg2[0]));
173 mulxU64(&x45, &x46, x1, arg2[0]);
216174 var x47: u64 = undefined;
217175 var x48: u1 = undefined;
218176 addcarryxU64(&x47, &x48, 0x0, x46, x43);
......@@ -222,7 +180,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
222180 var x51: u64 = undefined;
223181 var x52: u1 = undefined;
224182 addcarryxU64(&x51, &x52, x50, x42, x39);
225 const x53 = (@as(u64, x52) + x40);
183 const x53: u64 = (x52 + x40);
226184 var x54: u64 = undefined;
227185 var x55: u1 = undefined;
228186 addcarryxU64(&x54, &x55, 0x0, x31, x45);
......@@ -237,7 +195,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
237195 addcarryxU64(&x60, &x61, x59, x37, x51);
238196 var x62: u64 = undefined;
239197 var x63: u1 = undefined;
240 addcarryxU64(&x62, &x63, x61, @as(u64, x38), x53);
198 addcarryxU64(&x62, &x63, x61, x38, x53);
241199 var x64: u64 = undefined;
242200 var x65: u64 = undefined;
243201 mulxU64(&x64, &x65, x54, 0xffffffff00000001);
......@@ -250,7 +208,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
250208 var x70: u64 = undefined;
251209 var x71: u1 = undefined;
252210 addcarryxU64(&x70, &x71, 0x0, x69, x66);
253 const x72 = (@as(u64, x71) + x67);
211 const x72: u64 = (x71 + x67);
254212 var x73: u64 = undefined;
255213 var x74: u1 = undefined;
256214 addcarryxU64(&x73, &x74, 0x0, x54, x68);
......@@ -266,19 +224,19 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
266224 var x81: u64 = undefined;
267225 var x82: u1 = undefined;
268226 addcarryxU64(&x81, &x82, x80, x62, x65);
269 const x83 = (@as(u64, x82) + @as(u64, x63));
227 const x83: u64 = (@as(u64, x82) + x63);
270228 var x84: u64 = undefined;
271229 var x85: u64 = undefined;
272 mulxU64(&x84, &x85, x2, (arg2[3]));
230 mulxU64(&x84, &x85, x2, arg2[3]);
273231 var x86: u64 = undefined;
274232 var x87: u64 = undefined;
275 mulxU64(&x86, &x87, x2, (arg2[2]));
233 mulxU64(&x86, &x87, x2, arg2[2]);
276234 var x88: u64 = undefined;
277235 var x89: u64 = undefined;
278 mulxU64(&x88, &x89, x2, (arg2[1]));
236 mulxU64(&x88, &x89, x2, arg2[1]);
279237 var x90: u64 = undefined;
280238 var x91: u64 = undefined;
281 mulxU64(&x90, &x91, x2, (arg2[0]));
239 mulxU64(&x90, &x91, x2, arg2[0]);
282240 var x92: u64 = undefined;
283241 var x93: u1 = undefined;
284242 addcarryxU64(&x92, &x93, 0x0, x91, x88);
......@@ -288,7 +246,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
288246 var x96: u64 = undefined;
289247 var x97: u1 = undefined;
290248 addcarryxU64(&x96, &x97, x95, x87, x84);
291 const x98 = (@as(u64, x97) + x85);
249 const x98: u64 = (x97 + x85);
292250 var x99: u64 = undefined;
293251 var x100: u1 = undefined;
294252 addcarryxU64(&x99, &x100, 0x0, x75, x90);
......@@ -316,7 +274,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
316274 var x115: u64 = undefined;
317275 var x116: u1 = undefined;
318276 addcarryxU64(&x115, &x116, 0x0, x114, x111);
319 const x117 = (@as(u64, x116) + x112);
277 const x117: u64 = (x116 + x112);
320278 var x118: u64 = undefined;
321279 var x119: u1 = undefined;
322280 addcarryxU64(&x118, &x119, 0x0, x99, x113);
......@@ -332,19 +290,19 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
332290 var x126: u64 = undefined;
333291 var x127: u1 = undefined;
334292 addcarryxU64(&x126, &x127, x125, x107, x110);
335 const x128 = (@as(u64, x127) + @as(u64, x108));
293 const x128: u64 = (@as(u64, x127) + x108);
336294 var x129: u64 = undefined;
337295 var x130: u64 = undefined;
338 mulxU64(&x129, &x130, x3, (arg2[3]));
296 mulxU64(&x129, &x130, x3, arg2[3]);
339297 var x131: u64 = undefined;
340298 var x132: u64 = undefined;
341 mulxU64(&x131, &x132, x3, (arg2[2]));
299 mulxU64(&x131, &x132, x3, arg2[2]);
342300 var x133: u64 = undefined;
343301 var x134: u64 = undefined;
344 mulxU64(&x133, &x134, x3, (arg2[1]));
302 mulxU64(&x133, &x134, x3, arg2[1]);
345303 var x135: u64 = undefined;
346304 var x136: u64 = undefined;
347 mulxU64(&x135, &x136, x3, (arg2[0]));
305 mulxU64(&x135, &x136, x3, arg2[0]);
348306 var x137: u64 = undefined;
349307 var x138: u1 = undefined;
350308 addcarryxU64(&x137, &x138, 0x0, x136, x133);
......@@ -354,7 +312,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
354312 var x141: u64 = undefined;
355313 var x142: u1 = undefined;
356314 addcarryxU64(&x141, &x142, x140, x132, x129);
357 const x143 = (@as(u64, x142) + x130);
315 const x143: u64 = (x142 + x130);
358316 var x144: u64 = undefined;
359317 var x145: u1 = undefined;
360318 addcarryxU64(&x144, &x145, 0x0, x120, x135);
......@@ -382,7 +340,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
382340 var x160: u64 = undefined;
383341 var x161: u1 = undefined;
384342 addcarryxU64(&x160, &x161, 0x0, x159, x156);
385 const x162 = (@as(u64, x161) + x157);
343 const x162: u64 = (x161 + x157);
386344 var x163: u64 = undefined;
387345 var x164: u1 = undefined;
388346 addcarryxU64(&x163, &x164, 0x0, x144, x158);
......@@ -398,7 +356,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
398356 var x171: u64 = undefined;
399357 var x172: u1 = undefined;
400358 addcarryxU64(&x171, &x172, x170, x152, x155);
401 const x173 = (@as(u64, x172) + @as(u64, x153));
359 const x173: u64 = (@as(u64, x172) + x153);
402360 var x174: u64 = undefined;
403361 var x175: u1 = undefined;
404362 subborrowxU64(&x174, &x175, 0x0, x165, 0xffffffffffffffff);
......@@ -407,21 +365,22 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
407365 subborrowxU64(&x176, &x177, x175, x167, 0xffffffff);
408366 var x178: u64 = undefined;
409367 var x179: u1 = undefined;
410 subborrowxU64(&x178, &x179, x177, x169, @as(u64, 0x0));
368 subborrowxU64(&x178, &x179, x177, x169, 0x0);
411369 var x180: u64 = undefined;
412370 var x181: u1 = undefined;
413371 subborrowxU64(&x180, &x181, x179, x171, 0xffffffff00000001);
414372 var x182: u64 = undefined;
415373 var x183: u1 = undefined;
416 subborrowxU64(&x182, &x183, x181, x173, @as(u64, 0x0));
374 subborrowxU64(&x182, &x183, x181, x173, 0x0);
417375 var x184: u64 = undefined;
418 cmovznzU64(&x184, x183, x174, x165);
376 const x184_selection_mask = selectionMaskU64(x183);
377 x184 = x174 ^ ((x174 ^ x165) & x184_selection_mask);
419378 var x185: u64 = undefined;
420 cmovznzU64(&x185, x183, x176, x167);
379 x185 = x176 ^ ((x176 ^ x167) & x184_selection_mask);
421380 var x186: u64 = undefined;
422 cmovznzU64(&x186, x183, x178, x169);
381 x186 = x178 ^ ((x178 ^ x169) & x184_selection_mask);
423382 var x187: u64 = undefined;
424 cmovznzU64(&x187, x183, x180, x171);
383 x187 = x180 ^ ((x180 ^ x171) & x184_selection_mask);
425384 out1[0] = x184;
426385 out1[1] = x185;
427386 out1[2] = x186;
......@@ -439,22 +398,22 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
439398pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldElement) void {
440399 @setRuntimeSafety(mode == .debug);
441400
442 const x1 = (arg1[1]);
443 const x2 = (arg1[2]);
444 const x3 = (arg1[3]);
445 const x4 = (arg1[0]);
401 const x1: u64 = arg1[1];
402 const x2: u64 = arg1[2];
403 const x3: u64 = arg1[3];
404 const x4: u64 = arg1[0];
446405 var x5: u64 = undefined;
447406 var x6: u64 = undefined;
448 mulxU64(&x5, &x6, x4, (arg1[3]));
407 mulxU64(&x5, &x6, x4, arg1[3]);
449408 var x7: u64 = undefined;
450409 var x8: u64 = undefined;
451 mulxU64(&x7, &x8, x4, (arg1[2]));
410 mulxU64(&x7, &x8, x4, arg1[2]);
452411 var x9: u64 = undefined;
453412 var x10: u64 = undefined;
454 mulxU64(&x9, &x10, x4, (arg1[1]));
413 mulxU64(&x9, &x10, x4, arg1[1]);
455414 var x11: u64 = undefined;
456415 var x12: u64 = undefined;
457 mulxU64(&x11, &x12, x4, (arg1[0]));
416 mulxU64(&x11, &x12, x4, arg1[0]);
458417 var x13: u64 = undefined;
459418 var x14: u1 = undefined;
460419 addcarryxU64(&x13, &x14, 0x0, x12, x9);
......@@ -464,7 +423,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
464423 var x17: u64 = undefined;
465424 var x18: u1 = undefined;
466425 addcarryxU64(&x17, &x18, x16, x8, x5);
467 const x19 = (@as(u64, x18) + x6);
426 const x19: u64 = (x18 + x6);
468427 var x20: u64 = undefined;
469428 var x21: u64 = undefined;
470429 mulxU64(&x20, &x21, x11, 0xffffffff00000001);
......@@ -477,7 +436,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
477436 var x26: u64 = undefined;
478437 var x27: u1 = undefined;
479438 addcarryxU64(&x26, &x27, 0x0, x25, x22);
480 const x28 = (@as(u64, x27) + x23);
439 const x28: u64 = (x27 + x23);
481440 var x29: u64 = undefined;
482441 var x30: u1 = undefined;
483442 addcarryxU64(&x29, &x30, 0x0, x11, x24);
......@@ -495,16 +454,16 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
495454 addcarryxU64(&x37, &x38, x36, x19, x21);
496455 var x39: u64 = undefined;
497456 var x40: u64 = undefined;
498 mulxU64(&x39, &x40, x1, (arg1[3]));
457 mulxU64(&x39, &x40, x1, arg1[3]);
499458 var x41: u64 = undefined;
500459 var x42: u64 = undefined;
501 mulxU64(&x41, &x42, x1, (arg1[2]));
460 mulxU64(&x41, &x42, x1, arg1[2]);
502461 var x43: u64 = undefined;
503462 var x44: u64 = undefined;
504 mulxU64(&x43, &x44, x1, (arg1[1]));
463 mulxU64(&x43, &x44, x1, arg1[1]);
505464 var x45: u64 = undefined;
506465 var x46: u64 = undefined;
507 mulxU64(&x45, &x46, x1, (arg1[0]));
466 mulxU64(&x45, &x46, x1, arg1[0]);
508467 var x47: u64 = undefined;
509468 var x48: u1 = undefined;
510469 addcarryxU64(&x47, &x48, 0x0, x46, x43);
......@@ -514,7 +473,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
514473 var x51: u64 = undefined;
515474 var x52: u1 = undefined;
516475 addcarryxU64(&x51, &x52, x50, x42, x39);
517 const x53 = (@as(u64, x52) + x40);
476 const x53: u64 = (x52 + x40);
518477 var x54: u64 = undefined;
519478 var x55: u1 = undefined;
520479 addcarryxU64(&x54, &x55, 0x0, x31, x45);
......@@ -529,7 +488,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
529488 addcarryxU64(&x60, &x61, x59, x37, x51);
530489 var x62: u64 = undefined;
531490 var x63: u1 = undefined;
532 addcarryxU64(&x62, &x63, x61, @as(u64, x38), x53);
491 addcarryxU64(&x62, &x63, x61, x38, x53);
533492 var x64: u64 = undefined;
534493 var x65: u64 = undefined;
535494 mulxU64(&x64, &x65, x54, 0xffffffff00000001);
......@@ -542,7 +501,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
542501 var x70: u64 = undefined;
543502 var x71: u1 = undefined;
544503 addcarryxU64(&x70, &x71, 0x0, x69, x66);
545 const x72 = (@as(u64, x71) + x67);
504 const x72: u64 = (x71 + x67);
546505 var x73: u64 = undefined;
547506 var x74: u1 = undefined;
548507 addcarryxU64(&x73, &x74, 0x0, x54, x68);
......@@ -558,19 +517,19 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
558517 var x81: u64 = undefined;
559518 var x82: u1 = undefined;
560519 addcarryxU64(&x81, &x82, x80, x62, x65);
561 const x83 = (@as(u64, x82) + @as(u64, x63));
520 const x83: u64 = (@as(u64, x82) + x63);
562521 var x84: u64 = undefined;
563522 var x85: u64 = undefined;
564 mulxU64(&x84, &x85, x2, (arg1[3]));
523 mulxU64(&x84, &x85, x2, arg1[3]);
565524 var x86: u64 = undefined;
566525 var x87: u64 = undefined;
567 mulxU64(&x86, &x87, x2, (arg1[2]));
526 mulxU64(&x86, &x87, x2, arg1[2]);
568527 var x88: u64 = undefined;
569528 var x89: u64 = undefined;
570 mulxU64(&x88, &x89, x2, (arg1[1]));
529 mulxU64(&x88, &x89, x2, arg1[1]);
571530 var x90: u64 = undefined;
572531 var x91: u64 = undefined;
573 mulxU64(&x90, &x91, x2, (arg1[0]));
532 mulxU64(&x90, &x91, x2, arg1[0]);
574533 var x92: u64 = undefined;
575534 var x93: u1 = undefined;
576535 addcarryxU64(&x92, &x93, 0x0, x91, x88);
......@@ -580,7 +539,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
580539 var x96: u64 = undefined;
581540 var x97: u1 = undefined;
582541 addcarryxU64(&x96, &x97, x95, x87, x84);
583 const x98 = (@as(u64, x97) + x85);
542 const x98: u64 = (x97 + x85);
584543 var x99: u64 = undefined;
585544 var x100: u1 = undefined;
586545 addcarryxU64(&x99, &x100, 0x0, x75, x90);
......@@ -608,7 +567,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
608567 var x115: u64 = undefined;
609568 var x116: u1 = undefined;
610569 addcarryxU64(&x115, &x116, 0x0, x114, x111);
611 const x117 = (@as(u64, x116) + x112);
570 const x117: u64 = (x116 + x112);
612571 var x118: u64 = undefined;
613572 var x119: u1 = undefined;
614573 addcarryxU64(&x118, &x119, 0x0, x99, x113);
......@@ -624,19 +583,19 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
624583 var x126: u64 = undefined;
625584 var x127: u1 = undefined;
626585 addcarryxU64(&x126, &x127, x125, x107, x110);
627 const x128 = (@as(u64, x127) + @as(u64, x108));
586 const x128: u64 = (@as(u64, x127) + x108);
628587 var x129: u64 = undefined;
629588 var x130: u64 = undefined;
630 mulxU64(&x129, &x130, x3, (arg1[3]));
589 mulxU64(&x129, &x130, x3, arg1[3]);
631590 var x131: u64 = undefined;
632591 var x132: u64 = undefined;
633 mulxU64(&x131, &x132, x3, (arg1[2]));
592 mulxU64(&x131, &x132, x3, arg1[2]);
634593 var x133: u64 = undefined;
635594 var x134: u64 = undefined;
636 mulxU64(&x133, &x134, x3, (arg1[1]));
595 mulxU64(&x133, &x134, x3, arg1[1]);
637596 var x135: u64 = undefined;
638597 var x136: u64 = undefined;
639 mulxU64(&x135, &x136, x3, (arg1[0]));
598 mulxU64(&x135, &x136, x3, arg1[0]);
640599 var x137: u64 = undefined;
641600 var x138: u1 = undefined;
642601 addcarryxU64(&x137, &x138, 0x0, x136, x133);
......@@ -646,7 +605,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
646605 var x141: u64 = undefined;
647606 var x142: u1 = undefined;
648607 addcarryxU64(&x141, &x142, x140, x132, x129);
649 const x143 = (@as(u64, x142) + x130);
608 const x143: u64 = (x142 + x130);
650609 var x144: u64 = undefined;
651610 var x145: u1 = undefined;
652611 addcarryxU64(&x144, &x145, 0x0, x120, x135);
......@@ -674,7 +633,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
674633 var x160: u64 = undefined;
675634 var x161: u1 = undefined;
676635 addcarryxU64(&x160, &x161, 0x0, x159, x156);
677 const x162 = (@as(u64, x161) + x157);
636 const x162: u64 = (x161 + x157);
678637 var x163: u64 = undefined;
679638 var x164: u1 = undefined;
680639 addcarryxU64(&x163, &x164, 0x0, x144, x158);
......@@ -690,7 +649,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
690649 var x171: u64 = undefined;
691650 var x172: u1 = undefined;
692651 addcarryxU64(&x171, &x172, x170, x152, x155);
693 const x173 = (@as(u64, x172) + @as(u64, x153));
652 const x173: u64 = (@as(u64, x172) + x153);
694653 var x174: u64 = undefined;
695654 var x175: u1 = undefined;
696655 subborrowxU64(&x174, &x175, 0x0, x165, 0xffffffffffffffff);
......@@ -699,21 +658,22 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
699658 subborrowxU64(&x176, &x177, x175, x167, 0xffffffff);
700659 var x178: u64 = undefined;
701660 var x179: u1 = undefined;
702 subborrowxU64(&x178, &x179, x177, x169, @as(u64, 0x0));
661 subborrowxU64(&x178, &x179, x177, x169, 0x0);
703662 var x180: u64 = undefined;
704663 var x181: u1 = undefined;
705664 subborrowxU64(&x180, &x181, x179, x171, 0xffffffff00000001);
706665 var x182: u64 = undefined;
707666 var x183: u1 = undefined;
708 subborrowxU64(&x182, &x183, x181, x173, @as(u64, 0x0));
667 subborrowxU64(&x182, &x183, x181, x173, 0x0);
709668 var x184: u64 = undefined;
710 cmovznzU64(&x184, x183, x174, x165);
669 const x184_selection_mask = selectionMaskU64(x183);
670 x184 = x174 ^ ((x174 ^ x165) & x184_selection_mask);
711671 var x185: u64 = undefined;
712 cmovznzU64(&x185, x183, x176, x167);
672 x185 = x176 ^ ((x176 ^ x167) & x184_selection_mask);
713673 var x186: u64 = undefined;
714 cmovznzU64(&x186, x183, x178, x169);
674 x186 = x178 ^ ((x178 ^ x169) & x184_selection_mask);
715675 var x187: u64 = undefined;
716 cmovznzU64(&x187, x183, x180, x171);
676 x187 = x180 ^ ((x180 ^ x171) & x184_selection_mask);
717677 out1[0] = x184;
718678 out1[1] = x185;
719679 out1[2] = x186;
......@@ -734,16 +694,16 @@ pub fn add(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
734694
735695 var x1: u64 = undefined;
736696 var x2: u1 = undefined;
737 addcarryxU64(&x1, &x2, 0x0, (arg1[0]), (arg2[0]));
697 addcarryxU64(&x1, &x2, 0x0, arg1[0], arg2[0]);
738698 var x3: u64 = undefined;
739699 var x4: u1 = undefined;
740 addcarryxU64(&x3, &x4, x2, (arg1[1]), (arg2[1]));
700 addcarryxU64(&x3, &x4, x2, arg1[1], arg2[1]);
741701 var x5: u64 = undefined;
742702 var x6: u1 = undefined;
743 addcarryxU64(&x5, &x6, x4, (arg1[2]), (arg2[2]));
703 addcarryxU64(&x5, &x6, x4, arg1[2], arg2[2]);
744704 var x7: u64 = undefined;
745705 var x8: u1 = undefined;
746 addcarryxU64(&x7, &x8, x6, (arg1[3]), (arg2[3]));
706 addcarryxU64(&x7, &x8, x6, arg1[3], arg2[3]);
747707 var x9: u64 = undefined;
748708 var x10: u1 = undefined;
749709 subborrowxU64(&x9, &x10, 0x0, x1, 0xffffffffffffffff);
......@@ -752,21 +712,22 @@ pub fn add(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
752712 subborrowxU64(&x11, &x12, x10, x3, 0xffffffff);
753713 var x13: u64 = undefined;
754714 var x14: u1 = undefined;
755 subborrowxU64(&x13, &x14, x12, x5, @as(u64, 0x0));
715 subborrowxU64(&x13, &x14, x12, x5, 0x0);
756716 var x15: u64 = undefined;
757717 var x16: u1 = undefined;
758718 subborrowxU64(&x15, &x16, x14, x7, 0xffffffff00000001);
759719 var x17: u64 = undefined;
760720 var x18: u1 = undefined;
761 subborrowxU64(&x17, &x18, x16, @as(u64, x8), @as(u64, 0x0));
721 subborrowxU64(&x17, &x18, x16, x8, 0x0);
762722 var x19: u64 = undefined;
763 cmovznzU64(&x19, x18, x9, x1);
723 const x19_selection_mask = selectionMaskU64(x18);
724 x19 = x9 ^ ((x9 ^ x1) & x19_selection_mask);
764725 var x20: u64 = undefined;
765 cmovznzU64(&x20, x18, x11, x3);
726 x20 = x11 ^ ((x11 ^ x3) & x19_selection_mask);
766727 var x21: u64 = undefined;
767 cmovznzU64(&x21, x18, x13, x5);
728 x21 = x13 ^ ((x13 ^ x5) & x19_selection_mask);
768729 var x22: u64 = undefined;
769 cmovznzU64(&x22, x18, x15, x7);
730 x22 = x15 ^ ((x15 ^ x7) & x19_selection_mask);
770731 out1[0] = x19;
771732 out1[1] = x20;
772733 out1[2] = x21;
......@@ -787,18 +748,19 @@ pub fn sub(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
787748
788749 var x1: u64 = undefined;
789750 var x2: u1 = undefined;
790 subborrowxU64(&x1, &x2, 0x0, (arg1[0]), (arg2[0]));
751 subborrowxU64(&x1, &x2, 0x0, arg1[0], arg2[0]);
791752 var x3: u64 = undefined;
792753 var x4: u1 = undefined;
793 subborrowxU64(&x3, &x4, x2, (arg1[1]), (arg2[1]));
754 subborrowxU64(&x3, &x4, x2, arg1[1], arg2[1]);
794755 var x5: u64 = undefined;
795756 var x6: u1 = undefined;
796 subborrowxU64(&x5, &x6, x4, (arg1[2]), (arg2[2]));
757 subborrowxU64(&x5, &x6, x4, arg1[2], arg2[2]);
797758 var x7: u64 = undefined;
798759 var x8: u1 = undefined;
799 subborrowxU64(&x7, &x8, x6, (arg1[3]), (arg2[3]));
760 subborrowxU64(&x7, &x8, x6, arg1[3], arg2[3]);
800761 var x9: u64 = undefined;
801 cmovznzU64(&x9, x8, @as(u64, 0x0), 0xffffffffffffffff);
762 const x9_selection_mask = selectionMaskU64(x8);
763 x9 = 0x0 ^ ((0x0 ^ 0xffffffffffffffff) & x9_selection_mask);
802764 var x10: u64 = undefined;
803765 var x11: u1 = undefined;
804766 addcarryxU64(&x10, &x11, 0x0, x1, x9);
......@@ -807,7 +769,7 @@ pub fn sub(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
807769 addcarryxU64(&x12, &x13, x11, x3, (x9 & 0xffffffff));
808770 var x14: u64 = undefined;
809771 var x15: u1 = undefined;
810 addcarryxU64(&x14, &x15, x13, x5, @as(u64, 0x0));
772 addcarryxU64(&x14, &x15, x13, x5, 0x0);
811773 var x16: u64 = undefined;
812774 var x17: u1 = undefined;
813775 addcarryxU64(&x16, &x17, x15, x7, (x9 & 0xffffffff00000001));
......@@ -830,18 +792,19 @@ pub fn opp(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
830792
831793 var x1: u64 = undefined;
832794 var x2: u1 = undefined;
833 subborrowxU64(&x1, &x2, 0x0, @as(u64, 0x0), (arg1[0]));
795 subborrowxU64(&x1, &x2, 0x0, 0x0, arg1[0]);
834796 var x3: u64 = undefined;
835797 var x4: u1 = undefined;
836 subborrowxU64(&x3, &x4, x2, @as(u64, 0x0), (arg1[1]));
798 subborrowxU64(&x3, &x4, x2, 0x0, arg1[1]);
837799 var x5: u64 = undefined;
838800 var x6: u1 = undefined;
839 subborrowxU64(&x5, &x6, x4, @as(u64, 0x0), (arg1[2]));
801 subborrowxU64(&x5, &x6, x4, 0x0, arg1[2]);
840802 var x7: u64 = undefined;
841803 var x8: u1 = undefined;
842 subborrowxU64(&x7, &x8, x6, @as(u64, 0x0), (arg1[3]));
804 subborrowxU64(&x7, &x8, x6, 0x0, arg1[3]);
843805 var x9: u64 = undefined;
844 cmovznzU64(&x9, x8, @as(u64, 0x0), 0xffffffffffffffff);
806 const x9_selection_mask = selectionMaskU64(x8);
807 x9 = 0x0 ^ ((0x0 ^ 0xffffffffffffffff) & x9_selection_mask);
845808 var x10: u64 = undefined;
846809 var x11: u1 = undefined;
847810 addcarryxU64(&x10, &x11, 0x0, x1, x9);
......@@ -850,7 +813,7 @@ pub fn opp(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
850813 addcarryxU64(&x12, &x13, x11, x3, (x9 & 0xffffffff));
851814 var x14: u64 = undefined;
852815 var x15: u1 = undefined;
853 addcarryxU64(&x14, &x15, x13, x5, @as(u64, 0x0));
816 addcarryxU64(&x14, &x15, x13, x5, 0x0);
854817 var x16: u64 = undefined;
855818 var x17: u1 = undefined;
856819 addcarryxU64(&x16, &x17, x15, x7, (x9 & 0xffffffff00000001));
......@@ -871,7 +834,7 @@ pub fn opp(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
871834pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldElement) void {
872835 @setRuntimeSafety(mode == .debug);
873836
874 const x1 = (arg1[0]);
837 const x1: u64 = arg1[0];
875838 var x2: u64 = undefined;
876839 var x3: u64 = undefined;
877840 mulxU64(&x2, &x3, x1, 0xffffffff00000001);
......@@ -889,10 +852,10 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo
889852 addcarryxU64(&x10, &x11, 0x0, x1, x6);
890853 var x12: u64 = undefined;
891854 var x13: u1 = undefined;
892 addcarryxU64(&x12, &x13, x11, @as(u64, 0x0), x8);
855 addcarryxU64(&x12, &x13, x11, 0x0, x8);
893856 var x14: u64 = undefined;
894857 var x15: u1 = undefined;
895 addcarryxU64(&x14, &x15, 0x0, x12, (arg1[1]));
858 addcarryxU64(&x14, &x15, 0x0, x12, arg1[1]);
896859 var x16: u64 = undefined;
897860 var x17: u64 = undefined;
898861 mulxU64(&x16, &x17, x14, 0xffffffff00000001);
......@@ -910,22 +873,22 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo
910873 addcarryxU64(&x24, &x25, 0x0, x14, x20);
911874 var x26: u64 = undefined;
912875 var x27: u1 = undefined;
913 addcarryxU64(&x26, &x27, x25, (@as(u64, x15) + (@as(u64, x13) + (@as(u64, x9) + x5))), x22);
876 addcarryxU64(&x26, &x27, x25, (x15 + (x13 + (x9 + x5))), x22);
914877 var x28: u64 = undefined;
915878 var x29: u1 = undefined;
916 addcarryxU64(&x28, &x29, x27, x2, (@as(u64, x23) + x19));
879 addcarryxU64(&x28, &x29, x27, x2, (x23 + x19));
917880 var x30: u64 = undefined;
918881 var x31: u1 = undefined;
919882 addcarryxU64(&x30, &x31, x29, x3, x16);
920883 var x32: u64 = undefined;
921884 var x33: u1 = undefined;
922 addcarryxU64(&x32, &x33, 0x0, x26, (arg1[2]));
885 addcarryxU64(&x32, &x33, 0x0, x26, arg1[2]);
923886 var x34: u64 = undefined;
924887 var x35: u1 = undefined;
925 addcarryxU64(&x34, &x35, x33, x28, @as(u64, 0x0));
888 addcarryxU64(&x34, &x35, x33, x28, 0x0);
926889 var x36: u64 = undefined;
927890 var x37: u1 = undefined;
928 addcarryxU64(&x36, &x37, x35, x30, @as(u64, 0x0));
891 addcarryxU64(&x36, &x37, x35, x30, 0x0);
929892 var x38: u64 = undefined;
930893 var x39: u64 = undefined;
931894 mulxU64(&x38, &x39, x32, 0xffffffff00000001);
......@@ -946,19 +909,19 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo
946909 addcarryxU64(&x48, &x49, x47, x34, x44);
947910 var x50: u64 = undefined;
948911 var x51: u1 = undefined;
949 addcarryxU64(&x50, &x51, x49, x36, (@as(u64, x45) + x41));
912 addcarryxU64(&x50, &x51, x49, x36, (x45 + x41));
950913 var x52: u64 = undefined;
951914 var x53: u1 = undefined;
952 addcarryxU64(&x52, &x53, x51, (@as(u64, x37) + (@as(u64, x31) + x17)), x38);
915 addcarryxU64(&x52, &x53, x51, (x37 + (x31 + x17)), x38);
953916 var x54: u64 = undefined;
954917 var x55: u1 = undefined;
955 addcarryxU64(&x54, &x55, 0x0, x48, (arg1[3]));
918 addcarryxU64(&x54, &x55, 0x0, x48, arg1[3]);
956919 var x56: u64 = undefined;
957920 var x57: u1 = undefined;
958 addcarryxU64(&x56, &x57, x55, x50, @as(u64, 0x0));
921 addcarryxU64(&x56, &x57, x55, x50, 0x0);
959922 var x58: u64 = undefined;
960923 var x59: u1 = undefined;
961 addcarryxU64(&x58, &x59, x57, x52, @as(u64, 0x0));
924 addcarryxU64(&x58, &x59, x57, x52, 0x0);
962925 var x60: u64 = undefined;
963926 var x61: u64 = undefined;
964927 mulxU64(&x60, &x61, x54, 0xffffffff00000001);
......@@ -979,11 +942,11 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo
979942 addcarryxU64(&x70, &x71, x69, x56, x66);
980943 var x72: u64 = undefined;
981944 var x73: u1 = undefined;
982 addcarryxU64(&x72, &x73, x71, x58, (@as(u64, x67) + x63));
945 addcarryxU64(&x72, &x73, x71, x58, (x67 + x63));
983946 var x74: u64 = undefined;
984947 var x75: u1 = undefined;
985 addcarryxU64(&x74, &x75, x73, (@as(u64, x59) + (@as(u64, x53) + x39)), x60);
986 const x76 = (@as(u64, x75) + x61);
948 addcarryxU64(&x74, &x75, x73, (x59 + (x53 + x39)), x60);
949 const x76: u64 = (x75 + x61);
987950 var x77: u64 = undefined;
988951 var x78: u1 = undefined;
989952 subborrowxU64(&x77, &x78, 0x0, x70, 0xffffffffffffffff);
......@@ -992,21 +955,22 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo
992955 subborrowxU64(&x79, &x80, x78, x72, 0xffffffff);
993956 var x81: u64 = undefined;
994957 var x82: u1 = undefined;
995 subborrowxU64(&x81, &x82, x80, x74, @as(u64, 0x0));
958 subborrowxU64(&x81, &x82, x80, x74, 0x0);
996959 var x83: u64 = undefined;
997960 var x84: u1 = undefined;
998961 subborrowxU64(&x83, &x84, x82, x76, 0xffffffff00000001);
999962 var x85: u64 = undefined;
1000963 var x86: u1 = undefined;
1001 subborrowxU64(&x85, &x86, x84, @as(u64, 0x0), @as(u64, 0x0));
964 subborrowxU64(&x85, &x86, x84, 0x0, 0x0);
1002965 var x87: u64 = undefined;
1003 cmovznzU64(&x87, x86, x77, x70);
966 const x87_selection_mask = selectionMaskU64(x86);
967 x87 = x77 ^ ((x77 ^ x70) & x87_selection_mask);
1004968 var x88: u64 = undefined;
1005 cmovznzU64(&x88, x86, x79, x72);
969 x88 = x79 ^ ((x79 ^ x72) & x87_selection_mask);
1006970 var x89: u64 = undefined;
1007 cmovznzU64(&x89, x86, x81, x74);
971 x89 = x81 ^ ((x81 ^ x74) & x87_selection_mask);
1008972 var x90: u64 = undefined;
1009 cmovznzU64(&x90, x86, x83, x76);
973 x90 = x83 ^ ((x83 ^ x76) & x87_selection_mask);
1010974 out1[0] = x87;
1011975 out1[1] = x88;
1012976 out1[2] = x89;
......@@ -1024,10 +988,10 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo
1024988pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDomainFieldElement) void {
1025989 @setRuntimeSafety(mode == .debug);
1026990
1027 const x1 = (arg1[1]);
1028 const x2 = (arg1[2]);
1029 const x3 = (arg1[3]);
1030 const x4 = (arg1[0]);
991 const x1: u64 = arg1[1];
992 const x2: u64 = arg1[2];
993 const x3: u64 = arg1[3];
994 const x4: u64 = arg1[0];
1031995 var x5: u64 = undefined;
1032996 var x6: u64 = undefined;
1033997 mulxU64(&x5, &x6, x4, 0x4fffffffd);
......@@ -1069,13 +1033,13 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma
10691033 addcarryxU64(&x29, &x30, x28, x13, x25);
10701034 var x31: u64 = undefined;
10711035 var x32: u1 = undefined;
1072 addcarryxU64(&x31, &x32, x30, x15, (@as(u64, x26) + x22));
1036 addcarryxU64(&x31, &x32, x30, x15, (x26 + x22));
10731037 var x33: u64 = undefined;
10741038 var x34: u1 = undefined;
10751039 addcarryxU64(&x33, &x34, x32, x17, x19);
10761040 var x35: u64 = undefined;
10771041 var x36: u1 = undefined;
1078 addcarryxU64(&x35, &x36, x34, (@as(u64, x18) + x6), x20);
1042 addcarryxU64(&x35, &x36, x34, (x18 + x6), x20);
10791043 var x37: u64 = undefined;
10801044 var x38: u64 = undefined;
10811045 mulxU64(&x37, &x38, x1, 0x4fffffffd);
......@@ -1129,13 +1093,13 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma
11291093 addcarryxU64(&x69, &x70, x68, x53, x65);
11301094 var x71: u64 = undefined;
11311095 var x72: u1 = undefined;
1132 addcarryxU64(&x71, &x72, x70, x55, (@as(u64, x66) + x62));
1096 addcarryxU64(&x71, &x72, x70, x55, (x66 + x62));
11331097 var x73: u64 = undefined;
11341098 var x74: u1 = undefined;
11351099 addcarryxU64(&x73, &x74, x72, x57, x59);
11361100 var x75: u64 = undefined;
11371101 var x76: u1 = undefined;
1138 addcarryxU64(&x75, &x76, x74, ((@as(u64, x58) + @as(u64, x36)) + (@as(u64, x50) + x38)), x60);
1102 addcarryxU64(&x75, &x76, x74, ((@as(u64, x58) + x36) + (x50 + x38)), x60);
11391103 var x77: u64 = undefined;
11401104 var x78: u64 = undefined;
11411105 mulxU64(&x77, &x78, x2, 0x4fffffffd);
......@@ -1189,13 +1153,13 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma
11891153 addcarryxU64(&x109, &x110, x108, x93, x105);
11901154 var x111: u64 = undefined;
11911155 var x112: u1 = undefined;
1192 addcarryxU64(&x111, &x112, x110, x95, (@as(u64, x106) + x102));
1156 addcarryxU64(&x111, &x112, x110, x95, (x106 + x102));
11931157 var x113: u64 = undefined;
11941158 var x114: u1 = undefined;
11951159 addcarryxU64(&x113, &x114, x112, x97, x99);
11961160 var x115: u64 = undefined;
11971161 var x116: u1 = undefined;
1198 addcarryxU64(&x115, &x116, x114, ((@as(u64, x98) + @as(u64, x76)) + (@as(u64, x90) + x78)), x100);
1162 addcarryxU64(&x115, &x116, x114, ((@as(u64, x98) + x76) + (x90 + x78)), x100);
11991163 var x117: u64 = undefined;
12001164 var x118: u64 = undefined;
12011165 mulxU64(&x117, &x118, x3, 0x4fffffffd);
......@@ -1249,13 +1213,13 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma
12491213 addcarryxU64(&x149, &x150, x148, x133, x145);
12501214 var x151: u64 = undefined;
12511215 var x152: u1 = undefined;
1252 addcarryxU64(&x151, &x152, x150, x135, (@as(u64, x146) + x142));
1216 addcarryxU64(&x151, &x152, x150, x135, (x146 + x142));
12531217 var x153: u64 = undefined;
12541218 var x154: u1 = undefined;
12551219 addcarryxU64(&x153, &x154, x152, x137, x139);
12561220 var x155: u64 = undefined;
12571221 var x156: u1 = undefined;
1258 addcarryxU64(&x155, &x156, x154, ((@as(u64, x138) + @as(u64, x116)) + (@as(u64, x130) + x118)), x140);
1222 addcarryxU64(&x155, &x156, x154, ((@as(u64, x138) + x116) + (x130 + x118)), x140);
12591223 var x157: u64 = undefined;
12601224 var x158: u1 = undefined;
12611225 subborrowxU64(&x157, &x158, 0x0, x149, 0xffffffffffffffff);
......@@ -1264,21 +1228,22 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma
12641228 subborrowxU64(&x159, &x160, x158, x151, 0xffffffff);
12651229 var x161: u64 = undefined;
12661230 var x162: u1 = undefined;
1267 subborrowxU64(&x161, &x162, x160, x153, @as(u64, 0x0));
1231 subborrowxU64(&x161, &x162, x160, x153, 0x0);
12681232 var x163: u64 = undefined;
12691233 var x164: u1 = undefined;
12701234 subborrowxU64(&x163, &x164, x162, x155, 0xffffffff00000001);
12711235 var x165: u64 = undefined;
12721236 var x166: u1 = undefined;
1273 subborrowxU64(&x165, &x166, x164, @as(u64, x156), @as(u64, 0x0));
1237 subborrowxU64(&x165, &x166, x164, x156, 0x0);
12741238 var x167: u64 = undefined;
1275 cmovznzU64(&x167, x166, x157, x149);
1239 const x167_selection_mask = selectionMaskU64(x166);
1240 x167 = x157 ^ ((x157 ^ x149) & x167_selection_mask);
12761241 var x168: u64 = undefined;
1277 cmovznzU64(&x168, x166, x159, x151);
1242 x168 = x159 ^ ((x159 ^ x151) & x167_selection_mask);
12781243 var x169: u64 = undefined;
1279 cmovznzU64(&x169, x166, x161, x153);
1244 x169 = x161 ^ ((x161 ^ x153) & x167_selection_mask);
12801245 var x170: u64 = undefined;
1281 cmovznzU64(&x170, x166, x163, x155);
1246 x170 = x163 ^ ((x163 ^ x155) & x167_selection_mask);
12821247 out1[0] = x167;
12831248 out1[1] = x168;
12841249 out1[2] = x169;
......@@ -1299,14 +1264,14 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma
12991264pub fn nonzero(out1: *u64, arg1: [4]u64) void {
13001265 @setRuntimeSafety(mode == .debug);
13011266
1302 const x1 = ((arg1[0]) | ((arg1[1]) | ((arg1[2]) | (arg1[3]))));
1267 const x1: u64 = (arg1[0] | (arg1[1] | (arg1[2] | arg1[3])));
13031268 out1.* = x1;
13041269}
13051270
13061271/// The function selectznz is a multi-limb conditional select.
13071272///
13081273/// Postconditions:
1309/// eval out1 = (if arg1 = 0 then eval arg2 else eval arg3)
1274/// out1 = (if arg1 = 0 then arg2 else arg3)
13101275///
13111276/// Input Bounds:
13121277/// arg1: [0x0 ~> 0x1]
......@@ -1318,13 +1283,14 @@ pub fn selectznz(out1: *[4]u64, arg1: u1, arg2: [4]u64, arg3: [4]u64) void {
13181283 @setRuntimeSafety(mode == .debug);
13191284
13201285 var x1: u64 = undefined;
1321 cmovznzU64(&x1, arg1, (arg2[0]), (arg3[0]));
1286 const x1_selection_mask = selectionMaskU64(arg1);
1287 x1 = arg2[0] ^ ((arg2[0] ^ arg3[0]) & x1_selection_mask);
13221288 var x2: u64 = undefined;
1323 cmovznzU64(&x2, arg1, (arg2[1]), (arg3[1]));
1289 x2 = arg2[1] ^ ((arg2[1] ^ arg3[1]) & x1_selection_mask);
13241290 var x3: u64 = undefined;
1325 cmovznzU64(&x3, arg1, (arg2[2]), (arg3[2]));
1291 x3 = arg2[2] ^ ((arg2[2] ^ arg3[2]) & x1_selection_mask);
13261292 var x4: u64 = undefined;
1327 cmovznzU64(&x4, arg1, (arg2[3]), (arg3[3]));
1293 x4 = arg2[3] ^ ((arg2[3] ^ arg3[3]) & x1_selection_mask);
13281294 out1[0] = x1;
13291295 out1[1] = x2;
13301296 out1[2] = x3;
......@@ -1345,66 +1311,66 @@ pub fn selectznz(out1: *[4]u64, arg1: u1, arg2: [4]u64, arg3: [4]u64) void {
13451311pub fn toBytes(out1: *[32]u8, arg1: [4]u64) void {
13461312 @setRuntimeSafety(mode == .debug);
13471313
1348 const x1 = (arg1[3]);
1349 const x2 = (arg1[2]);
1350 const x3 = (arg1[1]);
1351 const x4 = (arg1[0]);
1352 const x5 = @as(u8, @truncate((x4 & @as(u64, 0xff))));
1353 const x6 = (x4 >> 8);
1354 const x7 = @as(u8, @truncate((x6 & @as(u64, 0xff))));
1355 const x8 = (x6 >> 8);
1356 const x9 = @as(u8, @truncate((x8 & @as(u64, 0xff))));
1357 const x10 = (x8 >> 8);
1358 const x11 = @as(u8, @truncate((x10 & @as(u64, 0xff))));
1359 const x12 = (x10 >> 8);
1360 const x13 = @as(u8, @truncate((x12 & @as(u64, 0xff))));
1361 const x14 = (x12 >> 8);
1362 const x15 = @as(u8, @truncate((x14 & @as(u64, 0xff))));
1363 const x16 = (x14 >> 8);
1364 const x17 = @as(u8, @truncate((x16 & @as(u64, 0xff))));
1365 const x18 = @as(u8, @truncate((x16 >> 8)));
1366 const x19 = @as(u8, @truncate((x3 & @as(u64, 0xff))));
1367 const x20 = (x3 >> 8);
1368 const x21 = @as(u8, @truncate((x20 & @as(u64, 0xff))));
1369 const x22 = (x20 >> 8);
1370 const x23 = @as(u8, @truncate((x22 & @as(u64, 0xff))));
1371 const x24 = (x22 >> 8);
1372 const x25 = @as(u8, @truncate((x24 & @as(u64, 0xff))));
1373 const x26 = (x24 >> 8);
1374 const x27 = @as(u8, @truncate((x26 & @as(u64, 0xff))));
1375 const x28 = (x26 >> 8);
1376 const x29 = @as(u8, @truncate((x28 & @as(u64, 0xff))));
1377 const x30 = (x28 >> 8);
1378 const x31 = @as(u8, @truncate((x30 & @as(u64, 0xff))));
1379 const x32 = @as(u8, @truncate((x30 >> 8)));
1380 const x33 = @as(u8, @truncate((x2 & @as(u64, 0xff))));
1381 const x34 = (x2 >> 8);
1382 const x35 = @as(u8, @truncate((x34 & @as(u64, 0xff))));
1383 const x36 = (x34 >> 8);
1384 const x37 = @as(u8, @truncate((x36 & @as(u64, 0xff))));
1385 const x38 = (x36 >> 8);
1386 const x39 = @as(u8, @truncate((x38 & @as(u64, 0xff))));
1387 const x40 = (x38 >> 8);
1388 const x41 = @as(u8, @truncate((x40 & @as(u64, 0xff))));
1389 const x42 = (x40 >> 8);
1390 const x43 = @as(u8, @truncate((x42 & @as(u64, 0xff))));
1391 const x44 = (x42 >> 8);
1392 const x45 = @as(u8, @truncate((x44 & @as(u64, 0xff))));
1393 const x46 = @as(u8, @truncate((x44 >> 8)));
1394 const x47 = @as(u8, @truncate((x1 & @as(u64, 0xff))));
1395 const x48 = (x1 >> 8);
1396 const x49 = @as(u8, @truncate((x48 & @as(u64, 0xff))));
1397 const x50 = (x48 >> 8);
1398 const x51 = @as(u8, @truncate((x50 & @as(u64, 0xff))));
1399 const x52 = (x50 >> 8);
1400 const x53 = @as(u8, @truncate((x52 & @as(u64, 0xff))));
1401 const x54 = (x52 >> 8);
1402 const x55 = @as(u8, @truncate((x54 & @as(u64, 0xff))));
1403 const x56 = (x54 >> 8);
1404 const x57 = @as(u8, @truncate((x56 & @as(u64, 0xff))));
1405 const x58 = (x56 >> 8);
1406 const x59 = @as(u8, @truncate((x58 & @as(u64, 0xff))));
1407 const x60 = @as(u8, @truncate((x58 >> 8)));
1314 const x1: u64 = arg1[3];
1315 const x2: u64 = arg1[2];
1316 const x3: u64 = arg1[1];
1317 const x4: u64 = arg1[0];
1318 const x5: u8 = @truncate(x4);
1319 const x6: u64 = (x4 >> 8);
1320 const x7: u8 = @truncate(x6);
1321 const x8: u64 = (x6 >> 8);
1322 const x9: u8 = @truncate(x8);
1323 const x10: u64 = (x8 >> 8);
1324 const x11: u8 = @truncate(x10);
1325 const x12: u64 = (x10 >> 8);
1326 const x13: u8 = @truncate(x12);
1327 const x14: u64 = (x12 >> 8);
1328 const x15: u8 = @truncate(x14);
1329 const x16: u64 = (x14 >> 8);
1330 const x17: u8 = @truncate(x16);
1331 const x18: u8 = @truncate((x16 >> 8));
1332 const x19: u8 = @truncate(x3);
1333 const x20: u64 = (x3 >> 8);
1334 const x21: u8 = @truncate(x20);
1335 const x22: u64 = (x20 >> 8);
1336 const x23: u8 = @truncate(x22);
1337 const x24: u64 = (x22 >> 8);
1338 const x25: u8 = @truncate(x24);
1339 const x26: u64 = (x24 >> 8);
1340 const x27: u8 = @truncate(x26);
1341 const x28: u64 = (x26 >> 8);
1342 const x29: u8 = @truncate(x28);
1343 const x30: u64 = (x28 >> 8);
1344 const x31: u8 = @truncate(x30);
1345 const x32: u8 = @truncate((x30 >> 8));
1346 const x33: u8 = @truncate(x2);
1347 const x34: u64 = (x2 >> 8);
1348 const x35: u8 = @truncate(x34);
1349 const x36: u64 = (x34 >> 8);
1350 const x37: u8 = @truncate(x36);
1351 const x38: u64 = (x36 >> 8);
1352 const x39: u8 = @truncate(x38);
1353 const x40: u64 = (x38 >> 8);
1354 const x41: u8 = @truncate(x40);
1355 const x42: u64 = (x40 >> 8);
1356 const x43: u8 = @truncate(x42);
1357 const x44: u64 = (x42 >> 8);
1358 const x45: u8 = @truncate(x44);
1359 const x46: u8 = @truncate((x44 >> 8));
1360 const x47: u8 = @truncate(x1);
1361 const x48: u64 = (x1 >> 8);
1362 const x49: u8 = @truncate(x48);
1363 const x50: u64 = (x48 >> 8);
1364 const x51: u8 = @truncate(x50);
1365 const x52: u64 = (x50 >> 8);
1366 const x53: u8 = @truncate(x52);
1367 const x54: u64 = (x52 >> 8);
1368 const x55: u8 = @truncate(x54);
1369 const x56: u64 = (x54 >> 8);
1370 const x57: u8 = @truncate(x56);
1371 const x58: u64 = (x56 >> 8);
1372 const x59: u8 = @truncate(x58);
1373 const x60: u8 = @truncate((x58 >> 8));
14081374 out1[0] = x5;
14091375 out1[1] = x7;
14101376 out1[2] = x9;
......@@ -1454,66 +1420,66 @@ pub fn toBytes(out1: *[32]u8, arg1: [4]u64) void {
14541420pub fn fromBytes(out1: *[4]u64, arg1: [32]u8) void {
14551421 @setRuntimeSafety(mode == .debug);
14561422
1457 const x1 = (@as(u64, (arg1[31])) << 56);
1458 const x2 = (@as(u64, (arg1[30])) << 48);
1459 const x3 = (@as(u64, (arg1[29])) << 40);
1460 const x4 = (@as(u64, (arg1[28])) << 32);
1461 const x5 = (@as(u64, (arg1[27])) << 24);
1462 const x6 = (@as(u64, (arg1[26])) << 16);
1463 const x7 = (@as(u64, (arg1[25])) << 8);
1464 const x8 = (arg1[24]);
1465 const x9 = (@as(u64, (arg1[23])) << 56);
1466 const x10 = (@as(u64, (arg1[22])) << 48);
1467 const x11 = (@as(u64, (arg1[21])) << 40);
1468 const x12 = (@as(u64, (arg1[20])) << 32);
1469 const x13 = (@as(u64, (arg1[19])) << 24);
1470 const x14 = (@as(u64, (arg1[18])) << 16);
1471 const x15 = (@as(u64, (arg1[17])) << 8);
1472 const x16 = (arg1[16]);
1473 const x17 = (@as(u64, (arg1[15])) << 56);
1474 const x18 = (@as(u64, (arg1[14])) << 48);
1475 const x19 = (@as(u64, (arg1[13])) << 40);
1476 const x20 = (@as(u64, (arg1[12])) << 32);
1477 const x21 = (@as(u64, (arg1[11])) << 24);
1478 const x22 = (@as(u64, (arg1[10])) << 16);
1479 const x23 = (@as(u64, (arg1[9])) << 8);
1480 const x24 = (arg1[8]);
1481 const x25 = (@as(u64, (arg1[7])) << 56);
1482 const x26 = (@as(u64, (arg1[6])) << 48);
1483 const x27 = (@as(u64, (arg1[5])) << 40);
1484 const x28 = (@as(u64, (arg1[4])) << 32);
1485 const x29 = (@as(u64, (arg1[3])) << 24);
1486 const x30 = (@as(u64, (arg1[2])) << 16);
1487 const x31 = (@as(u64, (arg1[1])) << 8);
1488 const x32 = (arg1[0]);
1489 const x33 = (x31 + @as(u64, x32));
1490 const x34 = (x30 + x33);
1491 const x35 = (x29 + x34);
1492 const x36 = (x28 + x35);
1493 const x37 = (x27 + x36);
1494 const x38 = (x26 + x37);
1495 const x39 = (x25 + x38);
1496 const x40 = (x23 + @as(u64, x24));
1497 const x41 = (x22 + x40);
1498 const x42 = (x21 + x41);
1499 const x43 = (x20 + x42);
1500 const x44 = (x19 + x43);
1501 const x45 = (x18 + x44);
1502 const x46 = (x17 + x45);
1503 const x47 = (x15 + @as(u64, x16));
1504 const x48 = (x14 + x47);
1505 const x49 = (x13 + x48);
1506 const x50 = (x12 + x49);
1507 const x51 = (x11 + x50);
1508 const x52 = (x10 + x51);
1509 const x53 = (x9 + x52);
1510 const x54 = (x7 + @as(u64, x8));
1511 const x55 = (x6 + x54);
1512 const x56 = (x5 + x55);
1513 const x57 = (x4 + x56);
1514 const x58 = (x3 + x57);
1515 const x59 = (x2 + x58);
1516 const x60 = (x1 + x59);
1423 const x1: u64 = (@as(u64, arg1[31]) << 56);
1424 const x2: u64 = (@as(u64, arg1[30]) << 48);
1425 const x3: u64 = (@as(u64, arg1[29]) << 40);
1426 const x4: u64 = (@as(u64, arg1[28]) << 32);
1427 const x5: u64 = (@as(u64, arg1[27]) << 24);
1428 const x6: u64 = (@as(u64, arg1[26]) << 16);
1429 const x7: u64 = (@as(u64, arg1[25]) << 8);
1430 const x8: u8 = arg1[24];
1431 const x9: u64 = (@as(u64, arg1[23]) << 56);
1432 const x10: u64 = (@as(u64, arg1[22]) << 48);
1433 const x11: u64 = (@as(u64, arg1[21]) << 40);
1434 const x12: u64 = (@as(u64, arg1[20]) << 32);
1435 const x13: u64 = (@as(u64, arg1[19]) << 24);
1436 const x14: u64 = (@as(u64, arg1[18]) << 16);
1437 const x15: u64 = (@as(u64, arg1[17]) << 8);
1438 const x16: u8 = arg1[16];
1439 const x17: u64 = (@as(u64, arg1[15]) << 56);
1440 const x18: u64 = (@as(u64, arg1[14]) << 48);
1441 const x19: u64 = (@as(u64, arg1[13]) << 40);
1442 const x20: u64 = (@as(u64, arg1[12]) << 32);
1443 const x21: u64 = (@as(u64, arg1[11]) << 24);
1444 const x22: u64 = (@as(u64, arg1[10]) << 16);
1445 const x23: u64 = (@as(u64, arg1[9]) << 8);
1446 const x24: u8 = arg1[8];
1447 const x25: u64 = (@as(u64, arg1[7]) << 56);
1448 const x26: u64 = (@as(u64, arg1[6]) << 48);
1449 const x27: u64 = (@as(u64, arg1[5]) << 40);
1450 const x28: u64 = (@as(u64, arg1[4]) << 32);
1451 const x29: u64 = (@as(u64, arg1[3]) << 24);
1452 const x30: u64 = (@as(u64, arg1[2]) << 16);
1453 const x31: u64 = (@as(u64, arg1[1]) << 8);
1454 const x32: u8 = arg1[0];
1455 const x33: u64 = (x31 + x32);
1456 const x34: u64 = (x30 + x33);
1457 const x35: u64 = (x29 + x34);
1458 const x36: u64 = (x28 + x35);
1459 const x37: u64 = (x27 + x36);
1460 const x38: u64 = (x26 + x37);
1461 const x39: u64 = (x25 + x38);
1462 const x40: u64 = (x23 + x24);
1463 const x41: u64 = (x22 + x40);
1464 const x42: u64 = (x21 + x41);
1465 const x43: u64 = (x20 + x42);
1466 const x44: u64 = (x19 + x43);
1467 const x45: u64 = (x18 + x44);
1468 const x46: u64 = (x17 + x45);
1469 const x47: u64 = (x15 + x16);
1470 const x48: u64 = (x14 + x47);
1471 const x49: u64 = (x13 + x48);
1472 const x50: u64 = (x12 + x49);
1473 const x51: u64 = (x11 + x50);
1474 const x52: u64 = (x10 + x51);
1475 const x53: u64 = (x9 + x52);
1476 const x54: u64 = (x7 + x8);
1477 const x55: u64 = (x6 + x54);
1478 const x56: u64 = (x5 + x55);
1479 const x57: u64 = (x4 + x56);
1480 const x58: u64 = (x3 + x57);
1481 const x59: u64 = (x2 + x58);
1482 const x60: u64 = (x1 + x59);
15171483 out1[0] = x39;
15181484 out1[1] = x46;
15191485 out1[2] = x53;
......@@ -1529,7 +1495,7 @@ pub fn fromBytes(out1: *[4]u64, arg1: [32]u8) void {
15291495pub fn setOne(out1: *MontgomeryDomainFieldElement) void {
15301496 @setRuntimeSafety(mode == .debug);
15311497
1532 out1[0] = @as(u64, 0x1);
1498 out1[0] = 0x1;
15331499 out1[1] = 0xffffffff00000000;
15341500 out1[2] = 0xffffffffffffffff;
15351501 out1[3] = 0xfffffffe;
......@@ -1548,9 +1514,9 @@ pub fn msat(out1: *[5]u64) void {
15481514
15491515 out1[0] = 0xffffffffffffffff;
15501516 out1[1] = 0xffffffff;
1551 out1[2] = @as(u64, 0x0);
1517 out1[2] = 0x0;
15521518 out1[3] = 0xffffffff00000001;
1553 out1[4] = @as(u64, 0x0);
1519 out1[4] = 0x0;
15541520}
15551521
15561522/// The function divstep computes a divstep.
......@@ -1586,56 +1552,58 @@ pub fn divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *[4]u64, out5: *[
15861552
15871553 var x1: u64 = undefined;
15881554 var x2: u1 = undefined;
1589 addcarryxU64(&x1, &x2, 0x0, (~arg1), @as(u64, 0x1));
1590 const x3 = (@as(u1, @truncate((x1 >> 63))) & @as(u1, @truncate(((arg3[0]) & @as(u64, 0x1)))));
1555 addcarryxU64(&x1, &x2, 0x0, (~arg1), 0x1);
1556 const x3: u1 = (@as(u1, @truncate((x1 >> 63))) & @as(u1, @truncate(arg3[0])));
15911557 var x4: u64 = undefined;
15921558 var x5: u1 = undefined;
1593 addcarryxU64(&x4, &x5, 0x0, (~arg1), @as(u64, 0x1));
1559 addcarryxU64(&x4, &x5, 0x0, (~arg1), 0x1);
15941560 var x6: u64 = undefined;
1595 cmovznzU64(&x6, x3, arg1, x4);
1561 const x6_selection_mask = selectionMaskU64(x3);
1562 x6 = arg1 ^ ((arg1 ^ x4) & x6_selection_mask);
15961563 var x7: u64 = undefined;
1597 cmovznzU64(&x7, x3, (arg2[0]), (arg3[0]));
1564 x7 = arg2[0] ^ ((arg2[0] ^ arg3[0]) & x6_selection_mask);
15981565 var x8: u64 = undefined;
1599 cmovznzU64(&x8, x3, (arg2[1]), (arg3[1]));
1566 x8 = arg2[1] ^ ((arg2[1] ^ arg3[1]) & x6_selection_mask);
16001567 var x9: u64 = undefined;
1601 cmovznzU64(&x9, x3, (arg2[2]), (arg3[2]));
1568 x9 = arg2[2] ^ ((arg2[2] ^ arg3[2]) & x6_selection_mask);
16021569 var x10: u64 = undefined;
1603 cmovznzU64(&x10, x3, (arg2[3]), (arg3[3]));
1570 x10 = arg2[3] ^ ((arg2[3] ^ arg3[3]) & x6_selection_mask);
16041571 var x11: u64 = undefined;
1605 cmovznzU64(&x11, x3, (arg2[4]), (arg3[4]));
1572 x11 = arg2[4] ^ ((arg2[4] ^ arg3[4]) & x6_selection_mask);
16061573 var x12: u64 = undefined;
16071574 var x13: u1 = undefined;
1608 addcarryxU64(&x12, &x13, 0x0, @as(u64, 0x1), (~(arg2[0])));
1575 addcarryxU64(&x12, &x13, 0x0, 0x1, (~arg2[0]));
16091576 var x14: u64 = undefined;
16101577 var x15: u1 = undefined;
1611 addcarryxU64(&x14, &x15, x13, @as(u64, 0x0), (~(arg2[1])));
1578 addcarryxU64(&x14, &x15, x13, 0x0, (~arg2[1]));
16121579 var x16: u64 = undefined;
16131580 var x17: u1 = undefined;
1614 addcarryxU64(&x16, &x17, x15, @as(u64, 0x0), (~(arg2[2])));
1581 addcarryxU64(&x16, &x17, x15, 0x0, (~arg2[2]));
16151582 var x18: u64 = undefined;
16161583 var x19: u1 = undefined;
1617 addcarryxU64(&x18, &x19, x17, @as(u64, 0x0), (~(arg2[3])));
1584 addcarryxU64(&x18, &x19, x17, 0x0, (~arg2[3]));
16181585 var x20: u64 = undefined;
16191586 var x21: u1 = undefined;
1620 addcarryxU64(&x20, &x21, x19, @as(u64, 0x0), (~(arg2[4])));
1587 addcarryxU64(&x20, &x21, x19, 0x0, (~arg2[4]));
16211588 var x22: u64 = undefined;
1622 cmovznzU64(&x22, x3, (arg3[0]), x12);
1589 const x22_selection_mask = selectionMaskU64(x3);
1590 x22 = arg3[0] ^ ((arg3[0] ^ x12) & x22_selection_mask);
16231591 var x23: u64 = undefined;
1624 cmovznzU64(&x23, x3, (arg3[1]), x14);
1592 x23 = arg3[1] ^ ((arg3[1] ^ x14) & x22_selection_mask);
16251593 var x24: u64 = undefined;
1626 cmovznzU64(&x24, x3, (arg3[2]), x16);
1594 x24 = arg3[2] ^ ((arg3[2] ^ x16) & x22_selection_mask);
16271595 var x25: u64 = undefined;
1628 cmovznzU64(&x25, x3, (arg3[3]), x18);
1596 x25 = arg3[3] ^ ((arg3[3] ^ x18) & x22_selection_mask);
16291597 var x26: u64 = undefined;
1630 cmovznzU64(&x26, x3, (arg3[4]), x20);
1598 x26 = arg3[4] ^ ((arg3[4] ^ x20) & x22_selection_mask);
16311599 var x27: u64 = undefined;
1632 cmovznzU64(&x27, x3, (arg4[0]), (arg5[0]));
1600 x27 = arg4[0] ^ ((arg4[0] ^ arg5[0]) & x22_selection_mask);
16331601 var x28: u64 = undefined;
1634 cmovznzU64(&x28, x3, (arg4[1]), (arg5[1]));
1602 x28 = arg4[1] ^ ((arg4[1] ^ arg5[1]) & x22_selection_mask);
16351603 var x29: u64 = undefined;
1636 cmovznzU64(&x29, x3, (arg4[2]), (arg5[2]));
1604 x29 = arg4[2] ^ ((arg4[2] ^ arg5[2]) & x22_selection_mask);
16371605 var x30: u64 = undefined;
1638 cmovznzU64(&x30, x3, (arg4[3]), (arg5[3]));
1606 x30 = arg4[3] ^ ((arg4[3] ^ arg5[3]) & x22_selection_mask);
16391607 var x31: u64 = undefined;
16401608 var x32: u1 = undefined;
16411609 addcarryxU64(&x31, &x32, 0x0, x27, x27);
......@@ -1656,31 +1624,32 @@ pub fn divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *[4]u64, out5: *[
16561624 subborrowxU64(&x41, &x42, x40, x33, 0xffffffff);
16571625 var x43: u64 = undefined;
16581626 var x44: u1 = undefined;
1659 subborrowxU64(&x43, &x44, x42, x35, @as(u64, 0x0));
1627 subborrowxU64(&x43, &x44, x42, x35, 0x0);
16601628 var x45: u64 = undefined;
16611629 var x46: u1 = undefined;
16621630 subborrowxU64(&x45, &x46, x44, x37, 0xffffffff00000001);
16631631 var x47: u64 = undefined;
16641632 var x48: u1 = undefined;
1665 subborrowxU64(&x47, &x48, x46, @as(u64, x38), @as(u64, 0x0));
1666 const x49 = (arg4[3]);
1667 const x50 = (arg4[2]);
1668 const x51 = (arg4[1]);
1669 const x52 = (arg4[0]);
1633 subborrowxU64(&x47, &x48, x46, x38, 0x0);
1634 const x49: u64 = arg4[3];
1635 const x50: u64 = arg4[2];
1636 const x51: u64 = arg4[1];
1637 const x52: u64 = arg4[0];
16701638 var x53: u64 = undefined;
16711639 var x54: u1 = undefined;
1672 subborrowxU64(&x53, &x54, 0x0, @as(u64, 0x0), x52);
1640 subborrowxU64(&x53, &x54, 0x0, 0x0, x52);
16731641 var x55: u64 = undefined;
16741642 var x56: u1 = undefined;
1675 subborrowxU64(&x55, &x56, x54, @as(u64, 0x0), x51);
1643 subborrowxU64(&x55, &x56, x54, 0x0, x51);
16761644 var x57: u64 = undefined;
16771645 var x58: u1 = undefined;
1678 subborrowxU64(&x57, &x58, x56, @as(u64, 0x0), x50);
1646 subborrowxU64(&x57, &x58, x56, 0x0, x50);
16791647 var x59: u64 = undefined;
16801648 var x60: u1 = undefined;
1681 subborrowxU64(&x59, &x60, x58, @as(u64, 0x0), x49);
1649 subborrowxU64(&x59, &x60, x58, 0x0, x49);
16821650 var x61: u64 = undefined;
1683 cmovznzU64(&x61, x60, @as(u64, 0x0), 0xffffffffffffffff);
1651 const x61_selection_mask = selectionMaskU64(x60);
1652 x61 = 0x0 ^ ((0x0 ^ 0xffffffffffffffff) & x61_selection_mask);
16841653 var x62: u64 = undefined;
16851654 var x63: u1 = undefined;
16861655 addcarryxU64(&x62, &x63, 0x0, x53, x61);
......@@ -1689,29 +1658,31 @@ pub fn divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *[4]u64, out5: *[
16891658 addcarryxU64(&x64, &x65, x63, x55, (x61 & 0xffffffff));
16901659 var x66: u64 = undefined;
16911660 var x67: u1 = undefined;
1692 addcarryxU64(&x66, &x67, x65, x57, @as(u64, 0x0));
1661 addcarryxU64(&x66, &x67, x65, x57, 0x0);
16931662 var x68: u64 = undefined;
16941663 var x69: u1 = undefined;
16951664 addcarryxU64(&x68, &x69, x67, x59, (x61 & 0xffffffff00000001));
16961665 var x70: u64 = undefined;
1697 cmovznzU64(&x70, x3, (arg5[0]), x62);
1666 const x70_selection_mask = selectionMaskU64(x3);
1667 x70 = arg5[0] ^ ((arg5[0] ^ x62) & x70_selection_mask);
16981668 var x71: u64 = undefined;
1699 cmovznzU64(&x71, x3, (arg5[1]), x64);
1669 x71 = arg5[1] ^ ((arg5[1] ^ x64) & x70_selection_mask);
17001670 var x72: u64 = undefined;
1701 cmovznzU64(&x72, x3, (arg5[2]), x66);
1671 x72 = arg5[2] ^ ((arg5[2] ^ x66) & x70_selection_mask);
17021672 var x73: u64 = undefined;
1703 cmovznzU64(&x73, x3, (arg5[3]), x68);
1704 const x74 = @as(u1, @truncate((x22 & @as(u64, 0x1))));
1673 x73 = arg5[3] ^ ((arg5[3] ^ x68) & x70_selection_mask);
1674 const x74: u1 = @truncate(x22);
17051675 var x75: u64 = undefined;
1706 cmovznzU64(&x75, x74, @as(u64, 0x0), x7);
1676 const x75_selection_mask = selectionMaskU64(x74);
1677 x75 = 0x0 ^ ((0x0 ^ x7) & x75_selection_mask);
17071678 var x76: u64 = undefined;
1708 cmovznzU64(&x76, x74, @as(u64, 0x0), x8);
1679 x76 = 0x0 ^ ((0x0 ^ x8) & x75_selection_mask);
17091680 var x77: u64 = undefined;
1710 cmovznzU64(&x77, x74, @as(u64, 0x0), x9);
1681 x77 = 0x0 ^ ((0x0 ^ x9) & x75_selection_mask);
17111682 var x78: u64 = undefined;
1712 cmovznzU64(&x78, x74, @as(u64, 0x0), x10);
1683 x78 = 0x0 ^ ((0x0 ^ x10) & x75_selection_mask);
17131684 var x79: u64 = undefined;
1714 cmovznzU64(&x79, x74, @as(u64, 0x0), x11);
1685 x79 = 0x0 ^ ((0x0 ^ x11) & x75_selection_mask);
17151686 var x80: u64 = undefined;
17161687 var x81: u1 = undefined;
17171688 addcarryxU64(&x80, &x81, 0x0, x22, x75);
......@@ -1728,13 +1699,14 @@ pub fn divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *[4]u64, out5: *[
17281699 var x89: u1 = undefined;
17291700 addcarryxU64(&x88, &x89, x87, x26, x79);
17301701 var x90: u64 = undefined;
1731 cmovznzU64(&x90, x74, @as(u64, 0x0), x27);
1702 const x90_selection_mask = selectionMaskU64(x74);
1703 x90 = 0x0 ^ ((0x0 ^ x27) & x90_selection_mask);
17321704 var x91: u64 = undefined;
1733 cmovznzU64(&x91, x74, @as(u64, 0x0), x28);
1705 x91 = 0x0 ^ ((0x0 ^ x28) & x90_selection_mask);
17341706 var x92: u64 = undefined;
1735 cmovznzU64(&x92, x74, @as(u64, 0x0), x29);
1707 x92 = 0x0 ^ ((0x0 ^ x29) & x90_selection_mask);
17361708 var x93: u64 = undefined;
1737 cmovznzU64(&x93, x74, @as(u64, 0x0), x30);
1709 x93 = 0x0 ^ ((0x0 ^ x30) & x90_selection_mask);
17381710 var x94: u64 = undefined;
17391711 var x95: u1 = undefined;
17401712 addcarryxU64(&x94, &x95, 0x0, x70, x90);
......@@ -1755,37 +1727,39 @@ pub fn divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *[4]u64, out5: *[
17551727 subborrowxU64(&x104, &x105, x103, x96, 0xffffffff);
17561728 var x106: u64 = undefined;
17571729 var x107: u1 = undefined;
1758 subborrowxU64(&x106, &x107, x105, x98, @as(u64, 0x0));
1730 subborrowxU64(&x106, &x107, x105, x98, 0x0);
17591731 var x108: u64 = undefined;
17601732 var x109: u1 = undefined;
17611733 subborrowxU64(&x108, &x109, x107, x100, 0xffffffff00000001);
17621734 var x110: u64 = undefined;
17631735 var x111: u1 = undefined;
1764 subborrowxU64(&x110, &x111, x109, @as(u64, x101), @as(u64, 0x0));
1736 subborrowxU64(&x110, &x111, x109, x101, 0x0);
17651737 var x112: u64 = undefined;
17661738 var x113: u1 = undefined;
1767 addcarryxU64(&x112, &x113, 0x0, x6, @as(u64, 0x1));
1768 const x114 = ((x80 >> 1) | ((x82 << 63) & 0xffffffffffffffff));
1769 const x115 = ((x82 >> 1) | ((x84 << 63) & 0xffffffffffffffff));
1770 const x116 = ((x84 >> 1) | ((x86 << 63) & 0xffffffffffffffff));
1771 const x117 = ((x86 >> 1) | ((x88 << 63) & 0xffffffffffffffff));
1772 const x118 = ((x88 & 0x8000000000000000) | (x88 >> 1));
1739 addcarryxU64(&x112, &x113, 0x0, x6, 0x1);
1740 const x114: u64 = ((x80 >> 1) | ((x82 << 63) & 0xffffffffffffffff));
1741 const x115: u64 = ((x82 >> 1) | ((x84 << 63) & 0xffffffffffffffff));
1742 const x116: u64 = ((x84 >> 1) | ((x86 << 63) & 0xffffffffffffffff));
1743 const x117: u64 = ((x86 >> 1) | ((x88 << 63) & 0xffffffffffffffff));
1744 const x118: u64 = ((x88 & 0x8000000000000000) | (x88 >> 1));
17731745 var x119: u64 = undefined;
1774 cmovznzU64(&x119, x48, x39, x31);
1746 const x119_selection_mask = selectionMaskU64(x48);
1747 x119 = x39 ^ ((x39 ^ x31) & x119_selection_mask);
17751748 var x120: u64 = undefined;
1776 cmovznzU64(&x120, x48, x41, x33);
1749 x120 = x41 ^ ((x41 ^ x33) & x119_selection_mask);
17771750 var x121: u64 = undefined;
1778 cmovznzU64(&x121, x48, x43, x35);
1751 x121 = x43 ^ ((x43 ^ x35) & x119_selection_mask);
17791752 var x122: u64 = undefined;
1780 cmovznzU64(&x122, x48, x45, x37);
1753 x122 = x45 ^ ((x45 ^ x37) & x119_selection_mask);
17811754 var x123: u64 = undefined;
1782 cmovznzU64(&x123, x111, x102, x94);
1755 const x123_selection_mask = selectionMaskU64(x111);
1756 x123 = x102 ^ ((x102 ^ x94) & x123_selection_mask);
17831757 var x124: u64 = undefined;
1784 cmovznzU64(&x124, x111, x104, x96);
1758 x124 = x104 ^ ((x104 ^ x96) & x123_selection_mask);
17851759 var x125: u64 = undefined;
1786 cmovznzU64(&x125, x111, x106, x98);
1760 x125 = x106 ^ ((x106 ^ x98) & x123_selection_mask);
17871761 var x126: u64 = undefined;
1788 cmovznzU64(&x126, x111, x108, x100);
1762 x126 = x108 ^ ((x108 ^ x100) & x123_selection_mask);
17891763 out1.* = x112;
17901764 out2[0] = x7;
17911765 out2[1] = x8;
lib/std/crypto/pcurves/p256/p256_scalar_64.zig+385-411
......@@ -13,42 +13,10 @@
1313//
1414// Computed values:
1515// eval z = z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192)
16// bytes_eval z = z[0]
17// + (z[1] << 8)
18// + (z[2] << 16)
19// + (z[3] << 24)
20// + (z[4] << 32)
21// + (z[5] << 40)
22// + (z[6] << 48)
23// + (z[7] << 56)
24// + (z[8] << 64)
25// + (z[9] << 72)
26// + (z[10] << 80)
27// + (z[11] << 88)
28// + (z[12] << 96)
29// + (z[13] << 104)
30// + (z[14] << 112)
31// + (z[15] << 120)
32// + (z[16] << 128)
33// + (z[17] << 136)
34// + (z[18] << 144)
35// + (z[19] << 152)
36// + (z[20] << 160)
37// + (z[21] << 168)
38// + (z[22] << 176)
39// + (z[23] << 184)
40// + (z[24] << 192)
41// + (z[25] << 200)
42// + (z[26] << 208)
43// + (z[27] << 216)
44// + (z[28] << 224)
45// + (z[29] << 232)
46// + (z[30] << 240)
47// + (z[31] << 248)
16// bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248)
4817// twos_complement_eval z = let x1 := z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) in
4918// if x1 & (2^256-1) < 2^255 then x1 & (2^256-1) else (x1 & (2^256-1)) - 2^256
5019
51const std = @import("std");
5220const mode = @import("builtin").mode; // Checked arithmetic is disabled in non-debug modes to avoid side channels
5321
5422// The type MontgomeryDomainFieldElement is a field element in the Montgomery domain.
......@@ -59,80 +27,70 @@ pub const MontgomeryDomainFieldElement = [4]u64;
5927// Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
6028pub const NonMontgomeryDomainFieldElement = [4]u64;
6129
62/// The function addcarryxU64 is an addition with carry.
63///
64/// Postconditions:
65/// out1 = (arg1 + arg2 + arg3) mod 2^64
66/// out2 = ⌊(arg1 + arg2 + arg3) / 2^64⌋
67///
68/// Input Bounds:
69/// arg1: [0x0 ~> 0x1]
70/// arg2: [0x0 ~> 0xffffffffffffffff]
71/// arg3: [0x0 ~> 0xffffffffffffffff]
72/// Output Bounds:
73/// out1: [0x0 ~> 0xffffffffffffffff]
74/// out2: [0x0 ~> 0x1]
30/// Add two limbs and a carry bit, returning the sum modulo 2^64 and the carry bit.
7531fn addcarryxU64(out1: *u64, out2: *u1, arg1: u1, arg2: u64, arg3: u64) void {
76 const x = @as(u128, arg2) +% arg3 +% arg1;
77 out1.* = @truncate(x);
78 out2.* = @truncate(x >> 64);
32 @setRuntimeSafety(mode == .debug);
33
34 const x = @addWithOverflow(arg2, arg3);
35 const y = @addWithOverflow(x[0], arg1);
36 out1.* = y[0];
37 out2.* = x[1] | y[1];
7938}
8039
81/// The function subborrowxU64 is a subtraction with borrow.
82///
83/// Postconditions:
84/// out1 = (-arg1 + arg2 + -arg3) mod 2^64
85/// out2 = -⌊(-arg1 + arg2 + -arg3) / 2^64⌋
86///
87/// Input Bounds:
88/// arg1: [0x0 ~> 0x1]
89/// arg2: [0x0 ~> 0xffffffffffffffff]
90/// arg3: [0x0 ~> 0xffffffffffffffff]
91/// Output Bounds:
92/// out1: [0x0 ~> 0xffffffffffffffff]
93/// out2: [0x0 ~> 0x1]
40/// Subtract two limbs and a borrow bit, returning the difference modulo 2^64 and the borrow bit.
9441fn subborrowxU64(out1: *u64, out2: *u1, arg1: u1, arg2: u64, arg3: u64) void {
95 const x = @as(u128, arg2) -% arg3 -% arg1;
96 out1.* = @truncate(x);
97 out2.* = @truncate(x >> 64);
42 @setRuntimeSafety(mode == .debug);
43
44 const x = @subWithOverflow(arg2, arg3);
45 const y = @subWithOverflow(x[0], arg1);
46 out1.* = y[0];
47 out2.* = x[1] | y[1];
9848}
9949
100/// The function mulxU64 is a multiplication, returning the full double-width result.
101///
102/// Postconditions:
103/// out1 = (arg1 * arg2) mod 2^64
104/// out2 = ⌊arg1 * arg2 / 2^64⌋
105///
106/// Input Bounds:
107/// arg1: [0x0 ~> 0xffffffffffffffff]
108/// arg2: [0x0 ~> 0xffffffffffffffff]
109/// Output Bounds:
110/// out1: [0x0 ~> 0xffffffffffffffff]
111/// out2: [0x0 ~> 0xffffffffffffffff]
50/// Multiply two limbs, returning the low and high halves of the product.
11251fn mulxU64(out1: *u64, out2: *u64, arg1: u64, arg2: u64) void {
11352 @setRuntimeSafety(mode == .debug);
11453
115 const x = @as(u128, arg1) * @as(u128, arg2);
116 out1.* = @as(u64, @truncate(x));
117 out2.* = @as(u64, @truncate(x >> 64));
54 const x = @as(u128, arg1) * arg2;
55 out1.* = @truncate(x);
56 out2.* = @intCast(x >> 64);
11857}
11958
120/// The function cmovznzU64 is a single-word conditional move.
121///
122/// Postconditions:
123/// out1 = (if arg1 = 0 then arg2 else arg3)
124///
125/// Input Bounds:
126/// arg1: [0x0 ~> 0x1]
127/// arg2: [0x0 ~> 0xffffffffffffffff]
128/// arg3: [0x0 ~> 0xffffffffffffffff]
129/// Output Bounds:
130/// out1: [0x0 ~> 0xffffffffffffffff]
59/// Keep selection masks opaque to the optimizer without adding instructions.
60fn selectionMaskU64(arg1: u1) u64 {
61 @setRuntimeSafety(mode == .debug);
62
63 const value: u64 = 0 -% @as(u64, arg1);
64 if (@inComptime()) return value;
65 switch (@import("builtin").zig_backend) {
66 .stage2_c, .stage2_wasm => return value,
67 else => {},
68 }
69 if (@bitSizeOf(u64) <= @bitSizeOf(usize)) {
70 return asm (""
71 : [mask] "=r" (-> u64),
72 : [value] "0" (value),
73 );
74 }
75 var mask: u64 = 0;
76 inline for (0..@divExact(@bitSizeOf(u64), @bitSizeOf(usize))) |i| {
77 const shift = i * @bitSizeOf(usize);
78 const chunk: usize = @truncate(value >> shift);
79 const part = asm (""
80 : [mask] "=r" (-> usize),
81 : [value] "0" (chunk),
82 );
83 mask |= @as(u64, part) << shift;
84 }
85 return mask;
86}
87
88/// Select arg2 when arg1 is zero and arg3 otherwise, using a bit mask.
13189fn cmovznzU64(out1: *u64, arg1: u1, arg2: u64, arg3: u64) void {
13290 @setRuntimeSafety(mode == .debug);
13391
134 const mask = 0 -% @as(u64, arg1);
135 out1.* = (mask & arg3) | ((~mask) & arg2);
92 const mask = selectionMaskU64(arg1);
93 out1.* = arg2 ^ ((arg2 ^ arg3) & mask);
13694}
13795
13896/// The function mul multiplies two field elements in the Montgomery domain.
......@@ -147,22 +105,22 @@ fn cmovznzU64(out1: *u64, arg1: u1, arg2: u64, arg3: u64) void {
147105pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldElement, arg2: MontgomeryDomainFieldElement) void {
148106 @setRuntimeSafety(mode == .debug);
149107
150 const x1 = (arg1[1]);
151 const x2 = (arg1[2]);
152 const x3 = (arg1[3]);
153 const x4 = (arg1[0]);
108 const x1: u64 = arg1[1];
109 const x2: u64 = arg1[2];
110 const x3: u64 = arg1[3];
111 const x4: u64 = arg1[0];
154112 var x5: u64 = undefined;
155113 var x6: u64 = undefined;
156 mulxU64(&x5, &x6, x4, (arg2[3]));
114 mulxU64(&x5, &x6, x4, arg2[3]);
157115 var x7: u64 = undefined;
158116 var x8: u64 = undefined;
159 mulxU64(&x7, &x8, x4, (arg2[2]));
117 mulxU64(&x7, &x8, x4, arg2[2]);
160118 var x9: u64 = undefined;
161119 var x10: u64 = undefined;
162 mulxU64(&x9, &x10, x4, (arg2[1]));
120 mulxU64(&x9, &x10, x4, arg2[1]);
163121 var x11: u64 = undefined;
164122 var x12: u64 = undefined;
165 mulxU64(&x11, &x12, x4, (arg2[0]));
123 mulxU64(&x11, &x12, x4, arg2[0]);
166124 var x13: u64 = undefined;
167125 var x14: u1 = undefined;
168126 addcarryxU64(&x13, &x14, 0x0, x12, x9);
......@@ -172,7 +130,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
172130 var x17: u64 = undefined;
173131 var x18: u1 = undefined;
174132 addcarryxU64(&x17, &x18, x16, x8, x5);
175 const x19 = (@as(u64, x18) + x6);
133 const x19: u64 = (x18 + x6);
176134 var x20: u64 = undefined;
177135 var x21: u64 = undefined;
178136 mulxU64(&x20, &x21, x11, 0xccd1c8aaee00bc4f);
......@@ -197,7 +155,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
197155 var x34: u64 = undefined;
198156 var x35: u1 = undefined;
199157 addcarryxU64(&x34, &x35, x33, x25, x22);
200 const x36 = (@as(u64, x35) + x23);
158 const x36: u64 = (x35 + x23);
201159 var x37: u64 = undefined;
202160 var x38: u1 = undefined;
203161 addcarryxU64(&x37, &x38, 0x0, x11, x28);
......@@ -215,16 +173,16 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
215173 addcarryxU64(&x45, &x46, x44, x19, x36);
216174 var x47: u64 = undefined;
217175 var x48: u64 = undefined;
218 mulxU64(&x47, &x48, x1, (arg2[3]));
176 mulxU64(&x47, &x48, x1, arg2[3]);
219177 var x49: u64 = undefined;
220178 var x50: u64 = undefined;
221 mulxU64(&x49, &x50, x1, (arg2[2]));
179 mulxU64(&x49, &x50, x1, arg2[2]);
222180 var x51: u64 = undefined;
223181 var x52: u64 = undefined;
224 mulxU64(&x51, &x52, x1, (arg2[1]));
182 mulxU64(&x51, &x52, x1, arg2[1]);
225183 var x53: u64 = undefined;
226184 var x54: u64 = undefined;
227 mulxU64(&x53, &x54, x1, (arg2[0]));
185 mulxU64(&x53, &x54, x1, arg2[0]);
228186 var x55: u64 = undefined;
229187 var x56: u1 = undefined;
230188 addcarryxU64(&x55, &x56, 0x0, x54, x51);
......@@ -234,7 +192,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
234192 var x59: u64 = undefined;
235193 var x60: u1 = undefined;
236194 addcarryxU64(&x59, &x60, x58, x50, x47);
237 const x61 = (@as(u64, x60) + x48);
195 const x61: u64 = (x60 + x48);
238196 var x62: u64 = undefined;
239197 var x63: u1 = undefined;
240198 addcarryxU64(&x62, &x63, 0x0, x39, x53);
......@@ -249,7 +207,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
249207 addcarryxU64(&x68, &x69, x67, x45, x59);
250208 var x70: u64 = undefined;
251209 var x71: u1 = undefined;
252 addcarryxU64(&x70, &x71, x69, @as(u64, x46), x61);
210 addcarryxU64(&x70, &x71, x69, x46, x61);
253211 var x72: u64 = undefined;
254212 var x73: u64 = undefined;
255213 mulxU64(&x72, &x73, x62, 0xccd1c8aaee00bc4f);
......@@ -274,7 +232,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
274232 var x86: u64 = undefined;
275233 var x87: u1 = undefined;
276234 addcarryxU64(&x86, &x87, x85, x77, x74);
277 const x88 = (@as(u64, x87) + x75);
235 const x88: u64 = (x87 + x75);
278236 var x89: u64 = undefined;
279237 var x90: u1 = undefined;
280238 addcarryxU64(&x89, &x90, 0x0, x62, x80);
......@@ -290,19 +248,19 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
290248 var x97: u64 = undefined;
291249 var x98: u1 = undefined;
292250 addcarryxU64(&x97, &x98, x96, x70, x88);
293 const x99 = (@as(u64, x98) + @as(u64, x71));
251 const x99: u64 = (@as(u64, x98) + x71);
294252 var x100: u64 = undefined;
295253 var x101: u64 = undefined;
296 mulxU64(&x100, &x101, x2, (arg2[3]));
254 mulxU64(&x100, &x101, x2, arg2[3]);
297255 var x102: u64 = undefined;
298256 var x103: u64 = undefined;
299 mulxU64(&x102, &x103, x2, (arg2[2]));
257 mulxU64(&x102, &x103, x2, arg2[2]);
300258 var x104: u64 = undefined;
301259 var x105: u64 = undefined;
302 mulxU64(&x104, &x105, x2, (arg2[1]));
260 mulxU64(&x104, &x105, x2, arg2[1]);
303261 var x106: u64 = undefined;
304262 var x107: u64 = undefined;
305 mulxU64(&x106, &x107, x2, (arg2[0]));
263 mulxU64(&x106, &x107, x2, arg2[0]);
306264 var x108: u64 = undefined;
307265 var x109: u1 = undefined;
308266 addcarryxU64(&x108, &x109, 0x0, x107, x104);
......@@ -312,7 +270,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
312270 var x112: u64 = undefined;
313271 var x113: u1 = undefined;
314272 addcarryxU64(&x112, &x113, x111, x103, x100);
315 const x114 = (@as(u64, x113) + x101);
273 const x114: u64 = (x113 + x101);
316274 var x115: u64 = undefined;
317275 var x116: u1 = undefined;
318276 addcarryxU64(&x115, &x116, 0x0, x91, x106);
......@@ -352,7 +310,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
352310 var x139: u64 = undefined;
353311 var x140: u1 = undefined;
354312 addcarryxU64(&x139, &x140, x138, x130, x127);
355 const x141 = (@as(u64, x140) + x128);
313 const x141: u64 = (x140 + x128);
356314 var x142: u64 = undefined;
357315 var x143: u1 = undefined;
358316 addcarryxU64(&x142, &x143, 0x0, x115, x133);
......@@ -368,19 +326,19 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
368326 var x150: u64 = undefined;
369327 var x151: u1 = undefined;
370328 addcarryxU64(&x150, &x151, x149, x123, x141);
371 const x152 = (@as(u64, x151) + @as(u64, x124));
329 const x152: u64 = (@as(u64, x151) + x124);
372330 var x153: u64 = undefined;
373331 var x154: u64 = undefined;
374 mulxU64(&x153, &x154, x3, (arg2[3]));
332 mulxU64(&x153, &x154, x3, arg2[3]);
375333 var x155: u64 = undefined;
376334 var x156: u64 = undefined;
377 mulxU64(&x155, &x156, x3, (arg2[2]));
335 mulxU64(&x155, &x156, x3, arg2[2]);
378336 var x157: u64 = undefined;
379337 var x158: u64 = undefined;
380 mulxU64(&x157, &x158, x3, (arg2[1]));
338 mulxU64(&x157, &x158, x3, arg2[1]);
381339 var x159: u64 = undefined;
382340 var x160: u64 = undefined;
383 mulxU64(&x159, &x160, x3, (arg2[0]));
341 mulxU64(&x159, &x160, x3, arg2[0]);
384342 var x161: u64 = undefined;
385343 var x162: u1 = undefined;
386344 addcarryxU64(&x161, &x162, 0x0, x160, x157);
......@@ -390,7 +348,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
390348 var x165: u64 = undefined;
391349 var x166: u1 = undefined;
392350 addcarryxU64(&x165, &x166, x164, x156, x153);
393 const x167 = (@as(u64, x166) + x154);
351 const x167: u64 = (x166 + x154);
394352 var x168: u64 = undefined;
395353 var x169: u1 = undefined;
396354 addcarryxU64(&x168, &x169, 0x0, x144, x159);
......@@ -430,7 +388,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
430388 var x192: u64 = undefined;
431389 var x193: u1 = undefined;
432390 addcarryxU64(&x192, &x193, x191, x183, x180);
433 const x194 = (@as(u64, x193) + x181);
391 const x194: u64 = (x193 + x181);
434392 var x195: u64 = undefined;
435393 var x196: u1 = undefined;
436394 addcarryxU64(&x195, &x196, 0x0, x168, x186);
......@@ -446,7 +404,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
446404 var x203: u64 = undefined;
447405 var x204: u1 = undefined;
448406 addcarryxU64(&x203, &x204, x202, x176, x194);
449 const x205 = (@as(u64, x204) + @as(u64, x177));
407 const x205: u64 = (@as(u64, x204) + x177);
450408 var x206: u64 = undefined;
451409 var x207: u1 = undefined;
452410 subborrowxU64(&x206, &x207, 0x0, x197, 0xf3b9cac2fc632551);
......@@ -461,15 +419,16 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
461419 subborrowxU64(&x212, &x213, x211, x203, 0xffffffff00000000);
462420 var x214: u64 = undefined;
463421 var x215: u1 = undefined;
464 subborrowxU64(&x214, &x215, x213, x205, @as(u64, 0x0));
422 subborrowxU64(&x214, &x215, x213, x205, 0x0);
465423 var x216: u64 = undefined;
466 cmovznzU64(&x216, x215, x206, x197);
424 const x216_selection_mask = selectionMaskU64(x215);
425 x216 = x206 ^ ((x206 ^ x197) & x216_selection_mask);
467426 var x217: u64 = undefined;
468 cmovznzU64(&x217, x215, x208, x199);
427 x217 = x208 ^ ((x208 ^ x199) & x216_selection_mask);
469428 var x218: u64 = undefined;
470 cmovznzU64(&x218, x215, x210, x201);
429 x218 = x210 ^ ((x210 ^ x201) & x216_selection_mask);
471430 var x219: u64 = undefined;
472 cmovznzU64(&x219, x215, x212, x203);
431 x219 = x212 ^ ((x212 ^ x203) & x216_selection_mask);
473432 out1[0] = x216;
474433 out1[1] = x217;
475434 out1[2] = x218;
......@@ -487,22 +446,22 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
487446pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldElement) void {
488447 @setRuntimeSafety(mode == .debug);
489448
490 const x1 = (arg1[1]);
491 const x2 = (arg1[2]);
492 const x3 = (arg1[3]);
493 const x4 = (arg1[0]);
449 const x1: u64 = arg1[1];
450 const x2: u64 = arg1[2];
451 const x3: u64 = arg1[3];
452 const x4: u64 = arg1[0];
494453 var x5: u64 = undefined;
495454 var x6: u64 = undefined;
496 mulxU64(&x5, &x6, x4, (arg1[3]));
455 mulxU64(&x5, &x6, x4, arg1[3]);
497456 var x7: u64 = undefined;
498457 var x8: u64 = undefined;
499 mulxU64(&x7, &x8, x4, (arg1[2]));
458 mulxU64(&x7, &x8, x4, arg1[2]);
500459 var x9: u64 = undefined;
501460 var x10: u64 = undefined;
502 mulxU64(&x9, &x10, x4, (arg1[1]));
461 mulxU64(&x9, &x10, x4, arg1[1]);
503462 var x11: u64 = undefined;
504463 var x12: u64 = undefined;
505 mulxU64(&x11, &x12, x4, (arg1[0]));
464 mulxU64(&x11, &x12, x4, arg1[0]);
506465 var x13: u64 = undefined;
507466 var x14: u1 = undefined;
508467 addcarryxU64(&x13, &x14, 0x0, x12, x9);
......@@ -512,7 +471,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
512471 var x17: u64 = undefined;
513472 var x18: u1 = undefined;
514473 addcarryxU64(&x17, &x18, x16, x8, x5);
515 const x19 = (@as(u64, x18) + x6);
474 const x19: u64 = (x18 + x6);
516475 var x20: u64 = undefined;
517476 var x21: u64 = undefined;
518477 mulxU64(&x20, &x21, x11, 0xccd1c8aaee00bc4f);
......@@ -537,7 +496,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
537496 var x34: u64 = undefined;
538497 var x35: u1 = undefined;
539498 addcarryxU64(&x34, &x35, x33, x25, x22);
540 const x36 = (@as(u64, x35) + x23);
499 const x36: u64 = (x35 + x23);
541500 var x37: u64 = undefined;
542501 var x38: u1 = undefined;
543502 addcarryxU64(&x37, &x38, 0x0, x11, x28);
......@@ -555,16 +514,16 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
555514 addcarryxU64(&x45, &x46, x44, x19, x36);
556515 var x47: u64 = undefined;
557516 var x48: u64 = undefined;
558 mulxU64(&x47, &x48, x1, (arg1[3]));
517 mulxU64(&x47, &x48, x1, arg1[3]);
559518 var x49: u64 = undefined;
560519 var x50: u64 = undefined;
561 mulxU64(&x49, &x50, x1, (arg1[2]));
520 mulxU64(&x49, &x50, x1, arg1[2]);
562521 var x51: u64 = undefined;
563522 var x52: u64 = undefined;
564 mulxU64(&x51, &x52, x1, (arg1[1]));
523 mulxU64(&x51, &x52, x1, arg1[1]);
565524 var x53: u64 = undefined;
566525 var x54: u64 = undefined;
567 mulxU64(&x53, &x54, x1, (arg1[0]));
526 mulxU64(&x53, &x54, x1, arg1[0]);
568527 var x55: u64 = undefined;
569528 var x56: u1 = undefined;
570529 addcarryxU64(&x55, &x56, 0x0, x54, x51);
......@@ -574,7 +533,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
574533 var x59: u64 = undefined;
575534 var x60: u1 = undefined;
576535 addcarryxU64(&x59, &x60, x58, x50, x47);
577 const x61 = (@as(u64, x60) + x48);
536 const x61: u64 = (x60 + x48);
578537 var x62: u64 = undefined;
579538 var x63: u1 = undefined;
580539 addcarryxU64(&x62, &x63, 0x0, x39, x53);
......@@ -589,7 +548,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
589548 addcarryxU64(&x68, &x69, x67, x45, x59);
590549 var x70: u64 = undefined;
591550 var x71: u1 = undefined;
592 addcarryxU64(&x70, &x71, x69, @as(u64, x46), x61);
551 addcarryxU64(&x70, &x71, x69, x46, x61);
593552 var x72: u64 = undefined;
594553 var x73: u64 = undefined;
595554 mulxU64(&x72, &x73, x62, 0xccd1c8aaee00bc4f);
......@@ -614,7 +573,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
614573 var x86: u64 = undefined;
615574 var x87: u1 = undefined;
616575 addcarryxU64(&x86, &x87, x85, x77, x74);
617 const x88 = (@as(u64, x87) + x75);
576 const x88: u64 = (x87 + x75);
618577 var x89: u64 = undefined;
619578 var x90: u1 = undefined;
620579 addcarryxU64(&x89, &x90, 0x0, x62, x80);
......@@ -630,19 +589,19 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
630589 var x97: u64 = undefined;
631590 var x98: u1 = undefined;
632591 addcarryxU64(&x97, &x98, x96, x70, x88);
633 const x99 = (@as(u64, x98) + @as(u64, x71));
592 const x99: u64 = (@as(u64, x98) + x71);
634593 var x100: u64 = undefined;
635594 var x101: u64 = undefined;
636 mulxU64(&x100, &x101, x2, (arg1[3]));
595 mulxU64(&x100, &x101, x2, arg1[3]);
637596 var x102: u64 = undefined;
638597 var x103: u64 = undefined;
639 mulxU64(&x102, &x103, x2, (arg1[2]));
598 mulxU64(&x102, &x103, x2, arg1[2]);
640599 var x104: u64 = undefined;
641600 var x105: u64 = undefined;
642 mulxU64(&x104, &x105, x2, (arg1[1]));
601 mulxU64(&x104, &x105, x2, arg1[1]);
643602 var x106: u64 = undefined;
644603 var x107: u64 = undefined;
645 mulxU64(&x106, &x107, x2, (arg1[0]));
604 mulxU64(&x106, &x107, x2, arg1[0]);
646605 var x108: u64 = undefined;
647606 var x109: u1 = undefined;
648607 addcarryxU64(&x108, &x109, 0x0, x107, x104);
......@@ -652,7 +611,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
652611 var x112: u64 = undefined;
653612 var x113: u1 = undefined;
654613 addcarryxU64(&x112, &x113, x111, x103, x100);
655 const x114 = (@as(u64, x113) + x101);
614 const x114: u64 = (x113 + x101);
656615 var x115: u64 = undefined;
657616 var x116: u1 = undefined;
658617 addcarryxU64(&x115, &x116, 0x0, x91, x106);
......@@ -692,7 +651,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
692651 var x139: u64 = undefined;
693652 var x140: u1 = undefined;
694653 addcarryxU64(&x139, &x140, x138, x130, x127);
695 const x141 = (@as(u64, x140) + x128);
654 const x141: u64 = (x140 + x128);
696655 var x142: u64 = undefined;
697656 var x143: u1 = undefined;
698657 addcarryxU64(&x142, &x143, 0x0, x115, x133);
......@@ -708,19 +667,19 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
708667 var x150: u64 = undefined;
709668 var x151: u1 = undefined;
710669 addcarryxU64(&x150, &x151, x149, x123, x141);
711 const x152 = (@as(u64, x151) + @as(u64, x124));
670 const x152: u64 = (@as(u64, x151) + x124);
712671 var x153: u64 = undefined;
713672 var x154: u64 = undefined;
714 mulxU64(&x153, &x154, x3, (arg1[3]));
673 mulxU64(&x153, &x154, x3, arg1[3]);
715674 var x155: u64 = undefined;
716675 var x156: u64 = undefined;
717 mulxU64(&x155, &x156, x3, (arg1[2]));
676 mulxU64(&x155, &x156, x3, arg1[2]);
718677 var x157: u64 = undefined;
719678 var x158: u64 = undefined;
720 mulxU64(&x157, &x158, x3, (arg1[1]));
679 mulxU64(&x157, &x158, x3, arg1[1]);
721680 var x159: u64 = undefined;
722681 var x160: u64 = undefined;
723 mulxU64(&x159, &x160, x3, (arg1[0]));
682 mulxU64(&x159, &x160, x3, arg1[0]);
724683 var x161: u64 = undefined;
725684 var x162: u1 = undefined;
726685 addcarryxU64(&x161, &x162, 0x0, x160, x157);
......@@ -730,7 +689,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
730689 var x165: u64 = undefined;
731690 var x166: u1 = undefined;
732691 addcarryxU64(&x165, &x166, x164, x156, x153);
733 const x167 = (@as(u64, x166) + x154);
692 const x167: u64 = (x166 + x154);
734693 var x168: u64 = undefined;
735694 var x169: u1 = undefined;
736695 addcarryxU64(&x168, &x169, 0x0, x144, x159);
......@@ -770,7 +729,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
770729 var x192: u64 = undefined;
771730 var x193: u1 = undefined;
772731 addcarryxU64(&x192, &x193, x191, x183, x180);
773 const x194 = (@as(u64, x193) + x181);
732 const x194: u64 = (x193 + x181);
774733 var x195: u64 = undefined;
775734 var x196: u1 = undefined;
776735 addcarryxU64(&x195, &x196, 0x0, x168, x186);
......@@ -786,7 +745,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
786745 var x203: u64 = undefined;
787746 var x204: u1 = undefined;
788747 addcarryxU64(&x203, &x204, x202, x176, x194);
789 const x205 = (@as(u64, x204) + @as(u64, x177));
748 const x205: u64 = (@as(u64, x204) + x177);
790749 var x206: u64 = undefined;
791750 var x207: u1 = undefined;
792751 subborrowxU64(&x206, &x207, 0x0, x197, 0xf3b9cac2fc632551);
......@@ -801,15 +760,16 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
801760 subborrowxU64(&x212, &x213, x211, x203, 0xffffffff00000000);
802761 var x214: u64 = undefined;
803762 var x215: u1 = undefined;
804 subborrowxU64(&x214, &x215, x213, x205, @as(u64, 0x0));
763 subborrowxU64(&x214, &x215, x213, x205, 0x0);
805764 var x216: u64 = undefined;
806 cmovznzU64(&x216, x215, x206, x197);
765 const x216_selection_mask = selectionMaskU64(x215);
766 x216 = x206 ^ ((x206 ^ x197) & x216_selection_mask);
807767 var x217: u64 = undefined;
808 cmovznzU64(&x217, x215, x208, x199);
768 x217 = x208 ^ ((x208 ^ x199) & x216_selection_mask);
809769 var x218: u64 = undefined;
810 cmovznzU64(&x218, x215, x210, x201);
770 x218 = x210 ^ ((x210 ^ x201) & x216_selection_mask);
811771 var x219: u64 = undefined;
812 cmovznzU64(&x219, x215, x212, x203);
772 x219 = x212 ^ ((x212 ^ x203) & x216_selection_mask);
813773 out1[0] = x216;
814774 out1[1] = x217;
815775 out1[2] = x218;
......@@ -830,16 +790,16 @@ pub fn add(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
830790
831791 var x1: u64 = undefined;
832792 var x2: u1 = undefined;
833 addcarryxU64(&x1, &x2, 0x0, (arg1[0]), (arg2[0]));
793 addcarryxU64(&x1, &x2, 0x0, arg1[0], arg2[0]);
834794 var x3: u64 = undefined;
835795 var x4: u1 = undefined;
836 addcarryxU64(&x3, &x4, x2, (arg1[1]), (arg2[1]));
796 addcarryxU64(&x3, &x4, x2, arg1[1], arg2[1]);
837797 var x5: u64 = undefined;
838798 var x6: u1 = undefined;
839 addcarryxU64(&x5, &x6, x4, (arg1[2]), (arg2[2]));
799 addcarryxU64(&x5, &x6, x4, arg1[2], arg2[2]);
840800 var x7: u64 = undefined;
841801 var x8: u1 = undefined;
842 addcarryxU64(&x7, &x8, x6, (arg1[3]), (arg2[3]));
802 addcarryxU64(&x7, &x8, x6, arg1[3], arg2[3]);
843803 var x9: u64 = undefined;
844804 var x10: u1 = undefined;
845805 subborrowxU64(&x9, &x10, 0x0, x1, 0xf3b9cac2fc632551);
......@@ -854,15 +814,16 @@ pub fn add(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
854814 subborrowxU64(&x15, &x16, x14, x7, 0xffffffff00000000);
855815 var x17: u64 = undefined;
856816 var x18: u1 = undefined;
857 subborrowxU64(&x17, &x18, x16, @as(u64, x8), @as(u64, 0x0));
817 subborrowxU64(&x17, &x18, x16, x8, 0x0);
858818 var x19: u64 = undefined;
859 cmovznzU64(&x19, x18, x9, x1);
819 const x19_selection_mask = selectionMaskU64(x18);
820 x19 = x9 ^ ((x9 ^ x1) & x19_selection_mask);
860821 var x20: u64 = undefined;
861 cmovznzU64(&x20, x18, x11, x3);
822 x20 = x11 ^ ((x11 ^ x3) & x19_selection_mask);
862823 var x21: u64 = undefined;
863 cmovznzU64(&x21, x18, x13, x5);
824 x21 = x13 ^ ((x13 ^ x5) & x19_selection_mask);
864825 var x22: u64 = undefined;
865 cmovznzU64(&x22, x18, x15, x7);
826 x22 = x15 ^ ((x15 ^ x7) & x19_selection_mask);
866827 out1[0] = x19;
867828 out1[1] = x20;
868829 out1[2] = x21;
......@@ -883,18 +844,19 @@ pub fn sub(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
883844
884845 var x1: u64 = undefined;
885846 var x2: u1 = undefined;
886 subborrowxU64(&x1, &x2, 0x0, (arg1[0]), (arg2[0]));
847 subborrowxU64(&x1, &x2, 0x0, arg1[0], arg2[0]);
887848 var x3: u64 = undefined;
888849 var x4: u1 = undefined;
889 subborrowxU64(&x3, &x4, x2, (arg1[1]), (arg2[1]));
850 subborrowxU64(&x3, &x4, x2, arg1[1], arg2[1]);
890851 var x5: u64 = undefined;
891852 var x6: u1 = undefined;
892 subborrowxU64(&x5, &x6, x4, (arg1[2]), (arg2[2]));
853 subborrowxU64(&x5, &x6, x4, arg1[2], arg2[2]);
893854 var x7: u64 = undefined;
894855 var x8: u1 = undefined;
895 subborrowxU64(&x7, &x8, x6, (arg1[3]), (arg2[3]));
856 subborrowxU64(&x7, &x8, x6, arg1[3], arg2[3]);
896857 var x9: u64 = undefined;
897 cmovznzU64(&x9, x8, @as(u64, 0x0), 0xffffffffffffffff);
858 const x9_selection_mask = selectionMaskU64(x8);
859 x9 = 0x0 ^ ((0x0 ^ 0xffffffffffffffff) & x9_selection_mask);
898860 var x10: u64 = undefined;
899861 var x11: u1 = undefined;
900862 addcarryxU64(&x10, &x11, 0x0, x1, (x9 & 0xf3b9cac2fc632551));
......@@ -926,18 +888,19 @@ pub fn opp(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
926888
927889 var x1: u64 = undefined;
928890 var x2: u1 = undefined;
929 subborrowxU64(&x1, &x2, 0x0, @as(u64, 0x0), (arg1[0]));
891 subborrowxU64(&x1, &x2, 0x0, 0x0, arg1[0]);
930892 var x3: u64 = undefined;
931893 var x4: u1 = undefined;
932 subborrowxU64(&x3, &x4, x2, @as(u64, 0x0), (arg1[1]));
894 subborrowxU64(&x3, &x4, x2, 0x0, arg1[1]);
933895 var x5: u64 = undefined;
934896 var x6: u1 = undefined;
935 subborrowxU64(&x5, &x6, x4, @as(u64, 0x0), (arg1[2]));
897 subborrowxU64(&x5, &x6, x4, 0x0, arg1[2]);
936898 var x7: u64 = undefined;
937899 var x8: u1 = undefined;
938 subborrowxU64(&x7, &x8, x6, @as(u64, 0x0), (arg1[3]));
900 subborrowxU64(&x7, &x8, x6, 0x0, arg1[3]);
939901 var x9: u64 = undefined;
940 cmovznzU64(&x9, x8, @as(u64, 0x0), 0xffffffffffffffff);
902 const x9_selection_mask = selectionMaskU64(x8);
903 x9 = 0x0 ^ ((0x0 ^ 0xffffffffffffffff) & x9_selection_mask);
941904 var x10: u64 = undefined;
942905 var x11: u1 = undefined;
943906 addcarryxU64(&x10, &x11, 0x0, x1, (x9 & 0xf3b9cac2fc632551));
......@@ -967,7 +930,7 @@ pub fn opp(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
967930pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldElement) void {
968931 @setRuntimeSafety(mode == .debug);
969932
970 const x1 = (arg1[0]);
933 const x1: u64 = arg1[0];
971934 var x2: u64 = undefined;
972935 var x3: u64 = undefined;
973936 mulxU64(&x2, &x3, x1, 0xccd1c8aaee00bc4f);
......@@ -997,22 +960,22 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo
997960 addcarryxU64(&x18, &x19, 0x0, x1, x10);
998961 var x20: u64 = undefined;
999962 var x21: u1 = undefined;
1000 addcarryxU64(&x20, &x21, x19, @as(u64, 0x0), x12);
963 addcarryxU64(&x20, &x21, x19, 0x0, x12);
1001964 var x22: u64 = undefined;
1002965 var x23: u1 = undefined;
1003 addcarryxU64(&x22, &x23, x21, @as(u64, 0x0), x14);
966 addcarryxU64(&x22, &x23, x21, 0x0, x14);
1004967 var x24: u64 = undefined;
1005968 var x25: u1 = undefined;
1006 addcarryxU64(&x24, &x25, x23, @as(u64, 0x0), x16);
969 addcarryxU64(&x24, &x25, x23, 0x0, x16);
1007970 var x26: u64 = undefined;
1008971 var x27: u1 = undefined;
1009 addcarryxU64(&x26, &x27, 0x0, x20, (arg1[1]));
972 addcarryxU64(&x26, &x27, 0x0, x20, arg1[1]);
1010973 var x28: u64 = undefined;
1011974 var x29: u1 = undefined;
1012 addcarryxU64(&x28, &x29, x27, x22, @as(u64, 0x0));
975 addcarryxU64(&x28, &x29, x27, x22, 0x0);
1013976 var x30: u64 = undefined;
1014977 var x31: u1 = undefined;
1015 addcarryxU64(&x30, &x31, x29, x24, @as(u64, 0x0));
978 addcarryxU64(&x30, &x31, x29, x24, 0x0);
1016979 var x32: u64 = undefined;
1017980 var x33: u64 = undefined;
1018981 mulxU64(&x32, &x33, x26, 0xccd1c8aaee00bc4f);
......@@ -1048,16 +1011,16 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo
10481011 addcarryxU64(&x52, &x53, x51, x30, x44);
10491012 var x54: u64 = undefined;
10501013 var x55: u1 = undefined;
1051 addcarryxU64(&x54, &x55, x53, (@as(u64, x31) + (@as(u64, x25) + (@as(u64, x17) + x5))), x46);
1014 addcarryxU64(&x54, &x55, x53, (x31 + (x25 + (x17 + x5))), x46);
10521015 var x56: u64 = undefined;
10531016 var x57: u1 = undefined;
1054 addcarryxU64(&x56, &x57, 0x0, x50, (arg1[2]));
1017 addcarryxU64(&x56, &x57, 0x0, x50, arg1[2]);
10551018 var x58: u64 = undefined;
10561019 var x59: u1 = undefined;
1057 addcarryxU64(&x58, &x59, x57, x52, @as(u64, 0x0));
1020 addcarryxU64(&x58, &x59, x57, x52, 0x0);
10581021 var x60: u64 = undefined;
10591022 var x61: u1 = undefined;
1060 addcarryxU64(&x60, &x61, x59, x54, @as(u64, 0x0));
1023 addcarryxU64(&x60, &x61, x59, x54, 0x0);
10611024 var x62: u64 = undefined;
10621025 var x63: u64 = undefined;
10631026 mulxU64(&x62, &x63, x56, 0xccd1c8aaee00bc4f);
......@@ -1093,16 +1056,16 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo
10931056 addcarryxU64(&x82, &x83, x81, x60, x74);
10941057 var x84: u64 = undefined;
10951058 var x85: u1 = undefined;
1096 addcarryxU64(&x84, &x85, x83, (@as(u64, x61) + (@as(u64, x55) + (@as(u64, x47) + x35))), x76);
1059 addcarryxU64(&x84, &x85, x83, (x61 + (x55 + (x47 + x35))), x76);
10971060 var x86: u64 = undefined;
10981061 var x87: u1 = undefined;
1099 addcarryxU64(&x86, &x87, 0x0, x80, (arg1[3]));
1062 addcarryxU64(&x86, &x87, 0x0, x80, arg1[3]);
11001063 var x88: u64 = undefined;
11011064 var x89: u1 = undefined;
1102 addcarryxU64(&x88, &x89, x87, x82, @as(u64, 0x0));
1065 addcarryxU64(&x88, &x89, x87, x82, 0x0);
11031066 var x90: u64 = undefined;
11041067 var x91: u1 = undefined;
1105 addcarryxU64(&x90, &x91, x89, x84, @as(u64, 0x0));
1068 addcarryxU64(&x90, &x91, x89, x84, 0x0);
11061069 var x92: u64 = undefined;
11071070 var x93: u64 = undefined;
11081071 mulxU64(&x92, &x93, x86, 0xccd1c8aaee00bc4f);
......@@ -1138,8 +1101,8 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo
11381101 addcarryxU64(&x112, &x113, x111, x90, x104);
11391102 var x114: u64 = undefined;
11401103 var x115: u1 = undefined;
1141 addcarryxU64(&x114, &x115, x113, (@as(u64, x91) + (@as(u64, x85) + (@as(u64, x77) + x65))), x106);
1142 const x116 = (@as(u64, x115) + (@as(u64, x107) + x95));
1104 addcarryxU64(&x114, &x115, x113, (x91 + (x85 + (x77 + x65))), x106);
1105 const x116: u64 = (x115 + (x107 + x95));
11431106 var x117: u64 = undefined;
11441107 var x118: u1 = undefined;
11451108 subborrowxU64(&x117, &x118, 0x0, x110, 0xf3b9cac2fc632551);
......@@ -1154,15 +1117,16 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo
11541117 subborrowxU64(&x123, &x124, x122, x116, 0xffffffff00000000);
11551118 var x125: u64 = undefined;
11561119 var x126: u1 = undefined;
1157 subborrowxU64(&x125, &x126, x124, @as(u64, 0x0), @as(u64, 0x0));
1120 subborrowxU64(&x125, &x126, x124, 0x0, 0x0);
11581121 var x127: u64 = undefined;
1159 cmovznzU64(&x127, x126, x117, x110);
1122 const x127_selection_mask = selectionMaskU64(x126);
1123 x127 = x117 ^ ((x117 ^ x110) & x127_selection_mask);
11601124 var x128: u64 = undefined;
1161 cmovznzU64(&x128, x126, x119, x112);
1125 x128 = x119 ^ ((x119 ^ x112) & x127_selection_mask);
11621126 var x129: u64 = undefined;
1163 cmovznzU64(&x129, x126, x121, x114);
1127 x129 = x121 ^ ((x121 ^ x114) & x127_selection_mask);
11641128 var x130: u64 = undefined;
1165 cmovznzU64(&x130, x126, x123, x116);
1129 x130 = x123 ^ ((x123 ^ x116) & x127_selection_mask);
11661130 out1[0] = x127;
11671131 out1[1] = x128;
11681132 out1[2] = x129;
......@@ -1180,10 +1144,10 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo
11801144pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDomainFieldElement) void {
11811145 @setRuntimeSafety(mode == .debug);
11821146
1183 const x1 = (arg1[1]);
1184 const x2 = (arg1[2]);
1185 const x3 = (arg1[3]);
1186 const x4 = (arg1[0]);
1147 const x1: u64 = arg1[1];
1148 const x2: u64 = arg1[2];
1149 const x3: u64 = arg1[3];
1150 const x4: u64 = arg1[0];
11871151 var x5: u64 = undefined;
11881152 var x6: u64 = undefined;
11891153 mulxU64(&x5, &x6, x4, 0x66e12d94f3d95620);
......@@ -1243,7 +1207,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma
12431207 addcarryxU64(&x41, &x42, x40, x17, x33);
12441208 var x43: u64 = undefined;
12451209 var x44: u1 = undefined;
1246 addcarryxU64(&x43, &x44, x42, (@as(u64, x18) + x6), (@as(u64, x34) + x22));
1210 addcarryxU64(&x43, &x44, x42, (x18 + x6), (x34 + x22));
12471211 var x45: u64 = undefined;
12481212 var x46: u64 = undefined;
12491213 mulxU64(&x45, &x46, x1, 0x66e12d94f3d95620);
......@@ -1315,7 +1279,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma
13151279 addcarryxU64(&x89, &x90, x88, x65, x81);
13161280 var x91: u64 = undefined;
13171281 var x92: u1 = undefined;
1318 addcarryxU64(&x91, &x92, x90, ((@as(u64, x66) + @as(u64, x44)) + (@as(u64, x58) + x46)), (@as(u64, x82) + x70));
1282 addcarryxU64(&x91, &x92, x90, ((@as(u64, x66) + x44) + (x58 + x46)), (x82 + x70));
13191283 var x93: u64 = undefined;
13201284 var x94: u64 = undefined;
13211285 mulxU64(&x93, &x94, x2, 0x66e12d94f3d95620);
......@@ -1387,7 +1351,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma
13871351 addcarryxU64(&x137, &x138, x136, x113, x129);
13881352 var x139: u64 = undefined;
13891353 var x140: u1 = undefined;
1390 addcarryxU64(&x139, &x140, x138, ((@as(u64, x114) + @as(u64, x92)) + (@as(u64, x106) + x94)), (@as(u64, x130) + x118));
1354 addcarryxU64(&x139, &x140, x138, ((@as(u64, x114) + x92) + (x106 + x94)), (x130 + x118));
13911355 var x141: u64 = undefined;
13921356 var x142: u64 = undefined;
13931357 mulxU64(&x141, &x142, x3, 0x66e12d94f3d95620);
......@@ -1459,7 +1423,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma
14591423 addcarryxU64(&x185, &x186, x184, x161, x177);
14601424 var x187: u64 = undefined;
14611425 var x188: u1 = undefined;
1462 addcarryxU64(&x187, &x188, x186, ((@as(u64, x162) + @as(u64, x140)) + (@as(u64, x154) + x142)), (@as(u64, x178) + x166));
1426 addcarryxU64(&x187, &x188, x186, ((@as(u64, x162) + x140) + (x154 + x142)), (x178 + x166));
14631427 var x189: u64 = undefined;
14641428 var x190: u1 = undefined;
14651429 subborrowxU64(&x189, &x190, 0x0, x181, 0xf3b9cac2fc632551);
......@@ -1474,15 +1438,16 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma
14741438 subborrowxU64(&x195, &x196, x194, x187, 0xffffffff00000000);
14751439 var x197: u64 = undefined;
14761440 var x198: u1 = undefined;
1477 subborrowxU64(&x197, &x198, x196, @as(u64, x188), @as(u64, 0x0));
1441 subborrowxU64(&x197, &x198, x196, x188, 0x0);
14781442 var x199: u64 = undefined;
1479 cmovznzU64(&x199, x198, x189, x181);
1443 const x199_selection_mask = selectionMaskU64(x198);
1444 x199 = x189 ^ ((x189 ^ x181) & x199_selection_mask);
14801445 var x200: u64 = undefined;
1481 cmovznzU64(&x200, x198, x191, x183);
1446 x200 = x191 ^ ((x191 ^ x183) & x199_selection_mask);
14821447 var x201: u64 = undefined;
1483 cmovznzU64(&x201, x198, x193, x185);
1448 x201 = x193 ^ ((x193 ^ x185) & x199_selection_mask);
14841449 var x202: u64 = undefined;
1485 cmovznzU64(&x202, x198, x195, x187);
1450 x202 = x195 ^ ((x195 ^ x187) & x199_selection_mask);
14861451 out1[0] = x199;
14871452 out1[1] = x200;
14881453 out1[2] = x201;
......@@ -1503,14 +1468,14 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma
15031468pub fn nonzero(out1: *u64, arg1: [4]u64) void {
15041469 @setRuntimeSafety(mode == .debug);
15051470
1506 const x1 = ((arg1[0]) | ((arg1[1]) | ((arg1[2]) | (arg1[3]))));
1471 const x1: u64 = (arg1[0] | (arg1[1] | (arg1[2] | arg1[3])));
15071472 out1.* = x1;
15081473}
15091474
15101475/// The function selectznz is a multi-limb conditional select.
15111476///
15121477/// Postconditions:
1513/// eval out1 = (if arg1 = 0 then eval arg2 else eval arg3)
1478/// out1 = (if arg1 = 0 then arg2 else arg3)
15141479///
15151480/// Input Bounds:
15161481/// arg1: [0x0 ~> 0x1]
......@@ -1522,13 +1487,14 @@ pub fn selectznz(out1: *[4]u64, arg1: u1, arg2: [4]u64, arg3: [4]u64) void {
15221487 @setRuntimeSafety(mode == .debug);
15231488
15241489 var x1: u64 = undefined;
1525 cmovznzU64(&x1, arg1, (arg2[0]), (arg3[0]));
1490 const x1_selection_mask = selectionMaskU64(arg1);
1491 x1 = arg2[0] ^ ((arg2[0] ^ arg3[0]) & x1_selection_mask);
15261492 var x2: u64 = undefined;
1527 cmovznzU64(&x2, arg1, (arg2[1]), (arg3[1]));
1493 x2 = arg2[1] ^ ((arg2[1] ^ arg3[1]) & x1_selection_mask);
15281494 var x3: u64 = undefined;
1529 cmovznzU64(&x3, arg1, (arg2[2]), (arg3[2]));
1495 x3 = arg2[2] ^ ((arg2[2] ^ arg3[2]) & x1_selection_mask);
15301496 var x4: u64 = undefined;
1531 cmovznzU64(&x4, arg1, (arg2[3]), (arg3[3]));
1497 x4 = arg2[3] ^ ((arg2[3] ^ arg3[3]) & x1_selection_mask);
15321498 out1[0] = x1;
15331499 out1[1] = x2;
15341500 out1[2] = x3;
......@@ -1549,66 +1515,66 @@ pub fn selectznz(out1: *[4]u64, arg1: u1, arg2: [4]u64, arg3: [4]u64) void {
15491515pub fn toBytes(out1: *[32]u8, arg1: [4]u64) void {
15501516 @setRuntimeSafety(mode == .debug);
15511517
1552 const x1 = (arg1[3]);
1553 const x2 = (arg1[2]);
1554 const x3 = (arg1[1]);
1555 const x4 = (arg1[0]);
1556 const x5 = @as(u8, @truncate((x4 & @as(u64, 0xff))));
1557 const x6 = (x4 >> 8);
1558 const x7 = @as(u8, @truncate((x6 & @as(u64, 0xff))));
1559 const x8 = (x6 >> 8);
1560 const x9 = @as(u8, @truncate((x8 & @as(u64, 0xff))));
1561 const x10 = (x8 >> 8);
1562 const x11 = @as(u8, @truncate((x10 & @as(u64, 0xff))));
1563 const x12 = (x10 >> 8);
1564 const x13 = @as(u8, @truncate((x12 & @as(u64, 0xff))));
1565 const x14 = (x12 >> 8);
1566 const x15 = @as(u8, @truncate((x14 & @as(u64, 0xff))));
1567 const x16 = (x14 >> 8);
1568 const x17 = @as(u8, @truncate((x16 & @as(u64, 0xff))));
1569 const x18 = @as(u8, @truncate((x16 >> 8)));
1570 const x19 = @as(u8, @truncate((x3 & @as(u64, 0xff))));
1571 const x20 = (x3 >> 8);
1572 const x21 = @as(u8, @truncate((x20 & @as(u64, 0xff))));
1573 const x22 = (x20 >> 8);
1574 const x23 = @as(u8, @truncate((x22 & @as(u64, 0xff))));
1575 const x24 = (x22 >> 8);
1576 const x25 = @as(u8, @truncate((x24 & @as(u64, 0xff))));
1577 const x26 = (x24 >> 8);
1578 const x27 = @as(u8, @truncate((x26 & @as(u64, 0xff))));
1579 const x28 = (x26 >> 8);
1580 const x29 = @as(u8, @truncate((x28 & @as(u64, 0xff))));
1581 const x30 = (x28 >> 8);
1582 const x31 = @as(u8, @truncate((x30 & @as(u64, 0xff))));
1583 const x32 = @as(u8, @truncate((x30 >> 8)));
1584 const x33 = @as(u8, @truncate((x2 & @as(u64, 0xff))));
1585 const x34 = (x2 >> 8);
1586 const x35 = @as(u8, @truncate((x34 & @as(u64, 0xff))));
1587 const x36 = (x34 >> 8);
1588 const x37 = @as(u8, @truncate((x36 & @as(u64, 0xff))));
1589 const x38 = (x36 >> 8);
1590 const x39 = @as(u8, @truncate((x38 & @as(u64, 0xff))));
1591 const x40 = (x38 >> 8);
1592 const x41 = @as(u8, @truncate((x40 & @as(u64, 0xff))));
1593 const x42 = (x40 >> 8);
1594 const x43 = @as(u8, @truncate((x42 & @as(u64, 0xff))));
1595 const x44 = (x42 >> 8);
1596 const x45 = @as(u8, @truncate((x44 & @as(u64, 0xff))));
1597 const x46 = @as(u8, @truncate((x44 >> 8)));
1598 const x47 = @as(u8, @truncate((x1 & @as(u64, 0xff))));
1599 const x48 = (x1 >> 8);
1600 const x49 = @as(u8, @truncate((x48 & @as(u64, 0xff))));
1601 const x50 = (x48 >> 8);
1602 const x51 = @as(u8, @truncate((x50 & @as(u64, 0xff))));
1603 const x52 = (x50 >> 8);
1604 const x53 = @as(u8, @truncate((x52 & @as(u64, 0xff))));
1605 const x54 = (x52 >> 8);
1606 const x55 = @as(u8, @truncate((x54 & @as(u64, 0xff))));
1607 const x56 = (x54 >> 8);
1608 const x57 = @as(u8, @truncate((x56 & @as(u64, 0xff))));
1609 const x58 = (x56 >> 8);
1610 const x59 = @as(u8, @truncate((x58 & @as(u64, 0xff))));
1611 const x60 = @as(u8, @truncate((x58 >> 8)));
1518 const x1: u64 = arg1[3];
1519 const x2: u64 = arg1[2];
1520 const x3: u64 = arg1[1];
1521 const x4: u64 = arg1[0];
1522 const x5: u8 = @truncate(x4);
1523 const x6: u64 = (x4 >> 8);
1524 const x7: u8 = @truncate(x6);
1525 const x8: u64 = (x6 >> 8);
1526 const x9: u8 = @truncate(x8);
1527 const x10: u64 = (x8 >> 8);
1528 const x11: u8 = @truncate(x10);
1529 const x12: u64 = (x10 >> 8);
1530 const x13: u8 = @truncate(x12);
1531 const x14: u64 = (x12 >> 8);
1532 const x15: u8 = @truncate(x14);
1533 const x16: u64 = (x14 >> 8);
1534 const x17: u8 = @truncate(x16);
1535 const x18: u8 = @truncate((x16 >> 8));
1536 const x19: u8 = @truncate(x3);
1537 const x20: u64 = (x3 >> 8);
1538 const x21: u8 = @truncate(x20);
1539 const x22: u64 = (x20 >> 8);
1540 const x23: u8 = @truncate(x22);
1541 const x24: u64 = (x22 >> 8);
1542 const x25: u8 = @truncate(x24);
1543 const x26: u64 = (x24 >> 8);
1544 const x27: u8 = @truncate(x26);
1545 const x28: u64 = (x26 >> 8);
1546 const x29: u8 = @truncate(x28);
1547 const x30: u64 = (x28 >> 8);
1548 const x31: u8 = @truncate(x30);
1549 const x32: u8 = @truncate((x30 >> 8));
1550 const x33: u8 = @truncate(x2);
1551 const x34: u64 = (x2 >> 8);
1552 const x35: u8 = @truncate(x34);
1553 const x36: u64 = (x34 >> 8);
1554 const x37: u8 = @truncate(x36);
1555 const x38: u64 = (x36 >> 8);
1556 const x39: u8 = @truncate(x38);
1557 const x40: u64 = (x38 >> 8);
1558 const x41: u8 = @truncate(x40);
1559 const x42: u64 = (x40 >> 8);
1560 const x43: u8 = @truncate(x42);
1561 const x44: u64 = (x42 >> 8);
1562 const x45: u8 = @truncate(x44);
1563 const x46: u8 = @truncate((x44 >> 8));
1564 const x47: u8 = @truncate(x1);
1565 const x48: u64 = (x1 >> 8);
1566 const x49: u8 = @truncate(x48);
1567 const x50: u64 = (x48 >> 8);
1568 const x51: u8 = @truncate(x50);
1569 const x52: u64 = (x50 >> 8);
1570 const x53: u8 = @truncate(x52);
1571 const x54: u64 = (x52 >> 8);
1572 const x55: u8 = @truncate(x54);
1573 const x56: u64 = (x54 >> 8);
1574 const x57: u8 = @truncate(x56);
1575 const x58: u64 = (x56 >> 8);
1576 const x59: u8 = @truncate(x58);
1577 const x60: u8 = @truncate((x58 >> 8));
16121578 out1[0] = x5;
16131579 out1[1] = x7;
16141580 out1[2] = x9;
......@@ -1658,66 +1624,66 @@ pub fn toBytes(out1: *[32]u8, arg1: [4]u64) void {
16581624pub fn fromBytes(out1: *[4]u64, arg1: [32]u8) void {
16591625 @setRuntimeSafety(mode == .debug);
16601626
1661 const x1 = (@as(u64, (arg1[31])) << 56);
1662 const x2 = (@as(u64, (arg1[30])) << 48);
1663 const x3 = (@as(u64, (arg1[29])) << 40);
1664 const x4 = (@as(u64, (arg1[28])) << 32);
1665 const x5 = (@as(u64, (arg1[27])) << 24);
1666 const x6 = (@as(u64, (arg1[26])) << 16);
1667 const x7 = (@as(u64, (arg1[25])) << 8);
1668 const x8 = (arg1[24]);
1669 const x9 = (@as(u64, (arg1[23])) << 56);
1670 const x10 = (@as(u64, (arg1[22])) << 48);
1671 const x11 = (@as(u64, (arg1[21])) << 40);
1672 const x12 = (@as(u64, (arg1[20])) << 32);
1673 const x13 = (@as(u64, (arg1[19])) << 24);
1674 const x14 = (@as(u64, (arg1[18])) << 16);
1675 const x15 = (@as(u64, (arg1[17])) << 8);
1676 const x16 = (arg1[16]);
1677 const x17 = (@as(u64, (arg1[15])) << 56);
1678 const x18 = (@as(u64, (arg1[14])) << 48);
1679 const x19 = (@as(u64, (arg1[13])) << 40);
1680 const x20 = (@as(u64, (arg1[12])) << 32);
1681 const x21 = (@as(u64, (arg1[11])) << 24);
1682 const x22 = (@as(u64, (arg1[10])) << 16);
1683 const x23 = (@as(u64, (arg1[9])) << 8);
1684 const x24 = (arg1[8]);
1685 const x25 = (@as(u64, (arg1[7])) << 56);
1686 const x26 = (@as(u64, (arg1[6])) << 48);
1687 const x27 = (@as(u64, (arg1[5])) << 40);
1688 const x28 = (@as(u64, (arg1[4])) << 32);
1689 const x29 = (@as(u64, (arg1[3])) << 24);
1690 const x30 = (@as(u64, (arg1[2])) << 16);
1691 const x31 = (@as(u64, (arg1[1])) << 8);
1692 const x32 = (arg1[0]);
1693 const x33 = (x31 + @as(u64, x32));
1694 const x34 = (x30 + x33);
1695 const x35 = (x29 + x34);
1696 const x36 = (x28 + x35);
1697 const x37 = (x27 + x36);
1698 const x38 = (x26 + x37);
1699 const x39 = (x25 + x38);
1700 const x40 = (x23 + @as(u64, x24));
1701 const x41 = (x22 + x40);
1702 const x42 = (x21 + x41);
1703 const x43 = (x20 + x42);
1704 const x44 = (x19 + x43);
1705 const x45 = (x18 + x44);
1706 const x46 = (x17 + x45);
1707 const x47 = (x15 + @as(u64, x16));
1708 const x48 = (x14 + x47);
1709 const x49 = (x13 + x48);
1710 const x50 = (x12 + x49);
1711 const x51 = (x11 + x50);
1712 const x52 = (x10 + x51);
1713 const x53 = (x9 + x52);
1714 const x54 = (x7 + @as(u64, x8));
1715 const x55 = (x6 + x54);
1716 const x56 = (x5 + x55);
1717 const x57 = (x4 + x56);
1718 const x58 = (x3 + x57);
1719 const x59 = (x2 + x58);
1720 const x60 = (x1 + x59);
1627 const x1: u64 = (@as(u64, arg1[31]) << 56);
1628 const x2: u64 = (@as(u64, arg1[30]) << 48);
1629 const x3: u64 = (@as(u64, arg1[29]) << 40);
1630 const x4: u64 = (@as(u64, arg1[28]) << 32);
1631 const x5: u64 = (@as(u64, arg1[27]) << 24);
1632 const x6: u64 = (@as(u64, arg1[26]) << 16);
1633 const x7: u64 = (@as(u64, arg1[25]) << 8);
1634 const x8: u8 = arg1[24];
1635 const x9: u64 = (@as(u64, arg1[23]) << 56);
1636 const x10: u64 = (@as(u64, arg1[22]) << 48);
1637 const x11: u64 = (@as(u64, arg1[21]) << 40);
1638 const x12: u64 = (@as(u64, arg1[20]) << 32);
1639 const x13: u64 = (@as(u64, arg1[19]) << 24);
1640 const x14: u64 = (@as(u64, arg1[18]) << 16);
1641 const x15: u64 = (@as(u64, arg1[17]) << 8);
1642 const x16: u8 = arg1[16];
1643 const x17: u64 = (@as(u64, arg1[15]) << 56);
1644 const x18: u64 = (@as(u64, arg1[14]) << 48);
1645 const x19: u64 = (@as(u64, arg1[13]) << 40);
1646 const x20: u64 = (@as(u64, arg1[12]) << 32);
1647 const x21: u64 = (@as(u64, arg1[11]) << 24);
1648 const x22: u64 = (@as(u64, arg1[10]) << 16);
1649 const x23: u64 = (@as(u64, arg1[9]) << 8);
1650 const x24: u8 = arg1[8];
1651 const x25: u64 = (@as(u64, arg1[7]) << 56);
1652 const x26: u64 = (@as(u64, arg1[6]) << 48);
1653 const x27: u64 = (@as(u64, arg1[5]) << 40);
1654 const x28: u64 = (@as(u64, arg1[4]) << 32);
1655 const x29: u64 = (@as(u64, arg1[3]) << 24);
1656 const x30: u64 = (@as(u64, arg1[2]) << 16);
1657 const x31: u64 = (@as(u64, arg1[1]) << 8);
1658 const x32: u8 = arg1[0];
1659 const x33: u64 = (x31 + x32);
1660 const x34: u64 = (x30 + x33);
1661 const x35: u64 = (x29 + x34);
1662 const x36: u64 = (x28 + x35);
1663 const x37: u64 = (x27 + x36);
1664 const x38: u64 = (x26 + x37);
1665 const x39: u64 = (x25 + x38);
1666 const x40: u64 = (x23 + x24);
1667 const x41: u64 = (x22 + x40);
1668 const x42: u64 = (x21 + x41);
1669 const x43: u64 = (x20 + x42);
1670 const x44: u64 = (x19 + x43);
1671 const x45: u64 = (x18 + x44);
1672 const x46: u64 = (x17 + x45);
1673 const x47: u64 = (x15 + x16);
1674 const x48: u64 = (x14 + x47);
1675 const x49: u64 = (x13 + x48);
1676 const x50: u64 = (x12 + x49);
1677 const x51: u64 = (x11 + x50);
1678 const x52: u64 = (x10 + x51);
1679 const x53: u64 = (x9 + x52);
1680 const x54: u64 = (x7 + x8);
1681 const x55: u64 = (x6 + x54);
1682 const x56: u64 = (x5 + x55);
1683 const x57: u64 = (x4 + x56);
1684 const x58: u64 = (x3 + x57);
1685 const x59: u64 = (x2 + x58);
1686 const x60: u64 = (x1 + x59);
17211687 out1[0] = x39;
17221688 out1[1] = x46;
17231689 out1[2] = x53;
......@@ -1735,7 +1701,7 @@ pub fn setOne(out1: *MontgomeryDomainFieldElement) void {
17351701
17361702 out1[0] = 0xc46353d039cdaaf;
17371703 out1[1] = 0x4319055258e8617b;
1738 out1[2] = @as(u64, 0x0);
1704 out1[2] = 0x0;
17391705 out1[3] = 0xffffffff;
17401706}
17411707
......@@ -1754,7 +1720,7 @@ pub fn msat(out1: *[5]u64) void {
17541720 out1[1] = 0xbce6faada7179e84;
17551721 out1[2] = 0xffffffffffffffff;
17561722 out1[3] = 0xffffffff00000000;
1757 out1[4] = @as(u64, 0x0);
1723 out1[4] = 0x0;
17581724}
17591725
17601726/// The function divstep computes a divstep.
......@@ -1790,56 +1756,58 @@ pub fn divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *[4]u64, out5: *[
17901756
17911757 var x1: u64 = undefined;
17921758 var x2: u1 = undefined;
1793 addcarryxU64(&x1, &x2, 0x0, (~arg1), @as(u64, 0x1));
1794 const x3 = @as(u1, @truncate((x1 >> 63))) & @as(u1, @truncate(((arg3[0]) & @as(u64, 0x1))));
1759 addcarryxU64(&x1, &x2, 0x0, (~arg1), 0x1);
1760 const x3: u1 = (@as(u1, @truncate((x1 >> 63))) & @as(u1, @truncate(arg3[0])));
17951761 var x4: u64 = undefined;
17961762 var x5: u1 = undefined;
1797 addcarryxU64(&x4, &x5, 0x0, (~arg1), @as(u64, 0x1));
1763 addcarryxU64(&x4, &x5, 0x0, (~arg1), 0x1);
17981764 var x6: u64 = undefined;
1799 cmovznzU64(&x6, x3, arg1, x4);
1765 const x6_selection_mask = selectionMaskU64(x3);
1766 x6 = arg1 ^ ((arg1 ^ x4) & x6_selection_mask);
18001767 var x7: u64 = undefined;
1801 cmovznzU64(&x7, x3, (arg2[0]), (arg3[0]));
1768 x7 = arg2[0] ^ ((arg2[0] ^ arg3[0]) & x6_selection_mask);
18021769 var x8: u64 = undefined;
1803 cmovznzU64(&x8, x3, (arg2[1]), (arg3[1]));
1770 x8 = arg2[1] ^ ((arg2[1] ^ arg3[1]) & x6_selection_mask);
18041771 var x9: u64 = undefined;
1805 cmovznzU64(&x9, x3, (arg2[2]), (arg3[2]));
1772 x9 = arg2[2] ^ ((arg2[2] ^ arg3[2]) & x6_selection_mask);
18061773 var x10: u64 = undefined;
1807 cmovznzU64(&x10, x3, (arg2[3]), (arg3[3]));
1774 x10 = arg2[3] ^ ((arg2[3] ^ arg3[3]) & x6_selection_mask);
18081775 var x11: u64 = undefined;
1809 cmovznzU64(&x11, x3, (arg2[4]), (arg3[4]));
1776 x11 = arg2[4] ^ ((arg2[4] ^ arg3[4]) & x6_selection_mask);
18101777 var x12: u64 = undefined;
18111778 var x13: u1 = undefined;
1812 addcarryxU64(&x12, &x13, 0x0, @as(u64, 0x1), (~(arg2[0])));
1779 addcarryxU64(&x12, &x13, 0x0, 0x1, (~arg2[0]));
18131780 var x14: u64 = undefined;
18141781 var x15: u1 = undefined;
1815 addcarryxU64(&x14, &x15, x13, @as(u64, 0x0), (~(arg2[1])));
1782 addcarryxU64(&x14, &x15, x13, 0x0, (~arg2[1]));
18161783 var x16: u64 = undefined;
18171784 var x17: u1 = undefined;
1818 addcarryxU64(&x16, &x17, x15, @as(u64, 0x0), (~(arg2[2])));
1785 addcarryxU64(&x16, &x17, x15, 0x0, (~arg2[2]));
18191786 var x18: u64 = undefined;
18201787 var x19: u1 = undefined;
1821 addcarryxU64(&x18, &x19, x17, @as(u64, 0x0), (~(arg2[3])));
1788 addcarryxU64(&x18, &x19, x17, 0x0, (~arg2[3]));
18221789 var x20: u64 = undefined;
18231790 var x21: u1 = undefined;
1824 addcarryxU64(&x20, &x21, x19, @as(u64, 0x0), (~(arg2[4])));
1791 addcarryxU64(&x20, &x21, x19, 0x0, (~arg2[4]));
18251792 var x22: u64 = undefined;
1826 cmovznzU64(&x22, x3, (arg3[0]), x12);
1793 const x22_selection_mask = selectionMaskU64(x3);
1794 x22 = arg3[0] ^ ((arg3[0] ^ x12) & x22_selection_mask);
18271795 var x23: u64 = undefined;
1828 cmovznzU64(&x23, x3, (arg3[1]), x14);
1796 x23 = arg3[1] ^ ((arg3[1] ^ x14) & x22_selection_mask);
18291797 var x24: u64 = undefined;
1830 cmovznzU64(&x24, x3, (arg3[2]), x16);
1798 x24 = arg3[2] ^ ((arg3[2] ^ x16) & x22_selection_mask);
18311799 var x25: u64 = undefined;
1832 cmovznzU64(&x25, x3, (arg3[3]), x18);
1800 x25 = arg3[3] ^ ((arg3[3] ^ x18) & x22_selection_mask);
18331801 var x26: u64 = undefined;
1834 cmovznzU64(&x26, x3, (arg3[4]), x20);
1802 x26 = arg3[4] ^ ((arg3[4] ^ x20) & x22_selection_mask);
18351803 var x27: u64 = undefined;
1836 cmovznzU64(&x27, x3, (arg4[0]), (arg5[0]));
1804 x27 = arg4[0] ^ ((arg4[0] ^ arg5[0]) & x22_selection_mask);
18371805 var x28: u64 = undefined;
1838 cmovznzU64(&x28, x3, (arg4[1]), (arg5[1]));
1806 x28 = arg4[1] ^ ((arg4[1] ^ arg5[1]) & x22_selection_mask);
18391807 var x29: u64 = undefined;
1840 cmovznzU64(&x29, x3, (arg4[2]), (arg5[2]));
1808 x29 = arg4[2] ^ ((arg4[2] ^ arg5[2]) & x22_selection_mask);
18411809 var x30: u64 = undefined;
1842 cmovznzU64(&x30, x3, (arg4[3]), (arg5[3]));
1810 x30 = arg4[3] ^ ((arg4[3] ^ arg5[3]) & x22_selection_mask);
18431811 var x31: u64 = undefined;
18441812 var x32: u1 = undefined;
18451813 addcarryxU64(&x31, &x32, 0x0, x27, x27);
......@@ -1866,25 +1834,26 @@ pub fn divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *[4]u64, out5: *[
18661834 subborrowxU64(&x45, &x46, x44, x37, 0xffffffff00000000);
18671835 var x47: u64 = undefined;
18681836 var x48: u1 = undefined;
1869 subborrowxU64(&x47, &x48, x46, @as(u64, x38), @as(u64, 0x0));
1870 const x49 = (arg4[3]);
1871 const x50 = (arg4[2]);
1872 const x51 = (arg4[1]);
1873 const x52 = (arg4[0]);
1837 subborrowxU64(&x47, &x48, x46, x38, 0x0);
1838 const x49: u64 = arg4[3];
1839 const x50: u64 = arg4[2];
1840 const x51: u64 = arg4[1];
1841 const x52: u64 = arg4[0];
18741842 var x53: u64 = undefined;
18751843 var x54: u1 = undefined;
1876 subborrowxU64(&x53, &x54, 0x0, @as(u64, 0x0), x52);
1844 subborrowxU64(&x53, &x54, 0x0, 0x0, x52);
18771845 var x55: u64 = undefined;
18781846 var x56: u1 = undefined;
1879 subborrowxU64(&x55, &x56, x54, @as(u64, 0x0), x51);
1847 subborrowxU64(&x55, &x56, x54, 0x0, x51);
18801848 var x57: u64 = undefined;
18811849 var x58: u1 = undefined;
1882 subborrowxU64(&x57, &x58, x56, @as(u64, 0x0), x50);
1850 subborrowxU64(&x57, &x58, x56, 0x0, x50);
18831851 var x59: u64 = undefined;
18841852 var x60: u1 = undefined;
1885 subborrowxU64(&x59, &x60, x58, @as(u64, 0x0), x49);
1853 subborrowxU64(&x59, &x60, x58, 0x0, x49);
18861854 var x61: u64 = undefined;
1887 cmovznzU64(&x61, x60, @as(u64, 0x0), 0xffffffffffffffff);
1855 const x61_selection_mask = selectionMaskU64(x60);
1856 x61 = 0x0 ^ ((0x0 ^ 0xffffffffffffffff) & x61_selection_mask);
18881857 var x62: u64 = undefined;
18891858 var x63: u1 = undefined;
18901859 addcarryxU64(&x62, &x63, 0x0, x53, (x61 & 0xf3b9cac2fc632551));
......@@ -1898,24 +1867,26 @@ pub fn divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *[4]u64, out5: *[
18981867 var x69: u1 = undefined;
18991868 addcarryxU64(&x68, &x69, x67, x59, (x61 & 0xffffffff00000000));
19001869 var x70: u64 = undefined;
1901 cmovznzU64(&x70, x3, (arg5[0]), x62);
1870 const x70_selection_mask = selectionMaskU64(x3);
1871 x70 = arg5[0] ^ ((arg5[0] ^ x62) & x70_selection_mask);
19021872 var x71: u64 = undefined;
1903 cmovznzU64(&x71, x3, (arg5[1]), x64);
1873 x71 = arg5[1] ^ ((arg5[1] ^ x64) & x70_selection_mask);
19041874 var x72: u64 = undefined;
1905 cmovznzU64(&x72, x3, (arg5[2]), x66);
1875 x72 = arg5[2] ^ ((arg5[2] ^ x66) & x70_selection_mask);
19061876 var x73: u64 = undefined;
1907 cmovznzU64(&x73, x3, (arg5[3]), x68);
1908 const x74 = @as(u1, @truncate((x22 & @as(u64, 0x1))));
1877 x73 = arg5[3] ^ ((arg5[3] ^ x68) & x70_selection_mask);
1878 const x74: u1 = @truncate(x22);
19091879 var x75: u64 = undefined;
1910 cmovznzU64(&x75, x74, @as(u64, 0x0), x7);
1880 const x75_selection_mask = selectionMaskU64(x74);
1881 x75 = 0x0 ^ ((0x0 ^ x7) & x75_selection_mask);
19111882 var x76: u64 = undefined;
1912 cmovznzU64(&x76, x74, @as(u64, 0x0), x8);
1883 x76 = 0x0 ^ ((0x0 ^ x8) & x75_selection_mask);
19131884 var x77: u64 = undefined;
1914 cmovznzU64(&x77, x74, @as(u64, 0x0), x9);
1885 x77 = 0x0 ^ ((0x0 ^ x9) & x75_selection_mask);
19151886 var x78: u64 = undefined;
1916 cmovznzU64(&x78, x74, @as(u64, 0x0), x10);
1887 x78 = 0x0 ^ ((0x0 ^ x10) & x75_selection_mask);
19171888 var x79: u64 = undefined;
1918 cmovznzU64(&x79, x74, @as(u64, 0x0), x11);
1889 x79 = 0x0 ^ ((0x0 ^ x11) & x75_selection_mask);
19191890 var x80: u64 = undefined;
19201891 var x81: u1 = undefined;
19211892 addcarryxU64(&x80, &x81, 0x0, x22, x75);
......@@ -1932,13 +1903,14 @@ pub fn divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *[4]u64, out5: *[
19321903 var x89: u1 = undefined;
19331904 addcarryxU64(&x88, &x89, x87, x26, x79);
19341905 var x90: u64 = undefined;
1935 cmovznzU64(&x90, x74, @as(u64, 0x0), x27);
1906 const x90_selection_mask = selectionMaskU64(x74);
1907 x90 = 0x0 ^ ((0x0 ^ x27) & x90_selection_mask);
19361908 var x91: u64 = undefined;
1937 cmovznzU64(&x91, x74, @as(u64, 0x0), x28);
1909 x91 = 0x0 ^ ((0x0 ^ x28) & x90_selection_mask);
19381910 var x92: u64 = undefined;
1939 cmovznzU64(&x92, x74, @as(u64, 0x0), x29);
1911 x92 = 0x0 ^ ((0x0 ^ x29) & x90_selection_mask);
19401912 var x93: u64 = undefined;
1941 cmovznzU64(&x93, x74, @as(u64, 0x0), x30);
1913 x93 = 0x0 ^ ((0x0 ^ x30) & x90_selection_mask);
19421914 var x94: u64 = undefined;
19431915 var x95: u1 = undefined;
19441916 addcarryxU64(&x94, &x95, 0x0, x70, x90);
......@@ -1965,31 +1937,33 @@ pub fn divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *[4]u64, out5: *[
19651937 subborrowxU64(&x108, &x109, x107, x100, 0xffffffff00000000);
19661938 var x110: u64 = undefined;
19671939 var x111: u1 = undefined;
1968 subborrowxU64(&x110, &x111, x109, @as(u64, x101), @as(u64, 0x0));
1940 subborrowxU64(&x110, &x111, x109, x101, 0x0);
19691941 var x112: u64 = undefined;
19701942 var x113: u1 = undefined;
1971 addcarryxU64(&x112, &x113, 0x0, x6, @as(u64, 0x1));
1972 const x114 = ((x80 >> 1) | ((x82 << 63) & 0xffffffffffffffff));
1973 const x115 = ((x82 >> 1) | ((x84 << 63) & 0xffffffffffffffff));
1974 const x116 = ((x84 >> 1) | ((x86 << 63) & 0xffffffffffffffff));
1975 const x117 = ((x86 >> 1) | ((x88 << 63) & 0xffffffffffffffff));
1976 const x118 = ((x88 & 0x8000000000000000) | (x88 >> 1));
1943 addcarryxU64(&x112, &x113, 0x0, x6, 0x1);
1944 const x114: u64 = ((x80 >> 1) | ((x82 << 63) & 0xffffffffffffffff));
1945 const x115: u64 = ((x82 >> 1) | ((x84 << 63) & 0xffffffffffffffff));
1946 const x116: u64 = ((x84 >> 1) | ((x86 << 63) & 0xffffffffffffffff));
1947 const x117: u64 = ((x86 >> 1) | ((x88 << 63) & 0xffffffffffffffff));
1948 const x118: u64 = ((x88 & 0x8000000000000000) | (x88 >> 1));
19771949 var x119: u64 = undefined;
1978 cmovznzU64(&x119, x48, x39, x31);
1950 const x119_selection_mask = selectionMaskU64(x48);
1951 x119 = x39 ^ ((x39 ^ x31) & x119_selection_mask);
19791952 var x120: u64 = undefined;
1980 cmovznzU64(&x120, x48, x41, x33);
1953 x120 = x41 ^ ((x41 ^ x33) & x119_selection_mask);
19811954 var x121: u64 = undefined;
1982 cmovznzU64(&x121, x48, x43, x35);
1955 x121 = x43 ^ ((x43 ^ x35) & x119_selection_mask);
19831956 var x122: u64 = undefined;
1984 cmovznzU64(&x122, x48, x45, x37);
1957 x122 = x45 ^ ((x45 ^ x37) & x119_selection_mask);
19851958 var x123: u64 = undefined;
1986 cmovznzU64(&x123, x111, x102, x94);
1959 const x123_selection_mask = selectionMaskU64(x111);
1960 x123 = x102 ^ ((x102 ^ x94) & x123_selection_mask);
19871961 var x124: u64 = undefined;
1988 cmovznzU64(&x124, x111, x104, x96);
1962 x124 = x104 ^ ((x104 ^ x96) & x123_selection_mask);
19891963 var x125: u64 = undefined;
1990 cmovznzU64(&x125, x111, x106, x98);
1964 x125 = x106 ^ ((x106 ^ x98) & x123_selection_mask);
19911965 var x126: u64 = undefined;
1992 cmovznzU64(&x126, x111, x108, x100);
1966 x126 = x108 ^ ((x108 ^ x100) & x123_selection_mask);
19931967 out1.* = x112;
19941968 out2[0] = x7;
19951969 out2[1] = x8;
lib/std/crypto/pcurves/p384/p384_64.zig+533-528
......@@ -17,7 +17,6 @@
1717// twos_complement_eval z = let x1 := z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) + (z[4] << 256) + (z[5] << 0x140) in
1818// if x1 & (2^384-1) < 2^383 then x1 & (2^384-1) else (x1 & (2^384-1)) - 2^384
1919
20const std = @import("std");
2120const mode = @import("builtin").mode; // Checked arithmetic is disabled in non-debug modes to avoid side channels
2221
2322// The type MontgomeryDomainFieldElement is a field element in the Montgomery domain.
......@@ -28,80 +27,70 @@ pub const MontgomeryDomainFieldElement = [6]u64;
2827// Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
2928pub const NonMontgomeryDomainFieldElement = [6]u64;
3029
31/// The function addcarryxU64 is an addition with carry.
32///
33/// Postconditions:
34/// out1 = (arg1 + arg2 + arg3) mod 2^64
35/// out2 = ⌊(arg1 + arg2 + arg3) / 2^64⌋
36///
37/// Input Bounds:
38/// arg1: [0x0 ~> 0x1]
39/// arg2: [0x0 ~> 0xffffffffffffffff]
40/// arg3: [0x0 ~> 0xffffffffffffffff]
41/// Output Bounds:
42/// out1: [0x0 ~> 0xffffffffffffffff]
43/// out2: [0x0 ~> 0x1]
30/// Add two limbs and a carry bit, returning the sum modulo 2^64 and the carry bit.
4431fn addcarryxU64(out1: *u64, out2: *u1, arg1: u1, arg2: u64, arg3: u64) void {
45 const x = @as(u128, arg2) +% arg3 +% arg1;
46 out1.* = @truncate(x);
47 out2.* = @truncate(x >> 64);
32 @setRuntimeSafety(mode == .debug);
33
34 const x = @addWithOverflow(arg2, arg3);
35 const y = @addWithOverflow(x[0], arg1);
36 out1.* = y[0];
37 out2.* = x[1] | y[1];
4838}
4939
50/// The function subborrowxU64 is a subtraction with borrow.
51///
52/// Postconditions:
53/// out1 = (-arg1 + arg2 + -arg3) mod 2^64
54/// out2 = -⌊(-arg1 + arg2 + -arg3) / 2^64⌋
55///
56/// Input Bounds:
57/// arg1: [0x0 ~> 0x1]
58/// arg2: [0x0 ~> 0xffffffffffffffff]
59/// arg3: [0x0 ~> 0xffffffffffffffff]
60/// Output Bounds:
61/// out1: [0x0 ~> 0xffffffffffffffff]
62/// out2: [0x0 ~> 0x1]
40/// Subtract two limbs and a borrow bit, returning the difference modulo 2^64 and the borrow bit.
6341fn subborrowxU64(out1: *u64, out2: *u1, arg1: u1, arg2: u64, arg3: u64) void {
64 const x = @as(u128, arg2) -% arg3 -% arg1;
65 out1.* = @truncate(x);
66 out2.* = @truncate(x >> 64);
42 @setRuntimeSafety(mode == .debug);
43
44 const x = @subWithOverflow(arg2, arg3);
45 const y = @subWithOverflow(x[0], arg1);
46 out1.* = y[0];
47 out2.* = x[1] | y[1];
6748}
6849
69/// The function mulxU64 is a multiplication, returning the full double-width result.
70///
71/// Postconditions:
72/// out1 = (arg1 * arg2) mod 2^64
73/// out2 = ⌊arg1 * arg2 / 2^64⌋
74///
75/// Input Bounds:
76/// arg1: [0x0 ~> 0xffffffffffffffff]
77/// arg2: [0x0 ~> 0xffffffffffffffff]
78/// Output Bounds:
79/// out1: [0x0 ~> 0xffffffffffffffff]
80/// out2: [0x0 ~> 0xffffffffffffffff]
50/// Multiply two limbs, returning the low and high halves of the product.
8151fn mulxU64(out1: *u64, out2: *u64, arg1: u64, arg2: u64) void {
8252 @setRuntimeSafety(mode == .debug);
8353
84 const x = @as(u128, arg1) * @as(u128, arg2);
85 out1.* = @as(u64, @truncate(x));
86 out2.* = @as(u64, @truncate(x >> 64));
54 const x = @as(u128, arg1) * arg2;
55 out1.* = @truncate(x);
56 out2.* = @intCast(x >> 64);
8757}
8858
89/// The function cmovznzU64 is a single-word conditional move.
90///
91/// Postconditions:
92/// out1 = (if arg1 = 0 then arg2 else arg3)
93///
94/// Input Bounds:
95/// arg1: [0x0 ~> 0x1]
96/// arg2: [0x0 ~> 0xffffffffffffffff]
97/// arg3: [0x0 ~> 0xffffffffffffffff]
98/// Output Bounds:
99/// out1: [0x0 ~> 0xffffffffffffffff]
59/// Keep selection masks opaque to the optimizer without adding instructions.
60fn selectionMaskU64(arg1: u1) u64 {
61 @setRuntimeSafety(mode == .debug);
62
63 const value: u64 = 0 -% @as(u64, arg1);
64 if (@inComptime()) return value;
65 switch (@import("builtin").zig_backend) {
66 .stage2_c, .stage2_wasm => return value,
67 else => {},
68 }
69 if (@bitSizeOf(u64) <= @bitSizeOf(usize)) {
70 return asm (""
71 : [mask] "=r" (-> u64),
72 : [value] "0" (value),
73 );
74 }
75 var mask: u64 = 0;
76 inline for (0..@divExact(@bitSizeOf(u64), @bitSizeOf(usize))) |i| {
77 const shift = i * @bitSizeOf(usize);
78 const chunk: usize = @truncate(value >> shift);
79 const part = asm (""
80 : [mask] "=r" (-> usize),
81 : [value] "0" (chunk),
82 );
83 mask |= @as(u64, part) << shift;
84 }
85 return mask;
86}
87
88/// Select arg2 when arg1 is zero and arg3 otherwise, using a bit mask.
10089fn cmovznzU64(out1: *u64, arg1: u1, arg2: u64, arg3: u64) void {
10190 @setRuntimeSafety(mode == .debug);
10291
103 const mask = 0 -% @as(u64, arg1);
104 out1.* = (mask & arg3) | ((~mask) & arg2);
92 const mask = selectionMaskU64(arg1);
93 out1.* = arg2 ^ ((arg2 ^ arg3) & mask);
10594}
10695
10796/// The function mul multiplies two field elements in the Montgomery domain.
......@@ -116,30 +105,30 @@ fn cmovznzU64(out1: *u64, arg1: u1, arg2: u64, arg3: u64) void {
116105pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldElement, arg2: MontgomeryDomainFieldElement) void {
117106 @setRuntimeSafety(mode == .debug);
118107
119 const x1 = (arg1[1]);
120 const x2 = (arg1[2]);
121 const x3 = (arg1[3]);
122 const x4 = (arg1[4]);
123 const x5 = (arg1[5]);
124 const x6 = (arg1[0]);
108 const x1: u64 = arg1[1];
109 const x2: u64 = arg1[2];
110 const x3: u64 = arg1[3];
111 const x4: u64 = arg1[4];
112 const x5: u64 = arg1[5];
113 const x6: u64 = arg1[0];
125114 var x7: u64 = undefined;
126115 var x8: u64 = undefined;
127 mulxU64(&x7, &x8, x6, (arg2[5]));
116 mulxU64(&x7, &x8, x6, arg2[5]);
128117 var x9: u64 = undefined;
129118 var x10: u64 = undefined;
130 mulxU64(&x9, &x10, x6, (arg2[4]));
119 mulxU64(&x9, &x10, x6, arg2[4]);
131120 var x11: u64 = undefined;
132121 var x12: u64 = undefined;
133 mulxU64(&x11, &x12, x6, (arg2[3]));
122 mulxU64(&x11, &x12, x6, arg2[3]);
134123 var x13: u64 = undefined;
135124 var x14: u64 = undefined;
136 mulxU64(&x13, &x14, x6, (arg2[2]));
125 mulxU64(&x13, &x14, x6, arg2[2]);
137126 var x15: u64 = undefined;
138127 var x16: u64 = undefined;
139 mulxU64(&x15, &x16, x6, (arg2[1]));
128 mulxU64(&x15, &x16, x6, arg2[1]);
140129 var x17: u64 = undefined;
141130 var x18: u64 = undefined;
142 mulxU64(&x17, &x18, x6, (arg2[0]));
131 mulxU64(&x17, &x18, x6, arg2[0]);
143132 var x19: u64 = undefined;
144133 var x20: u1 = undefined;
145134 addcarryxU64(&x19, &x20, 0x0, x18, x15);
......@@ -155,7 +144,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
155144 var x27: u64 = undefined;
156145 var x28: u1 = undefined;
157146 addcarryxU64(&x27, &x28, x26, x10, x7);
158 const x29 = (@as(u64, x28) + x8);
147 const x29: u64 = (x28 + x8);
159148 var x30: u64 = undefined;
160149 var x31: u64 = undefined;
161150 mulxU64(&x30, &x31, x17, 0x100000001);
......@@ -192,7 +181,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
192181 var x52: u64 = undefined;
193182 var x53: u1 = undefined;
194183 addcarryxU64(&x52, &x53, x51, x35, x32);
195 const x54 = (@as(u64, x53) + x33);
184 const x54: u64 = (x53 + x33);
196185 var x55: u64 = undefined;
197186 var x56: u1 = undefined;
198187 addcarryxU64(&x55, &x56, 0x0, x17, x42);
......@@ -216,22 +205,22 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
216205 addcarryxU64(&x67, &x68, x66, x29, x54);
217206 var x69: u64 = undefined;
218207 var x70: u64 = undefined;
219 mulxU64(&x69, &x70, x1, (arg2[5]));
208 mulxU64(&x69, &x70, x1, arg2[5]);
220209 var x71: u64 = undefined;
221210 var x72: u64 = undefined;
222 mulxU64(&x71, &x72, x1, (arg2[4]));
211 mulxU64(&x71, &x72, x1, arg2[4]);
223212 var x73: u64 = undefined;
224213 var x74: u64 = undefined;
225 mulxU64(&x73, &x74, x1, (arg2[3]));
214 mulxU64(&x73, &x74, x1, arg2[3]);
226215 var x75: u64 = undefined;
227216 var x76: u64 = undefined;
228 mulxU64(&x75, &x76, x1, (arg2[2]));
217 mulxU64(&x75, &x76, x1, arg2[2]);
229218 var x77: u64 = undefined;
230219 var x78: u64 = undefined;
231 mulxU64(&x77, &x78, x1, (arg2[1]));
220 mulxU64(&x77, &x78, x1, arg2[1]);
232221 var x79: u64 = undefined;
233222 var x80: u64 = undefined;
234 mulxU64(&x79, &x80, x1, (arg2[0]));
223 mulxU64(&x79, &x80, x1, arg2[0]);
235224 var x81: u64 = undefined;
236225 var x82: u1 = undefined;
237226 addcarryxU64(&x81, &x82, 0x0, x80, x77);
......@@ -247,7 +236,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
247236 var x89: u64 = undefined;
248237 var x90: u1 = undefined;
249238 addcarryxU64(&x89, &x90, x88, x72, x69);
250 const x91 = (@as(u64, x90) + x70);
239 const x91: u64 = (x90 + x70);
251240 var x92: u64 = undefined;
252241 var x93: u1 = undefined;
253242 addcarryxU64(&x92, &x93, 0x0, x57, x79);
......@@ -268,7 +257,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
268257 addcarryxU64(&x102, &x103, x101, x67, x89);
269258 var x104: u64 = undefined;
270259 var x105: u1 = undefined;
271 addcarryxU64(&x104, &x105, x103, @as(u64, x68), x91);
260 addcarryxU64(&x104, &x105, x103, x68, x91);
272261 var x106: u64 = undefined;
273262 var x107: u64 = undefined;
274263 mulxU64(&x106, &x107, x92, 0x100000001);
......@@ -305,7 +294,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
305294 var x128: u64 = undefined;
306295 var x129: u1 = undefined;
307296 addcarryxU64(&x128, &x129, x127, x111, x108);
308 const x130 = (@as(u64, x129) + x109);
297 const x130: u64 = (x129 + x109);
309298 var x131: u64 = undefined;
310299 var x132: u1 = undefined;
311300 addcarryxU64(&x131, &x132, 0x0, x92, x118);
......@@ -327,25 +316,25 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
327316 var x143: u64 = undefined;
328317 var x144: u1 = undefined;
329318 addcarryxU64(&x143, &x144, x142, x104, x130);
330 const x145 = (@as(u64, x144) + @as(u64, x105));
319 const x145: u64 = (@as(u64, x144) + x105);
331320 var x146: u64 = undefined;
332321 var x147: u64 = undefined;
333 mulxU64(&x146, &x147, x2, (arg2[5]));
322 mulxU64(&x146, &x147, x2, arg2[5]);
334323 var x148: u64 = undefined;
335324 var x149: u64 = undefined;
336 mulxU64(&x148, &x149, x2, (arg2[4]));
325 mulxU64(&x148, &x149, x2, arg2[4]);
337326 var x150: u64 = undefined;
338327 var x151: u64 = undefined;
339 mulxU64(&x150, &x151, x2, (arg2[3]));
328 mulxU64(&x150, &x151, x2, arg2[3]);
340329 var x152: u64 = undefined;
341330 var x153: u64 = undefined;
342 mulxU64(&x152, &x153, x2, (arg2[2]));
331 mulxU64(&x152, &x153, x2, arg2[2]);
343332 var x154: u64 = undefined;
344333 var x155: u64 = undefined;
345 mulxU64(&x154, &x155, x2, (arg2[1]));
334 mulxU64(&x154, &x155, x2, arg2[1]);
346335 var x156: u64 = undefined;
347336 var x157: u64 = undefined;
348 mulxU64(&x156, &x157, x2, (arg2[0]));
337 mulxU64(&x156, &x157, x2, arg2[0]);
349338 var x158: u64 = undefined;
350339 var x159: u1 = undefined;
351340 addcarryxU64(&x158, &x159, 0x0, x157, x154);
......@@ -361,7 +350,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
361350 var x166: u64 = undefined;
362351 var x167: u1 = undefined;
363352 addcarryxU64(&x166, &x167, x165, x149, x146);
364 const x168 = (@as(u64, x167) + x147);
353 const x168: u64 = (x167 + x147);
365354 var x169: u64 = undefined;
366355 var x170: u1 = undefined;
367356 addcarryxU64(&x169, &x170, 0x0, x133, x156);
......@@ -419,7 +408,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
419408 var x205: u64 = undefined;
420409 var x206: u1 = undefined;
421410 addcarryxU64(&x205, &x206, x204, x188, x185);
422 const x207 = (@as(u64, x206) + x186);
411 const x207: u64 = (x206 + x186);
423412 var x208: u64 = undefined;
424413 var x209: u1 = undefined;
425414 addcarryxU64(&x208, &x209, 0x0, x169, x195);
......@@ -441,25 +430,25 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
441430 var x220: u64 = undefined;
442431 var x221: u1 = undefined;
443432 addcarryxU64(&x220, &x221, x219, x181, x207);
444 const x222 = (@as(u64, x221) + @as(u64, x182));
433 const x222: u64 = (@as(u64, x221) + x182);
445434 var x223: u64 = undefined;
446435 var x224: u64 = undefined;
447 mulxU64(&x223, &x224, x3, (arg2[5]));
436 mulxU64(&x223, &x224, x3, arg2[5]);
448437 var x225: u64 = undefined;
449438 var x226: u64 = undefined;
450 mulxU64(&x225, &x226, x3, (arg2[4]));
439 mulxU64(&x225, &x226, x3, arg2[4]);
451440 var x227: u64 = undefined;
452441 var x228: u64 = undefined;
453 mulxU64(&x227, &x228, x3, (arg2[3]));
442 mulxU64(&x227, &x228, x3, arg2[3]);
454443 var x229: u64 = undefined;
455444 var x230: u64 = undefined;
456 mulxU64(&x229, &x230, x3, (arg2[2]));
445 mulxU64(&x229, &x230, x3, arg2[2]);
457446 var x231: u64 = undefined;
458447 var x232: u64 = undefined;
459 mulxU64(&x231, &x232, x3, (arg2[1]));
448 mulxU64(&x231, &x232, x3, arg2[1]);
460449 var x233: u64 = undefined;
461450 var x234: u64 = undefined;
462 mulxU64(&x233, &x234, x3, (arg2[0]));
451 mulxU64(&x233, &x234, x3, arg2[0]);
463452 var x235: u64 = undefined;
464453 var x236: u1 = undefined;
465454 addcarryxU64(&x235, &x236, 0x0, x234, x231);
......@@ -475,7 +464,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
475464 var x243: u64 = undefined;
476465 var x244: u1 = undefined;
477466 addcarryxU64(&x243, &x244, x242, x226, x223);
478 const x245 = (@as(u64, x244) + x224);
467 const x245: u64 = (x244 + x224);
479468 var x246: u64 = undefined;
480469 var x247: u1 = undefined;
481470 addcarryxU64(&x246, &x247, 0x0, x210, x233);
......@@ -533,7 +522,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
533522 var x282: u64 = undefined;
534523 var x283: u1 = undefined;
535524 addcarryxU64(&x282, &x283, x281, x265, x262);
536 const x284 = (@as(u64, x283) + x263);
525 const x284: u64 = (x283 + x263);
537526 var x285: u64 = undefined;
538527 var x286: u1 = undefined;
539528 addcarryxU64(&x285, &x286, 0x0, x246, x272);
......@@ -555,25 +544,25 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
555544 var x297: u64 = undefined;
556545 var x298: u1 = undefined;
557546 addcarryxU64(&x297, &x298, x296, x258, x284);
558 const x299 = (@as(u64, x298) + @as(u64, x259));
547 const x299: u64 = (@as(u64, x298) + x259);
559548 var x300: u64 = undefined;
560549 var x301: u64 = undefined;
561 mulxU64(&x300, &x301, x4, (arg2[5]));
550 mulxU64(&x300, &x301, x4, arg2[5]);
562551 var x302: u64 = undefined;
563552 var x303: u64 = undefined;
564 mulxU64(&x302, &x303, x4, (arg2[4]));
553 mulxU64(&x302, &x303, x4, arg2[4]);
565554 var x304: u64 = undefined;
566555 var x305: u64 = undefined;
567 mulxU64(&x304, &x305, x4, (arg2[3]));
556 mulxU64(&x304, &x305, x4, arg2[3]);
568557 var x306: u64 = undefined;
569558 var x307: u64 = undefined;
570 mulxU64(&x306, &x307, x4, (arg2[2]));
559 mulxU64(&x306, &x307, x4, arg2[2]);
571560 var x308: u64 = undefined;
572561 var x309: u64 = undefined;
573 mulxU64(&x308, &x309, x4, (arg2[1]));
562 mulxU64(&x308, &x309, x4, arg2[1]);
574563 var x310: u64 = undefined;
575564 var x311: u64 = undefined;
576 mulxU64(&x310, &x311, x4, (arg2[0]));
565 mulxU64(&x310, &x311, x4, arg2[0]);
577566 var x312: u64 = undefined;
578567 var x313: u1 = undefined;
579568 addcarryxU64(&x312, &x313, 0x0, x311, x308);
......@@ -589,7 +578,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
589578 var x320: u64 = undefined;
590579 var x321: u1 = undefined;
591580 addcarryxU64(&x320, &x321, x319, x303, x300);
592 const x322 = (@as(u64, x321) + x301);
581 const x322: u64 = (x321 + x301);
593582 var x323: u64 = undefined;
594583 var x324: u1 = undefined;
595584 addcarryxU64(&x323, &x324, 0x0, x287, x310);
......@@ -647,7 +636,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
647636 var x359: u64 = undefined;
648637 var x360: u1 = undefined;
649638 addcarryxU64(&x359, &x360, x358, x342, x339);
650 const x361 = (@as(u64, x360) + x340);
639 const x361: u64 = (x360 + x340);
651640 var x362: u64 = undefined;
652641 var x363: u1 = undefined;
653642 addcarryxU64(&x362, &x363, 0x0, x323, x349);
......@@ -669,25 +658,25 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
669658 var x374: u64 = undefined;
670659 var x375: u1 = undefined;
671660 addcarryxU64(&x374, &x375, x373, x335, x361);
672 const x376 = (@as(u64, x375) + @as(u64, x336));
661 const x376: u64 = (@as(u64, x375) + x336);
673662 var x377: u64 = undefined;
674663 var x378: u64 = undefined;
675 mulxU64(&x377, &x378, x5, (arg2[5]));
664 mulxU64(&x377, &x378, x5, arg2[5]);
676665 var x379: u64 = undefined;
677666 var x380: u64 = undefined;
678 mulxU64(&x379, &x380, x5, (arg2[4]));
667 mulxU64(&x379, &x380, x5, arg2[4]);
679668 var x381: u64 = undefined;
680669 var x382: u64 = undefined;
681 mulxU64(&x381, &x382, x5, (arg2[3]));
670 mulxU64(&x381, &x382, x5, arg2[3]);
682671 var x383: u64 = undefined;
683672 var x384: u64 = undefined;
684 mulxU64(&x383, &x384, x5, (arg2[2]));
673 mulxU64(&x383, &x384, x5, arg2[2]);
685674 var x385: u64 = undefined;
686675 var x386: u64 = undefined;
687 mulxU64(&x385, &x386, x5, (arg2[1]));
676 mulxU64(&x385, &x386, x5, arg2[1]);
688677 var x387: u64 = undefined;
689678 var x388: u64 = undefined;
690 mulxU64(&x387, &x388, x5, (arg2[0]));
679 mulxU64(&x387, &x388, x5, arg2[0]);
691680 var x389: u64 = undefined;
692681 var x390: u1 = undefined;
693682 addcarryxU64(&x389, &x390, 0x0, x388, x385);
......@@ -703,7 +692,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
703692 var x397: u64 = undefined;
704693 var x398: u1 = undefined;
705694 addcarryxU64(&x397, &x398, x396, x380, x377);
706 const x399 = (@as(u64, x398) + x378);
695 const x399: u64 = (x398 + x378);
707696 var x400: u64 = undefined;
708697 var x401: u1 = undefined;
709698 addcarryxU64(&x400, &x401, 0x0, x364, x387);
......@@ -761,7 +750,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
761750 var x436: u64 = undefined;
762751 var x437: u1 = undefined;
763752 addcarryxU64(&x436, &x437, x435, x419, x416);
764 const x438 = (@as(u64, x437) + x417);
753 const x438: u64 = (x437 + x417);
765754 var x439: u64 = undefined;
766755 var x440: u1 = undefined;
767756 addcarryxU64(&x439, &x440, 0x0, x400, x426);
......@@ -783,7 +772,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
783772 var x451: u64 = undefined;
784773 var x452: u1 = undefined;
785774 addcarryxU64(&x451, &x452, x450, x412, x438);
786 const x453 = (@as(u64, x452) + @as(u64, x413));
775 const x453: u64 = (@as(u64, x452) + x413);
787776 var x454: u64 = undefined;
788777 var x455: u1 = undefined;
789778 subborrowxU64(&x454, &x455, 0x0, x441, 0xffffffff);
......@@ -806,17 +795,18 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
806795 var x467: u1 = undefined;
807796 subborrowxU64(&x466, &x467, x465, x453, 0x0);
808797 var x468: u64 = undefined;
809 cmovznzU64(&x468, x467, x454, x441);
798 const x468_selection_mask = selectionMaskU64(x467);
799 x468 = x454 ^ ((x454 ^ x441) & x468_selection_mask);
810800 var x469: u64 = undefined;
811 cmovznzU64(&x469, x467, x456, x443);
801 x469 = x456 ^ ((x456 ^ x443) & x468_selection_mask);
812802 var x470: u64 = undefined;
813 cmovznzU64(&x470, x467, x458, x445);
803 x470 = x458 ^ ((x458 ^ x445) & x468_selection_mask);
814804 var x471: u64 = undefined;
815 cmovznzU64(&x471, x467, x460, x447);
805 x471 = x460 ^ ((x460 ^ x447) & x468_selection_mask);
816806 var x472: u64 = undefined;
817 cmovznzU64(&x472, x467, x462, x449);
807 x472 = x462 ^ ((x462 ^ x449) & x468_selection_mask);
818808 var x473: u64 = undefined;
819 cmovznzU64(&x473, x467, x464, x451);
809 x473 = x464 ^ ((x464 ^ x451) & x468_selection_mask);
820810 out1[0] = x468;
821811 out1[1] = x469;
822812 out1[2] = x470;
......@@ -836,30 +826,30 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
836826pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldElement) void {
837827 @setRuntimeSafety(mode == .debug);
838828
839 const x1 = (arg1[1]);
840 const x2 = (arg1[2]);
841 const x3 = (arg1[3]);
842 const x4 = (arg1[4]);
843 const x5 = (arg1[5]);
844 const x6 = (arg1[0]);
829 const x1: u64 = arg1[1];
830 const x2: u64 = arg1[2];
831 const x3: u64 = arg1[3];
832 const x4: u64 = arg1[4];
833 const x5: u64 = arg1[5];
834 const x6: u64 = arg1[0];
845835 var x7: u64 = undefined;
846836 var x8: u64 = undefined;
847 mulxU64(&x7, &x8, x6, (arg1[5]));
837 mulxU64(&x7, &x8, x6, arg1[5]);
848838 var x9: u64 = undefined;
849839 var x10: u64 = undefined;
850 mulxU64(&x9, &x10, x6, (arg1[4]));
840 mulxU64(&x9, &x10, x6, arg1[4]);
851841 var x11: u64 = undefined;
852842 var x12: u64 = undefined;
853 mulxU64(&x11, &x12, x6, (arg1[3]));
843 mulxU64(&x11, &x12, x6, arg1[3]);
854844 var x13: u64 = undefined;
855845 var x14: u64 = undefined;
856 mulxU64(&x13, &x14, x6, (arg1[2]));
846 mulxU64(&x13, &x14, x6, arg1[2]);
857847 var x15: u64 = undefined;
858848 var x16: u64 = undefined;
859 mulxU64(&x15, &x16, x6, (arg1[1]));
849 mulxU64(&x15, &x16, x6, arg1[1]);
860850 var x17: u64 = undefined;
861851 var x18: u64 = undefined;
862 mulxU64(&x17, &x18, x6, (arg1[0]));
852 mulxU64(&x17, &x18, x6, arg1[0]);
863853 var x19: u64 = undefined;
864854 var x20: u1 = undefined;
865855 addcarryxU64(&x19, &x20, 0x0, x18, x15);
......@@ -875,7 +865,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
875865 var x27: u64 = undefined;
876866 var x28: u1 = undefined;
877867 addcarryxU64(&x27, &x28, x26, x10, x7);
878 const x29 = (@as(u64, x28) + x8);
868 const x29: u64 = (x28 + x8);
879869 var x30: u64 = undefined;
880870 var x31: u64 = undefined;
881871 mulxU64(&x30, &x31, x17, 0x100000001);
......@@ -912,7 +902,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
912902 var x52: u64 = undefined;
913903 var x53: u1 = undefined;
914904 addcarryxU64(&x52, &x53, x51, x35, x32);
915 const x54 = (@as(u64, x53) + x33);
905 const x54: u64 = (x53 + x33);
916906 var x55: u64 = undefined;
917907 var x56: u1 = undefined;
918908 addcarryxU64(&x55, &x56, 0x0, x17, x42);
......@@ -936,22 +926,22 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
936926 addcarryxU64(&x67, &x68, x66, x29, x54);
937927 var x69: u64 = undefined;
938928 var x70: u64 = undefined;
939 mulxU64(&x69, &x70, x1, (arg1[5]));
929 mulxU64(&x69, &x70, x1, arg1[5]);
940930 var x71: u64 = undefined;
941931 var x72: u64 = undefined;
942 mulxU64(&x71, &x72, x1, (arg1[4]));
932 mulxU64(&x71, &x72, x1, arg1[4]);
943933 var x73: u64 = undefined;
944934 var x74: u64 = undefined;
945 mulxU64(&x73, &x74, x1, (arg1[3]));
935 mulxU64(&x73, &x74, x1, arg1[3]);
946936 var x75: u64 = undefined;
947937 var x76: u64 = undefined;
948 mulxU64(&x75, &x76, x1, (arg1[2]));
938 mulxU64(&x75, &x76, x1, arg1[2]);
949939 var x77: u64 = undefined;
950940 var x78: u64 = undefined;
951 mulxU64(&x77, &x78, x1, (arg1[1]));
941 mulxU64(&x77, &x78, x1, arg1[1]);
952942 var x79: u64 = undefined;
953943 var x80: u64 = undefined;
954 mulxU64(&x79, &x80, x1, (arg1[0]));
944 mulxU64(&x79, &x80, x1, arg1[0]);
955945 var x81: u64 = undefined;
956946 var x82: u1 = undefined;
957947 addcarryxU64(&x81, &x82, 0x0, x80, x77);
......@@ -967,7 +957,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
967957 var x89: u64 = undefined;
968958 var x90: u1 = undefined;
969959 addcarryxU64(&x89, &x90, x88, x72, x69);
970 const x91 = (@as(u64, x90) + x70);
960 const x91: u64 = (x90 + x70);
971961 var x92: u64 = undefined;
972962 var x93: u1 = undefined;
973963 addcarryxU64(&x92, &x93, 0x0, x57, x79);
......@@ -988,7 +978,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
988978 addcarryxU64(&x102, &x103, x101, x67, x89);
989979 var x104: u64 = undefined;
990980 var x105: u1 = undefined;
991 addcarryxU64(&x104, &x105, x103, @as(u64, x68), x91);
981 addcarryxU64(&x104, &x105, x103, x68, x91);
992982 var x106: u64 = undefined;
993983 var x107: u64 = undefined;
994984 mulxU64(&x106, &x107, x92, 0x100000001);
......@@ -1025,7 +1015,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
10251015 var x128: u64 = undefined;
10261016 var x129: u1 = undefined;
10271017 addcarryxU64(&x128, &x129, x127, x111, x108);
1028 const x130 = (@as(u64, x129) + x109);
1018 const x130: u64 = (x129 + x109);
10291019 var x131: u64 = undefined;
10301020 var x132: u1 = undefined;
10311021 addcarryxU64(&x131, &x132, 0x0, x92, x118);
......@@ -1047,25 +1037,25 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
10471037 var x143: u64 = undefined;
10481038 var x144: u1 = undefined;
10491039 addcarryxU64(&x143, &x144, x142, x104, x130);
1050 const x145 = (@as(u64, x144) + @as(u64, x105));
1040 const x145: u64 = (@as(u64, x144) + x105);
10511041 var x146: u64 = undefined;
10521042 var x147: u64 = undefined;
1053 mulxU64(&x146, &x147, x2, (arg1[5]));
1043 mulxU64(&x146, &x147, x2, arg1[5]);
10541044 var x148: u64 = undefined;
10551045 var x149: u64 = undefined;
1056 mulxU64(&x148, &x149, x2, (arg1[4]));
1046 mulxU64(&x148, &x149, x2, arg1[4]);
10571047 var x150: u64 = undefined;
10581048 var x151: u64 = undefined;
1059 mulxU64(&x150, &x151, x2, (arg1[3]));
1049 mulxU64(&x150, &x151, x2, arg1[3]);
10601050 var x152: u64 = undefined;
10611051 var x153: u64 = undefined;
1062 mulxU64(&x152, &x153, x2, (arg1[2]));
1052 mulxU64(&x152, &x153, x2, arg1[2]);
10631053 var x154: u64 = undefined;
10641054 var x155: u64 = undefined;
1065 mulxU64(&x154, &x155, x2, (arg1[1]));
1055 mulxU64(&x154, &x155, x2, arg1[1]);
10661056 var x156: u64 = undefined;
10671057 var x157: u64 = undefined;
1068 mulxU64(&x156, &x157, x2, (arg1[0]));
1058 mulxU64(&x156, &x157, x2, arg1[0]);
10691059 var x158: u64 = undefined;
10701060 var x159: u1 = undefined;
10711061 addcarryxU64(&x158, &x159, 0x0, x157, x154);
......@@ -1081,7 +1071,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
10811071 var x166: u64 = undefined;
10821072 var x167: u1 = undefined;
10831073 addcarryxU64(&x166, &x167, x165, x149, x146);
1084 const x168 = (@as(u64, x167) + x147);
1074 const x168: u64 = (x167 + x147);
10851075 var x169: u64 = undefined;
10861076 var x170: u1 = undefined;
10871077 addcarryxU64(&x169, &x170, 0x0, x133, x156);
......@@ -1139,7 +1129,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
11391129 var x205: u64 = undefined;
11401130 var x206: u1 = undefined;
11411131 addcarryxU64(&x205, &x206, x204, x188, x185);
1142 const x207 = (@as(u64, x206) + x186);
1132 const x207: u64 = (x206 + x186);
11431133 var x208: u64 = undefined;
11441134 var x209: u1 = undefined;
11451135 addcarryxU64(&x208, &x209, 0x0, x169, x195);
......@@ -1161,25 +1151,25 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
11611151 var x220: u64 = undefined;
11621152 var x221: u1 = undefined;
11631153 addcarryxU64(&x220, &x221, x219, x181, x207);
1164 const x222 = (@as(u64, x221) + @as(u64, x182));
1154 const x222: u64 = (@as(u64, x221) + x182);
11651155 var x223: u64 = undefined;
11661156 var x224: u64 = undefined;
1167 mulxU64(&x223, &x224, x3, (arg1[5]));
1157 mulxU64(&x223, &x224, x3, arg1[5]);
11681158 var x225: u64 = undefined;
11691159 var x226: u64 = undefined;
1170 mulxU64(&x225, &x226, x3, (arg1[4]));
1160 mulxU64(&x225, &x226, x3, arg1[4]);
11711161 var x227: u64 = undefined;
11721162 var x228: u64 = undefined;
1173 mulxU64(&x227, &x228, x3, (arg1[3]));
1163 mulxU64(&x227, &x228, x3, arg1[3]);
11741164 var x229: u64 = undefined;
11751165 var x230: u64 = undefined;
1176 mulxU64(&x229, &x230, x3, (arg1[2]));
1166 mulxU64(&x229, &x230, x3, arg1[2]);
11771167 var x231: u64 = undefined;
11781168 var x232: u64 = undefined;
1179 mulxU64(&x231, &x232, x3, (arg1[1]));
1169 mulxU64(&x231, &x232, x3, arg1[1]);
11801170 var x233: u64 = undefined;
11811171 var x234: u64 = undefined;
1182 mulxU64(&x233, &x234, x3, (arg1[0]));
1172 mulxU64(&x233, &x234, x3, arg1[0]);
11831173 var x235: u64 = undefined;
11841174 var x236: u1 = undefined;
11851175 addcarryxU64(&x235, &x236, 0x0, x234, x231);
......@@ -1195,7 +1185,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
11951185 var x243: u64 = undefined;
11961186 var x244: u1 = undefined;
11971187 addcarryxU64(&x243, &x244, x242, x226, x223);
1198 const x245 = (@as(u64, x244) + x224);
1188 const x245: u64 = (x244 + x224);
11991189 var x246: u64 = undefined;
12001190 var x247: u1 = undefined;
12011191 addcarryxU64(&x246, &x247, 0x0, x210, x233);
......@@ -1253,7 +1243,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
12531243 var x282: u64 = undefined;
12541244 var x283: u1 = undefined;
12551245 addcarryxU64(&x282, &x283, x281, x265, x262);
1256 const x284 = (@as(u64, x283) + x263);
1246 const x284: u64 = (x283 + x263);
12571247 var x285: u64 = undefined;
12581248 var x286: u1 = undefined;
12591249 addcarryxU64(&x285, &x286, 0x0, x246, x272);
......@@ -1275,25 +1265,25 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
12751265 var x297: u64 = undefined;
12761266 var x298: u1 = undefined;
12771267 addcarryxU64(&x297, &x298, x296, x258, x284);
1278 const x299 = (@as(u64, x298) + @as(u64, x259));
1268 const x299: u64 = (@as(u64, x298) + x259);
12791269 var x300: u64 = undefined;
12801270 var x301: u64 = undefined;
1281 mulxU64(&x300, &x301, x4, (arg1[5]));
1271 mulxU64(&x300, &x301, x4, arg1[5]);
12821272 var x302: u64 = undefined;
12831273 var x303: u64 = undefined;
1284 mulxU64(&x302, &x303, x4, (arg1[4]));
1274 mulxU64(&x302, &x303, x4, arg1[4]);
12851275 var x304: u64 = undefined;
12861276 var x305: u64 = undefined;
1287 mulxU64(&x304, &x305, x4, (arg1[3]));
1277 mulxU64(&x304, &x305, x4, arg1[3]);
12881278 var x306: u64 = undefined;
12891279 var x307: u64 = undefined;
1290 mulxU64(&x306, &x307, x4, (arg1[2]));
1280 mulxU64(&x306, &x307, x4, arg1[2]);
12911281 var x308: u64 = undefined;
12921282 var x309: u64 = undefined;
1293 mulxU64(&x308, &x309, x4, (arg1[1]));
1283 mulxU64(&x308, &x309, x4, arg1[1]);
12941284 var x310: u64 = undefined;
12951285 var x311: u64 = undefined;
1296 mulxU64(&x310, &x311, x4, (arg1[0]));
1286 mulxU64(&x310, &x311, x4, arg1[0]);
12971287 var x312: u64 = undefined;
12981288 var x313: u1 = undefined;
12991289 addcarryxU64(&x312, &x313, 0x0, x311, x308);
......@@ -1309,7 +1299,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
13091299 var x320: u64 = undefined;
13101300 var x321: u1 = undefined;
13111301 addcarryxU64(&x320, &x321, x319, x303, x300);
1312 const x322 = (@as(u64, x321) + x301);
1302 const x322: u64 = (x321 + x301);
13131303 var x323: u64 = undefined;
13141304 var x324: u1 = undefined;
13151305 addcarryxU64(&x323, &x324, 0x0, x287, x310);
......@@ -1367,7 +1357,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
13671357 var x359: u64 = undefined;
13681358 var x360: u1 = undefined;
13691359 addcarryxU64(&x359, &x360, x358, x342, x339);
1370 const x361 = (@as(u64, x360) + x340);
1360 const x361: u64 = (x360 + x340);
13711361 var x362: u64 = undefined;
13721362 var x363: u1 = undefined;
13731363 addcarryxU64(&x362, &x363, 0x0, x323, x349);
......@@ -1389,25 +1379,25 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
13891379 var x374: u64 = undefined;
13901380 var x375: u1 = undefined;
13911381 addcarryxU64(&x374, &x375, x373, x335, x361);
1392 const x376 = (@as(u64, x375) + @as(u64, x336));
1382 const x376: u64 = (@as(u64, x375) + x336);
13931383 var x377: u64 = undefined;
13941384 var x378: u64 = undefined;
1395 mulxU64(&x377, &x378, x5, (arg1[5]));
1385 mulxU64(&x377, &x378, x5, arg1[5]);
13961386 var x379: u64 = undefined;
13971387 var x380: u64 = undefined;
1398 mulxU64(&x379, &x380, x5, (arg1[4]));
1388 mulxU64(&x379, &x380, x5, arg1[4]);
13991389 var x381: u64 = undefined;
14001390 var x382: u64 = undefined;
1401 mulxU64(&x381, &x382, x5, (arg1[3]));
1391 mulxU64(&x381, &x382, x5, arg1[3]);
14021392 var x383: u64 = undefined;
14031393 var x384: u64 = undefined;
1404 mulxU64(&x383, &x384, x5, (arg1[2]));
1394 mulxU64(&x383, &x384, x5, arg1[2]);
14051395 var x385: u64 = undefined;
14061396 var x386: u64 = undefined;
1407 mulxU64(&x385, &x386, x5, (arg1[1]));
1397 mulxU64(&x385, &x386, x5, arg1[1]);
14081398 var x387: u64 = undefined;
14091399 var x388: u64 = undefined;
1410 mulxU64(&x387, &x388, x5, (arg1[0]));
1400 mulxU64(&x387, &x388, x5, arg1[0]);
14111401 var x389: u64 = undefined;
14121402 var x390: u1 = undefined;
14131403 addcarryxU64(&x389, &x390, 0x0, x388, x385);
......@@ -1423,7 +1413,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
14231413 var x397: u64 = undefined;
14241414 var x398: u1 = undefined;
14251415 addcarryxU64(&x397, &x398, x396, x380, x377);
1426 const x399 = (@as(u64, x398) + x378);
1416 const x399: u64 = (x398 + x378);
14271417 var x400: u64 = undefined;
14281418 var x401: u1 = undefined;
14291419 addcarryxU64(&x400, &x401, 0x0, x364, x387);
......@@ -1481,7 +1471,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
14811471 var x436: u64 = undefined;
14821472 var x437: u1 = undefined;
14831473 addcarryxU64(&x436, &x437, x435, x419, x416);
1484 const x438 = (@as(u64, x437) + x417);
1474 const x438: u64 = (x437 + x417);
14851475 var x439: u64 = undefined;
14861476 var x440: u1 = undefined;
14871477 addcarryxU64(&x439, &x440, 0x0, x400, x426);
......@@ -1503,7 +1493,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
15031493 var x451: u64 = undefined;
15041494 var x452: u1 = undefined;
15051495 addcarryxU64(&x451, &x452, x450, x412, x438);
1506 const x453 = (@as(u64, x452) + @as(u64, x413));
1496 const x453: u64 = (@as(u64, x452) + x413);
15071497 var x454: u64 = undefined;
15081498 var x455: u1 = undefined;
15091499 subborrowxU64(&x454, &x455, 0x0, x441, 0xffffffff);
......@@ -1526,17 +1516,18 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
15261516 var x467: u1 = undefined;
15271517 subborrowxU64(&x466, &x467, x465, x453, 0x0);
15281518 var x468: u64 = undefined;
1529 cmovznzU64(&x468, x467, x454, x441);
1519 const x468_selection_mask = selectionMaskU64(x467);
1520 x468 = x454 ^ ((x454 ^ x441) & x468_selection_mask);
15301521 var x469: u64 = undefined;
1531 cmovznzU64(&x469, x467, x456, x443);
1522 x469 = x456 ^ ((x456 ^ x443) & x468_selection_mask);
15321523 var x470: u64 = undefined;
1533 cmovznzU64(&x470, x467, x458, x445);
1524 x470 = x458 ^ ((x458 ^ x445) & x468_selection_mask);
15341525 var x471: u64 = undefined;
1535 cmovznzU64(&x471, x467, x460, x447);
1526 x471 = x460 ^ ((x460 ^ x447) & x468_selection_mask);
15361527 var x472: u64 = undefined;
1537 cmovznzU64(&x472, x467, x462, x449);
1528 x472 = x462 ^ ((x462 ^ x449) & x468_selection_mask);
15381529 var x473: u64 = undefined;
1539 cmovznzU64(&x473, x467, x464, x451);
1530 x473 = x464 ^ ((x464 ^ x451) & x468_selection_mask);
15401531 out1[0] = x468;
15411532 out1[1] = x469;
15421533 out1[2] = x470;
......@@ -1559,22 +1550,22 @@ pub fn add(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
15591550
15601551 var x1: u64 = undefined;
15611552 var x2: u1 = undefined;
1562 addcarryxU64(&x1, &x2, 0x0, (arg1[0]), (arg2[0]));
1553 addcarryxU64(&x1, &x2, 0x0, arg1[0], arg2[0]);
15631554 var x3: u64 = undefined;
15641555 var x4: u1 = undefined;
1565 addcarryxU64(&x3, &x4, x2, (arg1[1]), (arg2[1]));
1556 addcarryxU64(&x3, &x4, x2, arg1[1], arg2[1]);
15661557 var x5: u64 = undefined;
15671558 var x6: u1 = undefined;
1568 addcarryxU64(&x5, &x6, x4, (arg1[2]), (arg2[2]));
1559 addcarryxU64(&x5, &x6, x4, arg1[2], arg2[2]);
15691560 var x7: u64 = undefined;
15701561 var x8: u1 = undefined;
1571 addcarryxU64(&x7, &x8, x6, (arg1[3]), (arg2[3]));
1562 addcarryxU64(&x7, &x8, x6, arg1[3], arg2[3]);
15721563 var x9: u64 = undefined;
15731564 var x10: u1 = undefined;
1574 addcarryxU64(&x9, &x10, x8, (arg1[4]), (arg2[4]));
1565 addcarryxU64(&x9, &x10, x8, arg1[4], arg2[4]);
15751566 var x11: u64 = undefined;
15761567 var x12: u1 = undefined;
1577 addcarryxU64(&x11, &x12, x10, (arg1[5]), (arg2[5]));
1568 addcarryxU64(&x11, &x12, x10, arg1[5], arg2[5]);
15781569 var x13: u64 = undefined;
15791570 var x14: u1 = undefined;
15801571 subborrowxU64(&x13, &x14, 0x0, x1, 0xffffffff);
......@@ -1595,19 +1586,20 @@ pub fn add(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
15951586 subborrowxU64(&x23, &x24, x22, x11, 0xffffffffffffffff);
15961587 var x25: u64 = undefined;
15971588 var x26: u1 = undefined;
1598 subborrowxU64(&x25, &x26, x24, @as(u64, x12), 0x0);
1589 subborrowxU64(&x25, &x26, x24, x12, 0x0);
15991590 var x27: u64 = undefined;
1600 cmovznzU64(&x27, x26, x13, x1);
1591 const x27_selection_mask = selectionMaskU64(x26);
1592 x27 = x13 ^ ((x13 ^ x1) & x27_selection_mask);
16011593 var x28: u64 = undefined;
1602 cmovznzU64(&x28, x26, x15, x3);
1594 x28 = x15 ^ ((x15 ^ x3) & x27_selection_mask);
16031595 var x29: u64 = undefined;
1604 cmovznzU64(&x29, x26, x17, x5);
1596 x29 = x17 ^ ((x17 ^ x5) & x27_selection_mask);
16051597 var x30: u64 = undefined;
1606 cmovznzU64(&x30, x26, x19, x7);
1598 x30 = x19 ^ ((x19 ^ x7) & x27_selection_mask);
16071599 var x31: u64 = undefined;
1608 cmovznzU64(&x31, x26, x21, x9);
1600 x31 = x21 ^ ((x21 ^ x9) & x27_selection_mask);
16091601 var x32: u64 = undefined;
1610 cmovznzU64(&x32, x26, x23, x11);
1602 x32 = x23 ^ ((x23 ^ x11) & x27_selection_mask);
16111603 out1[0] = x27;
16121604 out1[1] = x28;
16131605 out1[2] = x29;
......@@ -1630,24 +1622,25 @@ pub fn sub(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
16301622
16311623 var x1: u64 = undefined;
16321624 var x2: u1 = undefined;
1633 subborrowxU64(&x1, &x2, 0x0, (arg1[0]), (arg2[0]));
1625 subborrowxU64(&x1, &x2, 0x0, arg1[0], arg2[0]);
16341626 var x3: u64 = undefined;
16351627 var x4: u1 = undefined;
1636 subborrowxU64(&x3, &x4, x2, (arg1[1]), (arg2[1]));
1628 subborrowxU64(&x3, &x4, x2, arg1[1], arg2[1]);
16371629 var x5: u64 = undefined;
16381630 var x6: u1 = undefined;
1639 subborrowxU64(&x5, &x6, x4, (arg1[2]), (arg2[2]));
1631 subborrowxU64(&x5, &x6, x4, arg1[2], arg2[2]);
16401632 var x7: u64 = undefined;
16411633 var x8: u1 = undefined;
1642 subborrowxU64(&x7, &x8, x6, (arg1[3]), (arg2[3]));
1634 subborrowxU64(&x7, &x8, x6, arg1[3], arg2[3]);
16431635 var x9: u64 = undefined;
16441636 var x10: u1 = undefined;
1645 subborrowxU64(&x9, &x10, x8, (arg1[4]), (arg2[4]));
1637 subborrowxU64(&x9, &x10, x8, arg1[4], arg2[4]);
16461638 var x11: u64 = undefined;
16471639 var x12: u1 = undefined;
1648 subborrowxU64(&x11, &x12, x10, (arg1[5]), (arg2[5]));
1640 subborrowxU64(&x11, &x12, x10, arg1[5], arg2[5]);
16491641 var x13: u64 = undefined;
1650 cmovznzU64(&x13, x12, 0x0, 0xffffffffffffffff);
1642 const x13_selection_mask = selectionMaskU64(x12);
1643 x13 = 0x0 ^ ((0x0 ^ 0xffffffffffffffff) & x13_selection_mask);
16511644 var x14: u64 = undefined;
16521645 var x15: u1 = undefined;
16531646 addcarryxU64(&x14, &x15, 0x0, x1, (x13 & 0xffffffff));
......@@ -1687,24 +1680,25 @@ pub fn opp(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
16871680
16881681 var x1: u64 = undefined;
16891682 var x2: u1 = undefined;
1690 subborrowxU64(&x1, &x2, 0x0, 0x0, (arg1[0]));
1683 subborrowxU64(&x1, &x2, 0x0, 0x0, arg1[0]);
16911684 var x3: u64 = undefined;
16921685 var x4: u1 = undefined;
1693 subborrowxU64(&x3, &x4, x2, 0x0, (arg1[1]));
1686 subborrowxU64(&x3, &x4, x2, 0x0, arg1[1]);
16941687 var x5: u64 = undefined;
16951688 var x6: u1 = undefined;
1696 subborrowxU64(&x5, &x6, x4, 0x0, (arg1[2]));
1689 subborrowxU64(&x5, &x6, x4, 0x0, arg1[2]);
16971690 var x7: u64 = undefined;
16981691 var x8: u1 = undefined;
1699 subborrowxU64(&x7, &x8, x6, 0x0, (arg1[3]));
1692 subborrowxU64(&x7, &x8, x6, 0x0, arg1[3]);
17001693 var x9: u64 = undefined;
17011694 var x10: u1 = undefined;
1702 subborrowxU64(&x9, &x10, x8, 0x0, (arg1[4]));
1695 subborrowxU64(&x9, &x10, x8, 0x0, arg1[4]);
17031696 var x11: u64 = undefined;
17041697 var x12: u1 = undefined;
1705 subborrowxU64(&x11, &x12, x10, 0x0, (arg1[5]));
1698 subborrowxU64(&x11, &x12, x10, 0x0, arg1[5]);
17061699 var x13: u64 = undefined;
1707 cmovznzU64(&x13, x12, 0x0, 0xffffffffffffffff);
1700 const x13_selection_mask = selectionMaskU64(x12);
1701 x13 = 0x0 ^ ((0x0 ^ 0xffffffffffffffff) & x13_selection_mask);
17081702 var x14: u64 = undefined;
17091703 var x15: u1 = undefined;
17101704 addcarryxU64(&x14, &x15, 0x0, x1, (x13 & 0xffffffff));
......@@ -1742,7 +1736,7 @@ pub fn opp(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
17421736pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldElement) void {
17431737 @setRuntimeSafety(mode == .debug);
17441738
1745 const x1 = (arg1[0]);
1739 const x1: u64 = arg1[0];
17461740 var x2: u64 = undefined;
17471741 var x3: u64 = undefined;
17481742 mulxU64(&x2, &x3, x1, 0x100000001);
......@@ -1799,10 +1793,10 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo
17991793 addcarryxU64(&x36, &x37, x35, 0x0, x24);
18001794 var x38: u64 = undefined;
18011795 var x39: u1 = undefined;
1802 addcarryxU64(&x38, &x39, x37, 0x0, (@as(u64, x25) + x5));
1796 addcarryxU64(&x38, &x39, x37, 0x0, (x25 + x5));
18031797 var x40: u64 = undefined;
18041798 var x41: u1 = undefined;
1805 addcarryxU64(&x40, &x41, 0x0, x28, (arg1[1]));
1799 addcarryxU64(&x40, &x41, 0x0, x28, arg1[1]);
18061800 var x42: u64 = undefined;
18071801 var x43: u1 = undefined;
18081802 addcarryxU64(&x42, &x43, x41, x30, 0x0);
......@@ -1874,10 +1868,10 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo
18741868 addcarryxU64(&x86, &x87, x85, x50, x74);
18751869 var x88: u64 = undefined;
18761870 var x89: u1 = undefined;
1877 addcarryxU64(&x88, &x89, x87, (@as(u64, x51) + @as(u64, x39)), (@as(u64, x75) + x55));
1871 addcarryxU64(&x88, &x89, x87, (@as(u64, x51) + x39), (x75 + x55));
18781872 var x90: u64 = undefined;
18791873 var x91: u1 = undefined;
1880 addcarryxU64(&x90, &x91, 0x0, x78, (arg1[2]));
1874 addcarryxU64(&x90, &x91, 0x0, x78, arg1[2]);
18811875 var x92: u64 = undefined;
18821876 var x93: u1 = undefined;
18831877 addcarryxU64(&x92, &x93, x91, x80, 0x0);
......@@ -1949,10 +1943,10 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo
19491943 addcarryxU64(&x136, &x137, x135, x100, x124);
19501944 var x138: u64 = undefined;
19511945 var x139: u1 = undefined;
1952 addcarryxU64(&x138, &x139, x137, (@as(u64, x101) + @as(u64, x89)), (@as(u64, x125) + x105));
1946 addcarryxU64(&x138, &x139, x137, (@as(u64, x101) + x89), (x125 + x105));
19531947 var x140: u64 = undefined;
19541948 var x141: u1 = undefined;
1955 addcarryxU64(&x140, &x141, 0x0, x128, (arg1[3]));
1949 addcarryxU64(&x140, &x141, 0x0, x128, arg1[3]);
19561950 var x142: u64 = undefined;
19571951 var x143: u1 = undefined;
19581952 addcarryxU64(&x142, &x143, x141, x130, 0x0);
......@@ -2024,10 +2018,10 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo
20242018 addcarryxU64(&x186, &x187, x185, x150, x174);
20252019 var x188: u64 = undefined;
20262020 var x189: u1 = undefined;
2027 addcarryxU64(&x188, &x189, x187, (@as(u64, x151) + @as(u64, x139)), (@as(u64, x175) + x155));
2021 addcarryxU64(&x188, &x189, x187, (@as(u64, x151) + x139), (x175 + x155));
20282022 var x190: u64 = undefined;
20292023 var x191: u1 = undefined;
2030 addcarryxU64(&x190, &x191, 0x0, x178, (arg1[4]));
2024 addcarryxU64(&x190, &x191, 0x0, x178, arg1[4]);
20312025 var x192: u64 = undefined;
20322026 var x193: u1 = undefined;
20332027 addcarryxU64(&x192, &x193, x191, x180, 0x0);
......@@ -2099,10 +2093,10 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo
20992093 addcarryxU64(&x236, &x237, x235, x200, x224);
21002094 var x238: u64 = undefined;
21012095 var x239: u1 = undefined;
2102 addcarryxU64(&x238, &x239, x237, (@as(u64, x201) + @as(u64, x189)), (@as(u64, x225) + x205));
2096 addcarryxU64(&x238, &x239, x237, (@as(u64, x201) + x189), (x225 + x205));
21032097 var x240: u64 = undefined;
21042098 var x241: u1 = undefined;
2105 addcarryxU64(&x240, &x241, 0x0, x228, (arg1[5]));
2099 addcarryxU64(&x240, &x241, 0x0, x228, arg1[5]);
21062100 var x242: u64 = undefined;
21072101 var x243: u1 = undefined;
21082102 addcarryxU64(&x242, &x243, x241, x230, 0x0);
......@@ -2174,7 +2168,7 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo
21742168 addcarryxU64(&x286, &x287, x285, x250, x274);
21752169 var x288: u64 = undefined;
21762170 var x289: u1 = undefined;
2177 addcarryxU64(&x288, &x289, x287, (@as(u64, x251) + @as(u64, x239)), (@as(u64, x275) + x255));
2171 addcarryxU64(&x288, &x289, x287, (@as(u64, x251) + x239), (x275 + x255));
21782172 var x290: u64 = undefined;
21792173 var x291: u1 = undefined;
21802174 subborrowxU64(&x290, &x291, 0x0, x278, 0xffffffff);
......@@ -2195,19 +2189,20 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo
21952189 subborrowxU64(&x300, &x301, x299, x288, 0xffffffffffffffff);
21962190 var x302: u64 = undefined;
21972191 var x303: u1 = undefined;
2198 subborrowxU64(&x302, &x303, x301, @as(u64, x289), 0x0);
2192 subborrowxU64(&x302, &x303, x301, x289, 0x0);
21992193 var x304: u64 = undefined;
2200 cmovznzU64(&x304, x303, x290, x278);
2194 const x304_selection_mask = selectionMaskU64(x303);
2195 x304 = x290 ^ ((x290 ^ x278) & x304_selection_mask);
22012196 var x305: u64 = undefined;
2202 cmovznzU64(&x305, x303, x292, x280);
2197 x305 = x292 ^ ((x292 ^ x280) & x304_selection_mask);
22032198 var x306: u64 = undefined;
2204 cmovznzU64(&x306, x303, x294, x282);
2199 x306 = x294 ^ ((x294 ^ x282) & x304_selection_mask);
22052200 var x307: u64 = undefined;
2206 cmovznzU64(&x307, x303, x296, x284);
2201 x307 = x296 ^ ((x296 ^ x284) & x304_selection_mask);
22072202 var x308: u64 = undefined;
2208 cmovznzU64(&x308, x303, x298, x286);
2203 x308 = x298 ^ ((x298 ^ x286) & x304_selection_mask);
22092204 var x309: u64 = undefined;
2210 cmovznzU64(&x309, x303, x300, x288);
2205 x309 = x300 ^ ((x300 ^ x288) & x304_selection_mask);
22112206 out1[0] = x304;
22122207 out1[1] = x305;
22132208 out1[2] = x306;
......@@ -2227,12 +2222,12 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo
22272222pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDomainFieldElement) void {
22282223 @setRuntimeSafety(mode == .debug);
22292224
2230 const x1 = (arg1[1]);
2231 const x2 = (arg1[2]);
2232 const x3 = (arg1[3]);
2233 const x4 = (arg1[4]);
2234 const x5 = (arg1[5]);
2235 const x6 = (arg1[0]);
2225 const x1: u64 = arg1[1];
2226 const x2: u64 = arg1[2];
2227 const x3: u64 = arg1[3];
2228 const x4: u64 = arg1[4];
2229 const x5: u64 = arg1[5];
2230 const x6: u64 = arg1[0];
22362231 var x7: u64 = undefined;
22372232 var x8: u64 = undefined;
22382233 mulxU64(&x7, &x8, x6, 0x200000000);
......@@ -2310,10 +2305,10 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma
23102305 addcarryxU64(&x55, &x56, x54, x21, x43);
23112306 var x57: u64 = undefined;
23122307 var x58: u1 = undefined;
2313 addcarryxU64(&x57, &x58, x56, @as(u64, x22), x45);
2308 addcarryxU64(&x57, &x58, x56, x22, x45);
23142309 var x59: u64 = undefined;
23152310 var x60: u1 = undefined;
2316 addcarryxU64(&x59, &x60, x58, 0x0, (@as(u64, x46) + x26));
2311 addcarryxU64(&x59, &x60, x58, 0x0, (x46 + x26));
23172312 var x61: u64 = undefined;
23182313 var x62: u64 = undefined;
23192314 mulxU64(&x61, &x62, x1, 0x200000000);
......@@ -2355,7 +2350,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma
23552350 addcarryxU64(&x85, &x86, x84, x57, x75);
23562351 var x87: u64 = undefined;
23572352 var x88: u1 = undefined;
2358 addcarryxU64(&x87, &x88, x86, x59, @as(u64, x76));
2353 addcarryxU64(&x87, &x88, x86, x59, x76);
23592354 var x89: u64 = undefined;
23602355 var x90: u64 = undefined;
23612356 mulxU64(&x89, &x90, x77, 0x100000001);
......@@ -2412,7 +2407,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma
24122407 addcarryxU64(&x123, &x124, x122, x87, x111);
24132408 var x125: u64 = undefined;
24142409 var x126: u1 = undefined;
2415 addcarryxU64(&x125, &x126, x124, (@as(u64, x88) + @as(u64, x60)), (@as(u64, x112) + x92));
2410 addcarryxU64(&x125, &x126, x124, (@as(u64, x88) + x60), (x112 + x92));
24162411 var x127: u64 = undefined;
24172412 var x128: u64 = undefined;
24182413 mulxU64(&x127, &x128, x2, 0x200000000);
......@@ -2454,7 +2449,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma
24542449 addcarryxU64(&x151, &x152, x150, x123, x141);
24552450 var x153: u64 = undefined;
24562451 var x154: u1 = undefined;
2457 addcarryxU64(&x153, &x154, x152, x125, @as(u64, x142));
2452 addcarryxU64(&x153, &x154, x152, x125, x142);
24582453 var x155: u64 = undefined;
24592454 var x156: u64 = undefined;
24602455 mulxU64(&x155, &x156, x143, 0x100000001);
......@@ -2511,7 +2506,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma
25112506 addcarryxU64(&x189, &x190, x188, x153, x177);
25122507 var x191: u64 = undefined;
25132508 var x192: u1 = undefined;
2514 addcarryxU64(&x191, &x192, x190, (@as(u64, x154) + @as(u64, x126)), (@as(u64, x178) + x158));
2509 addcarryxU64(&x191, &x192, x190, (@as(u64, x154) + x126), (x178 + x158));
25152510 var x193: u64 = undefined;
25162511 var x194: u64 = undefined;
25172512 mulxU64(&x193, &x194, x3, 0x200000000);
......@@ -2553,7 +2548,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma
25532548 addcarryxU64(&x217, &x218, x216, x189, x207);
25542549 var x219: u64 = undefined;
25552550 var x220: u1 = undefined;
2556 addcarryxU64(&x219, &x220, x218, x191, @as(u64, x208));
2551 addcarryxU64(&x219, &x220, x218, x191, x208);
25572552 var x221: u64 = undefined;
25582553 var x222: u64 = undefined;
25592554 mulxU64(&x221, &x222, x209, 0x100000001);
......@@ -2610,7 +2605,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma
26102605 addcarryxU64(&x255, &x256, x254, x219, x243);
26112606 var x257: u64 = undefined;
26122607 var x258: u1 = undefined;
2613 addcarryxU64(&x257, &x258, x256, (@as(u64, x220) + @as(u64, x192)), (@as(u64, x244) + x224));
2608 addcarryxU64(&x257, &x258, x256, (@as(u64, x220) + x192), (x244 + x224));
26142609 var x259: u64 = undefined;
26152610 var x260: u64 = undefined;
26162611 mulxU64(&x259, &x260, x4, 0x200000000);
......@@ -2652,7 +2647,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma
26522647 addcarryxU64(&x283, &x284, x282, x255, x273);
26532648 var x285: u64 = undefined;
26542649 var x286: u1 = undefined;
2655 addcarryxU64(&x285, &x286, x284, x257, @as(u64, x274));
2650 addcarryxU64(&x285, &x286, x284, x257, x274);
26562651 var x287: u64 = undefined;
26572652 var x288: u64 = undefined;
26582653 mulxU64(&x287, &x288, x275, 0x100000001);
......@@ -2709,7 +2704,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma
27092704 addcarryxU64(&x321, &x322, x320, x285, x309);
27102705 var x323: u64 = undefined;
27112706 var x324: u1 = undefined;
2712 addcarryxU64(&x323, &x324, x322, (@as(u64, x286) + @as(u64, x258)), (@as(u64, x310) + x290));
2707 addcarryxU64(&x323, &x324, x322, (@as(u64, x286) + x258), (x310 + x290));
27132708 var x325: u64 = undefined;
27142709 var x326: u64 = undefined;
27152710 mulxU64(&x325, &x326, x5, 0x200000000);
......@@ -2751,7 +2746,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma
27512746 addcarryxU64(&x349, &x350, x348, x321, x339);
27522747 var x351: u64 = undefined;
27532748 var x352: u1 = undefined;
2754 addcarryxU64(&x351, &x352, x350, x323, @as(u64, x340));
2749 addcarryxU64(&x351, &x352, x350, x323, x340);
27552750 var x353: u64 = undefined;
27562751 var x354: u64 = undefined;
27572752 mulxU64(&x353, &x354, x341, 0x100000001);
......@@ -2808,7 +2803,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma
28082803 addcarryxU64(&x387, &x388, x386, x351, x375);
28092804 var x389: u64 = undefined;
28102805 var x390: u1 = undefined;
2811 addcarryxU64(&x389, &x390, x388, (@as(u64, x352) + @as(u64, x324)), (@as(u64, x376) + x356));
2806 addcarryxU64(&x389, &x390, x388, (@as(u64, x352) + x324), (x376 + x356));
28122807 var x391: u64 = undefined;
28132808 var x392: u1 = undefined;
28142809 subborrowxU64(&x391, &x392, 0x0, x379, 0xffffffff);
......@@ -2829,19 +2824,20 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma
28292824 subborrowxU64(&x401, &x402, x400, x389, 0xffffffffffffffff);
28302825 var x403: u64 = undefined;
28312826 var x404: u1 = undefined;
2832 subborrowxU64(&x403, &x404, x402, @as(u64, x390), 0x0);
2827 subborrowxU64(&x403, &x404, x402, x390, 0x0);
28332828 var x405: u64 = undefined;
2834 cmovznzU64(&x405, x404, x391, x379);
2829 const x405_selection_mask = selectionMaskU64(x404);
2830 x405 = x391 ^ ((x391 ^ x379) & x405_selection_mask);
28352831 var x406: u64 = undefined;
2836 cmovznzU64(&x406, x404, x393, x381);
2832 x406 = x393 ^ ((x393 ^ x381) & x405_selection_mask);
28372833 var x407: u64 = undefined;
2838 cmovznzU64(&x407, x404, x395, x383);
2834 x407 = x395 ^ ((x395 ^ x383) & x405_selection_mask);
28392835 var x408: u64 = undefined;
2840 cmovznzU64(&x408, x404, x397, x385);
2836 x408 = x397 ^ ((x397 ^ x385) & x405_selection_mask);
28412837 var x409: u64 = undefined;
2842 cmovznzU64(&x409, x404, x399, x387);
2838 x409 = x399 ^ ((x399 ^ x387) & x405_selection_mask);
28432839 var x410: u64 = undefined;
2844 cmovznzU64(&x410, x404, x401, x389);
2840 x410 = x401 ^ ((x401 ^ x389) & x405_selection_mask);
28452841 out1[0] = x405;
28462842 out1[1] = x406;
28472843 out1[2] = x407;
......@@ -2864,7 +2860,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma
28642860pub fn nonzero(out1: *u64, arg1: [6]u64) void {
28652861 @setRuntimeSafety(mode == .debug);
28662862
2867 const x1 = ((arg1[0]) | ((arg1[1]) | ((arg1[2]) | ((arg1[3]) | ((arg1[4]) | (arg1[5]))))));
2863 const x1: u64 = (arg1[0] | (arg1[1] | (arg1[2] | (arg1[3] | (arg1[4] | arg1[5])))));
28682864 out1.* = x1;
28692865}
28702866
......@@ -2883,17 +2879,18 @@ pub fn selectznz(out1: *[6]u64, arg1: u1, arg2: [6]u64, arg3: [6]u64) void {
28832879 @setRuntimeSafety(mode == .debug);
28842880
28852881 var x1: u64 = undefined;
2886 cmovznzU64(&x1, arg1, (arg2[0]), (arg3[0]));
2882 const x1_selection_mask = selectionMaskU64(arg1);
2883 x1 = arg2[0] ^ ((arg2[0] ^ arg3[0]) & x1_selection_mask);
28872884 var x2: u64 = undefined;
2888 cmovznzU64(&x2, arg1, (arg2[1]), (arg3[1]));
2885 x2 = arg2[1] ^ ((arg2[1] ^ arg3[1]) & x1_selection_mask);
28892886 var x3: u64 = undefined;
2890 cmovznzU64(&x3, arg1, (arg2[2]), (arg3[2]));
2887 x3 = arg2[2] ^ ((arg2[2] ^ arg3[2]) & x1_selection_mask);
28912888 var x4: u64 = undefined;
2892 cmovznzU64(&x4, arg1, (arg2[3]), (arg3[3]));
2889 x4 = arg2[3] ^ ((arg2[3] ^ arg3[3]) & x1_selection_mask);
28932890 var x5: u64 = undefined;
2894 cmovznzU64(&x5, arg1, (arg2[4]), (arg3[4]));
2891 x5 = arg2[4] ^ ((arg2[4] ^ arg3[4]) & x1_selection_mask);
28952892 var x6: u64 = undefined;
2896 cmovznzU64(&x6, arg1, (arg2[5]), (arg3[5]));
2893 x6 = arg2[5] ^ ((arg2[5] ^ arg3[5]) & x1_selection_mask);
28972894 out1[0] = x1;
28982895 out1[1] = x2;
28992896 out1[2] = x3;
......@@ -2916,96 +2913,96 @@ pub fn selectznz(out1: *[6]u64, arg1: u1, arg2: [6]u64, arg3: [6]u64) void {
29162913pub fn toBytes(out1: *[48]u8, arg1: [6]u64) void {
29172914 @setRuntimeSafety(mode == .debug);
29182915
2919 const x1 = (arg1[5]);
2920 const x2 = (arg1[4]);
2921 const x3 = (arg1[3]);
2922 const x4 = (arg1[2]);
2923 const x5 = (arg1[1]);
2924 const x6 = (arg1[0]);
2925 const x7 = @as(u8, @truncate((x6 & 0xff)));
2926 const x8 = (x6 >> 8);
2927 const x9 = @as(u8, @truncate((x8 & 0xff)));
2928 const x10 = (x8 >> 8);
2929 const x11 = @as(u8, @truncate((x10 & 0xff)));
2930 const x12 = (x10 >> 8);
2931 const x13 = @as(u8, @truncate((x12 & 0xff)));
2932 const x14 = (x12 >> 8);
2933 const x15 = @as(u8, @truncate((x14 & 0xff)));
2934 const x16 = (x14 >> 8);
2935 const x17 = @as(u8, @truncate((x16 & 0xff)));
2936 const x18 = (x16 >> 8);
2937 const x19 = @as(u8, @truncate((x18 & 0xff)));
2938 const x20 = @as(u8, @truncate((x18 >> 8)));
2939 const x21 = @as(u8, @truncate((x5 & 0xff)));
2940 const x22 = (x5 >> 8);
2941 const x23 = @as(u8, @truncate((x22 & 0xff)));
2942 const x24 = (x22 >> 8);
2943 const x25 = @as(u8, @truncate((x24 & 0xff)));
2944 const x26 = (x24 >> 8);
2945 const x27 = @as(u8, @truncate((x26 & 0xff)));
2946 const x28 = (x26 >> 8);
2947 const x29 = @as(u8, @truncate((x28 & 0xff)));
2948 const x30 = (x28 >> 8);
2949 const x31 = @as(u8, @truncate((x30 & 0xff)));
2950 const x32 = (x30 >> 8);
2951 const x33 = @as(u8, @truncate((x32 & 0xff)));
2952 const x34 = @as(u8, @truncate((x32 >> 8)));
2953 const x35 = @as(u8, @truncate((x4 & 0xff)));
2954 const x36 = (x4 >> 8);
2955 const x37 = @as(u8, @truncate((x36 & 0xff)));
2956 const x38 = (x36 >> 8);
2957 const x39 = @as(u8, @truncate((x38 & 0xff)));
2958 const x40 = (x38 >> 8);
2959 const x41 = @as(u8, @truncate((x40 & 0xff)));
2960 const x42 = (x40 >> 8);
2961 const x43 = @as(u8, @truncate((x42 & 0xff)));
2962 const x44 = (x42 >> 8);
2963 const x45 = @as(u8, @truncate((x44 & 0xff)));
2964 const x46 = (x44 >> 8);
2965 const x47 = @as(u8, @truncate((x46 & 0xff)));
2966 const x48 = @as(u8, @truncate((x46 >> 8)));
2967 const x49 = @as(u8, @truncate((x3 & 0xff)));
2968 const x50 = (x3 >> 8);
2969 const x51 = @as(u8, @truncate((x50 & 0xff)));
2970 const x52 = (x50 >> 8);
2971 const x53 = @as(u8, @truncate((x52 & 0xff)));
2972 const x54 = (x52 >> 8);
2973 const x55 = @as(u8, @truncate((x54 & 0xff)));
2974 const x56 = (x54 >> 8);
2975 const x57 = @as(u8, @truncate((x56 & 0xff)));
2976 const x58 = (x56 >> 8);
2977 const x59 = @as(u8, @truncate((x58 & 0xff)));
2978 const x60 = (x58 >> 8);
2979 const x61 = @as(u8, @truncate((x60 & 0xff)));
2980 const x62 = @as(u8, @truncate((x60 >> 8)));
2981 const x63 = @as(u8, @truncate((x2 & 0xff)));
2982 const x64 = (x2 >> 8);
2983 const x65 = @as(u8, @truncate((x64 & 0xff)));
2984 const x66 = (x64 >> 8);
2985 const x67 = @as(u8, @truncate((x66 & 0xff)));
2986 const x68 = (x66 >> 8);
2987 const x69 = @as(u8, @truncate((x68 & 0xff)));
2988 const x70 = (x68 >> 8);
2989 const x71 = @as(u8, @truncate((x70 & 0xff)));
2990 const x72 = (x70 >> 8);
2991 const x73 = @as(u8, @truncate((x72 & 0xff)));
2992 const x74 = (x72 >> 8);
2993 const x75 = @as(u8, @truncate((x74 & 0xff)));
2994 const x76 = @as(u8, @truncate((x74 >> 8)));
2995 const x77 = @as(u8, @truncate((x1 & 0xff)));
2996 const x78 = (x1 >> 8);
2997 const x79 = @as(u8, @truncate((x78 & 0xff)));
2998 const x80 = (x78 >> 8);
2999 const x81 = @as(u8, @truncate((x80 & 0xff)));
3000 const x82 = (x80 >> 8);
3001 const x83 = @as(u8, @truncate((x82 & 0xff)));
3002 const x84 = (x82 >> 8);
3003 const x85 = @as(u8, @truncate((x84 & 0xff)));
3004 const x86 = (x84 >> 8);
3005 const x87 = @as(u8, @truncate((x86 & 0xff)));
3006 const x88 = (x86 >> 8);
3007 const x89 = @as(u8, @truncate((x88 & 0xff)));
3008 const x90 = @as(u8, @truncate((x88 >> 8)));
2916 const x1: u64 = arg1[5];
2917 const x2: u64 = arg1[4];
2918 const x3: u64 = arg1[3];
2919 const x4: u64 = arg1[2];
2920 const x5: u64 = arg1[1];
2921 const x6: u64 = arg1[0];
2922 const x7: u8 = @truncate(x6);
2923 const x8: u64 = (x6 >> 8);
2924 const x9: u8 = @truncate(x8);
2925 const x10: u64 = (x8 >> 8);
2926 const x11: u8 = @truncate(x10);
2927 const x12: u64 = (x10 >> 8);
2928 const x13: u8 = @truncate(x12);
2929 const x14: u64 = (x12 >> 8);
2930 const x15: u8 = @truncate(x14);
2931 const x16: u64 = (x14 >> 8);
2932 const x17: u8 = @truncate(x16);
2933 const x18: u64 = (x16 >> 8);
2934 const x19: u8 = @truncate(x18);
2935 const x20: u8 = @truncate((x18 >> 8));
2936 const x21: u8 = @truncate(x5);
2937 const x22: u64 = (x5 >> 8);
2938 const x23: u8 = @truncate(x22);
2939 const x24: u64 = (x22 >> 8);
2940 const x25: u8 = @truncate(x24);
2941 const x26: u64 = (x24 >> 8);
2942 const x27: u8 = @truncate(x26);
2943 const x28: u64 = (x26 >> 8);
2944 const x29: u8 = @truncate(x28);
2945 const x30: u64 = (x28 >> 8);
2946 const x31: u8 = @truncate(x30);
2947 const x32: u64 = (x30 >> 8);
2948 const x33: u8 = @truncate(x32);
2949 const x34: u8 = @truncate((x32 >> 8));
2950 const x35: u8 = @truncate(x4);
2951 const x36: u64 = (x4 >> 8);
2952 const x37: u8 = @truncate(x36);
2953 const x38: u64 = (x36 >> 8);
2954 const x39: u8 = @truncate(x38);
2955 const x40: u64 = (x38 >> 8);
2956 const x41: u8 = @truncate(x40);
2957 const x42: u64 = (x40 >> 8);
2958 const x43: u8 = @truncate(x42);
2959 const x44: u64 = (x42 >> 8);
2960 const x45: u8 = @truncate(x44);
2961 const x46: u64 = (x44 >> 8);
2962 const x47: u8 = @truncate(x46);
2963 const x48: u8 = @truncate((x46 >> 8));
2964 const x49: u8 = @truncate(x3);
2965 const x50: u64 = (x3 >> 8);
2966 const x51: u8 = @truncate(x50);
2967 const x52: u64 = (x50 >> 8);
2968 const x53: u8 = @truncate(x52);
2969 const x54: u64 = (x52 >> 8);
2970 const x55: u8 = @truncate(x54);
2971 const x56: u64 = (x54 >> 8);
2972 const x57: u8 = @truncate(x56);
2973 const x58: u64 = (x56 >> 8);
2974 const x59: u8 = @truncate(x58);
2975 const x60: u64 = (x58 >> 8);
2976 const x61: u8 = @truncate(x60);
2977 const x62: u8 = @truncate((x60 >> 8));
2978 const x63: u8 = @truncate(x2);
2979 const x64: u64 = (x2 >> 8);
2980 const x65: u8 = @truncate(x64);
2981 const x66: u64 = (x64 >> 8);
2982 const x67: u8 = @truncate(x66);
2983 const x68: u64 = (x66 >> 8);
2984 const x69: u8 = @truncate(x68);
2985 const x70: u64 = (x68 >> 8);
2986 const x71: u8 = @truncate(x70);
2987 const x72: u64 = (x70 >> 8);
2988 const x73: u8 = @truncate(x72);
2989 const x74: u64 = (x72 >> 8);
2990 const x75: u8 = @truncate(x74);
2991 const x76: u8 = @truncate((x74 >> 8));
2992 const x77: u8 = @truncate(x1);
2993 const x78: u64 = (x1 >> 8);
2994 const x79: u8 = @truncate(x78);
2995 const x80: u64 = (x78 >> 8);
2996 const x81: u8 = @truncate(x80);
2997 const x82: u64 = (x80 >> 8);
2998 const x83: u8 = @truncate(x82);
2999 const x84: u64 = (x82 >> 8);
3000 const x85: u8 = @truncate(x84);
3001 const x86: u64 = (x84 >> 8);
3002 const x87: u8 = @truncate(x86);
3003 const x88: u64 = (x86 >> 8);
3004 const x89: u8 = @truncate(x88);
3005 const x90: u8 = @truncate((x88 >> 8));
30093006 out1[0] = x7;
30103007 out1[1] = x9;
30113008 out1[2] = x11;
......@@ -3071,96 +3068,96 @@ pub fn toBytes(out1: *[48]u8, arg1: [6]u64) void {
30713068pub fn fromBytes(out1: *[6]u64, arg1: [48]u8) void {
30723069 @setRuntimeSafety(mode == .debug);
30733070
3074 const x1 = (@as(u64, (arg1[47])) << 56);
3075 const x2 = (@as(u64, (arg1[46])) << 48);
3076 const x3 = (@as(u64, (arg1[45])) << 40);
3077 const x4 = (@as(u64, (arg1[44])) << 32);
3078 const x5 = (@as(u64, (arg1[43])) << 24);
3079 const x6 = (@as(u64, (arg1[42])) << 16);
3080 const x7 = (@as(u64, (arg1[41])) << 8);
3081 const x8 = (arg1[40]);
3082 const x9 = (@as(u64, (arg1[39])) << 56);
3083 const x10 = (@as(u64, (arg1[38])) << 48);
3084 const x11 = (@as(u64, (arg1[37])) << 40);
3085 const x12 = (@as(u64, (arg1[36])) << 32);
3086 const x13 = (@as(u64, (arg1[35])) << 24);
3087 const x14 = (@as(u64, (arg1[34])) << 16);
3088 const x15 = (@as(u64, (arg1[33])) << 8);
3089 const x16 = (arg1[32]);
3090 const x17 = (@as(u64, (arg1[31])) << 56);
3091 const x18 = (@as(u64, (arg1[30])) << 48);
3092 const x19 = (@as(u64, (arg1[29])) << 40);
3093 const x20 = (@as(u64, (arg1[28])) << 32);
3094 const x21 = (@as(u64, (arg1[27])) << 24);
3095 const x22 = (@as(u64, (arg1[26])) << 16);
3096 const x23 = (@as(u64, (arg1[25])) << 8);
3097 const x24 = (arg1[24]);
3098 const x25 = (@as(u64, (arg1[23])) << 56);
3099 const x26 = (@as(u64, (arg1[22])) << 48);
3100 const x27 = (@as(u64, (arg1[21])) << 40);
3101 const x28 = (@as(u64, (arg1[20])) << 32);
3102 const x29 = (@as(u64, (arg1[19])) << 24);
3103 const x30 = (@as(u64, (arg1[18])) << 16);
3104 const x31 = (@as(u64, (arg1[17])) << 8);
3105 const x32 = (arg1[16]);
3106 const x33 = (@as(u64, (arg1[15])) << 56);
3107 const x34 = (@as(u64, (arg1[14])) << 48);
3108 const x35 = (@as(u64, (arg1[13])) << 40);
3109 const x36 = (@as(u64, (arg1[12])) << 32);
3110 const x37 = (@as(u64, (arg1[11])) << 24);
3111 const x38 = (@as(u64, (arg1[10])) << 16);
3112 const x39 = (@as(u64, (arg1[9])) << 8);
3113 const x40 = (arg1[8]);
3114 const x41 = (@as(u64, (arg1[7])) << 56);
3115 const x42 = (@as(u64, (arg1[6])) << 48);
3116 const x43 = (@as(u64, (arg1[5])) << 40);
3117 const x44 = (@as(u64, (arg1[4])) << 32);
3118 const x45 = (@as(u64, (arg1[3])) << 24);
3119 const x46 = (@as(u64, (arg1[2])) << 16);
3120 const x47 = (@as(u64, (arg1[1])) << 8);
3121 const x48 = (arg1[0]);
3122 const x49 = (x47 + @as(u64, x48));
3123 const x50 = (x46 + x49);
3124 const x51 = (x45 + x50);
3125 const x52 = (x44 + x51);
3126 const x53 = (x43 + x52);
3127 const x54 = (x42 + x53);
3128 const x55 = (x41 + x54);
3129 const x56 = (x39 + @as(u64, x40));
3130 const x57 = (x38 + x56);
3131 const x58 = (x37 + x57);
3132 const x59 = (x36 + x58);
3133 const x60 = (x35 + x59);
3134 const x61 = (x34 + x60);
3135 const x62 = (x33 + x61);
3136 const x63 = (x31 + @as(u64, x32));
3137 const x64 = (x30 + x63);
3138 const x65 = (x29 + x64);
3139 const x66 = (x28 + x65);
3140 const x67 = (x27 + x66);
3141 const x68 = (x26 + x67);
3142 const x69 = (x25 + x68);
3143 const x70 = (x23 + @as(u64, x24));
3144 const x71 = (x22 + x70);
3145 const x72 = (x21 + x71);
3146 const x73 = (x20 + x72);
3147 const x74 = (x19 + x73);
3148 const x75 = (x18 + x74);
3149 const x76 = (x17 + x75);
3150 const x77 = (x15 + @as(u64, x16));
3151 const x78 = (x14 + x77);
3152 const x79 = (x13 + x78);
3153 const x80 = (x12 + x79);
3154 const x81 = (x11 + x80);
3155 const x82 = (x10 + x81);
3156 const x83 = (x9 + x82);
3157 const x84 = (x7 + @as(u64, x8));
3158 const x85 = (x6 + x84);
3159 const x86 = (x5 + x85);
3160 const x87 = (x4 + x86);
3161 const x88 = (x3 + x87);
3162 const x89 = (x2 + x88);
3163 const x90 = (x1 + x89);
3071 const x1: u64 = (@as(u64, arg1[47]) << 56);
3072 const x2: u64 = (@as(u64, arg1[46]) << 48);
3073 const x3: u64 = (@as(u64, arg1[45]) << 40);
3074 const x4: u64 = (@as(u64, arg1[44]) << 32);
3075 const x5: u64 = (@as(u64, arg1[43]) << 24);
3076 const x6: u64 = (@as(u64, arg1[42]) << 16);
3077 const x7: u64 = (@as(u64, arg1[41]) << 8);
3078 const x8: u8 = arg1[40];
3079 const x9: u64 = (@as(u64, arg1[39]) << 56);
3080 const x10: u64 = (@as(u64, arg1[38]) << 48);
3081 const x11: u64 = (@as(u64, arg1[37]) << 40);
3082 const x12: u64 = (@as(u64, arg1[36]) << 32);
3083 const x13: u64 = (@as(u64, arg1[35]) << 24);
3084 const x14: u64 = (@as(u64, arg1[34]) << 16);
3085 const x15: u64 = (@as(u64, arg1[33]) << 8);
3086 const x16: u8 = arg1[32];
3087 const x17: u64 = (@as(u64, arg1[31]) << 56);
3088 const x18: u64 = (@as(u64, arg1[30]) << 48);
3089 const x19: u64 = (@as(u64, arg1[29]) << 40);
3090 const x20: u64 = (@as(u64, arg1[28]) << 32);
3091 const x21: u64 = (@as(u64, arg1[27]) << 24);
3092 const x22: u64 = (@as(u64, arg1[26]) << 16);
3093 const x23: u64 = (@as(u64, arg1[25]) << 8);
3094 const x24: u8 = arg1[24];
3095 const x25: u64 = (@as(u64, arg1[23]) << 56);
3096 const x26: u64 = (@as(u64, arg1[22]) << 48);
3097 const x27: u64 = (@as(u64, arg1[21]) << 40);
3098 const x28: u64 = (@as(u64, arg1[20]) << 32);
3099 const x29: u64 = (@as(u64, arg1[19]) << 24);
3100 const x30: u64 = (@as(u64, arg1[18]) << 16);
3101 const x31: u64 = (@as(u64, arg1[17]) << 8);
3102 const x32: u8 = arg1[16];
3103 const x33: u64 = (@as(u64, arg1[15]) << 56);
3104 const x34: u64 = (@as(u64, arg1[14]) << 48);
3105 const x35: u64 = (@as(u64, arg1[13]) << 40);
3106 const x36: u64 = (@as(u64, arg1[12]) << 32);
3107 const x37: u64 = (@as(u64, arg1[11]) << 24);
3108 const x38: u64 = (@as(u64, arg1[10]) << 16);
3109 const x39: u64 = (@as(u64, arg1[9]) << 8);
3110 const x40: u8 = arg1[8];
3111 const x41: u64 = (@as(u64, arg1[7]) << 56);
3112 const x42: u64 = (@as(u64, arg1[6]) << 48);
3113 const x43: u64 = (@as(u64, arg1[5]) << 40);
3114 const x44: u64 = (@as(u64, arg1[4]) << 32);
3115 const x45: u64 = (@as(u64, arg1[3]) << 24);
3116 const x46: u64 = (@as(u64, arg1[2]) << 16);
3117 const x47: u64 = (@as(u64, arg1[1]) << 8);
3118 const x48: u8 = arg1[0];
3119 const x49: u64 = (x47 + x48);
3120 const x50: u64 = (x46 + x49);
3121 const x51: u64 = (x45 + x50);
3122 const x52: u64 = (x44 + x51);
3123 const x53: u64 = (x43 + x52);
3124 const x54: u64 = (x42 + x53);
3125 const x55: u64 = (x41 + x54);
3126 const x56: u64 = (x39 + x40);
3127 const x57: u64 = (x38 + x56);
3128 const x58: u64 = (x37 + x57);
3129 const x59: u64 = (x36 + x58);
3130 const x60: u64 = (x35 + x59);
3131 const x61: u64 = (x34 + x60);
3132 const x62: u64 = (x33 + x61);
3133 const x63: u64 = (x31 + x32);
3134 const x64: u64 = (x30 + x63);
3135 const x65: u64 = (x29 + x64);
3136 const x66: u64 = (x28 + x65);
3137 const x67: u64 = (x27 + x66);
3138 const x68: u64 = (x26 + x67);
3139 const x69: u64 = (x25 + x68);
3140 const x70: u64 = (x23 + x24);
3141 const x71: u64 = (x22 + x70);
3142 const x72: u64 = (x21 + x71);
3143 const x73: u64 = (x20 + x72);
3144 const x74: u64 = (x19 + x73);
3145 const x75: u64 = (x18 + x74);
3146 const x76: u64 = (x17 + x75);
3147 const x77: u64 = (x15 + x16);
3148 const x78: u64 = (x14 + x77);
3149 const x79: u64 = (x13 + x78);
3150 const x80: u64 = (x12 + x79);
3151 const x81: u64 = (x11 + x80);
3152 const x82: u64 = (x10 + x81);
3153 const x83: u64 = (x9 + x82);
3154 const x84: u64 = (x7 + x8);
3155 const x85: u64 = (x6 + x84);
3156 const x86: u64 = (x5 + x85);
3157 const x87: u64 = (x4 + x86);
3158 const x88: u64 = (x3 + x87);
3159 const x89: u64 = (x2 + x88);
3160 const x90: u64 = (x1 + x89);
31643161 out1[0] = x55;
31653162 out1[1] = x62;
31663163 out1[2] = x69;
......@@ -3240,73 +3237,75 @@ pub fn divstep(out1: *u64, out2: *[7]u64, out3: *[7]u64, out4: *[6]u64, out5: *[
32403237 var x1: u64 = undefined;
32413238 var x2: u1 = undefined;
32423239 addcarryxU64(&x1, &x2, 0x0, (~arg1), 0x1);
3243 const x3 = (@as(u1, @truncate((x1 >> 63))) & @as(u1, @truncate(((arg3[0]) & 0x1))));
3240 const x3: u1 = (@as(u1, @truncate((x1 >> 63))) & @as(u1, @truncate(arg3[0])));
32443241 var x4: u64 = undefined;
32453242 var x5: u1 = undefined;
32463243 addcarryxU64(&x4, &x5, 0x0, (~arg1), 0x1);
32473244 var x6: u64 = undefined;
3248 cmovznzU64(&x6, x3, arg1, x4);
3245 const x6_selection_mask = selectionMaskU64(x3);
3246 x6 = arg1 ^ ((arg1 ^ x4) & x6_selection_mask);
32493247 var x7: u64 = undefined;
3250 cmovznzU64(&x7, x3, (arg2[0]), (arg3[0]));
3248 x7 = arg2[0] ^ ((arg2[0] ^ arg3[0]) & x6_selection_mask);
32513249 var x8: u64 = undefined;
3252 cmovznzU64(&x8, x3, (arg2[1]), (arg3[1]));
3250 x8 = arg2[1] ^ ((arg2[1] ^ arg3[1]) & x6_selection_mask);
32533251 var x9: u64 = undefined;
3254 cmovznzU64(&x9, x3, (arg2[2]), (arg3[2]));
3252 x9 = arg2[2] ^ ((arg2[2] ^ arg3[2]) & x6_selection_mask);
32553253 var x10: u64 = undefined;
3256 cmovznzU64(&x10, x3, (arg2[3]), (arg3[3]));
3254 x10 = arg2[3] ^ ((arg2[3] ^ arg3[3]) & x6_selection_mask);
32573255 var x11: u64 = undefined;
3258 cmovznzU64(&x11, x3, (arg2[4]), (arg3[4]));
3256 x11 = arg2[4] ^ ((arg2[4] ^ arg3[4]) & x6_selection_mask);
32593257 var x12: u64 = undefined;
3260 cmovznzU64(&x12, x3, (arg2[5]), (arg3[5]));
3258 x12 = arg2[5] ^ ((arg2[5] ^ arg3[5]) & x6_selection_mask);
32613259 var x13: u64 = undefined;
3262 cmovznzU64(&x13, x3, (arg2[6]), (arg3[6]));
3260 x13 = arg2[6] ^ ((arg2[6] ^ arg3[6]) & x6_selection_mask);
32633261 var x14: u64 = undefined;
32643262 var x15: u1 = undefined;
3265 addcarryxU64(&x14, &x15, 0x0, 0x1, (~(arg2[0])));
3263 addcarryxU64(&x14, &x15, 0x0, 0x1, (~arg2[0]));
32663264 var x16: u64 = undefined;
32673265 var x17: u1 = undefined;
3268 addcarryxU64(&x16, &x17, x15, 0x0, (~(arg2[1])));
3266 addcarryxU64(&x16, &x17, x15, 0x0, (~arg2[1]));
32693267 var x18: u64 = undefined;
32703268 var x19: u1 = undefined;
3271 addcarryxU64(&x18, &x19, x17, 0x0, (~(arg2[2])));
3269 addcarryxU64(&x18, &x19, x17, 0x0, (~arg2[2]));
32723270 var x20: u64 = undefined;
32733271 var x21: u1 = undefined;
3274 addcarryxU64(&x20, &x21, x19, 0x0, (~(arg2[3])));
3272 addcarryxU64(&x20, &x21, x19, 0x0, (~arg2[3]));
32753273 var x22: u64 = undefined;
32763274 var x23: u1 = undefined;
3277 addcarryxU64(&x22, &x23, x21, 0x0, (~(arg2[4])));
3275 addcarryxU64(&x22, &x23, x21, 0x0, (~arg2[4]));
32783276 var x24: u64 = undefined;
32793277 var x25: u1 = undefined;
3280 addcarryxU64(&x24, &x25, x23, 0x0, (~(arg2[5])));
3278 addcarryxU64(&x24, &x25, x23, 0x0, (~arg2[5]));
32813279 var x26: u64 = undefined;
32823280 var x27: u1 = undefined;
3283 addcarryxU64(&x26, &x27, x25, 0x0, (~(arg2[6])));
3281 addcarryxU64(&x26, &x27, x25, 0x0, (~arg2[6]));
32843282 var x28: u64 = undefined;
3285 cmovznzU64(&x28, x3, (arg3[0]), x14);
3283 const x28_selection_mask = selectionMaskU64(x3);
3284 x28 = arg3[0] ^ ((arg3[0] ^ x14) & x28_selection_mask);
32863285 var x29: u64 = undefined;
3287 cmovznzU64(&x29, x3, (arg3[1]), x16);
3286 x29 = arg3[1] ^ ((arg3[1] ^ x16) & x28_selection_mask);
32883287 var x30: u64 = undefined;
3289 cmovznzU64(&x30, x3, (arg3[2]), x18);
3288 x30 = arg3[2] ^ ((arg3[2] ^ x18) & x28_selection_mask);
32903289 var x31: u64 = undefined;
3291 cmovznzU64(&x31, x3, (arg3[3]), x20);
3290 x31 = arg3[3] ^ ((arg3[3] ^ x20) & x28_selection_mask);
32923291 var x32: u64 = undefined;
3293 cmovznzU64(&x32, x3, (arg3[4]), x22);
3292 x32 = arg3[4] ^ ((arg3[4] ^ x22) & x28_selection_mask);
32943293 var x33: u64 = undefined;
3295 cmovznzU64(&x33, x3, (arg3[5]), x24);
3294 x33 = arg3[5] ^ ((arg3[5] ^ x24) & x28_selection_mask);
32963295 var x34: u64 = undefined;
3297 cmovznzU64(&x34, x3, (arg3[6]), x26);
3296 x34 = arg3[6] ^ ((arg3[6] ^ x26) & x28_selection_mask);
32983297 var x35: u64 = undefined;
3299 cmovznzU64(&x35, x3, (arg4[0]), (arg5[0]));
3298 x35 = arg4[0] ^ ((arg4[0] ^ arg5[0]) & x28_selection_mask);
33003299 var x36: u64 = undefined;
3301 cmovznzU64(&x36, x3, (arg4[1]), (arg5[1]));
3300 x36 = arg4[1] ^ ((arg4[1] ^ arg5[1]) & x28_selection_mask);
33023301 var x37: u64 = undefined;
3303 cmovznzU64(&x37, x3, (arg4[2]), (arg5[2]));
3302 x37 = arg4[2] ^ ((arg4[2] ^ arg5[2]) & x28_selection_mask);
33043303 var x38: u64 = undefined;
3305 cmovznzU64(&x38, x3, (arg4[3]), (arg5[3]));
3304 x38 = arg4[3] ^ ((arg4[3] ^ arg5[3]) & x28_selection_mask);
33063305 var x39: u64 = undefined;
3307 cmovznzU64(&x39, x3, (arg4[4]), (arg5[4]));
3306 x39 = arg4[4] ^ ((arg4[4] ^ arg5[4]) & x28_selection_mask);
33083307 var x40: u64 = undefined;
3309 cmovznzU64(&x40, x3, (arg4[5]), (arg5[5]));
3308 x40 = arg4[5] ^ ((arg4[5] ^ arg5[5]) & x28_selection_mask);
33103309 var x41: u64 = undefined;
33113310 var x42: u1 = undefined;
33123311 addcarryxU64(&x41, &x42, 0x0, x35, x35);
......@@ -3345,13 +3344,13 @@ pub fn divstep(out1: *u64, out2: *[7]u64, out3: *[7]u64, out4: *[6]u64, out5: *[
33453344 subborrowxU64(&x63, &x64, x62, x51, 0xffffffffffffffff);
33463345 var x65: u64 = undefined;
33473346 var x66: u1 = undefined;
3348 subborrowxU64(&x65, &x66, x64, @as(u64, x52), 0x0);
3349 const x67 = (arg4[5]);
3350 const x68 = (arg4[4]);
3351 const x69 = (arg4[3]);
3352 const x70 = (arg4[2]);
3353 const x71 = (arg4[1]);
3354 const x72 = (arg4[0]);
3347 subborrowxU64(&x65, &x66, x64, x52, 0x0);
3348 const x67: u64 = arg4[5];
3349 const x68: u64 = arg4[4];
3350 const x69: u64 = arg4[3];
3351 const x70: u64 = arg4[2];
3352 const x71: u64 = arg4[1];
3353 const x72: u64 = arg4[0];
33553354 var x73: u64 = undefined;
33563355 var x74: u1 = undefined;
33573356 subborrowxU64(&x73, &x74, 0x0, 0x0, x72);
......@@ -3371,7 +3370,8 @@ pub fn divstep(out1: *u64, out2: *[7]u64, out3: *[7]u64, out4: *[6]u64, out5: *[
33713370 var x84: u1 = undefined;
33723371 subborrowxU64(&x83, &x84, x82, 0x0, x67);
33733372 var x85: u64 = undefined;
3374 cmovznzU64(&x85, x84, 0x0, 0xffffffffffffffff);
3373 const x85_selection_mask = selectionMaskU64(x84);
3374 x85 = 0x0 ^ ((0x0 ^ 0xffffffffffffffff) & x85_selection_mask);
33753375 var x86: u64 = undefined;
33763376 var x87: u1 = undefined;
33773377 addcarryxU64(&x86, &x87, 0x0, x73, (x85 & 0xffffffff));
......@@ -3391,32 +3391,34 @@ pub fn divstep(out1: *u64, out2: *[7]u64, out3: *[7]u64, out4: *[6]u64, out5: *[
33913391 var x97: u1 = undefined;
33923392 addcarryxU64(&x96, &x97, x95, x83, x85);
33933393 var x98: u64 = undefined;
3394 cmovznzU64(&x98, x3, (arg5[0]), x86);
3394 const x98_selection_mask = selectionMaskU64(x3);
3395 x98 = arg5[0] ^ ((arg5[0] ^ x86) & x98_selection_mask);
33953396 var x99: u64 = undefined;
3396 cmovznzU64(&x99, x3, (arg5[1]), x88);
3397 x99 = arg5[1] ^ ((arg5[1] ^ x88) & x98_selection_mask);
33973398 var x100: u64 = undefined;
3398 cmovznzU64(&x100, x3, (arg5[2]), x90);
3399 x100 = arg5[2] ^ ((arg5[2] ^ x90) & x98_selection_mask);
33993400 var x101: u64 = undefined;
3400 cmovznzU64(&x101, x3, (arg5[3]), x92);
3401 x101 = arg5[3] ^ ((arg5[3] ^ x92) & x98_selection_mask);
34013402 var x102: u64 = undefined;
3402 cmovznzU64(&x102, x3, (arg5[4]), x94);
3403 x102 = arg5[4] ^ ((arg5[4] ^ x94) & x98_selection_mask);
34033404 var x103: u64 = undefined;
3404 cmovznzU64(&x103, x3, (arg5[5]), x96);
3405 const x104 = @as(u1, @truncate((x28 & 0x1)));
3405 x103 = arg5[5] ^ ((arg5[5] ^ x96) & x98_selection_mask);
3406 const x104: u1 = @truncate(x28);
34063407 var x105: u64 = undefined;
3407 cmovznzU64(&x105, x104, 0x0, x7);
3408 const x105_selection_mask = selectionMaskU64(x104);
3409 x105 = 0x0 ^ ((0x0 ^ x7) & x105_selection_mask);
34083410 var x106: u64 = undefined;
3409 cmovznzU64(&x106, x104, 0x0, x8);
3411 x106 = 0x0 ^ ((0x0 ^ x8) & x105_selection_mask);
34103412 var x107: u64 = undefined;
3411 cmovznzU64(&x107, x104, 0x0, x9);
3413 x107 = 0x0 ^ ((0x0 ^ x9) & x105_selection_mask);
34123414 var x108: u64 = undefined;
3413 cmovznzU64(&x108, x104, 0x0, x10);
3415 x108 = 0x0 ^ ((0x0 ^ x10) & x105_selection_mask);
34143416 var x109: u64 = undefined;
3415 cmovznzU64(&x109, x104, 0x0, x11);
3417 x109 = 0x0 ^ ((0x0 ^ x11) & x105_selection_mask);
34163418 var x110: u64 = undefined;
3417 cmovznzU64(&x110, x104, 0x0, x12);
3419 x110 = 0x0 ^ ((0x0 ^ x12) & x105_selection_mask);
34183420 var x111: u64 = undefined;
3419 cmovznzU64(&x111, x104, 0x0, x13);
3421 x111 = 0x0 ^ ((0x0 ^ x13) & x105_selection_mask);
34203422 var x112: u64 = undefined;
34213423 var x113: u1 = undefined;
34223424 addcarryxU64(&x112, &x113, 0x0, x28, x105);
......@@ -3439,17 +3441,18 @@ pub fn divstep(out1: *u64, out2: *[7]u64, out3: *[7]u64, out4: *[6]u64, out5: *[
34393441 var x125: u1 = undefined;
34403442 addcarryxU64(&x124, &x125, x123, x34, x111);
34413443 var x126: u64 = undefined;
3442 cmovznzU64(&x126, x104, 0x0, x35);
3444 const x126_selection_mask = selectionMaskU64(x104);
3445 x126 = 0x0 ^ ((0x0 ^ x35) & x126_selection_mask);
34433446 var x127: u64 = undefined;
3444 cmovznzU64(&x127, x104, 0x0, x36);
3447 x127 = 0x0 ^ ((0x0 ^ x36) & x126_selection_mask);
34453448 var x128: u64 = undefined;
3446 cmovznzU64(&x128, x104, 0x0, x37);
3449 x128 = 0x0 ^ ((0x0 ^ x37) & x126_selection_mask);
34473450 var x129: u64 = undefined;
3448 cmovznzU64(&x129, x104, 0x0, x38);
3451 x129 = 0x0 ^ ((0x0 ^ x38) & x126_selection_mask);
34493452 var x130: u64 = undefined;
3450 cmovznzU64(&x130, x104, 0x0, x39);
3453 x130 = 0x0 ^ ((0x0 ^ x39) & x126_selection_mask);
34513454 var x131: u64 = undefined;
3452 cmovznzU64(&x131, x104, 0x0, x40);
3455 x131 = 0x0 ^ ((0x0 ^ x40) & x126_selection_mask);
34533456 var x132: u64 = undefined;
34543457 var x133: u1 = undefined;
34553458 addcarryxU64(&x132, &x133, 0x0, x98, x126);
......@@ -3488,41 +3491,43 @@ pub fn divstep(out1: *u64, out2: *[7]u64, out3: *[7]u64, out4: *[6]u64, out5: *[
34883491 subborrowxU64(&x154, &x155, x153, x142, 0xffffffffffffffff);
34893492 var x156: u64 = undefined;
34903493 var x157: u1 = undefined;
3491 subborrowxU64(&x156, &x157, x155, @as(u64, x143), 0x0);
3494 subborrowxU64(&x156, &x157, x155, x143, 0x0);
34923495 var x158: u64 = undefined;
34933496 var x159: u1 = undefined;
34943497 addcarryxU64(&x158, &x159, 0x0, x6, 0x1);
3495 const x160 = ((x112 >> 1) | ((x114 << 63) & 0xffffffffffffffff));
3496 const x161 = ((x114 >> 1) | ((x116 << 63) & 0xffffffffffffffff));
3497 const x162 = ((x116 >> 1) | ((x118 << 63) & 0xffffffffffffffff));
3498 const x163 = ((x118 >> 1) | ((x120 << 63) & 0xffffffffffffffff));
3499 const x164 = ((x120 >> 1) | ((x122 << 63) & 0xffffffffffffffff));
3500 const x165 = ((x122 >> 1) | ((x124 << 63) & 0xffffffffffffffff));
3501 const x166 = ((x124 & 0x8000000000000000) | (x124 >> 1));
3498 const x160: u64 = ((x112 >> 1) | ((x114 << 63) & 0xffffffffffffffff));
3499 const x161: u64 = ((x114 >> 1) | ((x116 << 63) & 0xffffffffffffffff));
3500 const x162: u64 = ((x116 >> 1) | ((x118 << 63) & 0xffffffffffffffff));
3501 const x163: u64 = ((x118 >> 1) | ((x120 << 63) & 0xffffffffffffffff));
3502 const x164: u64 = ((x120 >> 1) | ((x122 << 63) & 0xffffffffffffffff));
3503 const x165: u64 = ((x122 >> 1) | ((x124 << 63) & 0xffffffffffffffff));
3504 const x166: u64 = ((x124 & 0x8000000000000000) | (x124 >> 1));
35023505 var x167: u64 = undefined;
3503 cmovznzU64(&x167, x66, x53, x41);
3506 const x167_selection_mask = selectionMaskU64(x66);
3507 x167 = x53 ^ ((x53 ^ x41) & x167_selection_mask);
35043508 var x168: u64 = undefined;
3505 cmovznzU64(&x168, x66, x55, x43);
3509 x168 = x55 ^ ((x55 ^ x43) & x167_selection_mask);
35063510 var x169: u64 = undefined;
3507 cmovznzU64(&x169, x66, x57, x45);
3511 x169 = x57 ^ ((x57 ^ x45) & x167_selection_mask);
35083512 var x170: u64 = undefined;
3509 cmovznzU64(&x170, x66, x59, x47);
3513 x170 = x59 ^ ((x59 ^ x47) & x167_selection_mask);
35103514 var x171: u64 = undefined;
3511 cmovznzU64(&x171, x66, x61, x49);
3515 x171 = x61 ^ ((x61 ^ x49) & x167_selection_mask);
35123516 var x172: u64 = undefined;
3513 cmovznzU64(&x172, x66, x63, x51);
3517 x172 = x63 ^ ((x63 ^ x51) & x167_selection_mask);
35143518 var x173: u64 = undefined;
3515 cmovznzU64(&x173, x157, x144, x132);
3519 const x173_selection_mask = selectionMaskU64(x157);
3520 x173 = x144 ^ ((x144 ^ x132) & x173_selection_mask);
35163521 var x174: u64 = undefined;
3517 cmovznzU64(&x174, x157, x146, x134);
3522 x174 = x146 ^ ((x146 ^ x134) & x173_selection_mask);
35183523 var x175: u64 = undefined;
3519 cmovznzU64(&x175, x157, x148, x136);
3524 x175 = x148 ^ ((x148 ^ x136) & x173_selection_mask);
35203525 var x176: u64 = undefined;
3521 cmovznzU64(&x176, x157, x150, x138);
3526 x176 = x150 ^ ((x150 ^ x138) & x173_selection_mask);
35223527 var x177: u64 = undefined;
3523 cmovznzU64(&x177, x157, x152, x140);
3528 x177 = x152 ^ ((x152 ^ x140) & x173_selection_mask);
35243529 var x178: u64 = undefined;
3525 cmovznzU64(&x178, x157, x154, x142);
3530 x178 = x154 ^ ((x154 ^ x142) & x173_selection_mask);
35263531 out1.* = x158;
35273532 out2[0] = x7;
35283533 out2[1] = x8;
lib/std/crypto/pcurves/p384/p384_scalar_64.zig+527-522
......@@ -17,7 +17,6 @@
1717// twos_complement_eval z = let x1 := z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) + (z[4] << 256) + (z[5] << 0x140) in
1818// if x1 & (2^384-1) < 2^383 then x1 & (2^384-1) else (x1 & (2^384-1)) - 2^384
1919
20const std = @import("std");
2120const mode = @import("builtin").mode; // Checked arithmetic is disabled in non-debug modes to avoid side channels
2221
2322// The type MontgomeryDomainFieldElement is a field element in the Montgomery domain.
......@@ -28,80 +27,70 @@ pub const MontgomeryDomainFieldElement = [6]u64;
2827// Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
2928pub const NonMontgomeryDomainFieldElement = [6]u64;
3029
31/// The function addcarryxU64 is an addition with carry.
32///
33/// Postconditions:
34/// out1 = (arg1 + arg2 + arg3) mod 2^64
35/// out2 = ⌊(arg1 + arg2 + arg3) / 2^64⌋
36///
37/// Input Bounds:
38/// arg1: [0x0 ~> 0x1]
39/// arg2: [0x0 ~> 0xffffffffffffffff]
40/// arg3: [0x0 ~> 0xffffffffffffffff]
41/// Output Bounds:
42/// out1: [0x0 ~> 0xffffffffffffffff]
43/// out2: [0x0 ~> 0x1]
30/// Add two limbs and a carry bit, returning the sum modulo 2^64 and the carry bit.
4431fn addcarryxU64(out1: *u64, out2: *u1, arg1: u1, arg2: u64, arg3: u64) void {
45 const x = @as(u128, arg2) +% arg3 +% arg1;
46 out1.* = @truncate(x);
47 out2.* = @truncate(x >> 64);
32 @setRuntimeSafety(mode == .debug);
33
34 const x = @addWithOverflow(arg2, arg3);
35 const y = @addWithOverflow(x[0], arg1);
36 out1.* = y[0];
37 out2.* = x[1] | y[1];
4838}
4939
50/// The function subborrowxU64 is a subtraction with borrow.
51///
52/// Postconditions:
53/// out1 = (-arg1 + arg2 + -arg3) mod 2^64
54/// out2 = -⌊(-arg1 + arg2 + -arg3) / 2^64⌋
55///
56/// Input Bounds:
57/// arg1: [0x0 ~> 0x1]
58/// arg2: [0x0 ~> 0xffffffffffffffff]
59/// arg3: [0x0 ~> 0xffffffffffffffff]
60/// Output Bounds:
61/// out1: [0x0 ~> 0xffffffffffffffff]
62/// out2: [0x0 ~> 0x1]
40/// Subtract two limbs and a borrow bit, returning the difference modulo 2^64 and the borrow bit.
6341fn subborrowxU64(out1: *u64, out2: *u1, arg1: u1, arg2: u64, arg3: u64) void {
64 const x = @as(u128, arg2) -% arg3 -% arg1;
65 out1.* = @truncate(x);
66 out2.* = @truncate(x >> 64);
42 @setRuntimeSafety(mode == .debug);
43
44 const x = @subWithOverflow(arg2, arg3);
45 const y = @subWithOverflow(x[0], arg1);
46 out1.* = y[0];
47 out2.* = x[1] | y[1];
6748}
6849
69/// The function mulxU64 is a multiplication, returning the full double-width result.
70///
71/// Postconditions:
72/// out1 = (arg1 * arg2) mod 2^64
73/// out2 = ⌊arg1 * arg2 / 2^64⌋
74///
75/// Input Bounds:
76/// arg1: [0x0 ~> 0xffffffffffffffff]
77/// arg2: [0x0 ~> 0xffffffffffffffff]
78/// Output Bounds:
79/// out1: [0x0 ~> 0xffffffffffffffff]
80/// out2: [0x0 ~> 0xffffffffffffffff]
50/// Multiply two limbs, returning the low and high halves of the product.
8151fn mulxU64(out1: *u64, out2: *u64, arg1: u64, arg2: u64) void {
8252 @setRuntimeSafety(mode == .debug);
8353
84 const x = @as(u128, arg1) * @as(u128, arg2);
85 out1.* = @as(u64, @truncate(x));
86 out2.* = @as(u64, @truncate(x >> 64));
54 const x = @as(u128, arg1) * arg2;
55 out1.* = @truncate(x);
56 out2.* = @intCast(x >> 64);
8757}
8858
89/// The function cmovznzU64 is a single-word conditional move.
90///
91/// Postconditions:
92/// out1 = (if arg1 = 0 then arg2 else arg3)
93///
94/// Input Bounds:
95/// arg1: [0x0 ~> 0x1]
96/// arg2: [0x0 ~> 0xffffffffffffffff]
97/// arg3: [0x0 ~> 0xffffffffffffffff]
98/// Output Bounds:
99/// out1: [0x0 ~> 0xffffffffffffffff]
59/// Keep selection masks opaque to the optimizer without adding instructions.
60fn selectionMaskU64(arg1: u1) u64 {
61 @setRuntimeSafety(mode == .debug);
62
63 const value: u64 = 0 -% @as(u64, arg1);
64 if (@inComptime()) return value;
65 switch (@import("builtin").zig_backend) {
66 .stage2_c, .stage2_wasm => return value,
67 else => {},
68 }
69 if (@bitSizeOf(u64) <= @bitSizeOf(usize)) {
70 return asm (""
71 : [mask] "=r" (-> u64),
72 : [value] "0" (value),
73 );
74 }
75 var mask: u64 = 0;
76 inline for (0..@divExact(@bitSizeOf(u64), @bitSizeOf(usize))) |i| {
77 const shift = i * @bitSizeOf(usize);
78 const chunk: usize = @truncate(value >> shift);
79 const part = asm (""
80 : [mask] "=r" (-> usize),
81 : [value] "0" (chunk),
82 );
83 mask |= @as(u64, part) << shift;
84 }
85 return mask;
86}
87
88/// Select arg2 when arg1 is zero and arg3 otherwise, using a bit mask.
10089fn cmovznzU64(out1: *u64, arg1: u1, arg2: u64, arg3: u64) void {
10190 @setRuntimeSafety(mode == .debug);
10291
103 const mask = 0 -% @as(u64, arg1);
104 out1.* = (mask & arg3) | ((~mask) & arg2);
92 const mask = selectionMaskU64(arg1);
93 out1.* = arg2 ^ ((arg2 ^ arg3) & mask);
10594}
10695
10796/// The function mul multiplies two field elements in the Montgomery domain.
......@@ -116,30 +105,30 @@ fn cmovznzU64(out1: *u64, arg1: u1, arg2: u64, arg3: u64) void {
116105pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldElement, arg2: MontgomeryDomainFieldElement) void {
117106 @setRuntimeSafety(mode == .debug);
118107
119 const x1 = (arg1[1]);
120 const x2 = (arg1[2]);
121 const x3 = (arg1[3]);
122 const x4 = (arg1[4]);
123 const x5 = (arg1[5]);
124 const x6 = (arg1[0]);
108 const x1: u64 = arg1[1];
109 const x2: u64 = arg1[2];
110 const x3: u64 = arg1[3];
111 const x4: u64 = arg1[4];
112 const x5: u64 = arg1[5];
113 const x6: u64 = arg1[0];
125114 var x7: u64 = undefined;
126115 var x8: u64 = undefined;
127 mulxU64(&x7, &x8, x6, (arg2[5]));
116 mulxU64(&x7, &x8, x6, arg2[5]);
128117 var x9: u64 = undefined;
129118 var x10: u64 = undefined;
130 mulxU64(&x9, &x10, x6, (arg2[4]));
119 mulxU64(&x9, &x10, x6, arg2[4]);
131120 var x11: u64 = undefined;
132121 var x12: u64 = undefined;
133 mulxU64(&x11, &x12, x6, (arg2[3]));
122 mulxU64(&x11, &x12, x6, arg2[3]);
134123 var x13: u64 = undefined;
135124 var x14: u64 = undefined;
136 mulxU64(&x13, &x14, x6, (arg2[2]));
125 mulxU64(&x13, &x14, x6, arg2[2]);
137126 var x15: u64 = undefined;
138127 var x16: u64 = undefined;
139 mulxU64(&x15, &x16, x6, (arg2[1]));
128 mulxU64(&x15, &x16, x6, arg2[1]);
140129 var x17: u64 = undefined;
141130 var x18: u64 = undefined;
142 mulxU64(&x17, &x18, x6, (arg2[0]));
131 mulxU64(&x17, &x18, x6, arg2[0]);
143132 var x19: u64 = undefined;
144133 var x20: u1 = undefined;
145134 addcarryxU64(&x19, &x20, 0x0, x18, x15);
......@@ -155,7 +144,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
155144 var x27: u64 = undefined;
156145 var x28: u1 = undefined;
157146 addcarryxU64(&x27, &x28, x26, x10, x7);
158 const x29 = (@as(u64, x28) + x8);
147 const x29: u64 = (x28 + x8);
159148 var x30: u64 = undefined;
160149 var x31: u64 = undefined;
161150 mulxU64(&x30, &x31, x17, 0x6ed46089e88fdc45);
......@@ -192,7 +181,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
192181 var x52: u64 = undefined;
193182 var x53: u1 = undefined;
194183 addcarryxU64(&x52, &x53, x51, x35, x32);
195 const x54 = (@as(u64, x53) + x33);
184 const x54: u64 = (x53 + x33);
196185 var x55: u64 = undefined;
197186 var x56: u1 = undefined;
198187 addcarryxU64(&x55, &x56, 0x0, x17, x42);
......@@ -216,22 +205,22 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
216205 addcarryxU64(&x67, &x68, x66, x29, x54);
217206 var x69: u64 = undefined;
218207 var x70: u64 = undefined;
219 mulxU64(&x69, &x70, x1, (arg2[5]));
208 mulxU64(&x69, &x70, x1, arg2[5]);
220209 var x71: u64 = undefined;
221210 var x72: u64 = undefined;
222 mulxU64(&x71, &x72, x1, (arg2[4]));
211 mulxU64(&x71, &x72, x1, arg2[4]);
223212 var x73: u64 = undefined;
224213 var x74: u64 = undefined;
225 mulxU64(&x73, &x74, x1, (arg2[3]));
214 mulxU64(&x73, &x74, x1, arg2[3]);
226215 var x75: u64 = undefined;
227216 var x76: u64 = undefined;
228 mulxU64(&x75, &x76, x1, (arg2[2]));
217 mulxU64(&x75, &x76, x1, arg2[2]);
229218 var x77: u64 = undefined;
230219 var x78: u64 = undefined;
231 mulxU64(&x77, &x78, x1, (arg2[1]));
220 mulxU64(&x77, &x78, x1, arg2[1]);
232221 var x79: u64 = undefined;
233222 var x80: u64 = undefined;
234 mulxU64(&x79, &x80, x1, (arg2[0]));
223 mulxU64(&x79, &x80, x1, arg2[0]);
235224 var x81: u64 = undefined;
236225 var x82: u1 = undefined;
237226 addcarryxU64(&x81, &x82, 0x0, x80, x77);
......@@ -247,7 +236,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
247236 var x89: u64 = undefined;
248237 var x90: u1 = undefined;
249238 addcarryxU64(&x89, &x90, x88, x72, x69);
250 const x91 = (@as(u64, x90) + x70);
239 const x91: u64 = (x90 + x70);
251240 var x92: u64 = undefined;
252241 var x93: u1 = undefined;
253242 addcarryxU64(&x92, &x93, 0x0, x57, x79);
......@@ -268,7 +257,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
268257 addcarryxU64(&x102, &x103, x101, x67, x89);
269258 var x104: u64 = undefined;
270259 var x105: u1 = undefined;
271 addcarryxU64(&x104, &x105, x103, @as(u64, x68), x91);
260 addcarryxU64(&x104, &x105, x103, x68, x91);
272261 var x106: u64 = undefined;
273262 var x107: u64 = undefined;
274263 mulxU64(&x106, &x107, x92, 0x6ed46089e88fdc45);
......@@ -305,7 +294,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
305294 var x128: u64 = undefined;
306295 var x129: u1 = undefined;
307296 addcarryxU64(&x128, &x129, x127, x111, x108);
308 const x130 = (@as(u64, x129) + x109);
297 const x130: u64 = (x129 + x109);
309298 var x131: u64 = undefined;
310299 var x132: u1 = undefined;
311300 addcarryxU64(&x131, &x132, 0x0, x92, x118);
......@@ -327,25 +316,25 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
327316 var x143: u64 = undefined;
328317 var x144: u1 = undefined;
329318 addcarryxU64(&x143, &x144, x142, x104, x130);
330 const x145 = (@as(u64, x144) + @as(u64, x105));
319 const x145: u64 = (@as(u64, x144) + x105);
331320 var x146: u64 = undefined;
332321 var x147: u64 = undefined;
333 mulxU64(&x146, &x147, x2, (arg2[5]));
322 mulxU64(&x146, &x147, x2, arg2[5]);
334323 var x148: u64 = undefined;
335324 var x149: u64 = undefined;
336 mulxU64(&x148, &x149, x2, (arg2[4]));
325 mulxU64(&x148, &x149, x2, arg2[4]);
337326 var x150: u64 = undefined;
338327 var x151: u64 = undefined;
339 mulxU64(&x150, &x151, x2, (arg2[3]));
328 mulxU64(&x150, &x151, x2, arg2[3]);
340329 var x152: u64 = undefined;
341330 var x153: u64 = undefined;
342 mulxU64(&x152, &x153, x2, (arg2[2]));
331 mulxU64(&x152, &x153, x2, arg2[2]);
343332 var x154: u64 = undefined;
344333 var x155: u64 = undefined;
345 mulxU64(&x154, &x155, x2, (arg2[1]));
334 mulxU64(&x154, &x155, x2, arg2[1]);
346335 var x156: u64 = undefined;
347336 var x157: u64 = undefined;
348 mulxU64(&x156, &x157, x2, (arg2[0]));
337 mulxU64(&x156, &x157, x2, arg2[0]);
349338 var x158: u64 = undefined;
350339 var x159: u1 = undefined;
351340 addcarryxU64(&x158, &x159, 0x0, x157, x154);
......@@ -361,7 +350,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
361350 var x166: u64 = undefined;
362351 var x167: u1 = undefined;
363352 addcarryxU64(&x166, &x167, x165, x149, x146);
364 const x168 = (@as(u64, x167) + x147);
353 const x168: u64 = (x167 + x147);
365354 var x169: u64 = undefined;
366355 var x170: u1 = undefined;
367356 addcarryxU64(&x169, &x170, 0x0, x133, x156);
......@@ -419,7 +408,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
419408 var x205: u64 = undefined;
420409 var x206: u1 = undefined;
421410 addcarryxU64(&x205, &x206, x204, x188, x185);
422 const x207 = (@as(u64, x206) + x186);
411 const x207: u64 = (x206 + x186);
423412 var x208: u64 = undefined;
424413 var x209: u1 = undefined;
425414 addcarryxU64(&x208, &x209, 0x0, x169, x195);
......@@ -441,25 +430,25 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
441430 var x220: u64 = undefined;
442431 var x221: u1 = undefined;
443432 addcarryxU64(&x220, &x221, x219, x181, x207);
444 const x222 = (@as(u64, x221) + @as(u64, x182));
433 const x222: u64 = (@as(u64, x221) + x182);
445434 var x223: u64 = undefined;
446435 var x224: u64 = undefined;
447 mulxU64(&x223, &x224, x3, (arg2[5]));
436 mulxU64(&x223, &x224, x3, arg2[5]);
448437 var x225: u64 = undefined;
449438 var x226: u64 = undefined;
450 mulxU64(&x225, &x226, x3, (arg2[4]));
439 mulxU64(&x225, &x226, x3, arg2[4]);
451440 var x227: u64 = undefined;
452441 var x228: u64 = undefined;
453 mulxU64(&x227, &x228, x3, (arg2[3]));
442 mulxU64(&x227, &x228, x3, arg2[3]);
454443 var x229: u64 = undefined;
455444 var x230: u64 = undefined;
456 mulxU64(&x229, &x230, x3, (arg2[2]));
445 mulxU64(&x229, &x230, x3, arg2[2]);
457446 var x231: u64 = undefined;
458447 var x232: u64 = undefined;
459 mulxU64(&x231, &x232, x3, (arg2[1]));
448 mulxU64(&x231, &x232, x3, arg2[1]);
460449 var x233: u64 = undefined;
461450 var x234: u64 = undefined;
462 mulxU64(&x233, &x234, x3, (arg2[0]));
451 mulxU64(&x233, &x234, x3, arg2[0]);
463452 var x235: u64 = undefined;
464453 var x236: u1 = undefined;
465454 addcarryxU64(&x235, &x236, 0x0, x234, x231);
......@@ -475,7 +464,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
475464 var x243: u64 = undefined;
476465 var x244: u1 = undefined;
477466 addcarryxU64(&x243, &x244, x242, x226, x223);
478 const x245 = (@as(u64, x244) + x224);
467 const x245: u64 = (x244 + x224);
479468 var x246: u64 = undefined;
480469 var x247: u1 = undefined;
481470 addcarryxU64(&x246, &x247, 0x0, x210, x233);
......@@ -533,7 +522,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
533522 var x282: u64 = undefined;
534523 var x283: u1 = undefined;
535524 addcarryxU64(&x282, &x283, x281, x265, x262);
536 const x284 = (@as(u64, x283) + x263);
525 const x284: u64 = (x283 + x263);
537526 var x285: u64 = undefined;
538527 var x286: u1 = undefined;
539528 addcarryxU64(&x285, &x286, 0x0, x246, x272);
......@@ -555,25 +544,25 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
555544 var x297: u64 = undefined;
556545 var x298: u1 = undefined;
557546 addcarryxU64(&x297, &x298, x296, x258, x284);
558 const x299 = (@as(u64, x298) + @as(u64, x259));
547 const x299: u64 = (@as(u64, x298) + x259);
559548 var x300: u64 = undefined;
560549 var x301: u64 = undefined;
561 mulxU64(&x300, &x301, x4, (arg2[5]));
550 mulxU64(&x300, &x301, x4, arg2[5]);
562551 var x302: u64 = undefined;
563552 var x303: u64 = undefined;
564 mulxU64(&x302, &x303, x4, (arg2[4]));
553 mulxU64(&x302, &x303, x4, arg2[4]);
565554 var x304: u64 = undefined;
566555 var x305: u64 = undefined;
567 mulxU64(&x304, &x305, x4, (arg2[3]));
556 mulxU64(&x304, &x305, x4, arg2[3]);
568557 var x306: u64 = undefined;
569558 var x307: u64 = undefined;
570 mulxU64(&x306, &x307, x4, (arg2[2]));
559 mulxU64(&x306, &x307, x4, arg2[2]);
571560 var x308: u64 = undefined;
572561 var x309: u64 = undefined;
573 mulxU64(&x308, &x309, x4, (arg2[1]));
562 mulxU64(&x308, &x309, x4, arg2[1]);
574563 var x310: u64 = undefined;
575564 var x311: u64 = undefined;
576 mulxU64(&x310, &x311, x4, (arg2[0]));
565 mulxU64(&x310, &x311, x4, arg2[0]);
577566 var x312: u64 = undefined;
578567 var x313: u1 = undefined;
579568 addcarryxU64(&x312, &x313, 0x0, x311, x308);
......@@ -589,7 +578,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
589578 var x320: u64 = undefined;
590579 var x321: u1 = undefined;
591580 addcarryxU64(&x320, &x321, x319, x303, x300);
592 const x322 = (@as(u64, x321) + x301);
581 const x322: u64 = (x321 + x301);
593582 var x323: u64 = undefined;
594583 var x324: u1 = undefined;
595584 addcarryxU64(&x323, &x324, 0x0, x287, x310);
......@@ -647,7 +636,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
647636 var x359: u64 = undefined;
648637 var x360: u1 = undefined;
649638 addcarryxU64(&x359, &x360, x358, x342, x339);
650 const x361 = (@as(u64, x360) + x340);
639 const x361: u64 = (x360 + x340);
651640 var x362: u64 = undefined;
652641 var x363: u1 = undefined;
653642 addcarryxU64(&x362, &x363, 0x0, x323, x349);
......@@ -669,25 +658,25 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
669658 var x374: u64 = undefined;
670659 var x375: u1 = undefined;
671660 addcarryxU64(&x374, &x375, x373, x335, x361);
672 const x376 = (@as(u64, x375) + @as(u64, x336));
661 const x376: u64 = (@as(u64, x375) + x336);
673662 var x377: u64 = undefined;
674663 var x378: u64 = undefined;
675 mulxU64(&x377, &x378, x5, (arg2[5]));
664 mulxU64(&x377, &x378, x5, arg2[5]);
676665 var x379: u64 = undefined;
677666 var x380: u64 = undefined;
678 mulxU64(&x379, &x380, x5, (arg2[4]));
667 mulxU64(&x379, &x380, x5, arg2[4]);
679668 var x381: u64 = undefined;
680669 var x382: u64 = undefined;
681 mulxU64(&x381, &x382, x5, (arg2[3]));
670 mulxU64(&x381, &x382, x5, arg2[3]);
682671 var x383: u64 = undefined;
683672 var x384: u64 = undefined;
684 mulxU64(&x383, &x384, x5, (arg2[2]));
673 mulxU64(&x383, &x384, x5, arg2[2]);
685674 var x385: u64 = undefined;
686675 var x386: u64 = undefined;
687 mulxU64(&x385, &x386, x5, (arg2[1]));
676 mulxU64(&x385, &x386, x5, arg2[1]);
688677 var x387: u64 = undefined;
689678 var x388: u64 = undefined;
690 mulxU64(&x387, &x388, x5, (arg2[0]));
679 mulxU64(&x387, &x388, x5, arg2[0]);
691680 var x389: u64 = undefined;
692681 var x390: u1 = undefined;
693682 addcarryxU64(&x389, &x390, 0x0, x388, x385);
......@@ -703,7 +692,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
703692 var x397: u64 = undefined;
704693 var x398: u1 = undefined;
705694 addcarryxU64(&x397, &x398, x396, x380, x377);
706 const x399 = (@as(u64, x398) + x378);
695 const x399: u64 = (x398 + x378);
707696 var x400: u64 = undefined;
708697 var x401: u1 = undefined;
709698 addcarryxU64(&x400, &x401, 0x0, x364, x387);
......@@ -761,7 +750,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
761750 var x436: u64 = undefined;
762751 var x437: u1 = undefined;
763752 addcarryxU64(&x436, &x437, x435, x419, x416);
764 const x438 = (@as(u64, x437) + x417);
753 const x438: u64 = (x437 + x417);
765754 var x439: u64 = undefined;
766755 var x440: u1 = undefined;
767756 addcarryxU64(&x439, &x440, 0x0, x400, x426);
......@@ -783,7 +772,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
783772 var x451: u64 = undefined;
784773 var x452: u1 = undefined;
785774 addcarryxU64(&x451, &x452, x450, x412, x438);
786 const x453 = (@as(u64, x452) + @as(u64, x413));
775 const x453: u64 = (@as(u64, x452) + x413);
787776 var x454: u64 = undefined;
788777 var x455: u1 = undefined;
789778 subborrowxU64(&x454, &x455, 0x0, x441, 0xecec196accc52973);
......@@ -806,17 +795,18 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
806795 var x467: u1 = undefined;
807796 subborrowxU64(&x466, &x467, x465, x453, 0x0);
808797 var x468: u64 = undefined;
809 cmovznzU64(&x468, x467, x454, x441);
798 const x468_selection_mask = selectionMaskU64(x467);
799 x468 = x454 ^ ((x454 ^ x441) & x468_selection_mask);
810800 var x469: u64 = undefined;
811 cmovznzU64(&x469, x467, x456, x443);
801 x469 = x456 ^ ((x456 ^ x443) & x468_selection_mask);
812802 var x470: u64 = undefined;
813 cmovznzU64(&x470, x467, x458, x445);
803 x470 = x458 ^ ((x458 ^ x445) & x468_selection_mask);
814804 var x471: u64 = undefined;
815 cmovznzU64(&x471, x467, x460, x447);
805 x471 = x460 ^ ((x460 ^ x447) & x468_selection_mask);
816806 var x472: u64 = undefined;
817 cmovznzU64(&x472, x467, x462, x449);
807 x472 = x462 ^ ((x462 ^ x449) & x468_selection_mask);
818808 var x473: u64 = undefined;
819 cmovznzU64(&x473, x467, x464, x451);
809 x473 = x464 ^ ((x464 ^ x451) & x468_selection_mask);
820810 out1[0] = x468;
821811 out1[1] = x469;
822812 out1[2] = x470;
......@@ -836,30 +826,30 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
836826pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldElement) void {
837827 @setRuntimeSafety(mode == .debug);
838828
839 const x1 = (arg1[1]);
840 const x2 = (arg1[2]);
841 const x3 = (arg1[3]);
842 const x4 = (arg1[4]);
843 const x5 = (arg1[5]);
844 const x6 = (arg1[0]);
829 const x1: u64 = arg1[1];
830 const x2: u64 = arg1[2];
831 const x3: u64 = arg1[3];
832 const x4: u64 = arg1[4];
833 const x5: u64 = arg1[5];
834 const x6: u64 = arg1[0];
845835 var x7: u64 = undefined;
846836 var x8: u64 = undefined;
847 mulxU64(&x7, &x8, x6, (arg1[5]));
837 mulxU64(&x7, &x8, x6, arg1[5]);
848838 var x9: u64 = undefined;
849839 var x10: u64 = undefined;
850 mulxU64(&x9, &x10, x6, (arg1[4]));
840 mulxU64(&x9, &x10, x6, arg1[4]);
851841 var x11: u64 = undefined;
852842 var x12: u64 = undefined;
853 mulxU64(&x11, &x12, x6, (arg1[3]));
843 mulxU64(&x11, &x12, x6, arg1[3]);
854844 var x13: u64 = undefined;
855845 var x14: u64 = undefined;
856 mulxU64(&x13, &x14, x6, (arg1[2]));
846 mulxU64(&x13, &x14, x6, arg1[2]);
857847 var x15: u64 = undefined;
858848 var x16: u64 = undefined;
859 mulxU64(&x15, &x16, x6, (arg1[1]));
849 mulxU64(&x15, &x16, x6, arg1[1]);
860850 var x17: u64 = undefined;
861851 var x18: u64 = undefined;
862 mulxU64(&x17, &x18, x6, (arg1[0]));
852 mulxU64(&x17, &x18, x6, arg1[0]);
863853 var x19: u64 = undefined;
864854 var x20: u1 = undefined;
865855 addcarryxU64(&x19, &x20, 0x0, x18, x15);
......@@ -875,7 +865,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
875865 var x27: u64 = undefined;
876866 var x28: u1 = undefined;
877867 addcarryxU64(&x27, &x28, x26, x10, x7);
878 const x29 = (@as(u64, x28) + x8);
868 const x29: u64 = (x28 + x8);
879869 var x30: u64 = undefined;
880870 var x31: u64 = undefined;
881871 mulxU64(&x30, &x31, x17, 0x6ed46089e88fdc45);
......@@ -912,7 +902,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
912902 var x52: u64 = undefined;
913903 var x53: u1 = undefined;
914904 addcarryxU64(&x52, &x53, x51, x35, x32);
915 const x54 = (@as(u64, x53) + x33);
905 const x54: u64 = (x53 + x33);
916906 var x55: u64 = undefined;
917907 var x56: u1 = undefined;
918908 addcarryxU64(&x55, &x56, 0x0, x17, x42);
......@@ -936,22 +926,22 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
936926 addcarryxU64(&x67, &x68, x66, x29, x54);
937927 var x69: u64 = undefined;
938928 var x70: u64 = undefined;
939 mulxU64(&x69, &x70, x1, (arg1[5]));
929 mulxU64(&x69, &x70, x1, arg1[5]);
940930 var x71: u64 = undefined;
941931 var x72: u64 = undefined;
942 mulxU64(&x71, &x72, x1, (arg1[4]));
932 mulxU64(&x71, &x72, x1, arg1[4]);
943933 var x73: u64 = undefined;
944934 var x74: u64 = undefined;
945 mulxU64(&x73, &x74, x1, (arg1[3]));
935 mulxU64(&x73, &x74, x1, arg1[3]);
946936 var x75: u64 = undefined;
947937 var x76: u64 = undefined;
948 mulxU64(&x75, &x76, x1, (arg1[2]));
938 mulxU64(&x75, &x76, x1, arg1[2]);
949939 var x77: u64 = undefined;
950940 var x78: u64 = undefined;
951 mulxU64(&x77, &x78, x1, (arg1[1]));
941 mulxU64(&x77, &x78, x1, arg1[1]);
952942 var x79: u64 = undefined;
953943 var x80: u64 = undefined;
954 mulxU64(&x79, &x80, x1, (arg1[0]));
944 mulxU64(&x79, &x80, x1, arg1[0]);
955945 var x81: u64 = undefined;
956946 var x82: u1 = undefined;
957947 addcarryxU64(&x81, &x82, 0x0, x80, x77);
......@@ -967,7 +957,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
967957 var x89: u64 = undefined;
968958 var x90: u1 = undefined;
969959 addcarryxU64(&x89, &x90, x88, x72, x69);
970 const x91 = (@as(u64, x90) + x70);
960 const x91: u64 = (x90 + x70);
971961 var x92: u64 = undefined;
972962 var x93: u1 = undefined;
973963 addcarryxU64(&x92, &x93, 0x0, x57, x79);
......@@ -988,7 +978,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
988978 addcarryxU64(&x102, &x103, x101, x67, x89);
989979 var x104: u64 = undefined;
990980 var x105: u1 = undefined;
991 addcarryxU64(&x104, &x105, x103, @as(u64, x68), x91);
981 addcarryxU64(&x104, &x105, x103, x68, x91);
992982 var x106: u64 = undefined;
993983 var x107: u64 = undefined;
994984 mulxU64(&x106, &x107, x92, 0x6ed46089e88fdc45);
......@@ -1025,7 +1015,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
10251015 var x128: u64 = undefined;
10261016 var x129: u1 = undefined;
10271017 addcarryxU64(&x128, &x129, x127, x111, x108);
1028 const x130 = (@as(u64, x129) + x109);
1018 const x130: u64 = (x129 + x109);
10291019 var x131: u64 = undefined;
10301020 var x132: u1 = undefined;
10311021 addcarryxU64(&x131, &x132, 0x0, x92, x118);
......@@ -1047,25 +1037,25 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
10471037 var x143: u64 = undefined;
10481038 var x144: u1 = undefined;
10491039 addcarryxU64(&x143, &x144, x142, x104, x130);
1050 const x145 = (@as(u64, x144) + @as(u64, x105));
1040 const x145: u64 = (@as(u64, x144) + x105);
10511041 var x146: u64 = undefined;
10521042 var x147: u64 = undefined;
1053 mulxU64(&x146, &x147, x2, (arg1[5]));
1043 mulxU64(&x146, &x147, x2, arg1[5]);
10541044 var x148: u64 = undefined;
10551045 var x149: u64 = undefined;
1056 mulxU64(&x148, &x149, x2, (arg1[4]));
1046 mulxU64(&x148, &x149, x2, arg1[4]);
10571047 var x150: u64 = undefined;
10581048 var x151: u64 = undefined;
1059 mulxU64(&x150, &x151, x2, (arg1[3]));
1049 mulxU64(&x150, &x151, x2, arg1[3]);
10601050 var x152: u64 = undefined;
10611051 var x153: u64 = undefined;
1062 mulxU64(&x152, &x153, x2, (arg1[2]));
1052 mulxU64(&x152, &x153, x2, arg1[2]);
10631053 var x154: u64 = undefined;
10641054 var x155: u64 = undefined;
1065 mulxU64(&x154, &x155, x2, (arg1[1]));
1055 mulxU64(&x154, &x155, x2, arg1[1]);
10661056 var x156: u64 = undefined;
10671057 var x157: u64 = undefined;
1068 mulxU64(&x156, &x157, x2, (arg1[0]));
1058 mulxU64(&x156, &x157, x2, arg1[0]);
10691059 var x158: u64 = undefined;
10701060 var x159: u1 = undefined;
10711061 addcarryxU64(&x158, &x159, 0x0, x157, x154);
......@@ -1081,7 +1071,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
10811071 var x166: u64 = undefined;
10821072 var x167: u1 = undefined;
10831073 addcarryxU64(&x166, &x167, x165, x149, x146);
1084 const x168 = (@as(u64, x167) + x147);
1074 const x168: u64 = (x167 + x147);
10851075 var x169: u64 = undefined;
10861076 var x170: u1 = undefined;
10871077 addcarryxU64(&x169, &x170, 0x0, x133, x156);
......@@ -1139,7 +1129,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
11391129 var x205: u64 = undefined;
11401130 var x206: u1 = undefined;
11411131 addcarryxU64(&x205, &x206, x204, x188, x185);
1142 const x207 = (@as(u64, x206) + x186);
1132 const x207: u64 = (x206 + x186);
11431133 var x208: u64 = undefined;
11441134 var x209: u1 = undefined;
11451135 addcarryxU64(&x208, &x209, 0x0, x169, x195);
......@@ -1161,25 +1151,25 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
11611151 var x220: u64 = undefined;
11621152 var x221: u1 = undefined;
11631153 addcarryxU64(&x220, &x221, x219, x181, x207);
1164 const x222 = (@as(u64, x221) + @as(u64, x182));
1154 const x222: u64 = (@as(u64, x221) + x182);
11651155 var x223: u64 = undefined;
11661156 var x224: u64 = undefined;
1167 mulxU64(&x223, &x224, x3, (arg1[5]));
1157 mulxU64(&x223, &x224, x3, arg1[5]);
11681158 var x225: u64 = undefined;
11691159 var x226: u64 = undefined;
1170 mulxU64(&x225, &x226, x3, (arg1[4]));
1160 mulxU64(&x225, &x226, x3, arg1[4]);
11711161 var x227: u64 = undefined;
11721162 var x228: u64 = undefined;
1173 mulxU64(&x227, &x228, x3, (arg1[3]));
1163 mulxU64(&x227, &x228, x3, arg1[3]);
11741164 var x229: u64 = undefined;
11751165 var x230: u64 = undefined;
1176 mulxU64(&x229, &x230, x3, (arg1[2]));
1166 mulxU64(&x229, &x230, x3, arg1[2]);
11771167 var x231: u64 = undefined;
11781168 var x232: u64 = undefined;
1179 mulxU64(&x231, &x232, x3, (arg1[1]));
1169 mulxU64(&x231, &x232, x3, arg1[1]);
11801170 var x233: u64 = undefined;
11811171 var x234: u64 = undefined;
1182 mulxU64(&x233, &x234, x3, (arg1[0]));
1172 mulxU64(&x233, &x234, x3, arg1[0]);
11831173 var x235: u64 = undefined;
11841174 var x236: u1 = undefined;
11851175 addcarryxU64(&x235, &x236, 0x0, x234, x231);
......@@ -1195,7 +1185,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
11951185 var x243: u64 = undefined;
11961186 var x244: u1 = undefined;
11971187 addcarryxU64(&x243, &x244, x242, x226, x223);
1198 const x245 = (@as(u64, x244) + x224);
1188 const x245: u64 = (x244 + x224);
11991189 var x246: u64 = undefined;
12001190 var x247: u1 = undefined;
12011191 addcarryxU64(&x246, &x247, 0x0, x210, x233);
......@@ -1253,7 +1243,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
12531243 var x282: u64 = undefined;
12541244 var x283: u1 = undefined;
12551245 addcarryxU64(&x282, &x283, x281, x265, x262);
1256 const x284 = (@as(u64, x283) + x263);
1246 const x284: u64 = (x283 + x263);
12571247 var x285: u64 = undefined;
12581248 var x286: u1 = undefined;
12591249 addcarryxU64(&x285, &x286, 0x0, x246, x272);
......@@ -1275,25 +1265,25 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
12751265 var x297: u64 = undefined;
12761266 var x298: u1 = undefined;
12771267 addcarryxU64(&x297, &x298, x296, x258, x284);
1278 const x299 = (@as(u64, x298) + @as(u64, x259));
1268 const x299: u64 = (@as(u64, x298) + x259);
12791269 var x300: u64 = undefined;
12801270 var x301: u64 = undefined;
1281 mulxU64(&x300, &x301, x4, (arg1[5]));
1271 mulxU64(&x300, &x301, x4, arg1[5]);
12821272 var x302: u64 = undefined;
12831273 var x303: u64 = undefined;
1284 mulxU64(&x302, &x303, x4, (arg1[4]));
1274 mulxU64(&x302, &x303, x4, arg1[4]);
12851275 var x304: u64 = undefined;
12861276 var x305: u64 = undefined;
1287 mulxU64(&x304, &x305, x4, (arg1[3]));
1277 mulxU64(&x304, &x305, x4, arg1[3]);
12881278 var x306: u64 = undefined;
12891279 var x307: u64 = undefined;
1290 mulxU64(&x306, &x307, x4, (arg1[2]));
1280 mulxU64(&x306, &x307, x4, arg1[2]);
12911281 var x308: u64 = undefined;
12921282 var x309: u64 = undefined;
1293 mulxU64(&x308, &x309, x4, (arg1[1]));
1283 mulxU64(&x308, &x309, x4, arg1[1]);
12941284 var x310: u64 = undefined;
12951285 var x311: u64 = undefined;
1296 mulxU64(&x310, &x311, x4, (arg1[0]));
1286 mulxU64(&x310, &x311, x4, arg1[0]);
12971287 var x312: u64 = undefined;
12981288 var x313: u1 = undefined;
12991289 addcarryxU64(&x312, &x313, 0x0, x311, x308);
......@@ -1309,7 +1299,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
13091299 var x320: u64 = undefined;
13101300 var x321: u1 = undefined;
13111301 addcarryxU64(&x320, &x321, x319, x303, x300);
1312 const x322 = (@as(u64, x321) + x301);
1302 const x322: u64 = (x321 + x301);
13131303 var x323: u64 = undefined;
13141304 var x324: u1 = undefined;
13151305 addcarryxU64(&x323, &x324, 0x0, x287, x310);
......@@ -1367,7 +1357,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
13671357 var x359: u64 = undefined;
13681358 var x360: u1 = undefined;
13691359 addcarryxU64(&x359, &x360, x358, x342, x339);
1370 const x361 = (@as(u64, x360) + x340);
1360 const x361: u64 = (x360 + x340);
13711361 var x362: u64 = undefined;
13721362 var x363: u1 = undefined;
13731363 addcarryxU64(&x362, &x363, 0x0, x323, x349);
......@@ -1389,25 +1379,25 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
13891379 var x374: u64 = undefined;
13901380 var x375: u1 = undefined;
13911381 addcarryxU64(&x374, &x375, x373, x335, x361);
1392 const x376 = (@as(u64, x375) + @as(u64, x336));
1382 const x376: u64 = (@as(u64, x375) + x336);
13931383 var x377: u64 = undefined;
13941384 var x378: u64 = undefined;
1395 mulxU64(&x377, &x378, x5, (arg1[5]));
1385 mulxU64(&x377, &x378, x5, arg1[5]);
13961386 var x379: u64 = undefined;
13971387 var x380: u64 = undefined;
1398 mulxU64(&x379, &x380, x5, (arg1[4]));
1388 mulxU64(&x379, &x380, x5, arg1[4]);
13991389 var x381: u64 = undefined;
14001390 var x382: u64 = undefined;
1401 mulxU64(&x381, &x382, x5, (arg1[3]));
1391 mulxU64(&x381, &x382, x5, arg1[3]);
14021392 var x383: u64 = undefined;
14031393 var x384: u64 = undefined;
1404 mulxU64(&x383, &x384, x5, (arg1[2]));
1394 mulxU64(&x383, &x384, x5, arg1[2]);
14051395 var x385: u64 = undefined;
14061396 var x386: u64 = undefined;
1407 mulxU64(&x385, &x386, x5, (arg1[1]));
1397 mulxU64(&x385, &x386, x5, arg1[1]);
14081398 var x387: u64 = undefined;
14091399 var x388: u64 = undefined;
1410 mulxU64(&x387, &x388, x5, (arg1[0]));
1400 mulxU64(&x387, &x388, x5, arg1[0]);
14111401 var x389: u64 = undefined;
14121402 var x390: u1 = undefined;
14131403 addcarryxU64(&x389, &x390, 0x0, x388, x385);
......@@ -1423,7 +1413,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
14231413 var x397: u64 = undefined;
14241414 var x398: u1 = undefined;
14251415 addcarryxU64(&x397, &x398, x396, x380, x377);
1426 const x399 = (@as(u64, x398) + x378);
1416 const x399: u64 = (x398 + x378);
14271417 var x400: u64 = undefined;
14281418 var x401: u1 = undefined;
14291419 addcarryxU64(&x400, &x401, 0x0, x364, x387);
......@@ -1481,7 +1471,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
14811471 var x436: u64 = undefined;
14821472 var x437: u1 = undefined;
14831473 addcarryxU64(&x436, &x437, x435, x419, x416);
1484 const x438 = (@as(u64, x437) + x417);
1474 const x438: u64 = (x437 + x417);
14851475 var x439: u64 = undefined;
14861476 var x440: u1 = undefined;
14871477 addcarryxU64(&x439, &x440, 0x0, x400, x426);
......@@ -1503,7 +1493,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
15031493 var x451: u64 = undefined;
15041494 var x452: u1 = undefined;
15051495 addcarryxU64(&x451, &x452, x450, x412, x438);
1506 const x453 = (@as(u64, x452) + @as(u64, x413));
1496 const x453: u64 = (@as(u64, x452) + x413);
15071497 var x454: u64 = undefined;
15081498 var x455: u1 = undefined;
15091499 subborrowxU64(&x454, &x455, 0x0, x441, 0xecec196accc52973);
......@@ -1526,17 +1516,18 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
15261516 var x467: u1 = undefined;
15271517 subborrowxU64(&x466, &x467, x465, x453, 0x0);
15281518 var x468: u64 = undefined;
1529 cmovznzU64(&x468, x467, x454, x441);
1519 const x468_selection_mask = selectionMaskU64(x467);
1520 x468 = x454 ^ ((x454 ^ x441) & x468_selection_mask);
15301521 var x469: u64 = undefined;
1531 cmovznzU64(&x469, x467, x456, x443);
1522 x469 = x456 ^ ((x456 ^ x443) & x468_selection_mask);
15321523 var x470: u64 = undefined;
1533 cmovznzU64(&x470, x467, x458, x445);
1524 x470 = x458 ^ ((x458 ^ x445) & x468_selection_mask);
15341525 var x471: u64 = undefined;
1535 cmovznzU64(&x471, x467, x460, x447);
1526 x471 = x460 ^ ((x460 ^ x447) & x468_selection_mask);
15361527 var x472: u64 = undefined;
1537 cmovznzU64(&x472, x467, x462, x449);
1528 x472 = x462 ^ ((x462 ^ x449) & x468_selection_mask);
15381529 var x473: u64 = undefined;
1539 cmovznzU64(&x473, x467, x464, x451);
1530 x473 = x464 ^ ((x464 ^ x451) & x468_selection_mask);
15401531 out1[0] = x468;
15411532 out1[1] = x469;
15421533 out1[2] = x470;
......@@ -1559,22 +1550,22 @@ pub fn add(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
15591550
15601551 var x1: u64 = undefined;
15611552 var x2: u1 = undefined;
1562 addcarryxU64(&x1, &x2, 0x0, (arg1[0]), (arg2[0]));
1553 addcarryxU64(&x1, &x2, 0x0, arg1[0], arg2[0]);
15631554 var x3: u64 = undefined;
15641555 var x4: u1 = undefined;
1565 addcarryxU64(&x3, &x4, x2, (arg1[1]), (arg2[1]));
1556 addcarryxU64(&x3, &x4, x2, arg1[1], arg2[1]);
15661557 var x5: u64 = undefined;
15671558 var x6: u1 = undefined;
1568 addcarryxU64(&x5, &x6, x4, (arg1[2]), (arg2[2]));
1559 addcarryxU64(&x5, &x6, x4, arg1[2], arg2[2]);
15691560 var x7: u64 = undefined;
15701561 var x8: u1 = undefined;
1571 addcarryxU64(&x7, &x8, x6, (arg1[3]), (arg2[3]));
1562 addcarryxU64(&x7, &x8, x6, arg1[3], arg2[3]);
15721563 var x9: u64 = undefined;
15731564 var x10: u1 = undefined;
1574 addcarryxU64(&x9, &x10, x8, (arg1[4]), (arg2[4]));
1565 addcarryxU64(&x9, &x10, x8, arg1[4], arg2[4]);
15751566 var x11: u64 = undefined;
15761567 var x12: u1 = undefined;
1577 addcarryxU64(&x11, &x12, x10, (arg1[5]), (arg2[5]));
1568 addcarryxU64(&x11, &x12, x10, arg1[5], arg2[5]);
15781569 var x13: u64 = undefined;
15791570 var x14: u1 = undefined;
15801571 subborrowxU64(&x13, &x14, 0x0, x1, 0xecec196accc52973);
......@@ -1595,19 +1586,20 @@ pub fn add(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
15951586 subborrowxU64(&x23, &x24, x22, x11, 0xffffffffffffffff);
15961587 var x25: u64 = undefined;
15971588 var x26: u1 = undefined;
1598 subborrowxU64(&x25, &x26, x24, @as(u64, x12), 0x0);
1589 subborrowxU64(&x25, &x26, x24, x12, 0x0);
15991590 var x27: u64 = undefined;
1600 cmovznzU64(&x27, x26, x13, x1);
1591 const x27_selection_mask = selectionMaskU64(x26);
1592 x27 = x13 ^ ((x13 ^ x1) & x27_selection_mask);
16011593 var x28: u64 = undefined;
1602 cmovznzU64(&x28, x26, x15, x3);
1594 x28 = x15 ^ ((x15 ^ x3) & x27_selection_mask);
16031595 var x29: u64 = undefined;
1604 cmovznzU64(&x29, x26, x17, x5);
1596 x29 = x17 ^ ((x17 ^ x5) & x27_selection_mask);
16051597 var x30: u64 = undefined;
1606 cmovznzU64(&x30, x26, x19, x7);
1598 x30 = x19 ^ ((x19 ^ x7) & x27_selection_mask);
16071599 var x31: u64 = undefined;
1608 cmovznzU64(&x31, x26, x21, x9);
1600 x31 = x21 ^ ((x21 ^ x9) & x27_selection_mask);
16091601 var x32: u64 = undefined;
1610 cmovznzU64(&x32, x26, x23, x11);
1602 x32 = x23 ^ ((x23 ^ x11) & x27_selection_mask);
16111603 out1[0] = x27;
16121604 out1[1] = x28;
16131605 out1[2] = x29;
......@@ -1630,24 +1622,25 @@ pub fn sub(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
16301622
16311623 var x1: u64 = undefined;
16321624 var x2: u1 = undefined;
1633 subborrowxU64(&x1, &x2, 0x0, (arg1[0]), (arg2[0]));
1625 subborrowxU64(&x1, &x2, 0x0, arg1[0], arg2[0]);
16341626 var x3: u64 = undefined;
16351627 var x4: u1 = undefined;
1636 subborrowxU64(&x3, &x4, x2, (arg1[1]), (arg2[1]));
1628 subborrowxU64(&x3, &x4, x2, arg1[1], arg2[1]);
16371629 var x5: u64 = undefined;
16381630 var x6: u1 = undefined;
1639 subborrowxU64(&x5, &x6, x4, (arg1[2]), (arg2[2]));
1631 subborrowxU64(&x5, &x6, x4, arg1[2], arg2[2]);
16401632 var x7: u64 = undefined;
16411633 var x8: u1 = undefined;
1642 subborrowxU64(&x7, &x8, x6, (arg1[3]), (arg2[3]));
1634 subborrowxU64(&x7, &x8, x6, arg1[3], arg2[3]);
16431635 var x9: u64 = undefined;
16441636 var x10: u1 = undefined;
1645 subborrowxU64(&x9, &x10, x8, (arg1[4]), (arg2[4]));
1637 subborrowxU64(&x9, &x10, x8, arg1[4], arg2[4]);
16461638 var x11: u64 = undefined;
16471639 var x12: u1 = undefined;
1648 subborrowxU64(&x11, &x12, x10, (arg1[5]), (arg2[5]));
1640 subborrowxU64(&x11, &x12, x10, arg1[5], arg2[5]);
16491641 var x13: u64 = undefined;
1650 cmovznzU64(&x13, x12, 0x0, 0xffffffffffffffff);
1642 const x13_selection_mask = selectionMaskU64(x12);
1643 x13 = 0x0 ^ ((0x0 ^ 0xffffffffffffffff) & x13_selection_mask);
16511644 var x14: u64 = undefined;
16521645 var x15: u1 = undefined;
16531646 addcarryxU64(&x14, &x15, 0x0, x1, (x13 & 0xecec196accc52973));
......@@ -1687,24 +1680,25 @@ pub fn opp(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
16871680
16881681 var x1: u64 = undefined;
16891682 var x2: u1 = undefined;
1690 subborrowxU64(&x1, &x2, 0x0, 0x0, (arg1[0]));
1683 subborrowxU64(&x1, &x2, 0x0, 0x0, arg1[0]);
16911684 var x3: u64 = undefined;
16921685 var x4: u1 = undefined;
1693 subborrowxU64(&x3, &x4, x2, 0x0, (arg1[1]));
1686 subborrowxU64(&x3, &x4, x2, 0x0, arg1[1]);
16941687 var x5: u64 = undefined;
16951688 var x6: u1 = undefined;
1696 subborrowxU64(&x5, &x6, x4, 0x0, (arg1[2]));
1689 subborrowxU64(&x5, &x6, x4, 0x0, arg1[2]);
16971690 var x7: u64 = undefined;
16981691 var x8: u1 = undefined;
1699 subborrowxU64(&x7, &x8, x6, 0x0, (arg1[3]));
1692 subborrowxU64(&x7, &x8, x6, 0x0, arg1[3]);
17001693 var x9: u64 = undefined;
17011694 var x10: u1 = undefined;
1702 subborrowxU64(&x9, &x10, x8, 0x0, (arg1[4]));
1695 subborrowxU64(&x9, &x10, x8, 0x0, arg1[4]);
17031696 var x11: u64 = undefined;
17041697 var x12: u1 = undefined;
1705 subborrowxU64(&x11, &x12, x10, 0x0, (arg1[5]));
1698 subborrowxU64(&x11, &x12, x10, 0x0, arg1[5]);
17061699 var x13: u64 = undefined;
1707 cmovznzU64(&x13, x12, 0x0, 0xffffffffffffffff);
1700 const x13_selection_mask = selectionMaskU64(x12);
1701 x13 = 0x0 ^ ((0x0 ^ 0xffffffffffffffff) & x13_selection_mask);
17081702 var x14: u64 = undefined;
17091703 var x15: u1 = undefined;
17101704 addcarryxU64(&x14, &x15, 0x0, x1, (x13 & 0xecec196accc52973));
......@@ -1742,7 +1736,7 @@ pub fn opp(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
17421736pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldElement) void {
17431737 @setRuntimeSafety(mode == .debug);
17441738
1745 const x1 = (arg1[0]);
1739 const x1: u64 = arg1[0];
17461740 var x2: u64 = undefined;
17471741 var x3: u64 = undefined;
17481742 mulxU64(&x2, &x3, x1, 0x6ed46089e88fdc45);
......@@ -1799,10 +1793,10 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo
17991793 addcarryxU64(&x36, &x37, x35, 0x0, x24);
18001794 var x38: u64 = undefined;
18011795 var x39: u1 = undefined;
1802 addcarryxU64(&x38, &x39, x37, 0x0, (@as(u64, x25) + x5));
1796 addcarryxU64(&x38, &x39, x37, 0x0, (x25 + x5));
18031797 var x40: u64 = undefined;
18041798 var x41: u1 = undefined;
1805 addcarryxU64(&x40, &x41, 0x0, x28, (arg1[1]));
1799 addcarryxU64(&x40, &x41, 0x0, x28, arg1[1]);
18061800 var x42: u64 = undefined;
18071801 var x43: u1 = undefined;
18081802 addcarryxU64(&x42, &x43, x41, x30, 0x0);
......@@ -1874,10 +1868,10 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo
18741868 addcarryxU64(&x86, &x87, x85, x50, x74);
18751869 var x88: u64 = undefined;
18761870 var x89: u1 = undefined;
1877 addcarryxU64(&x88, &x89, x87, (@as(u64, x51) + @as(u64, x39)), (@as(u64, x75) + x55));
1871 addcarryxU64(&x88, &x89, x87, (@as(u64, x51) + x39), (x75 + x55));
18781872 var x90: u64 = undefined;
18791873 var x91: u1 = undefined;
1880 addcarryxU64(&x90, &x91, 0x0, x78, (arg1[2]));
1874 addcarryxU64(&x90, &x91, 0x0, x78, arg1[2]);
18811875 var x92: u64 = undefined;
18821876 var x93: u1 = undefined;
18831877 addcarryxU64(&x92, &x93, x91, x80, 0x0);
......@@ -1949,10 +1943,10 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo
19491943 addcarryxU64(&x136, &x137, x135, x100, x124);
19501944 var x138: u64 = undefined;
19511945 var x139: u1 = undefined;
1952 addcarryxU64(&x138, &x139, x137, (@as(u64, x101) + @as(u64, x89)), (@as(u64, x125) + x105));
1946 addcarryxU64(&x138, &x139, x137, (@as(u64, x101) + x89), (x125 + x105));
19531947 var x140: u64 = undefined;
19541948 var x141: u1 = undefined;
1955 addcarryxU64(&x140, &x141, 0x0, x128, (arg1[3]));
1949 addcarryxU64(&x140, &x141, 0x0, x128, arg1[3]);
19561950 var x142: u64 = undefined;
19571951 var x143: u1 = undefined;
19581952 addcarryxU64(&x142, &x143, x141, x130, 0x0);
......@@ -2024,10 +2018,10 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo
20242018 addcarryxU64(&x186, &x187, x185, x150, x174);
20252019 var x188: u64 = undefined;
20262020 var x189: u1 = undefined;
2027 addcarryxU64(&x188, &x189, x187, (@as(u64, x151) + @as(u64, x139)), (@as(u64, x175) + x155));
2021 addcarryxU64(&x188, &x189, x187, (@as(u64, x151) + x139), (x175 + x155));
20282022 var x190: u64 = undefined;
20292023 var x191: u1 = undefined;
2030 addcarryxU64(&x190, &x191, 0x0, x178, (arg1[4]));
2024 addcarryxU64(&x190, &x191, 0x0, x178, arg1[4]);
20312025 var x192: u64 = undefined;
20322026 var x193: u1 = undefined;
20332027 addcarryxU64(&x192, &x193, x191, x180, 0x0);
......@@ -2099,10 +2093,10 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo
20992093 addcarryxU64(&x236, &x237, x235, x200, x224);
21002094 var x238: u64 = undefined;
21012095 var x239: u1 = undefined;
2102 addcarryxU64(&x238, &x239, x237, (@as(u64, x201) + @as(u64, x189)), (@as(u64, x225) + x205));
2096 addcarryxU64(&x238, &x239, x237, (@as(u64, x201) + x189), (x225 + x205));
21032097 var x240: u64 = undefined;
21042098 var x241: u1 = undefined;
2105 addcarryxU64(&x240, &x241, 0x0, x228, (arg1[5]));
2099 addcarryxU64(&x240, &x241, 0x0, x228, arg1[5]);
21062100 var x242: u64 = undefined;
21072101 var x243: u1 = undefined;
21082102 addcarryxU64(&x242, &x243, x241, x230, 0x0);
......@@ -2174,7 +2168,7 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo
21742168 addcarryxU64(&x286, &x287, x285, x250, x274);
21752169 var x288: u64 = undefined;
21762170 var x289: u1 = undefined;
2177 addcarryxU64(&x288, &x289, x287, (@as(u64, x251) + @as(u64, x239)), (@as(u64, x275) + x255));
2171 addcarryxU64(&x288, &x289, x287, (@as(u64, x251) + x239), (x275 + x255));
21782172 var x290: u64 = undefined;
21792173 var x291: u1 = undefined;
21802174 subborrowxU64(&x290, &x291, 0x0, x278, 0xecec196accc52973);
......@@ -2195,19 +2189,20 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo
21952189 subborrowxU64(&x300, &x301, x299, x288, 0xffffffffffffffff);
21962190 var x302: u64 = undefined;
21972191 var x303: u1 = undefined;
2198 subborrowxU64(&x302, &x303, x301, @as(u64, x289), 0x0);
2192 subborrowxU64(&x302, &x303, x301, x289, 0x0);
21992193 var x304: u64 = undefined;
2200 cmovznzU64(&x304, x303, x290, x278);
2194 const x304_selection_mask = selectionMaskU64(x303);
2195 x304 = x290 ^ ((x290 ^ x278) & x304_selection_mask);
22012196 var x305: u64 = undefined;
2202 cmovznzU64(&x305, x303, x292, x280);
2197 x305 = x292 ^ ((x292 ^ x280) & x304_selection_mask);
22032198 var x306: u64 = undefined;
2204 cmovznzU64(&x306, x303, x294, x282);
2199 x306 = x294 ^ ((x294 ^ x282) & x304_selection_mask);
22052200 var x307: u64 = undefined;
2206 cmovznzU64(&x307, x303, x296, x284);
2201 x307 = x296 ^ ((x296 ^ x284) & x304_selection_mask);
22072202 var x308: u64 = undefined;
2208 cmovznzU64(&x308, x303, x298, x286);
2203 x308 = x298 ^ ((x298 ^ x286) & x304_selection_mask);
22092204 var x309: u64 = undefined;
2210 cmovznzU64(&x309, x303, x300, x288);
2205 x309 = x300 ^ ((x300 ^ x288) & x304_selection_mask);
22112206 out1[0] = x304;
22122207 out1[1] = x305;
22132208 out1[2] = x306;
......@@ -2227,12 +2222,12 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo
22272222pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDomainFieldElement) void {
22282223 @setRuntimeSafety(mode == .debug);
22292224
2230 const x1 = (arg1[1]);
2231 const x2 = (arg1[2]);
2232 const x3 = (arg1[3]);
2233 const x4 = (arg1[4]);
2234 const x5 = (arg1[5]);
2235 const x6 = (arg1[0]);
2225 const x1: u64 = arg1[1];
2226 const x2: u64 = arg1[2];
2227 const x3: u64 = arg1[3];
2228 const x4: u64 = arg1[4];
2229 const x5: u64 = arg1[5];
2230 const x6: u64 = arg1[0];
22362231 var x7: u64 = undefined;
22372232 var x8: u64 = undefined;
22382233 mulxU64(&x7, &x8, x6, 0xc84ee012b39bf21);
......@@ -2322,7 +2317,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma
23222317 addcarryxU64(&x63, &x64, x62, x27, x51);
23232318 var x65: u64 = undefined;
23242319 var x66: u1 = undefined;
2325 addcarryxU64(&x65, &x66, x64, (@as(u64, x28) + x8), (@as(u64, x52) + x32));
2320 addcarryxU64(&x65, &x66, x64, (x28 + x8), (x52 + x32));
23262321 var x67: u64 = undefined;
23272322 var x68: u64 = undefined;
23282323 mulxU64(&x67, &x68, x1, 0xc84ee012b39bf21);
......@@ -2430,7 +2425,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma
24302425 addcarryxU64(&x135, &x136, x134, x99, x123);
24312426 var x137: u64 = undefined;
24322427 var x138: u1 = undefined;
2433 addcarryxU64(&x137, &x138, x136, ((@as(u64, x100) + @as(u64, x66)) + (@as(u64, x88) + x68)), (@as(u64, x124) + x104));
2428 addcarryxU64(&x137, &x138, x136, ((@as(u64, x100) + x66) + (x88 + x68)), (x124 + x104));
24342429 var x139: u64 = undefined;
24352430 var x140: u64 = undefined;
24362431 mulxU64(&x139, &x140, x2, 0xc84ee012b39bf21);
......@@ -2538,7 +2533,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma
25382533 addcarryxU64(&x207, &x208, x206, x171, x195);
25392534 var x209: u64 = undefined;
25402535 var x210: u1 = undefined;
2541 addcarryxU64(&x209, &x210, x208, ((@as(u64, x172) + @as(u64, x138)) + (@as(u64, x160) + x140)), (@as(u64, x196) + x176));
2536 addcarryxU64(&x209, &x210, x208, ((@as(u64, x172) + x138) + (x160 + x140)), (x196 + x176));
25422537 var x211: u64 = undefined;
25432538 var x212: u64 = undefined;
25442539 mulxU64(&x211, &x212, x3, 0xc84ee012b39bf21);
......@@ -2646,7 +2641,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma
26462641 addcarryxU64(&x279, &x280, x278, x243, x267);
26472642 var x281: u64 = undefined;
26482643 var x282: u1 = undefined;
2649 addcarryxU64(&x281, &x282, x280, ((@as(u64, x244) + @as(u64, x210)) + (@as(u64, x232) + x212)), (@as(u64, x268) + x248));
2644 addcarryxU64(&x281, &x282, x280, ((@as(u64, x244) + x210) + (x232 + x212)), (x268 + x248));
26502645 var x283: u64 = undefined;
26512646 var x284: u64 = undefined;
26522647 mulxU64(&x283, &x284, x4, 0xc84ee012b39bf21);
......@@ -2754,7 +2749,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma
27542749 addcarryxU64(&x351, &x352, x350, x315, x339);
27552750 var x353: u64 = undefined;
27562751 var x354: u1 = undefined;
2757 addcarryxU64(&x353, &x354, x352, ((@as(u64, x316) + @as(u64, x282)) + (@as(u64, x304) + x284)), (@as(u64, x340) + x320));
2752 addcarryxU64(&x353, &x354, x352, ((@as(u64, x316) + x282) + (x304 + x284)), (x340 + x320));
27582753 var x355: u64 = undefined;
27592754 var x356: u64 = undefined;
27602755 mulxU64(&x355, &x356, x5, 0xc84ee012b39bf21);
......@@ -2862,7 +2857,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma
28622857 addcarryxU64(&x423, &x424, x422, x387, x411);
28632858 var x425: u64 = undefined;
28642859 var x426: u1 = undefined;
2865 addcarryxU64(&x425, &x426, x424, ((@as(u64, x388) + @as(u64, x354)) + (@as(u64, x376) + x356)), (@as(u64, x412) + x392));
2860 addcarryxU64(&x425, &x426, x424, ((@as(u64, x388) + x354) + (x376 + x356)), (x412 + x392));
28662861 var x427: u64 = undefined;
28672862 var x428: u1 = undefined;
28682863 subborrowxU64(&x427, &x428, 0x0, x415, 0xecec196accc52973);
......@@ -2883,19 +2878,20 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma
28832878 subborrowxU64(&x437, &x438, x436, x425, 0xffffffffffffffff);
28842879 var x439: u64 = undefined;
28852880 var x440: u1 = undefined;
2886 subborrowxU64(&x439, &x440, x438, @as(u64, x426), 0x0);
2881 subborrowxU64(&x439, &x440, x438, x426, 0x0);
28872882 var x441: u64 = undefined;
2888 cmovznzU64(&x441, x440, x427, x415);
2883 const x441_selection_mask = selectionMaskU64(x440);
2884 x441 = x427 ^ ((x427 ^ x415) & x441_selection_mask);
28892885 var x442: u64 = undefined;
2890 cmovznzU64(&x442, x440, x429, x417);
2886 x442 = x429 ^ ((x429 ^ x417) & x441_selection_mask);
28912887 var x443: u64 = undefined;
2892 cmovznzU64(&x443, x440, x431, x419);
2888 x443 = x431 ^ ((x431 ^ x419) & x441_selection_mask);
28932889 var x444: u64 = undefined;
2894 cmovznzU64(&x444, x440, x433, x421);
2890 x444 = x433 ^ ((x433 ^ x421) & x441_selection_mask);
28952891 var x445: u64 = undefined;
2896 cmovznzU64(&x445, x440, x435, x423);
2892 x445 = x435 ^ ((x435 ^ x423) & x441_selection_mask);
28972893 var x446: u64 = undefined;
2898 cmovznzU64(&x446, x440, x437, x425);
2894 x446 = x437 ^ ((x437 ^ x425) & x441_selection_mask);
28992895 out1[0] = x441;
29002896 out1[1] = x442;
29012897 out1[2] = x443;
......@@ -2918,7 +2914,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma
29182914pub fn nonzero(out1: *u64, arg1: [6]u64) void {
29192915 @setRuntimeSafety(mode == .debug);
29202916
2921 const x1 = ((arg1[0]) | ((arg1[1]) | ((arg1[2]) | ((arg1[3]) | ((arg1[4]) | (arg1[5]))))));
2917 const x1: u64 = (arg1[0] | (arg1[1] | (arg1[2] | (arg1[3] | (arg1[4] | arg1[5])))));
29222918 out1.* = x1;
29232919}
29242920
......@@ -2937,17 +2933,18 @@ pub fn selectznz(out1: *[6]u64, arg1: u1, arg2: [6]u64, arg3: [6]u64) void {
29372933 @setRuntimeSafety(mode == .debug);
29382934
29392935 var x1: u64 = undefined;
2940 cmovznzU64(&x1, arg1, (arg2[0]), (arg3[0]));
2936 const x1_selection_mask = selectionMaskU64(arg1);
2937 x1 = arg2[0] ^ ((arg2[0] ^ arg3[0]) & x1_selection_mask);
29412938 var x2: u64 = undefined;
2942 cmovznzU64(&x2, arg1, (arg2[1]), (arg3[1]));
2939 x2 = arg2[1] ^ ((arg2[1] ^ arg3[1]) & x1_selection_mask);
29432940 var x3: u64 = undefined;
2944 cmovznzU64(&x3, arg1, (arg2[2]), (arg3[2]));
2941 x3 = arg2[2] ^ ((arg2[2] ^ arg3[2]) & x1_selection_mask);
29452942 var x4: u64 = undefined;
2946 cmovznzU64(&x4, arg1, (arg2[3]), (arg3[3]));
2943 x4 = arg2[3] ^ ((arg2[3] ^ arg3[3]) & x1_selection_mask);
29472944 var x5: u64 = undefined;
2948 cmovznzU64(&x5, arg1, (arg2[4]), (arg3[4]));
2945 x5 = arg2[4] ^ ((arg2[4] ^ arg3[4]) & x1_selection_mask);
29492946 var x6: u64 = undefined;
2950 cmovznzU64(&x6, arg1, (arg2[5]), (arg3[5]));
2947 x6 = arg2[5] ^ ((arg2[5] ^ arg3[5]) & x1_selection_mask);
29512948 out1[0] = x1;
29522949 out1[1] = x2;
29532950 out1[2] = x3;
......@@ -2970,96 +2967,96 @@ pub fn selectznz(out1: *[6]u64, arg1: u1, arg2: [6]u64, arg3: [6]u64) void {
29702967pub fn toBytes(out1: *[48]u8, arg1: [6]u64) void {
29712968 @setRuntimeSafety(mode == .debug);
29722969
2973 const x1 = (arg1[5]);
2974 const x2 = (arg1[4]);
2975 const x3 = (arg1[3]);
2976 const x4 = (arg1[2]);
2977 const x5 = (arg1[1]);
2978 const x6 = (arg1[0]);
2979 const x7 = @as(u8, @truncate((x6 & 0xff)));
2980 const x8 = (x6 >> 8);
2981 const x9 = @as(u8, @truncate((x8 & 0xff)));
2982 const x10 = (x8 >> 8);
2983 const x11 = @as(u8, @truncate((x10 & 0xff)));
2984 const x12 = (x10 >> 8);
2985 const x13 = @as(u8, @truncate((x12 & 0xff)));
2986 const x14 = (x12 >> 8);
2987 const x15 = @as(u8, @truncate((x14 & 0xff)));
2988 const x16 = (x14 >> 8);
2989 const x17 = @as(u8, @truncate((x16 & 0xff)));
2990 const x18 = (x16 >> 8);
2991 const x19 = @as(u8, @truncate((x18 & 0xff)));
2992 const x20 = @as(u8, @truncate((x18 >> 8)));
2993 const x21 = @as(u8, @truncate((x5 & 0xff)));
2994 const x22 = (x5 >> 8);
2995 const x23 = @as(u8, @truncate((x22 & 0xff)));
2996 const x24 = (x22 >> 8);
2997 const x25 = @as(u8, @truncate((x24 & 0xff)));
2998 const x26 = (x24 >> 8);
2999 const x27 = @as(u8, @truncate((x26 & 0xff)));
3000 const x28 = (x26 >> 8);
3001 const x29 = @as(u8, @truncate((x28 & 0xff)));
3002 const x30 = (x28 >> 8);
3003 const x31 = @as(u8, @truncate((x30 & 0xff)));
3004 const x32 = (x30 >> 8);
3005 const x33 = @as(u8, @truncate((x32 & 0xff)));
3006 const x34 = @as(u8, @truncate((x32 >> 8)));
3007 const x35 = @as(u8, @truncate((x4 & 0xff)));
3008 const x36 = (x4 >> 8);
3009 const x37 = @as(u8, @truncate((x36 & 0xff)));
3010 const x38 = (x36 >> 8);
3011 const x39 = @as(u8, @truncate((x38 & 0xff)));
3012 const x40 = (x38 >> 8);
3013 const x41 = @as(u8, @truncate((x40 & 0xff)));
3014 const x42 = (x40 >> 8);
3015 const x43 = @as(u8, @truncate((x42 & 0xff)));
3016 const x44 = (x42 >> 8);
3017 const x45 = @as(u8, @truncate((x44 & 0xff)));
3018 const x46 = (x44 >> 8);
3019 const x47 = @as(u8, @truncate((x46 & 0xff)));
3020 const x48 = @as(u8, @truncate((x46 >> 8)));
3021 const x49 = @as(u8, @truncate((x3 & 0xff)));
3022 const x50 = (x3 >> 8);
3023 const x51 = @as(u8, @truncate((x50 & 0xff)));
3024 const x52 = (x50 >> 8);
3025 const x53 = @as(u8, @truncate((x52 & 0xff)));
3026 const x54 = (x52 >> 8);
3027 const x55 = @as(u8, @truncate((x54 & 0xff)));
3028 const x56 = (x54 >> 8);
3029 const x57 = @as(u8, @truncate((x56 & 0xff)));
3030 const x58 = (x56 >> 8);
3031 const x59 = @as(u8, @truncate((x58 & 0xff)));
3032 const x60 = (x58 >> 8);
3033 const x61 = @as(u8, @truncate((x60 & 0xff)));
3034 const x62 = @as(u8, @truncate((x60 >> 8)));
3035 const x63 = @as(u8, @truncate((x2 & 0xff)));
3036 const x64 = (x2 >> 8);
3037 const x65 = @as(u8, @truncate((x64 & 0xff)));
3038 const x66 = (x64 >> 8);
3039 const x67 = @as(u8, @truncate((x66 & 0xff)));
3040 const x68 = (x66 >> 8);
3041 const x69 = @as(u8, @truncate((x68 & 0xff)));
3042 const x70 = (x68 >> 8);
3043 const x71 = @as(u8, @truncate((x70 & 0xff)));
3044 const x72 = (x70 >> 8);
3045 const x73 = @as(u8, @truncate((x72 & 0xff)));
3046 const x74 = (x72 >> 8);
3047 const x75 = @as(u8, @truncate((x74 & 0xff)));
3048 const x76 = @as(u8, @truncate((x74 >> 8)));
3049 const x77 = @as(u8, @truncate((x1 & 0xff)));
3050 const x78 = (x1 >> 8);
3051 const x79 = @as(u8, @truncate((x78 & 0xff)));
3052 const x80 = (x78 >> 8);
3053 const x81 = @as(u8, @truncate((x80 & 0xff)));
3054 const x82 = (x80 >> 8);
3055 const x83 = @as(u8, @truncate((x82 & 0xff)));
3056 const x84 = (x82 >> 8);
3057 const x85 = @as(u8, @truncate((x84 & 0xff)));
3058 const x86 = (x84 >> 8);
3059 const x87 = @as(u8, @truncate((x86 & 0xff)));
3060 const x88 = (x86 >> 8);
3061 const x89 = @as(u8, @truncate((x88 & 0xff)));
3062 const x90 = @as(u8, @truncate((x88 >> 8)));
2970 const x1: u64 = arg1[5];
2971 const x2: u64 = arg1[4];
2972 const x3: u64 = arg1[3];
2973 const x4: u64 = arg1[2];
2974 const x5: u64 = arg1[1];
2975 const x6: u64 = arg1[0];
2976 const x7: u8 = @truncate(x6);
2977 const x8: u64 = (x6 >> 8);
2978 const x9: u8 = @truncate(x8);
2979 const x10: u64 = (x8 >> 8);
2980 const x11: u8 = @truncate(x10);
2981 const x12: u64 = (x10 >> 8);
2982 const x13: u8 = @truncate(x12);
2983 const x14: u64 = (x12 >> 8);
2984 const x15: u8 = @truncate(x14);
2985 const x16: u64 = (x14 >> 8);
2986 const x17: u8 = @truncate(x16);
2987 const x18: u64 = (x16 >> 8);
2988 const x19: u8 = @truncate(x18);
2989 const x20: u8 = @truncate((x18 >> 8));
2990 const x21: u8 = @truncate(x5);
2991 const x22: u64 = (x5 >> 8);
2992 const x23: u8 = @truncate(x22);
2993 const x24: u64 = (x22 >> 8);
2994 const x25: u8 = @truncate(x24);
2995 const x26: u64 = (x24 >> 8);
2996 const x27: u8 = @truncate(x26);
2997 const x28: u64 = (x26 >> 8);
2998 const x29: u8 = @truncate(x28);
2999 const x30: u64 = (x28 >> 8);
3000 const x31: u8 = @truncate(x30);
3001 const x32: u64 = (x30 >> 8);
3002 const x33: u8 = @truncate(x32);
3003 const x34: u8 = @truncate((x32 >> 8));
3004 const x35: u8 = @truncate(x4);
3005 const x36: u64 = (x4 >> 8);
3006 const x37: u8 = @truncate(x36);
3007 const x38: u64 = (x36 >> 8);
3008 const x39: u8 = @truncate(x38);
3009 const x40: u64 = (x38 >> 8);
3010 const x41: u8 = @truncate(x40);
3011 const x42: u64 = (x40 >> 8);
3012 const x43: u8 = @truncate(x42);
3013 const x44: u64 = (x42 >> 8);
3014 const x45: u8 = @truncate(x44);
3015 const x46: u64 = (x44 >> 8);
3016 const x47: u8 = @truncate(x46);
3017 const x48: u8 = @truncate((x46 >> 8));
3018 const x49: u8 = @truncate(x3);
3019 const x50: u64 = (x3 >> 8);
3020 const x51: u8 = @truncate(x50);
3021 const x52: u64 = (x50 >> 8);
3022 const x53: u8 = @truncate(x52);
3023 const x54: u64 = (x52 >> 8);
3024 const x55: u8 = @truncate(x54);
3025 const x56: u64 = (x54 >> 8);
3026 const x57: u8 = @truncate(x56);
3027 const x58: u64 = (x56 >> 8);
3028 const x59: u8 = @truncate(x58);
3029 const x60: u64 = (x58 >> 8);
3030 const x61: u8 = @truncate(x60);
3031 const x62: u8 = @truncate((x60 >> 8));
3032 const x63: u8 = @truncate(x2);
3033 const x64: u64 = (x2 >> 8);
3034 const x65: u8 = @truncate(x64);
3035 const x66: u64 = (x64 >> 8);
3036 const x67: u8 = @truncate(x66);
3037 const x68: u64 = (x66 >> 8);
3038 const x69: u8 = @truncate(x68);
3039 const x70: u64 = (x68 >> 8);
3040 const x71: u8 = @truncate(x70);
3041 const x72: u64 = (x70 >> 8);
3042 const x73: u8 = @truncate(x72);
3043 const x74: u64 = (x72 >> 8);
3044 const x75: u8 = @truncate(x74);
3045 const x76: u8 = @truncate((x74 >> 8));
3046 const x77: u8 = @truncate(x1);
3047 const x78: u64 = (x1 >> 8);
3048 const x79: u8 = @truncate(x78);
3049 const x80: u64 = (x78 >> 8);
3050 const x81: u8 = @truncate(x80);
3051 const x82: u64 = (x80 >> 8);
3052 const x83: u8 = @truncate(x82);
3053 const x84: u64 = (x82 >> 8);
3054 const x85: u8 = @truncate(x84);
3055 const x86: u64 = (x84 >> 8);
3056 const x87: u8 = @truncate(x86);
3057 const x88: u64 = (x86 >> 8);
3058 const x89: u8 = @truncate(x88);
3059 const x90: u8 = @truncate((x88 >> 8));
30633060 out1[0] = x7;
30643061 out1[1] = x9;
30653062 out1[2] = x11;
......@@ -3125,96 +3122,96 @@ pub fn toBytes(out1: *[48]u8, arg1: [6]u64) void {
31253122pub fn fromBytes(out1: *[6]u64, arg1: [48]u8) void {
31263123 @setRuntimeSafety(mode == .debug);
31273124
3128 const x1 = (@as(u64, (arg1[47])) << 56);
3129 const x2 = (@as(u64, (arg1[46])) << 48);
3130 const x3 = (@as(u64, (arg1[45])) << 40);
3131 const x4 = (@as(u64, (arg1[44])) << 32);
3132 const x5 = (@as(u64, (arg1[43])) << 24);
3133 const x6 = (@as(u64, (arg1[42])) << 16);
3134 const x7 = (@as(u64, (arg1[41])) << 8);
3135 const x8 = (arg1[40]);
3136 const x9 = (@as(u64, (arg1[39])) << 56);
3137 const x10 = (@as(u64, (arg1[38])) << 48);
3138 const x11 = (@as(u64, (arg1[37])) << 40);
3139 const x12 = (@as(u64, (arg1[36])) << 32);
3140 const x13 = (@as(u64, (arg1[35])) << 24);
3141 const x14 = (@as(u64, (arg1[34])) << 16);
3142 const x15 = (@as(u64, (arg1[33])) << 8);
3143 const x16 = (arg1[32]);
3144 const x17 = (@as(u64, (arg1[31])) << 56);
3145 const x18 = (@as(u64, (arg1[30])) << 48);
3146 const x19 = (@as(u64, (arg1[29])) << 40);
3147 const x20 = (@as(u64, (arg1[28])) << 32);
3148 const x21 = (@as(u64, (arg1[27])) << 24);
3149 const x22 = (@as(u64, (arg1[26])) << 16);
3150 const x23 = (@as(u64, (arg1[25])) << 8);
3151 const x24 = (arg1[24]);
3152 const x25 = (@as(u64, (arg1[23])) << 56);
3153 const x26 = (@as(u64, (arg1[22])) << 48);
3154 const x27 = (@as(u64, (arg1[21])) << 40);
3155 const x28 = (@as(u64, (arg1[20])) << 32);
3156 const x29 = (@as(u64, (arg1[19])) << 24);
3157 const x30 = (@as(u64, (arg1[18])) << 16);
3158 const x31 = (@as(u64, (arg1[17])) << 8);
3159 const x32 = (arg1[16]);
3160 const x33 = (@as(u64, (arg1[15])) << 56);
3161 const x34 = (@as(u64, (arg1[14])) << 48);
3162 const x35 = (@as(u64, (arg1[13])) << 40);
3163 const x36 = (@as(u64, (arg1[12])) << 32);
3164 const x37 = (@as(u64, (arg1[11])) << 24);
3165 const x38 = (@as(u64, (arg1[10])) << 16);
3166 const x39 = (@as(u64, (arg1[9])) << 8);
3167 const x40 = (arg1[8]);
3168 const x41 = (@as(u64, (arg1[7])) << 56);
3169 const x42 = (@as(u64, (arg1[6])) << 48);
3170 const x43 = (@as(u64, (arg1[5])) << 40);
3171 const x44 = (@as(u64, (arg1[4])) << 32);
3172 const x45 = (@as(u64, (arg1[3])) << 24);
3173 const x46 = (@as(u64, (arg1[2])) << 16);
3174 const x47 = (@as(u64, (arg1[1])) << 8);
3175 const x48 = (arg1[0]);
3176 const x49 = (x47 + @as(u64, x48));
3177 const x50 = (x46 + x49);
3178 const x51 = (x45 + x50);
3179 const x52 = (x44 + x51);
3180 const x53 = (x43 + x52);
3181 const x54 = (x42 + x53);
3182 const x55 = (x41 + x54);
3183 const x56 = (x39 + @as(u64, x40));
3184 const x57 = (x38 + x56);
3185 const x58 = (x37 + x57);
3186 const x59 = (x36 + x58);
3187 const x60 = (x35 + x59);
3188 const x61 = (x34 + x60);
3189 const x62 = (x33 + x61);
3190 const x63 = (x31 + @as(u64, x32));
3191 const x64 = (x30 + x63);
3192 const x65 = (x29 + x64);
3193 const x66 = (x28 + x65);
3194 const x67 = (x27 + x66);
3195 const x68 = (x26 + x67);
3196 const x69 = (x25 + x68);
3197 const x70 = (x23 + @as(u64, x24));
3198 const x71 = (x22 + x70);
3199 const x72 = (x21 + x71);
3200 const x73 = (x20 + x72);
3201 const x74 = (x19 + x73);
3202 const x75 = (x18 + x74);
3203 const x76 = (x17 + x75);
3204 const x77 = (x15 + @as(u64, x16));
3205 const x78 = (x14 + x77);
3206 const x79 = (x13 + x78);
3207 const x80 = (x12 + x79);
3208 const x81 = (x11 + x80);
3209 const x82 = (x10 + x81);
3210 const x83 = (x9 + x82);
3211 const x84 = (x7 + @as(u64, x8));
3212 const x85 = (x6 + x84);
3213 const x86 = (x5 + x85);
3214 const x87 = (x4 + x86);
3215 const x88 = (x3 + x87);
3216 const x89 = (x2 + x88);
3217 const x90 = (x1 + x89);
3125 const x1: u64 = (@as(u64, arg1[47]) << 56);
3126 const x2: u64 = (@as(u64, arg1[46]) << 48);
3127 const x3: u64 = (@as(u64, arg1[45]) << 40);
3128 const x4: u64 = (@as(u64, arg1[44]) << 32);
3129 const x5: u64 = (@as(u64, arg1[43]) << 24);
3130 const x6: u64 = (@as(u64, arg1[42]) << 16);
3131 const x7: u64 = (@as(u64, arg1[41]) << 8);
3132 const x8: u8 = arg1[40];
3133 const x9: u64 = (@as(u64, arg1[39]) << 56);
3134 const x10: u64 = (@as(u64, arg1[38]) << 48);
3135 const x11: u64 = (@as(u64, arg1[37]) << 40);
3136 const x12: u64 = (@as(u64, arg1[36]) << 32);
3137 const x13: u64 = (@as(u64, arg1[35]) << 24);
3138 const x14: u64 = (@as(u64, arg1[34]) << 16);
3139 const x15: u64 = (@as(u64, arg1[33]) << 8);
3140 const x16: u8 = arg1[32];
3141 const x17: u64 = (@as(u64, arg1[31]) << 56);
3142 const x18: u64 = (@as(u64, arg1[30]) << 48);
3143 const x19: u64 = (@as(u64, arg1[29]) << 40);
3144 const x20: u64 = (@as(u64, arg1[28]) << 32);
3145 const x21: u64 = (@as(u64, arg1[27]) << 24);
3146 const x22: u64 = (@as(u64, arg1[26]) << 16);
3147 const x23: u64 = (@as(u64, arg1[25]) << 8);
3148 const x24: u8 = arg1[24];
3149 const x25: u64 = (@as(u64, arg1[23]) << 56);
3150 const x26: u64 = (@as(u64, arg1[22]) << 48);
3151 const x27: u64 = (@as(u64, arg1[21]) << 40);
3152 const x28: u64 = (@as(u64, arg1[20]) << 32);
3153 const x29: u64 = (@as(u64, arg1[19]) << 24);
3154 const x30: u64 = (@as(u64, arg1[18]) << 16);
3155 const x31: u64 = (@as(u64, arg1[17]) << 8);
3156 const x32: u8 = arg1[16];
3157 const x33: u64 = (@as(u64, arg1[15]) << 56);
3158 const x34: u64 = (@as(u64, arg1[14]) << 48);
3159 const x35: u64 = (@as(u64, arg1[13]) << 40);
3160 const x36: u64 = (@as(u64, arg1[12]) << 32);
3161 const x37: u64 = (@as(u64, arg1[11]) << 24);
3162 const x38: u64 = (@as(u64, arg1[10]) << 16);
3163 const x39: u64 = (@as(u64, arg1[9]) << 8);
3164 const x40: u8 = arg1[8];
3165 const x41: u64 = (@as(u64, arg1[7]) << 56);
3166 const x42: u64 = (@as(u64, arg1[6]) << 48);
3167 const x43: u64 = (@as(u64, arg1[5]) << 40);
3168 const x44: u64 = (@as(u64, arg1[4]) << 32);
3169 const x45: u64 = (@as(u64, arg1[3]) << 24);
3170 const x46: u64 = (@as(u64, arg1[2]) << 16);
3171 const x47: u64 = (@as(u64, arg1[1]) << 8);
3172 const x48: u8 = arg1[0];
3173 const x49: u64 = (x47 + x48);
3174 const x50: u64 = (x46 + x49);
3175 const x51: u64 = (x45 + x50);
3176 const x52: u64 = (x44 + x51);
3177 const x53: u64 = (x43 + x52);
3178 const x54: u64 = (x42 + x53);
3179 const x55: u64 = (x41 + x54);
3180 const x56: u64 = (x39 + x40);
3181 const x57: u64 = (x38 + x56);
3182 const x58: u64 = (x37 + x57);
3183 const x59: u64 = (x36 + x58);
3184 const x60: u64 = (x35 + x59);
3185 const x61: u64 = (x34 + x60);
3186 const x62: u64 = (x33 + x61);
3187 const x63: u64 = (x31 + x32);
3188 const x64: u64 = (x30 + x63);
3189 const x65: u64 = (x29 + x64);
3190 const x66: u64 = (x28 + x65);
3191 const x67: u64 = (x27 + x66);
3192 const x68: u64 = (x26 + x67);
3193 const x69: u64 = (x25 + x68);
3194 const x70: u64 = (x23 + x24);
3195 const x71: u64 = (x22 + x70);
3196 const x72: u64 = (x21 + x71);
3197 const x73: u64 = (x20 + x72);
3198 const x74: u64 = (x19 + x73);
3199 const x75: u64 = (x18 + x74);
3200 const x76: u64 = (x17 + x75);
3201 const x77: u64 = (x15 + x16);
3202 const x78: u64 = (x14 + x77);
3203 const x79: u64 = (x13 + x78);
3204 const x80: u64 = (x12 + x79);
3205 const x81: u64 = (x11 + x80);
3206 const x82: u64 = (x10 + x81);
3207 const x83: u64 = (x9 + x82);
3208 const x84: u64 = (x7 + x8);
3209 const x85: u64 = (x6 + x84);
3210 const x86: u64 = (x5 + x85);
3211 const x87: u64 = (x4 + x86);
3212 const x88: u64 = (x3 + x87);
3213 const x89: u64 = (x2 + x88);
3214 const x90: u64 = (x1 + x89);
32183215 out1[0] = x55;
32193216 out1[1] = x62;
32203217 out1[2] = x69;
......@@ -3294,73 +3291,75 @@ pub fn divstep(out1: *u64, out2: *[7]u64, out3: *[7]u64, out4: *[6]u64, out5: *[
32943291 var x1: u64 = undefined;
32953292 var x2: u1 = undefined;
32963293 addcarryxU64(&x1, &x2, 0x0, (~arg1), 0x1);
3297 const x3 = (@as(u1, @truncate((x1 >> 63))) & @as(u1, @truncate(((arg3[0]) & 0x1))));
3294 const x3: u1 = (@as(u1, @truncate((x1 >> 63))) & @as(u1, @truncate(arg3[0])));
32983295 var x4: u64 = undefined;
32993296 var x5: u1 = undefined;
33003297 addcarryxU64(&x4, &x5, 0x0, (~arg1), 0x1);
33013298 var x6: u64 = undefined;
3302 cmovznzU64(&x6, x3, arg1, x4);
3299 const x6_selection_mask = selectionMaskU64(x3);
3300 x6 = arg1 ^ ((arg1 ^ x4) & x6_selection_mask);
33033301 var x7: u64 = undefined;
3304 cmovznzU64(&x7, x3, (arg2[0]), (arg3[0]));
3302 x7 = arg2[0] ^ ((arg2[0] ^ arg3[0]) & x6_selection_mask);
33053303 var x8: u64 = undefined;
3306 cmovznzU64(&x8, x3, (arg2[1]), (arg3[1]));
3304 x8 = arg2[1] ^ ((arg2[1] ^ arg3[1]) & x6_selection_mask);
33073305 var x9: u64 = undefined;
3308 cmovznzU64(&x9, x3, (arg2[2]), (arg3[2]));
3306 x9 = arg2[2] ^ ((arg2[2] ^ arg3[2]) & x6_selection_mask);
33093307 var x10: u64 = undefined;
3310 cmovznzU64(&x10, x3, (arg2[3]), (arg3[3]));
3308 x10 = arg2[3] ^ ((arg2[3] ^ arg3[3]) & x6_selection_mask);
33113309 var x11: u64 = undefined;
3312 cmovznzU64(&x11, x3, (arg2[4]), (arg3[4]));
3310 x11 = arg2[4] ^ ((arg2[4] ^ arg3[4]) & x6_selection_mask);
33133311 var x12: u64 = undefined;
3314 cmovznzU64(&x12, x3, (arg2[5]), (arg3[5]));
3312 x12 = arg2[5] ^ ((arg2[5] ^ arg3[5]) & x6_selection_mask);
33153313 var x13: u64 = undefined;
3316 cmovznzU64(&x13, x3, (arg2[6]), (arg3[6]));
3314 x13 = arg2[6] ^ ((arg2[6] ^ arg3[6]) & x6_selection_mask);
33173315 var x14: u64 = undefined;
33183316 var x15: u1 = undefined;
3319 addcarryxU64(&x14, &x15, 0x0, 0x1, (~(arg2[0])));
3317 addcarryxU64(&x14, &x15, 0x0, 0x1, (~arg2[0]));
33203318 var x16: u64 = undefined;
33213319 var x17: u1 = undefined;
3322 addcarryxU64(&x16, &x17, x15, 0x0, (~(arg2[1])));
3320 addcarryxU64(&x16, &x17, x15, 0x0, (~arg2[1]));
33233321 var x18: u64 = undefined;
33243322 var x19: u1 = undefined;
3325 addcarryxU64(&x18, &x19, x17, 0x0, (~(arg2[2])));
3323 addcarryxU64(&x18, &x19, x17, 0x0, (~arg2[2]));
33263324 var x20: u64 = undefined;
33273325 var x21: u1 = undefined;
3328 addcarryxU64(&x20, &x21, x19, 0x0, (~(arg2[3])));
3326 addcarryxU64(&x20, &x21, x19, 0x0, (~arg2[3]));
33293327 var x22: u64 = undefined;
33303328 var x23: u1 = undefined;
3331 addcarryxU64(&x22, &x23, x21, 0x0, (~(arg2[4])));
3329 addcarryxU64(&x22, &x23, x21, 0x0, (~arg2[4]));
33323330 var x24: u64 = undefined;
33333331 var x25: u1 = undefined;
3334 addcarryxU64(&x24, &x25, x23, 0x0, (~(arg2[5])));
3332 addcarryxU64(&x24, &x25, x23, 0x0, (~arg2[5]));
33353333 var x26: u64 = undefined;
33363334 var x27: u1 = undefined;
3337 addcarryxU64(&x26, &x27, x25, 0x0, (~(arg2[6])));
3335 addcarryxU64(&x26, &x27, x25, 0x0, (~arg2[6]));
33383336 var x28: u64 = undefined;
3339 cmovznzU64(&x28, x3, (arg3[0]), x14);
3337 const x28_selection_mask = selectionMaskU64(x3);
3338 x28 = arg3[0] ^ ((arg3[0] ^ x14) & x28_selection_mask);
33403339 var x29: u64 = undefined;
3341 cmovznzU64(&x29, x3, (arg3[1]), x16);
3340 x29 = arg3[1] ^ ((arg3[1] ^ x16) & x28_selection_mask);
33423341 var x30: u64 = undefined;
3343 cmovznzU64(&x30, x3, (arg3[2]), x18);
3342 x30 = arg3[2] ^ ((arg3[2] ^ x18) & x28_selection_mask);
33443343 var x31: u64 = undefined;
3345 cmovznzU64(&x31, x3, (arg3[3]), x20);
3344 x31 = arg3[3] ^ ((arg3[3] ^ x20) & x28_selection_mask);
33463345 var x32: u64 = undefined;
3347 cmovznzU64(&x32, x3, (arg3[4]), x22);
3346 x32 = arg3[4] ^ ((arg3[4] ^ x22) & x28_selection_mask);
33483347 var x33: u64 = undefined;
3349 cmovznzU64(&x33, x3, (arg3[5]), x24);
3348 x33 = arg3[5] ^ ((arg3[5] ^ x24) & x28_selection_mask);
33503349 var x34: u64 = undefined;
3351 cmovznzU64(&x34, x3, (arg3[6]), x26);
3350 x34 = arg3[6] ^ ((arg3[6] ^ x26) & x28_selection_mask);
33523351 var x35: u64 = undefined;
3353 cmovznzU64(&x35, x3, (arg4[0]), (arg5[0]));
3352 x35 = arg4[0] ^ ((arg4[0] ^ arg5[0]) & x28_selection_mask);
33543353 var x36: u64 = undefined;
3355 cmovznzU64(&x36, x3, (arg4[1]), (arg5[1]));
3354 x36 = arg4[1] ^ ((arg4[1] ^ arg5[1]) & x28_selection_mask);
33563355 var x37: u64 = undefined;
3357 cmovznzU64(&x37, x3, (arg4[2]), (arg5[2]));
3356 x37 = arg4[2] ^ ((arg4[2] ^ arg5[2]) & x28_selection_mask);
33583357 var x38: u64 = undefined;
3359 cmovznzU64(&x38, x3, (arg4[3]), (arg5[3]));
3358 x38 = arg4[3] ^ ((arg4[3] ^ arg5[3]) & x28_selection_mask);
33603359 var x39: u64 = undefined;
3361 cmovznzU64(&x39, x3, (arg4[4]), (arg5[4]));
3360 x39 = arg4[4] ^ ((arg4[4] ^ arg5[4]) & x28_selection_mask);
33623361 var x40: u64 = undefined;
3363 cmovznzU64(&x40, x3, (arg4[5]), (arg5[5]));
3362 x40 = arg4[5] ^ ((arg4[5] ^ arg5[5]) & x28_selection_mask);
33643363 var x41: u64 = undefined;
33653364 var x42: u1 = undefined;
33663365 addcarryxU64(&x41, &x42, 0x0, x35, x35);
......@@ -3399,13 +3398,13 @@ pub fn divstep(out1: *u64, out2: *[7]u64, out3: *[7]u64, out4: *[6]u64, out5: *[
33993398 subborrowxU64(&x63, &x64, x62, x51, 0xffffffffffffffff);
34003399 var x65: u64 = undefined;
34013400 var x66: u1 = undefined;
3402 subborrowxU64(&x65, &x66, x64, @as(u64, x52), 0x0);
3403 const x67 = (arg4[5]);
3404 const x68 = (arg4[4]);
3405 const x69 = (arg4[3]);
3406 const x70 = (arg4[2]);
3407 const x71 = (arg4[1]);
3408 const x72 = (arg4[0]);
3401 subborrowxU64(&x65, &x66, x64, x52, 0x0);
3402 const x67: u64 = arg4[5];
3403 const x68: u64 = arg4[4];
3404 const x69: u64 = arg4[3];
3405 const x70: u64 = arg4[2];
3406 const x71: u64 = arg4[1];
3407 const x72: u64 = arg4[0];
34093408 var x73: u64 = undefined;
34103409 var x74: u1 = undefined;
34113410 subborrowxU64(&x73, &x74, 0x0, 0x0, x72);
......@@ -3425,7 +3424,8 @@ pub fn divstep(out1: *u64, out2: *[7]u64, out3: *[7]u64, out4: *[6]u64, out5: *[
34253424 var x84: u1 = undefined;
34263425 subborrowxU64(&x83, &x84, x82, 0x0, x67);
34273426 var x85: u64 = undefined;
3428 cmovznzU64(&x85, x84, 0x0, 0xffffffffffffffff);
3427 const x85_selection_mask = selectionMaskU64(x84);
3428 x85 = 0x0 ^ ((0x0 ^ 0xffffffffffffffff) & x85_selection_mask);
34293429 var x86: u64 = undefined;
34303430 var x87: u1 = undefined;
34313431 addcarryxU64(&x86, &x87, 0x0, x73, (x85 & 0xecec196accc52973));
......@@ -3445,32 +3445,34 @@ pub fn divstep(out1: *u64, out2: *[7]u64, out3: *[7]u64, out4: *[6]u64, out5: *[
34453445 var x97: u1 = undefined;
34463446 addcarryxU64(&x96, &x97, x95, x83, x85);
34473447 var x98: u64 = undefined;
3448 cmovznzU64(&x98, x3, (arg5[0]), x86);
3448 const x98_selection_mask = selectionMaskU64(x3);
3449 x98 = arg5[0] ^ ((arg5[0] ^ x86) & x98_selection_mask);
34493450 var x99: u64 = undefined;
3450 cmovznzU64(&x99, x3, (arg5[1]), x88);
3451 x99 = arg5[1] ^ ((arg5[1] ^ x88) & x98_selection_mask);
34513452 var x100: u64 = undefined;
3452 cmovznzU64(&x100, x3, (arg5[2]), x90);
3453 x100 = arg5[2] ^ ((arg5[2] ^ x90) & x98_selection_mask);
34533454 var x101: u64 = undefined;
3454 cmovznzU64(&x101, x3, (arg5[3]), x92);
3455 x101 = arg5[3] ^ ((arg5[3] ^ x92) & x98_selection_mask);
34553456 var x102: u64 = undefined;
3456 cmovznzU64(&x102, x3, (arg5[4]), x94);
3457 x102 = arg5[4] ^ ((arg5[4] ^ x94) & x98_selection_mask);
34573458 var x103: u64 = undefined;
3458 cmovznzU64(&x103, x3, (arg5[5]), x96);
3459 const x104 = @as(u1, @truncate((x28 & 0x1)));
3459 x103 = arg5[5] ^ ((arg5[5] ^ x96) & x98_selection_mask);
3460 const x104: u1 = @truncate(x28);
34603461 var x105: u64 = undefined;
3461 cmovznzU64(&x105, x104, 0x0, x7);
3462 const x105_selection_mask = selectionMaskU64(x104);
3463 x105 = 0x0 ^ ((0x0 ^ x7) & x105_selection_mask);
34623464 var x106: u64 = undefined;
3463 cmovznzU64(&x106, x104, 0x0, x8);
3465 x106 = 0x0 ^ ((0x0 ^ x8) & x105_selection_mask);
34643466 var x107: u64 = undefined;
3465 cmovznzU64(&x107, x104, 0x0, x9);
3467 x107 = 0x0 ^ ((0x0 ^ x9) & x105_selection_mask);
34663468 var x108: u64 = undefined;
3467 cmovznzU64(&x108, x104, 0x0, x10);
3469 x108 = 0x0 ^ ((0x0 ^ x10) & x105_selection_mask);
34683470 var x109: u64 = undefined;
3469 cmovznzU64(&x109, x104, 0x0, x11);
3471 x109 = 0x0 ^ ((0x0 ^ x11) & x105_selection_mask);
34703472 var x110: u64 = undefined;
3471 cmovznzU64(&x110, x104, 0x0, x12);
3473 x110 = 0x0 ^ ((0x0 ^ x12) & x105_selection_mask);
34723474 var x111: u64 = undefined;
3473 cmovznzU64(&x111, x104, 0x0, x13);
3475 x111 = 0x0 ^ ((0x0 ^ x13) & x105_selection_mask);
34743476 var x112: u64 = undefined;
34753477 var x113: u1 = undefined;
34763478 addcarryxU64(&x112, &x113, 0x0, x28, x105);
......@@ -3493,17 +3495,18 @@ pub fn divstep(out1: *u64, out2: *[7]u64, out3: *[7]u64, out4: *[6]u64, out5: *[
34933495 var x125: u1 = undefined;
34943496 addcarryxU64(&x124, &x125, x123, x34, x111);
34953497 var x126: u64 = undefined;
3496 cmovznzU64(&x126, x104, 0x0, x35);
3498 const x126_selection_mask = selectionMaskU64(x104);
3499 x126 = 0x0 ^ ((0x0 ^ x35) & x126_selection_mask);
34973500 var x127: u64 = undefined;
3498 cmovznzU64(&x127, x104, 0x0, x36);
3501 x127 = 0x0 ^ ((0x0 ^ x36) & x126_selection_mask);
34993502 var x128: u64 = undefined;
3500 cmovznzU64(&x128, x104, 0x0, x37);
3503 x128 = 0x0 ^ ((0x0 ^ x37) & x126_selection_mask);
35013504 var x129: u64 = undefined;
3502 cmovznzU64(&x129, x104, 0x0, x38);
3505 x129 = 0x0 ^ ((0x0 ^ x38) & x126_selection_mask);
35033506 var x130: u64 = undefined;
3504 cmovznzU64(&x130, x104, 0x0, x39);
3507 x130 = 0x0 ^ ((0x0 ^ x39) & x126_selection_mask);
35053508 var x131: u64 = undefined;
3506 cmovznzU64(&x131, x104, 0x0, x40);
3509 x131 = 0x0 ^ ((0x0 ^ x40) & x126_selection_mask);
35073510 var x132: u64 = undefined;
35083511 var x133: u1 = undefined;
35093512 addcarryxU64(&x132, &x133, 0x0, x98, x126);
......@@ -3542,41 +3545,43 @@ pub fn divstep(out1: *u64, out2: *[7]u64, out3: *[7]u64, out4: *[6]u64, out5: *[
35423545 subborrowxU64(&x154, &x155, x153, x142, 0xffffffffffffffff);
35433546 var x156: u64 = undefined;
35443547 var x157: u1 = undefined;
3545 subborrowxU64(&x156, &x157, x155, @as(u64, x143), 0x0);
3548 subborrowxU64(&x156, &x157, x155, x143, 0x0);
35463549 var x158: u64 = undefined;
35473550 var x159: u1 = undefined;
35483551 addcarryxU64(&x158, &x159, 0x0, x6, 0x1);
3549 const x160 = ((x112 >> 1) | ((x114 << 63) & 0xffffffffffffffff));
3550 const x161 = ((x114 >> 1) | ((x116 << 63) & 0xffffffffffffffff));
3551 const x162 = ((x116 >> 1) | ((x118 << 63) & 0xffffffffffffffff));
3552 const x163 = ((x118 >> 1) | ((x120 << 63) & 0xffffffffffffffff));
3553 const x164 = ((x120 >> 1) | ((x122 << 63) & 0xffffffffffffffff));
3554 const x165 = ((x122 >> 1) | ((x124 << 63) & 0xffffffffffffffff));
3555 const x166 = ((x124 & 0x8000000000000000) | (x124 >> 1));
3552 const x160: u64 = ((x112 >> 1) | ((x114 << 63) & 0xffffffffffffffff));
3553 const x161: u64 = ((x114 >> 1) | ((x116 << 63) & 0xffffffffffffffff));
3554 const x162: u64 = ((x116 >> 1) | ((x118 << 63) & 0xffffffffffffffff));
3555 const x163: u64 = ((x118 >> 1) | ((x120 << 63) & 0xffffffffffffffff));
3556 const x164: u64 = ((x120 >> 1) | ((x122 << 63) & 0xffffffffffffffff));
3557 const x165: u64 = ((x122 >> 1) | ((x124 << 63) & 0xffffffffffffffff));
3558 const x166: u64 = ((x124 & 0x8000000000000000) | (x124 >> 1));
35563559 var x167: u64 = undefined;
3557 cmovznzU64(&x167, x66, x53, x41);
3560 const x167_selection_mask = selectionMaskU64(x66);
3561 x167 = x53 ^ ((x53 ^ x41) & x167_selection_mask);
35583562 var x168: u64 = undefined;
3559 cmovznzU64(&x168, x66, x55, x43);
3563 x168 = x55 ^ ((x55 ^ x43) & x167_selection_mask);
35603564 var x169: u64 = undefined;
3561 cmovznzU64(&x169, x66, x57, x45);
3565 x169 = x57 ^ ((x57 ^ x45) & x167_selection_mask);
35623566 var x170: u64 = undefined;
3563 cmovznzU64(&x170, x66, x59, x47);
3567 x170 = x59 ^ ((x59 ^ x47) & x167_selection_mask);
35643568 var x171: u64 = undefined;
3565 cmovznzU64(&x171, x66, x61, x49);
3569 x171 = x61 ^ ((x61 ^ x49) & x167_selection_mask);
35663570 var x172: u64 = undefined;
3567 cmovznzU64(&x172, x66, x63, x51);
3571 x172 = x63 ^ ((x63 ^ x51) & x167_selection_mask);
35683572 var x173: u64 = undefined;
3569 cmovznzU64(&x173, x157, x144, x132);
3573 const x173_selection_mask = selectionMaskU64(x157);
3574 x173 = x144 ^ ((x144 ^ x132) & x173_selection_mask);
35703575 var x174: u64 = undefined;
3571 cmovznzU64(&x174, x157, x146, x134);
3576 x174 = x146 ^ ((x146 ^ x134) & x173_selection_mask);
35723577 var x175: u64 = undefined;
3573 cmovznzU64(&x175, x157, x148, x136);
3578 x175 = x148 ^ ((x148 ^ x136) & x173_selection_mask);
35743579 var x176: u64 = undefined;
3575 cmovznzU64(&x176, x157, x150, x138);
3580 x176 = x150 ^ ((x150 ^ x138) & x173_selection_mask);
35763581 var x177: u64 = undefined;
3577 cmovznzU64(&x177, x157, x152, x140);
3582 x177 = x152 ^ ((x152 ^ x140) & x173_selection_mask);
35783583 var x178: u64 = undefined;
3579 cmovznzU64(&x178, x157, x154, x142);
3584 x178 = x154 ^ ((x154 ^ x142) & x173_selection_mask);
35803585 out1.* = x158;
35813586 out2[0] = x7;
35823587 out2[1] = x8;
lib/std/crypto/pcurves/secp256k1/secp256k1_64.zig+367-362
......@@ -17,7 +17,6 @@
1717// twos_complement_eval z = let x1 := z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) in
1818// if x1 & (2^256-1) < 2^255 then x1 & (2^256-1) else (x1 & (2^256-1)) - 2^256
1919
20const std = @import("std");
2120const mode = @import("builtin").mode; // Checked arithmetic is disabled in non-debug modes to avoid side channels
2221
2322// The type MontgomeryDomainFieldElement is a field element in the Montgomery domain.
......@@ -28,80 +27,70 @@ pub const MontgomeryDomainFieldElement = [4]u64;
2827// Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
2928pub const NonMontgomeryDomainFieldElement = [4]u64;
3029
31/// The function addcarryxU64 is an addition with carry.
32///
33/// Postconditions:
34/// out1 = (arg1 + arg2 + arg3) mod 2^64
35/// out2 = ⌊(arg1 + arg2 + arg3) / 2^64⌋
36///
37/// Input Bounds:
38/// arg1: [0x0 ~> 0x1]
39/// arg2: [0x0 ~> 0xffffffffffffffff]
40/// arg3: [0x0 ~> 0xffffffffffffffff]
41/// Output Bounds:
42/// out1: [0x0 ~> 0xffffffffffffffff]
43/// out2: [0x0 ~> 0x1]
30/// Add two limbs and a carry bit, returning the sum modulo 2^64 and the carry bit.
4431fn addcarryxU64(out1: *u64, out2: *u1, arg1: u1, arg2: u64, arg3: u64) void {
45 const x = @as(u128, arg2) +% arg3 +% arg1;
46 out1.* = @truncate(x);
47 out2.* = @truncate(x >> 64);
32 @setRuntimeSafety(mode == .debug);
33
34 const x = @addWithOverflow(arg2, arg3);
35 const y = @addWithOverflow(x[0], arg1);
36 out1.* = y[0];
37 out2.* = x[1] | y[1];
4838}
4939
50/// The function subborrowxU64 is a subtraction with borrow.
51///
52/// Postconditions:
53/// out1 = (-arg1 + arg2 + -arg3) mod 2^64
54/// out2 = -⌊(-arg1 + arg2 + -arg3) / 2^64⌋
55///
56/// Input Bounds:
57/// arg1: [0x0 ~> 0x1]
58/// arg2: [0x0 ~> 0xffffffffffffffff]
59/// arg3: [0x0 ~> 0xffffffffffffffff]
60/// Output Bounds:
61/// out1: [0x0 ~> 0xffffffffffffffff]
62/// out2: [0x0 ~> 0x1]
40/// Subtract two limbs and a borrow bit, returning the difference modulo 2^64 and the borrow bit.
6341fn subborrowxU64(out1: *u64, out2: *u1, arg1: u1, arg2: u64, arg3: u64) void {
64 const x = @as(u128, arg2) -% arg3 -% arg1;
65 out1.* = @truncate(x);
66 out2.* = @truncate(x >> 64);
42 @setRuntimeSafety(mode == .debug);
43
44 const x = @subWithOverflow(arg2, arg3);
45 const y = @subWithOverflow(x[0], arg1);
46 out1.* = y[0];
47 out2.* = x[1] | y[1];
6748}
6849
69/// The function mulxU64 is a multiplication, returning the full double-width result.
70///
71/// Postconditions:
72/// out1 = (arg1 * arg2) mod 2^64
73/// out2 = ⌊arg1 * arg2 / 2^64⌋
74///
75/// Input Bounds:
76/// arg1: [0x0 ~> 0xffffffffffffffff]
77/// arg2: [0x0 ~> 0xffffffffffffffff]
78/// Output Bounds:
79/// out1: [0x0 ~> 0xffffffffffffffff]
80/// out2: [0x0 ~> 0xffffffffffffffff]
50/// Multiply two limbs, returning the low and high halves of the product.
8151fn mulxU64(out1: *u64, out2: *u64, arg1: u64, arg2: u64) void {
8252 @setRuntimeSafety(mode == .debug);
8353
84 const x = @as(u128, arg1) * @as(u128, arg2);
85 out1.* = @as(u64, @truncate(x));
86 out2.* = @as(u64, @truncate(x >> 64));
54 const x = @as(u128, arg1) * arg2;
55 out1.* = @truncate(x);
56 out2.* = @intCast(x >> 64);
8757}
8858
89/// The function cmovznzU64 is a single-word conditional move.
90///
91/// Postconditions:
92/// out1 = (if arg1 = 0 then arg2 else arg3)
93///
94/// Input Bounds:
95/// arg1: [0x0 ~> 0x1]
96/// arg2: [0x0 ~> 0xffffffffffffffff]
97/// arg3: [0x0 ~> 0xffffffffffffffff]
98/// Output Bounds:
99/// out1: [0x0 ~> 0xffffffffffffffff]
59/// Keep selection masks opaque to the optimizer without adding instructions.
60fn selectionMaskU64(arg1: u1) u64 {
61 @setRuntimeSafety(mode == .debug);
62
63 const value: u64 = 0 -% @as(u64, arg1);
64 if (@inComptime()) return value;
65 switch (@import("builtin").zig_backend) {
66 .stage2_c, .stage2_wasm => return value,
67 else => {},
68 }
69 if (@bitSizeOf(u64) <= @bitSizeOf(usize)) {
70 return asm (""
71 : [mask] "=r" (-> u64),
72 : [value] "0" (value),
73 );
74 }
75 var mask: u64 = 0;
76 inline for (0..@divExact(@bitSizeOf(u64), @bitSizeOf(usize))) |i| {
77 const shift = i * @bitSizeOf(usize);
78 const chunk: usize = @truncate(value >> shift);
79 const part = asm (""
80 : [mask] "=r" (-> usize),
81 : [value] "0" (chunk),
82 );
83 mask |= @as(u64, part) << shift;
84 }
85 return mask;
86}
87
88/// Select arg2 when arg1 is zero and arg3 otherwise, using a bit mask.
10089fn cmovznzU64(out1: *u64, arg1: u1, arg2: u64, arg3: u64) void {
10190 @setRuntimeSafety(mode == .debug);
10291
103 const mask = 0 -% @as(u64, arg1);
104 out1.* = (mask & arg3) | ((~mask) & arg2);
92 const mask = selectionMaskU64(arg1);
93 out1.* = arg2 ^ ((arg2 ^ arg3) & mask);
10594}
10695
10796/// The function mul multiplies two field elements in the Montgomery domain.
......@@ -116,22 +105,22 @@ fn cmovznzU64(out1: *u64, arg1: u1, arg2: u64, arg3: u64) void {
116105pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldElement, arg2: MontgomeryDomainFieldElement) void {
117106 @setRuntimeSafety(mode == .debug);
118107
119 const x1 = (arg1[1]);
120 const x2 = (arg1[2]);
121 const x3 = (arg1[3]);
122 const x4 = (arg1[0]);
108 const x1: u64 = arg1[1];
109 const x2: u64 = arg1[2];
110 const x3: u64 = arg1[3];
111 const x4: u64 = arg1[0];
123112 var x5: u64 = undefined;
124113 var x6: u64 = undefined;
125 mulxU64(&x5, &x6, x4, (arg2[3]));
114 mulxU64(&x5, &x6, x4, arg2[3]);
126115 var x7: u64 = undefined;
127116 var x8: u64 = undefined;
128 mulxU64(&x7, &x8, x4, (arg2[2]));
117 mulxU64(&x7, &x8, x4, arg2[2]);
129118 var x9: u64 = undefined;
130119 var x10: u64 = undefined;
131 mulxU64(&x9, &x10, x4, (arg2[1]));
120 mulxU64(&x9, &x10, x4, arg2[1]);
132121 var x11: u64 = undefined;
133122 var x12: u64 = undefined;
134 mulxU64(&x11, &x12, x4, (arg2[0]));
123 mulxU64(&x11, &x12, x4, arg2[0]);
135124 var x13: u64 = undefined;
136125 var x14: u1 = undefined;
137126 addcarryxU64(&x13, &x14, 0x0, x12, x9);
......@@ -141,7 +130,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
141130 var x17: u64 = undefined;
142131 var x18: u1 = undefined;
143132 addcarryxU64(&x17, &x18, x16, x8, x5);
144 const x19 = (@as(u64, x18) + x6);
133 const x19: u64 = (x18 + x6);
145134 var x20: u64 = undefined;
146135 var x21: u64 = undefined;
147136 mulxU64(&x20, &x21, x11, 0xd838091dd2253531);
......@@ -166,7 +155,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
166155 var x34: u64 = undefined;
167156 var x35: u1 = undefined;
168157 addcarryxU64(&x34, &x35, x33, x25, x22);
169 const x36 = (@as(u64, x35) + x23);
158 const x36: u64 = (x35 + x23);
170159 var x37: u64 = undefined;
171160 var x38: u1 = undefined;
172161 addcarryxU64(&x37, &x38, 0x0, x11, x28);
......@@ -184,16 +173,16 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
184173 addcarryxU64(&x45, &x46, x44, x19, x36);
185174 var x47: u64 = undefined;
186175 var x48: u64 = undefined;
187 mulxU64(&x47, &x48, x1, (arg2[3]));
176 mulxU64(&x47, &x48, x1, arg2[3]);
188177 var x49: u64 = undefined;
189178 var x50: u64 = undefined;
190 mulxU64(&x49, &x50, x1, (arg2[2]));
179 mulxU64(&x49, &x50, x1, arg2[2]);
191180 var x51: u64 = undefined;
192181 var x52: u64 = undefined;
193 mulxU64(&x51, &x52, x1, (arg2[1]));
182 mulxU64(&x51, &x52, x1, arg2[1]);
194183 var x53: u64 = undefined;
195184 var x54: u64 = undefined;
196 mulxU64(&x53, &x54, x1, (arg2[0]));
185 mulxU64(&x53, &x54, x1, arg2[0]);
197186 var x55: u64 = undefined;
198187 var x56: u1 = undefined;
199188 addcarryxU64(&x55, &x56, 0x0, x54, x51);
......@@ -203,7 +192,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
203192 var x59: u64 = undefined;
204193 var x60: u1 = undefined;
205194 addcarryxU64(&x59, &x60, x58, x50, x47);
206 const x61 = (@as(u64, x60) + x48);
195 const x61: u64 = (x60 + x48);
207196 var x62: u64 = undefined;
208197 var x63: u1 = undefined;
209198 addcarryxU64(&x62, &x63, 0x0, x39, x53);
......@@ -218,7 +207,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
218207 addcarryxU64(&x68, &x69, x67, x45, x59);
219208 var x70: u64 = undefined;
220209 var x71: u1 = undefined;
221 addcarryxU64(&x70, &x71, x69, @as(u64, x46), x61);
210 addcarryxU64(&x70, &x71, x69, x46, x61);
222211 var x72: u64 = undefined;
223212 var x73: u64 = undefined;
224213 mulxU64(&x72, &x73, x62, 0xd838091dd2253531);
......@@ -243,7 +232,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
243232 var x86: u64 = undefined;
244233 var x87: u1 = undefined;
245234 addcarryxU64(&x86, &x87, x85, x77, x74);
246 const x88 = (@as(u64, x87) + x75);
235 const x88: u64 = (x87 + x75);
247236 var x89: u64 = undefined;
248237 var x90: u1 = undefined;
249238 addcarryxU64(&x89, &x90, 0x0, x62, x80);
......@@ -259,19 +248,19 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
259248 var x97: u64 = undefined;
260249 var x98: u1 = undefined;
261250 addcarryxU64(&x97, &x98, x96, x70, x88);
262 const x99 = (@as(u64, x98) + @as(u64, x71));
251 const x99: u64 = (@as(u64, x98) + x71);
263252 var x100: u64 = undefined;
264253 var x101: u64 = undefined;
265 mulxU64(&x100, &x101, x2, (arg2[3]));
254 mulxU64(&x100, &x101, x2, arg2[3]);
266255 var x102: u64 = undefined;
267256 var x103: u64 = undefined;
268 mulxU64(&x102, &x103, x2, (arg2[2]));
257 mulxU64(&x102, &x103, x2, arg2[2]);
269258 var x104: u64 = undefined;
270259 var x105: u64 = undefined;
271 mulxU64(&x104, &x105, x2, (arg2[1]));
260 mulxU64(&x104, &x105, x2, arg2[1]);
272261 var x106: u64 = undefined;
273262 var x107: u64 = undefined;
274 mulxU64(&x106, &x107, x2, (arg2[0]));
263 mulxU64(&x106, &x107, x2, arg2[0]);
275264 var x108: u64 = undefined;
276265 var x109: u1 = undefined;
277266 addcarryxU64(&x108, &x109, 0x0, x107, x104);
......@@ -281,7 +270,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
281270 var x112: u64 = undefined;
282271 var x113: u1 = undefined;
283272 addcarryxU64(&x112, &x113, x111, x103, x100);
284 const x114 = (@as(u64, x113) + x101);
273 const x114: u64 = (x113 + x101);
285274 var x115: u64 = undefined;
286275 var x116: u1 = undefined;
287276 addcarryxU64(&x115, &x116, 0x0, x91, x106);
......@@ -321,7 +310,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
321310 var x139: u64 = undefined;
322311 var x140: u1 = undefined;
323312 addcarryxU64(&x139, &x140, x138, x130, x127);
324 const x141 = (@as(u64, x140) + x128);
313 const x141: u64 = (x140 + x128);
325314 var x142: u64 = undefined;
326315 var x143: u1 = undefined;
327316 addcarryxU64(&x142, &x143, 0x0, x115, x133);
......@@ -337,19 +326,19 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
337326 var x150: u64 = undefined;
338327 var x151: u1 = undefined;
339328 addcarryxU64(&x150, &x151, x149, x123, x141);
340 const x152 = (@as(u64, x151) + @as(u64, x124));
329 const x152: u64 = (@as(u64, x151) + x124);
341330 var x153: u64 = undefined;
342331 var x154: u64 = undefined;
343 mulxU64(&x153, &x154, x3, (arg2[3]));
332 mulxU64(&x153, &x154, x3, arg2[3]);
344333 var x155: u64 = undefined;
345334 var x156: u64 = undefined;
346 mulxU64(&x155, &x156, x3, (arg2[2]));
335 mulxU64(&x155, &x156, x3, arg2[2]);
347336 var x157: u64 = undefined;
348337 var x158: u64 = undefined;
349 mulxU64(&x157, &x158, x3, (arg2[1]));
338 mulxU64(&x157, &x158, x3, arg2[1]);
350339 var x159: u64 = undefined;
351340 var x160: u64 = undefined;
352 mulxU64(&x159, &x160, x3, (arg2[0]));
341 mulxU64(&x159, &x160, x3, arg2[0]);
353342 var x161: u64 = undefined;
354343 var x162: u1 = undefined;
355344 addcarryxU64(&x161, &x162, 0x0, x160, x157);
......@@ -359,7 +348,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
359348 var x165: u64 = undefined;
360349 var x166: u1 = undefined;
361350 addcarryxU64(&x165, &x166, x164, x156, x153);
362 const x167 = (@as(u64, x166) + x154);
351 const x167: u64 = (x166 + x154);
363352 var x168: u64 = undefined;
364353 var x169: u1 = undefined;
365354 addcarryxU64(&x168, &x169, 0x0, x144, x159);
......@@ -399,7 +388,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
399388 var x192: u64 = undefined;
400389 var x193: u1 = undefined;
401390 addcarryxU64(&x192, &x193, x191, x183, x180);
402 const x194 = (@as(u64, x193) + x181);
391 const x194: u64 = (x193 + x181);
403392 var x195: u64 = undefined;
404393 var x196: u1 = undefined;
405394 addcarryxU64(&x195, &x196, 0x0, x168, x186);
......@@ -415,7 +404,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
415404 var x203: u64 = undefined;
416405 var x204: u1 = undefined;
417406 addcarryxU64(&x203, &x204, x202, x176, x194);
418 const x205 = (@as(u64, x204) + @as(u64, x177));
407 const x205: u64 = (@as(u64, x204) + x177);
419408 var x206: u64 = undefined;
420409 var x207: u1 = undefined;
421410 subborrowxU64(&x206, &x207, 0x0, x197, 0xfffffffefffffc2f);
......@@ -432,13 +421,14 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
432421 var x215: u1 = undefined;
433422 subborrowxU64(&x214, &x215, x213, x205, 0x0);
434423 var x216: u64 = undefined;
435 cmovznzU64(&x216, x215, x206, x197);
424 const x216_selection_mask = selectionMaskU64(x215);
425 x216 = x206 ^ ((x206 ^ x197) & x216_selection_mask);
436426 var x217: u64 = undefined;
437 cmovznzU64(&x217, x215, x208, x199);
427 x217 = x208 ^ ((x208 ^ x199) & x216_selection_mask);
438428 var x218: u64 = undefined;
439 cmovznzU64(&x218, x215, x210, x201);
429 x218 = x210 ^ ((x210 ^ x201) & x216_selection_mask);
440430 var x219: u64 = undefined;
441 cmovznzU64(&x219, x215, x212, x203);
431 x219 = x212 ^ ((x212 ^ x203) & x216_selection_mask);
442432 out1[0] = x216;
443433 out1[1] = x217;
444434 out1[2] = x218;
......@@ -456,22 +446,22 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
456446pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldElement) void {
457447 @setRuntimeSafety(mode == .debug);
458448
459 const x1 = (arg1[1]);
460 const x2 = (arg1[2]);
461 const x3 = (arg1[3]);
462 const x4 = (arg1[0]);
449 const x1: u64 = arg1[1];
450 const x2: u64 = arg1[2];
451 const x3: u64 = arg1[3];
452 const x4: u64 = arg1[0];
463453 var x5: u64 = undefined;
464454 var x6: u64 = undefined;
465 mulxU64(&x5, &x6, x4, (arg1[3]));
455 mulxU64(&x5, &x6, x4, arg1[3]);
466456 var x7: u64 = undefined;
467457 var x8: u64 = undefined;
468 mulxU64(&x7, &x8, x4, (arg1[2]));
458 mulxU64(&x7, &x8, x4, arg1[2]);
469459 var x9: u64 = undefined;
470460 var x10: u64 = undefined;
471 mulxU64(&x9, &x10, x4, (arg1[1]));
461 mulxU64(&x9, &x10, x4, arg1[1]);
472462 var x11: u64 = undefined;
473463 var x12: u64 = undefined;
474 mulxU64(&x11, &x12, x4, (arg1[0]));
464 mulxU64(&x11, &x12, x4, arg1[0]);
475465 var x13: u64 = undefined;
476466 var x14: u1 = undefined;
477467 addcarryxU64(&x13, &x14, 0x0, x12, x9);
......@@ -481,7 +471,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
481471 var x17: u64 = undefined;
482472 var x18: u1 = undefined;
483473 addcarryxU64(&x17, &x18, x16, x8, x5);
484 const x19 = (@as(u64, x18) + x6);
474 const x19: u64 = (x18 + x6);
485475 var x20: u64 = undefined;
486476 var x21: u64 = undefined;
487477 mulxU64(&x20, &x21, x11, 0xd838091dd2253531);
......@@ -506,7 +496,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
506496 var x34: u64 = undefined;
507497 var x35: u1 = undefined;
508498 addcarryxU64(&x34, &x35, x33, x25, x22);
509 const x36 = (@as(u64, x35) + x23);
499 const x36: u64 = (x35 + x23);
510500 var x37: u64 = undefined;
511501 var x38: u1 = undefined;
512502 addcarryxU64(&x37, &x38, 0x0, x11, x28);
......@@ -524,16 +514,16 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
524514 addcarryxU64(&x45, &x46, x44, x19, x36);
525515 var x47: u64 = undefined;
526516 var x48: u64 = undefined;
527 mulxU64(&x47, &x48, x1, (arg1[3]));
517 mulxU64(&x47, &x48, x1, arg1[3]);
528518 var x49: u64 = undefined;
529519 var x50: u64 = undefined;
530 mulxU64(&x49, &x50, x1, (arg1[2]));
520 mulxU64(&x49, &x50, x1, arg1[2]);
531521 var x51: u64 = undefined;
532522 var x52: u64 = undefined;
533 mulxU64(&x51, &x52, x1, (arg1[1]));
523 mulxU64(&x51, &x52, x1, arg1[1]);
534524 var x53: u64 = undefined;
535525 var x54: u64 = undefined;
536 mulxU64(&x53, &x54, x1, (arg1[0]));
526 mulxU64(&x53, &x54, x1, arg1[0]);
537527 var x55: u64 = undefined;
538528 var x56: u1 = undefined;
539529 addcarryxU64(&x55, &x56, 0x0, x54, x51);
......@@ -543,7 +533,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
543533 var x59: u64 = undefined;
544534 var x60: u1 = undefined;
545535 addcarryxU64(&x59, &x60, x58, x50, x47);
546 const x61 = (@as(u64, x60) + x48);
536 const x61: u64 = (x60 + x48);
547537 var x62: u64 = undefined;
548538 var x63: u1 = undefined;
549539 addcarryxU64(&x62, &x63, 0x0, x39, x53);
......@@ -558,7 +548,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
558548 addcarryxU64(&x68, &x69, x67, x45, x59);
559549 var x70: u64 = undefined;
560550 var x71: u1 = undefined;
561 addcarryxU64(&x70, &x71, x69, @as(u64, x46), x61);
551 addcarryxU64(&x70, &x71, x69, x46, x61);
562552 var x72: u64 = undefined;
563553 var x73: u64 = undefined;
564554 mulxU64(&x72, &x73, x62, 0xd838091dd2253531);
......@@ -583,7 +573,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
583573 var x86: u64 = undefined;
584574 var x87: u1 = undefined;
585575 addcarryxU64(&x86, &x87, x85, x77, x74);
586 const x88 = (@as(u64, x87) + x75);
576 const x88: u64 = (x87 + x75);
587577 var x89: u64 = undefined;
588578 var x90: u1 = undefined;
589579 addcarryxU64(&x89, &x90, 0x0, x62, x80);
......@@ -599,19 +589,19 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
599589 var x97: u64 = undefined;
600590 var x98: u1 = undefined;
601591 addcarryxU64(&x97, &x98, x96, x70, x88);
602 const x99 = (@as(u64, x98) + @as(u64, x71));
592 const x99: u64 = (@as(u64, x98) + x71);
603593 var x100: u64 = undefined;
604594 var x101: u64 = undefined;
605 mulxU64(&x100, &x101, x2, (arg1[3]));
595 mulxU64(&x100, &x101, x2, arg1[3]);
606596 var x102: u64 = undefined;
607597 var x103: u64 = undefined;
608 mulxU64(&x102, &x103, x2, (arg1[2]));
598 mulxU64(&x102, &x103, x2, arg1[2]);
609599 var x104: u64 = undefined;
610600 var x105: u64 = undefined;
611 mulxU64(&x104, &x105, x2, (arg1[1]));
601 mulxU64(&x104, &x105, x2, arg1[1]);
612602 var x106: u64 = undefined;
613603 var x107: u64 = undefined;
614 mulxU64(&x106, &x107, x2, (arg1[0]));
604 mulxU64(&x106, &x107, x2, arg1[0]);
615605 var x108: u64 = undefined;
616606 var x109: u1 = undefined;
617607 addcarryxU64(&x108, &x109, 0x0, x107, x104);
......@@ -621,7 +611,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
621611 var x112: u64 = undefined;
622612 var x113: u1 = undefined;
623613 addcarryxU64(&x112, &x113, x111, x103, x100);
624 const x114 = (@as(u64, x113) + x101);
614 const x114: u64 = (x113 + x101);
625615 var x115: u64 = undefined;
626616 var x116: u1 = undefined;
627617 addcarryxU64(&x115, &x116, 0x0, x91, x106);
......@@ -661,7 +651,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
661651 var x139: u64 = undefined;
662652 var x140: u1 = undefined;
663653 addcarryxU64(&x139, &x140, x138, x130, x127);
664 const x141 = (@as(u64, x140) + x128);
654 const x141: u64 = (x140 + x128);
665655 var x142: u64 = undefined;
666656 var x143: u1 = undefined;
667657 addcarryxU64(&x142, &x143, 0x0, x115, x133);
......@@ -677,19 +667,19 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
677667 var x150: u64 = undefined;
678668 var x151: u1 = undefined;
679669 addcarryxU64(&x150, &x151, x149, x123, x141);
680 const x152 = (@as(u64, x151) + @as(u64, x124));
670 const x152: u64 = (@as(u64, x151) + x124);
681671 var x153: u64 = undefined;
682672 var x154: u64 = undefined;
683 mulxU64(&x153, &x154, x3, (arg1[3]));
673 mulxU64(&x153, &x154, x3, arg1[3]);
684674 var x155: u64 = undefined;
685675 var x156: u64 = undefined;
686 mulxU64(&x155, &x156, x3, (arg1[2]));
676 mulxU64(&x155, &x156, x3, arg1[2]);
687677 var x157: u64 = undefined;
688678 var x158: u64 = undefined;
689 mulxU64(&x157, &x158, x3, (arg1[1]));
679 mulxU64(&x157, &x158, x3, arg1[1]);
690680 var x159: u64 = undefined;
691681 var x160: u64 = undefined;
692 mulxU64(&x159, &x160, x3, (arg1[0]));
682 mulxU64(&x159, &x160, x3, arg1[0]);
693683 var x161: u64 = undefined;
694684 var x162: u1 = undefined;
695685 addcarryxU64(&x161, &x162, 0x0, x160, x157);
......@@ -699,7 +689,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
699689 var x165: u64 = undefined;
700690 var x166: u1 = undefined;
701691 addcarryxU64(&x165, &x166, x164, x156, x153);
702 const x167 = (@as(u64, x166) + x154);
692 const x167: u64 = (x166 + x154);
703693 var x168: u64 = undefined;
704694 var x169: u1 = undefined;
705695 addcarryxU64(&x168, &x169, 0x0, x144, x159);
......@@ -739,7 +729,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
739729 var x192: u64 = undefined;
740730 var x193: u1 = undefined;
741731 addcarryxU64(&x192, &x193, x191, x183, x180);
742 const x194 = (@as(u64, x193) + x181);
732 const x194: u64 = (x193 + x181);
743733 var x195: u64 = undefined;
744734 var x196: u1 = undefined;
745735 addcarryxU64(&x195, &x196, 0x0, x168, x186);
......@@ -755,7 +745,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
755745 var x203: u64 = undefined;
756746 var x204: u1 = undefined;
757747 addcarryxU64(&x203, &x204, x202, x176, x194);
758 const x205 = (@as(u64, x204) + @as(u64, x177));
748 const x205: u64 = (@as(u64, x204) + x177);
759749 var x206: u64 = undefined;
760750 var x207: u1 = undefined;
761751 subborrowxU64(&x206, &x207, 0x0, x197, 0xfffffffefffffc2f);
......@@ -772,13 +762,14 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
772762 var x215: u1 = undefined;
773763 subborrowxU64(&x214, &x215, x213, x205, 0x0);
774764 var x216: u64 = undefined;
775 cmovznzU64(&x216, x215, x206, x197);
765 const x216_selection_mask = selectionMaskU64(x215);
766 x216 = x206 ^ ((x206 ^ x197) & x216_selection_mask);
776767 var x217: u64 = undefined;
777 cmovznzU64(&x217, x215, x208, x199);
768 x217 = x208 ^ ((x208 ^ x199) & x216_selection_mask);
778769 var x218: u64 = undefined;
779 cmovznzU64(&x218, x215, x210, x201);
770 x218 = x210 ^ ((x210 ^ x201) & x216_selection_mask);
780771 var x219: u64 = undefined;
781 cmovznzU64(&x219, x215, x212, x203);
772 x219 = x212 ^ ((x212 ^ x203) & x216_selection_mask);
782773 out1[0] = x216;
783774 out1[1] = x217;
784775 out1[2] = x218;
......@@ -799,16 +790,16 @@ pub fn add(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
799790
800791 var x1: u64 = undefined;
801792 var x2: u1 = undefined;
802 addcarryxU64(&x1, &x2, 0x0, (arg1[0]), (arg2[0]));
793 addcarryxU64(&x1, &x2, 0x0, arg1[0], arg2[0]);
803794 var x3: u64 = undefined;
804795 var x4: u1 = undefined;
805 addcarryxU64(&x3, &x4, x2, (arg1[1]), (arg2[1]));
796 addcarryxU64(&x3, &x4, x2, arg1[1], arg2[1]);
806797 var x5: u64 = undefined;
807798 var x6: u1 = undefined;
808 addcarryxU64(&x5, &x6, x4, (arg1[2]), (arg2[2]));
799 addcarryxU64(&x5, &x6, x4, arg1[2], arg2[2]);
809800 var x7: u64 = undefined;
810801 var x8: u1 = undefined;
811 addcarryxU64(&x7, &x8, x6, (arg1[3]), (arg2[3]));
802 addcarryxU64(&x7, &x8, x6, arg1[3], arg2[3]);
812803 var x9: u64 = undefined;
813804 var x10: u1 = undefined;
814805 subborrowxU64(&x9, &x10, 0x0, x1, 0xfffffffefffffc2f);
......@@ -823,15 +814,16 @@ pub fn add(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
823814 subborrowxU64(&x15, &x16, x14, x7, 0xffffffffffffffff);
824815 var x17: u64 = undefined;
825816 var x18: u1 = undefined;
826 subborrowxU64(&x17, &x18, x16, @as(u64, x8), 0x0);
817 subborrowxU64(&x17, &x18, x16, x8, 0x0);
827818 var x19: u64 = undefined;
828 cmovznzU64(&x19, x18, x9, x1);
819 const x19_selection_mask = selectionMaskU64(x18);
820 x19 = x9 ^ ((x9 ^ x1) & x19_selection_mask);
829821 var x20: u64 = undefined;
830 cmovznzU64(&x20, x18, x11, x3);
822 x20 = x11 ^ ((x11 ^ x3) & x19_selection_mask);
831823 var x21: u64 = undefined;
832 cmovznzU64(&x21, x18, x13, x5);
824 x21 = x13 ^ ((x13 ^ x5) & x19_selection_mask);
833825 var x22: u64 = undefined;
834 cmovznzU64(&x22, x18, x15, x7);
826 x22 = x15 ^ ((x15 ^ x7) & x19_selection_mask);
835827 out1[0] = x19;
836828 out1[1] = x20;
837829 out1[2] = x21;
......@@ -852,18 +844,19 @@ pub fn sub(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
852844
853845 var x1: u64 = undefined;
854846 var x2: u1 = undefined;
855 subborrowxU64(&x1, &x2, 0x0, (arg1[0]), (arg2[0]));
847 subborrowxU64(&x1, &x2, 0x0, arg1[0], arg2[0]);
856848 var x3: u64 = undefined;
857849 var x4: u1 = undefined;
858 subborrowxU64(&x3, &x4, x2, (arg1[1]), (arg2[1]));
850 subborrowxU64(&x3, &x4, x2, arg1[1], arg2[1]);
859851 var x5: u64 = undefined;
860852 var x6: u1 = undefined;
861 subborrowxU64(&x5, &x6, x4, (arg1[2]), (arg2[2]));
853 subborrowxU64(&x5, &x6, x4, arg1[2], arg2[2]);
862854 var x7: u64 = undefined;
863855 var x8: u1 = undefined;
864 subborrowxU64(&x7, &x8, x6, (arg1[3]), (arg2[3]));
856 subborrowxU64(&x7, &x8, x6, arg1[3], arg2[3]);
865857 var x9: u64 = undefined;
866 cmovznzU64(&x9, x8, 0x0, 0xffffffffffffffff);
858 const x9_selection_mask = selectionMaskU64(x8);
859 x9 = 0x0 ^ ((0x0 ^ 0xffffffffffffffff) & x9_selection_mask);
867860 var x10: u64 = undefined;
868861 var x11: u1 = undefined;
869862 addcarryxU64(&x10, &x11, 0x0, x1, (x9 & 0xfffffffefffffc2f));
......@@ -895,18 +888,19 @@ pub fn opp(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
895888
896889 var x1: u64 = undefined;
897890 var x2: u1 = undefined;
898 subborrowxU64(&x1, &x2, 0x0, 0x0, (arg1[0]));
891 subborrowxU64(&x1, &x2, 0x0, 0x0, arg1[0]);
899892 var x3: u64 = undefined;
900893 var x4: u1 = undefined;
901 subborrowxU64(&x3, &x4, x2, 0x0, (arg1[1]));
894 subborrowxU64(&x3, &x4, x2, 0x0, arg1[1]);
902895 var x5: u64 = undefined;
903896 var x6: u1 = undefined;
904 subborrowxU64(&x5, &x6, x4, 0x0, (arg1[2]));
897 subborrowxU64(&x5, &x6, x4, 0x0, arg1[2]);
905898 var x7: u64 = undefined;
906899 var x8: u1 = undefined;
907 subborrowxU64(&x7, &x8, x6, 0x0, (arg1[3]));
900 subborrowxU64(&x7, &x8, x6, 0x0, arg1[3]);
908901 var x9: u64 = undefined;
909 cmovznzU64(&x9, x8, 0x0, 0xffffffffffffffff);
902 const x9_selection_mask = selectionMaskU64(x8);
903 x9 = 0x0 ^ ((0x0 ^ 0xffffffffffffffff) & x9_selection_mask);
910904 var x10: u64 = undefined;
911905 var x11: u1 = undefined;
912906 addcarryxU64(&x10, &x11, 0x0, x1, (x9 & 0xfffffffefffffc2f));
......@@ -936,7 +930,7 @@ pub fn opp(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
936930pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldElement) void {
937931 @setRuntimeSafety(mode == .debug);
938932
939 const x1 = (arg1[0]);
933 const x1: u64 = arg1[0];
940934 var x2: u64 = undefined;
941935 var x3: u64 = undefined;
942936 mulxU64(&x2, &x3, x1, 0xd838091dd2253531);
......@@ -975,10 +969,10 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo
975969 addcarryxU64(&x24, &x25, x23, 0x0, x16);
976970 var x26: u64 = undefined;
977971 var x27: u1 = undefined;
978 addcarryxU64(&x26, &x27, x25, 0x0, (@as(u64, x17) + x5));
972 addcarryxU64(&x26, &x27, x25, 0x0, (x17 + x5));
979973 var x28: u64 = undefined;
980974 var x29: u1 = undefined;
981 addcarryxU64(&x28, &x29, 0x0, x20, (arg1[1]));
975 addcarryxU64(&x28, &x29, 0x0, x20, arg1[1]);
982976 var x30: u64 = undefined;
983977 var x31: u1 = undefined;
984978 addcarryxU64(&x30, &x31, x29, x22, 0x0);
......@@ -1026,10 +1020,10 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo
10261020 addcarryxU64(&x58, &x59, x57, x34, x50);
10271021 var x60: u64 = undefined;
10281022 var x61: u1 = undefined;
1029 addcarryxU64(&x60, &x61, x59, (@as(u64, x35) + @as(u64, x27)), (@as(u64, x51) + x39));
1023 addcarryxU64(&x60, &x61, x59, (@as(u64, x35) + x27), (x51 + x39));
10301024 var x62: u64 = undefined;
10311025 var x63: u1 = undefined;
1032 addcarryxU64(&x62, &x63, 0x0, x54, (arg1[2]));
1026 addcarryxU64(&x62, &x63, 0x0, x54, arg1[2]);
10331027 var x64: u64 = undefined;
10341028 var x65: u1 = undefined;
10351029 addcarryxU64(&x64, &x65, x63, x56, 0x0);
......@@ -1077,10 +1071,10 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo
10771071 addcarryxU64(&x92, &x93, x91, x68, x84);
10781072 var x94: u64 = undefined;
10791073 var x95: u1 = undefined;
1080 addcarryxU64(&x94, &x95, x93, (@as(u64, x69) + @as(u64, x61)), (@as(u64, x85) + x73));
1074 addcarryxU64(&x94, &x95, x93, (@as(u64, x69) + x61), (x85 + x73));
10811075 var x96: u64 = undefined;
10821076 var x97: u1 = undefined;
1083 addcarryxU64(&x96, &x97, 0x0, x88, (arg1[3]));
1077 addcarryxU64(&x96, &x97, 0x0, x88, arg1[3]);
10841078 var x98: u64 = undefined;
10851079 var x99: u1 = undefined;
10861080 addcarryxU64(&x98, &x99, x97, x90, 0x0);
......@@ -1128,7 +1122,7 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo
11281122 addcarryxU64(&x126, &x127, x125, x102, x118);
11291123 var x128: u64 = undefined;
11301124 var x129: u1 = undefined;
1131 addcarryxU64(&x128, &x129, x127, (@as(u64, x103) + @as(u64, x95)), (@as(u64, x119) + x107));
1125 addcarryxU64(&x128, &x129, x127, (@as(u64, x103) + x95), (x119 + x107));
11321126 var x130: u64 = undefined;
11331127 var x131: u1 = undefined;
11341128 subborrowxU64(&x130, &x131, 0x0, x122, 0xfffffffefffffc2f);
......@@ -1143,15 +1137,16 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo
11431137 subborrowxU64(&x136, &x137, x135, x128, 0xffffffffffffffff);
11441138 var x138: u64 = undefined;
11451139 var x139: u1 = undefined;
1146 subborrowxU64(&x138, &x139, x137, @as(u64, x129), 0x0);
1140 subborrowxU64(&x138, &x139, x137, x129, 0x0);
11471141 var x140: u64 = undefined;
1148 cmovznzU64(&x140, x139, x130, x122);
1142 const x140_selection_mask = selectionMaskU64(x139);
1143 x140 = x130 ^ ((x130 ^ x122) & x140_selection_mask);
11491144 var x141: u64 = undefined;
1150 cmovznzU64(&x141, x139, x132, x124);
1145 x141 = x132 ^ ((x132 ^ x124) & x140_selection_mask);
11511146 var x142: u64 = undefined;
1152 cmovznzU64(&x142, x139, x134, x126);
1147 x142 = x134 ^ ((x134 ^ x126) & x140_selection_mask);
11531148 var x143: u64 = undefined;
1154 cmovznzU64(&x143, x139, x136, x128);
1149 x143 = x136 ^ ((x136 ^ x128) & x140_selection_mask);
11551150 out1[0] = x140;
11561151 out1[1] = x141;
11571152 out1[2] = x142;
......@@ -1169,10 +1164,10 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo
11691164pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDomainFieldElement) void {
11701165 @setRuntimeSafety(mode == .debug);
11711166
1172 const x1 = (arg1[1]);
1173 const x2 = (arg1[2]);
1174 const x3 = (arg1[3]);
1175 const x4 = (arg1[0]);
1167 const x1: u64 = arg1[1];
1168 const x2: u64 = arg1[2];
1169 const x3: u64 = arg1[3];
1170 const x4: u64 = arg1[0];
11761171 var x5: u64 = undefined;
11771172 var x6: u64 = undefined;
11781173 mulxU64(&x5, &x6, x4, 0x7a2000e90a1);
......@@ -1211,13 +1206,13 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma
12111206 addcarryxU64(&x27, &x28, x26, x7, x19);
12121207 var x29: u64 = undefined;
12131208 var x30: u1 = undefined;
1214 addcarryxU64(&x29, &x30, x28, @as(u64, x8), x21);
1209 addcarryxU64(&x29, &x30, x28, x8, x21);
12151210 var x31: u64 = undefined;
12161211 var x32: u1 = undefined;
12171212 addcarryxU64(&x31, &x32, x30, 0x0, x23);
12181213 var x33: u64 = undefined;
12191214 var x34: u1 = undefined;
1220 addcarryxU64(&x33, &x34, x32, 0x0, (@as(u64, x24) + x12));
1215 addcarryxU64(&x33, &x34, x32, 0x0, (x24 + x12));
12211216 var x35: u64 = undefined;
12221217 var x36: u64 = undefined;
12231218 mulxU64(&x35, &x36, x1, 0x7a2000e90a1);
......@@ -1232,7 +1227,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma
12321227 addcarryxU64(&x41, &x42, x40, x29, x37);
12331228 var x43: u64 = undefined;
12341229 var x44: u1 = undefined;
1235 addcarryxU64(&x43, &x44, x42, x31, @as(u64, x38));
1230 addcarryxU64(&x43, &x44, x42, x31, x38);
12361231 var x45: u64 = undefined;
12371232 var x46: u1 = undefined;
12381233 addcarryxU64(&x45, &x46, x44, x33, 0x0);
......@@ -1274,7 +1269,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma
12741269 addcarryxU64(&x69, &x70, x68, x45, x61);
12751270 var x71: u64 = undefined;
12761271 var x72: u1 = undefined;
1277 addcarryxU64(&x71, &x72, x70, (@as(u64, x46) + @as(u64, x34)), (@as(u64, x62) + x50));
1272 addcarryxU64(&x71, &x72, x70, (@as(u64, x46) + x34), (x62 + x50));
12781273 var x73: u64 = undefined;
12791274 var x74: u64 = undefined;
12801275 mulxU64(&x73, &x74, x2, 0x7a2000e90a1);
......@@ -1289,7 +1284,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma
12891284 addcarryxU64(&x79, &x80, x78, x67, x75);
12901285 var x81: u64 = undefined;
12911286 var x82: u1 = undefined;
1292 addcarryxU64(&x81, &x82, x80, x69, @as(u64, x76));
1287 addcarryxU64(&x81, &x82, x80, x69, x76);
12931288 var x83: u64 = undefined;
12941289 var x84: u1 = undefined;
12951290 addcarryxU64(&x83, &x84, x82, x71, 0x0);
......@@ -1331,7 +1326,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma
13311326 addcarryxU64(&x107, &x108, x106, x83, x99);
13321327 var x109: u64 = undefined;
13331328 var x110: u1 = undefined;
1334 addcarryxU64(&x109, &x110, x108, (@as(u64, x84) + @as(u64, x72)), (@as(u64, x100) + x88));
1329 addcarryxU64(&x109, &x110, x108, (@as(u64, x84) + x72), (x100 + x88));
13351330 var x111: u64 = undefined;
13361331 var x112: u64 = undefined;
13371332 mulxU64(&x111, &x112, x3, 0x7a2000e90a1);
......@@ -1346,7 +1341,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma
13461341 addcarryxU64(&x117, &x118, x116, x105, x113);
13471342 var x119: u64 = undefined;
13481343 var x120: u1 = undefined;
1349 addcarryxU64(&x119, &x120, x118, x107, @as(u64, x114));
1344 addcarryxU64(&x119, &x120, x118, x107, x114);
13501345 var x121: u64 = undefined;
13511346 var x122: u1 = undefined;
13521347 addcarryxU64(&x121, &x122, x120, x109, 0x0);
......@@ -1388,7 +1383,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma
13881383 addcarryxU64(&x145, &x146, x144, x121, x137);
13891384 var x147: u64 = undefined;
13901385 var x148: u1 = undefined;
1391 addcarryxU64(&x147, &x148, x146, (@as(u64, x122) + @as(u64, x110)), (@as(u64, x138) + x126));
1386 addcarryxU64(&x147, &x148, x146, (@as(u64, x122) + x110), (x138 + x126));
13921387 var x149: u64 = undefined;
13931388 var x150: u1 = undefined;
13941389 subborrowxU64(&x149, &x150, 0x0, x141, 0xfffffffefffffc2f);
......@@ -1403,15 +1398,16 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma
14031398 subborrowxU64(&x155, &x156, x154, x147, 0xffffffffffffffff);
14041399 var x157: u64 = undefined;
14051400 var x158: u1 = undefined;
1406 subborrowxU64(&x157, &x158, x156, @as(u64, x148), 0x0);
1401 subborrowxU64(&x157, &x158, x156, x148, 0x0);
14071402 var x159: u64 = undefined;
1408 cmovznzU64(&x159, x158, x149, x141);
1403 const x159_selection_mask = selectionMaskU64(x158);
1404 x159 = x149 ^ ((x149 ^ x141) & x159_selection_mask);
14091405 var x160: u64 = undefined;
1410 cmovznzU64(&x160, x158, x151, x143);
1406 x160 = x151 ^ ((x151 ^ x143) & x159_selection_mask);
14111407 var x161: u64 = undefined;
1412 cmovznzU64(&x161, x158, x153, x145);
1408 x161 = x153 ^ ((x153 ^ x145) & x159_selection_mask);
14131409 var x162: u64 = undefined;
1414 cmovznzU64(&x162, x158, x155, x147);
1410 x162 = x155 ^ ((x155 ^ x147) & x159_selection_mask);
14151411 out1[0] = x159;
14161412 out1[1] = x160;
14171413 out1[2] = x161;
......@@ -1432,7 +1428,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma
14321428pub fn nonzero(out1: *u64, arg1: [4]u64) void {
14331429 @setRuntimeSafety(mode == .debug);
14341430
1435 const x1 = ((arg1[0]) | ((arg1[1]) | ((arg1[2]) | (arg1[3]))));
1431 const x1: u64 = (arg1[0] | (arg1[1] | (arg1[2] | arg1[3])));
14361432 out1.* = x1;
14371433}
14381434
......@@ -1451,13 +1447,14 @@ pub fn selectznz(out1: *[4]u64, arg1: u1, arg2: [4]u64, arg3: [4]u64) void {
14511447 @setRuntimeSafety(mode == .debug);
14521448
14531449 var x1: u64 = undefined;
1454 cmovznzU64(&x1, arg1, (arg2[0]), (arg3[0]));
1450 const x1_selection_mask = selectionMaskU64(arg1);
1451 x1 = arg2[0] ^ ((arg2[0] ^ arg3[0]) & x1_selection_mask);
14551452 var x2: u64 = undefined;
1456 cmovznzU64(&x2, arg1, (arg2[1]), (arg3[1]));
1453 x2 = arg2[1] ^ ((arg2[1] ^ arg3[1]) & x1_selection_mask);
14571454 var x3: u64 = undefined;
1458 cmovznzU64(&x3, arg1, (arg2[2]), (arg3[2]));
1455 x3 = arg2[2] ^ ((arg2[2] ^ arg3[2]) & x1_selection_mask);
14591456 var x4: u64 = undefined;
1460 cmovznzU64(&x4, arg1, (arg2[3]), (arg3[3]));
1457 x4 = arg2[3] ^ ((arg2[3] ^ arg3[3]) & x1_selection_mask);
14611458 out1[0] = x1;
14621459 out1[1] = x2;
14631460 out1[2] = x3;
......@@ -1478,66 +1475,66 @@ pub fn selectznz(out1: *[4]u64, arg1: u1, arg2: [4]u64, arg3: [4]u64) void {
14781475pub fn toBytes(out1: *[32]u8, arg1: [4]u64) void {
14791476 @setRuntimeSafety(mode == .debug);
14801477
1481 const x1 = (arg1[3]);
1482 const x2 = (arg1[2]);
1483 const x3 = (arg1[1]);
1484 const x4 = (arg1[0]);
1485 const x5 = @as(u8, @truncate((x4 & 0xff)));
1486 const x6 = (x4 >> 8);
1487 const x7 = @as(u8, @truncate((x6 & 0xff)));
1488 const x8 = (x6 >> 8);
1489 const x9 = @as(u8, @truncate((x8 & 0xff)));
1490 const x10 = (x8 >> 8);
1491 const x11 = @as(u8, @truncate((x10 & 0xff)));
1492 const x12 = (x10 >> 8);
1493 const x13 = @as(u8, @truncate((x12 & 0xff)));
1494 const x14 = (x12 >> 8);
1495 const x15 = @as(u8, @truncate((x14 & 0xff)));
1496 const x16 = (x14 >> 8);
1497 const x17 = @as(u8, @truncate((x16 & 0xff)));
1498 const x18 = @as(u8, @truncate((x16 >> 8)));
1499 const x19 = @as(u8, @truncate((x3 & 0xff)));
1500 const x20 = (x3 >> 8);
1501 const x21 = @as(u8, @truncate((x20 & 0xff)));
1502 const x22 = (x20 >> 8);
1503 const x23 = @as(u8, @truncate((x22 & 0xff)));
1504 const x24 = (x22 >> 8);
1505 const x25 = @as(u8, @truncate((x24 & 0xff)));
1506 const x26 = (x24 >> 8);
1507 const x27 = @as(u8, @truncate((x26 & 0xff)));
1508 const x28 = (x26 >> 8);
1509 const x29 = @as(u8, @truncate((x28 & 0xff)));
1510 const x30 = (x28 >> 8);
1511 const x31 = @as(u8, @truncate((x30 & 0xff)));
1512 const x32 = @as(u8, @truncate((x30 >> 8)));
1513 const x33 = @as(u8, @truncate((x2 & 0xff)));
1514 const x34 = (x2 >> 8);
1515 const x35 = @as(u8, @truncate((x34 & 0xff)));
1516 const x36 = (x34 >> 8);
1517 const x37 = @as(u8, @truncate((x36 & 0xff)));
1518 const x38 = (x36 >> 8);
1519 const x39 = @as(u8, @truncate((x38 & 0xff)));
1520 const x40 = (x38 >> 8);
1521 const x41 = @as(u8, @truncate((x40 & 0xff)));
1522 const x42 = (x40 >> 8);
1523 const x43 = @as(u8, @truncate((x42 & 0xff)));
1524 const x44 = (x42 >> 8);
1525 const x45 = @as(u8, @truncate((x44 & 0xff)));
1526 const x46 = @as(u8, @truncate((x44 >> 8)));
1527 const x47 = @as(u8, @truncate((x1 & 0xff)));
1528 const x48 = (x1 >> 8);
1529 const x49 = @as(u8, @truncate((x48 & 0xff)));
1530 const x50 = (x48 >> 8);
1531 const x51 = @as(u8, @truncate((x50 & 0xff)));
1532 const x52 = (x50 >> 8);
1533 const x53 = @as(u8, @truncate((x52 & 0xff)));
1534 const x54 = (x52 >> 8);
1535 const x55 = @as(u8, @truncate((x54 & 0xff)));
1536 const x56 = (x54 >> 8);
1537 const x57 = @as(u8, @truncate((x56 & 0xff)));
1538 const x58 = (x56 >> 8);
1539 const x59 = @as(u8, @truncate((x58 & 0xff)));
1540 const x60 = @as(u8, @truncate((x58 >> 8)));
1478 const x1: u64 = arg1[3];
1479 const x2: u64 = arg1[2];
1480 const x3: u64 = arg1[1];
1481 const x4: u64 = arg1[0];
1482 const x5: u8 = @truncate(x4);
1483 const x6: u64 = (x4 >> 8);
1484 const x7: u8 = @truncate(x6);
1485 const x8: u64 = (x6 >> 8);
1486 const x9: u8 = @truncate(x8);
1487 const x10: u64 = (x8 >> 8);
1488 const x11: u8 = @truncate(x10);
1489 const x12: u64 = (x10 >> 8);
1490 const x13: u8 = @truncate(x12);
1491 const x14: u64 = (x12 >> 8);
1492 const x15: u8 = @truncate(x14);
1493 const x16: u64 = (x14 >> 8);
1494 const x17: u8 = @truncate(x16);
1495 const x18: u8 = @truncate((x16 >> 8));
1496 const x19: u8 = @truncate(x3);
1497 const x20: u64 = (x3 >> 8);
1498 const x21: u8 = @truncate(x20);
1499 const x22: u64 = (x20 >> 8);
1500 const x23: u8 = @truncate(x22);
1501 const x24: u64 = (x22 >> 8);
1502 const x25: u8 = @truncate(x24);
1503 const x26: u64 = (x24 >> 8);
1504 const x27: u8 = @truncate(x26);
1505 const x28: u64 = (x26 >> 8);
1506 const x29: u8 = @truncate(x28);
1507 const x30: u64 = (x28 >> 8);
1508 const x31: u8 = @truncate(x30);
1509 const x32: u8 = @truncate((x30 >> 8));
1510 const x33: u8 = @truncate(x2);
1511 const x34: u64 = (x2 >> 8);
1512 const x35: u8 = @truncate(x34);
1513 const x36: u64 = (x34 >> 8);
1514 const x37: u8 = @truncate(x36);
1515 const x38: u64 = (x36 >> 8);
1516 const x39: u8 = @truncate(x38);
1517 const x40: u64 = (x38 >> 8);
1518 const x41: u8 = @truncate(x40);
1519 const x42: u64 = (x40 >> 8);
1520 const x43: u8 = @truncate(x42);
1521 const x44: u64 = (x42 >> 8);
1522 const x45: u8 = @truncate(x44);
1523 const x46: u8 = @truncate((x44 >> 8));
1524 const x47: u8 = @truncate(x1);
1525 const x48: u64 = (x1 >> 8);
1526 const x49: u8 = @truncate(x48);
1527 const x50: u64 = (x48 >> 8);
1528 const x51: u8 = @truncate(x50);
1529 const x52: u64 = (x50 >> 8);
1530 const x53: u8 = @truncate(x52);
1531 const x54: u64 = (x52 >> 8);
1532 const x55: u8 = @truncate(x54);
1533 const x56: u64 = (x54 >> 8);
1534 const x57: u8 = @truncate(x56);
1535 const x58: u64 = (x56 >> 8);
1536 const x59: u8 = @truncate(x58);
1537 const x60: u8 = @truncate((x58 >> 8));
15411538 out1[0] = x5;
15421539 out1[1] = x7;
15431540 out1[2] = x9;
......@@ -1587,66 +1584,66 @@ pub fn toBytes(out1: *[32]u8, arg1: [4]u64) void {
15871584pub fn fromBytes(out1: *[4]u64, arg1: [32]u8) void {
15881585 @setRuntimeSafety(mode == .debug);
15891586
1590 const x1 = (@as(u64, (arg1[31])) << 56);
1591 const x2 = (@as(u64, (arg1[30])) << 48);
1592 const x3 = (@as(u64, (arg1[29])) << 40);
1593 const x4 = (@as(u64, (arg1[28])) << 32);
1594 const x5 = (@as(u64, (arg1[27])) << 24);
1595 const x6 = (@as(u64, (arg1[26])) << 16);
1596 const x7 = (@as(u64, (arg1[25])) << 8);
1597 const x8 = (arg1[24]);
1598 const x9 = (@as(u64, (arg1[23])) << 56);
1599 const x10 = (@as(u64, (arg1[22])) << 48);
1600 const x11 = (@as(u64, (arg1[21])) << 40);
1601 const x12 = (@as(u64, (arg1[20])) << 32);
1602 const x13 = (@as(u64, (arg1[19])) << 24);
1603 const x14 = (@as(u64, (arg1[18])) << 16);
1604 const x15 = (@as(u64, (arg1[17])) << 8);
1605 const x16 = (arg1[16]);
1606 const x17 = (@as(u64, (arg1[15])) << 56);
1607 const x18 = (@as(u64, (arg1[14])) << 48);
1608 const x19 = (@as(u64, (arg1[13])) << 40);
1609 const x20 = (@as(u64, (arg1[12])) << 32);
1610 const x21 = (@as(u64, (arg1[11])) << 24);
1611 const x22 = (@as(u64, (arg1[10])) << 16);
1612 const x23 = (@as(u64, (arg1[9])) << 8);
1613 const x24 = (arg1[8]);
1614 const x25 = (@as(u64, (arg1[7])) << 56);
1615 const x26 = (@as(u64, (arg1[6])) << 48);
1616 const x27 = (@as(u64, (arg1[5])) << 40);
1617 const x28 = (@as(u64, (arg1[4])) << 32);
1618 const x29 = (@as(u64, (arg1[3])) << 24);
1619 const x30 = (@as(u64, (arg1[2])) << 16);
1620 const x31 = (@as(u64, (arg1[1])) << 8);
1621 const x32 = (arg1[0]);
1622 const x33 = (x31 + @as(u64, x32));
1623 const x34 = (x30 + x33);
1624 const x35 = (x29 + x34);
1625 const x36 = (x28 + x35);
1626 const x37 = (x27 + x36);
1627 const x38 = (x26 + x37);
1628 const x39 = (x25 + x38);
1629 const x40 = (x23 + @as(u64, x24));
1630 const x41 = (x22 + x40);
1631 const x42 = (x21 + x41);
1632 const x43 = (x20 + x42);
1633 const x44 = (x19 + x43);
1634 const x45 = (x18 + x44);
1635 const x46 = (x17 + x45);
1636 const x47 = (x15 + @as(u64, x16));
1637 const x48 = (x14 + x47);
1638 const x49 = (x13 + x48);
1639 const x50 = (x12 + x49);
1640 const x51 = (x11 + x50);
1641 const x52 = (x10 + x51);
1642 const x53 = (x9 + x52);
1643 const x54 = (x7 + @as(u64, x8));
1644 const x55 = (x6 + x54);
1645 const x56 = (x5 + x55);
1646 const x57 = (x4 + x56);
1647 const x58 = (x3 + x57);
1648 const x59 = (x2 + x58);
1649 const x60 = (x1 + x59);
1587 const x1: u64 = (@as(u64, arg1[31]) << 56);
1588 const x2: u64 = (@as(u64, arg1[30]) << 48);
1589 const x3: u64 = (@as(u64, arg1[29]) << 40);
1590 const x4: u64 = (@as(u64, arg1[28]) << 32);
1591 const x5: u64 = (@as(u64, arg1[27]) << 24);
1592 const x6: u64 = (@as(u64, arg1[26]) << 16);
1593 const x7: u64 = (@as(u64, arg1[25]) << 8);
1594 const x8: u8 = arg1[24];
1595 const x9: u64 = (@as(u64, arg1[23]) << 56);
1596 const x10: u64 = (@as(u64, arg1[22]) << 48);
1597 const x11: u64 = (@as(u64, arg1[21]) << 40);
1598 const x12: u64 = (@as(u64, arg1[20]) << 32);
1599 const x13: u64 = (@as(u64, arg1[19]) << 24);
1600 const x14: u64 = (@as(u64, arg1[18]) << 16);
1601 const x15: u64 = (@as(u64, arg1[17]) << 8);
1602 const x16: u8 = arg1[16];
1603 const x17: u64 = (@as(u64, arg1[15]) << 56);
1604 const x18: u64 = (@as(u64, arg1[14]) << 48);
1605 const x19: u64 = (@as(u64, arg1[13]) << 40);
1606 const x20: u64 = (@as(u64, arg1[12]) << 32);
1607 const x21: u64 = (@as(u64, arg1[11]) << 24);
1608 const x22: u64 = (@as(u64, arg1[10]) << 16);
1609 const x23: u64 = (@as(u64, arg1[9]) << 8);
1610 const x24: u8 = arg1[8];
1611 const x25: u64 = (@as(u64, arg1[7]) << 56);
1612 const x26: u64 = (@as(u64, arg1[6]) << 48);
1613 const x27: u64 = (@as(u64, arg1[5]) << 40);
1614 const x28: u64 = (@as(u64, arg1[4]) << 32);
1615 const x29: u64 = (@as(u64, arg1[3]) << 24);
1616 const x30: u64 = (@as(u64, arg1[2]) << 16);
1617 const x31: u64 = (@as(u64, arg1[1]) << 8);
1618 const x32: u8 = arg1[0];
1619 const x33: u64 = (x31 + x32);
1620 const x34: u64 = (x30 + x33);
1621 const x35: u64 = (x29 + x34);
1622 const x36: u64 = (x28 + x35);
1623 const x37: u64 = (x27 + x36);
1624 const x38: u64 = (x26 + x37);
1625 const x39: u64 = (x25 + x38);
1626 const x40: u64 = (x23 + x24);
1627 const x41: u64 = (x22 + x40);
1628 const x42: u64 = (x21 + x41);
1629 const x43: u64 = (x20 + x42);
1630 const x44: u64 = (x19 + x43);
1631 const x45: u64 = (x18 + x44);
1632 const x46: u64 = (x17 + x45);
1633 const x47: u64 = (x15 + x16);
1634 const x48: u64 = (x14 + x47);
1635 const x49: u64 = (x13 + x48);
1636 const x50: u64 = (x12 + x49);
1637 const x51: u64 = (x11 + x50);
1638 const x52: u64 = (x10 + x51);
1639 const x53: u64 = (x9 + x52);
1640 const x54: u64 = (x7 + x8);
1641 const x55: u64 = (x6 + x54);
1642 const x56: u64 = (x5 + x55);
1643 const x57: u64 = (x4 + x56);
1644 const x58: u64 = (x3 + x57);
1645 const x59: u64 = (x2 + x58);
1646 const x60: u64 = (x1 + x59);
16501647 out1[0] = x39;
16511648 out1[1] = x46;
16521649 out1[2] = x53;
......@@ -1720,55 +1717,57 @@ pub fn divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *[4]u64, out5: *[
17201717 var x1: u64 = undefined;
17211718 var x2: u1 = undefined;
17221719 addcarryxU64(&x1, &x2, 0x0, (~arg1), 0x1);
1723 const x3 = (@as(u1, @truncate((x1 >> 63))) & @as(u1, @truncate(((arg3[0]) & 0x1))));
1720 const x3: u1 = (@as(u1, @truncate((x1 >> 63))) & @as(u1, @truncate(arg3[0])));
17241721 var x4: u64 = undefined;
17251722 var x5: u1 = undefined;
17261723 addcarryxU64(&x4, &x5, 0x0, (~arg1), 0x1);
17271724 var x6: u64 = undefined;
1728 cmovznzU64(&x6, x3, arg1, x4);
1725 const x6_selection_mask = selectionMaskU64(x3);
1726 x6 = arg1 ^ ((arg1 ^ x4) & x6_selection_mask);
17291727 var x7: u64 = undefined;
1730 cmovznzU64(&x7, x3, (arg2[0]), (arg3[0]));
1728 x7 = arg2[0] ^ ((arg2[0] ^ arg3[0]) & x6_selection_mask);
17311729 var x8: u64 = undefined;
1732 cmovznzU64(&x8, x3, (arg2[1]), (arg3[1]));
1730 x8 = arg2[1] ^ ((arg2[1] ^ arg3[1]) & x6_selection_mask);
17331731 var x9: u64 = undefined;
1734 cmovznzU64(&x9, x3, (arg2[2]), (arg3[2]));
1732 x9 = arg2[2] ^ ((arg2[2] ^ arg3[2]) & x6_selection_mask);
17351733 var x10: u64 = undefined;
1736 cmovznzU64(&x10, x3, (arg2[3]), (arg3[3]));
1734 x10 = arg2[3] ^ ((arg2[3] ^ arg3[3]) & x6_selection_mask);
17371735 var x11: u64 = undefined;
1738 cmovznzU64(&x11, x3, (arg2[4]), (arg3[4]));
1736 x11 = arg2[4] ^ ((arg2[4] ^ arg3[4]) & x6_selection_mask);
17391737 var x12: u64 = undefined;
17401738 var x13: u1 = undefined;
1741 addcarryxU64(&x12, &x13, 0x0, 0x1, (~(arg2[0])));
1739 addcarryxU64(&x12, &x13, 0x0, 0x1, (~arg2[0]));
17421740 var x14: u64 = undefined;
17431741 var x15: u1 = undefined;
1744 addcarryxU64(&x14, &x15, x13, 0x0, (~(arg2[1])));
1742 addcarryxU64(&x14, &x15, x13, 0x0, (~arg2[1]));
17451743 var x16: u64 = undefined;
17461744 var x17: u1 = undefined;
1747 addcarryxU64(&x16, &x17, x15, 0x0, (~(arg2[2])));
1745 addcarryxU64(&x16, &x17, x15, 0x0, (~arg2[2]));
17481746 var x18: u64 = undefined;
17491747 var x19: u1 = undefined;
1750 addcarryxU64(&x18, &x19, x17, 0x0, (~(arg2[3])));
1748 addcarryxU64(&x18, &x19, x17, 0x0, (~arg2[3]));
17511749 var x20: u64 = undefined;
17521750 var x21: u1 = undefined;
1753 addcarryxU64(&x20, &x21, x19, 0x0, (~(arg2[4])));
1751 addcarryxU64(&x20, &x21, x19, 0x0, (~arg2[4]));
17541752 var x22: u64 = undefined;
1755 cmovznzU64(&x22, x3, (arg3[0]), x12);
1753 const x22_selection_mask = selectionMaskU64(x3);
1754 x22 = arg3[0] ^ ((arg3[0] ^ x12) & x22_selection_mask);
17561755 var x23: u64 = undefined;
1757 cmovznzU64(&x23, x3, (arg3[1]), x14);
1756 x23 = arg3[1] ^ ((arg3[1] ^ x14) & x22_selection_mask);
17581757 var x24: u64 = undefined;
1759 cmovznzU64(&x24, x3, (arg3[2]), x16);
1758 x24 = arg3[2] ^ ((arg3[2] ^ x16) & x22_selection_mask);
17601759 var x25: u64 = undefined;
1761 cmovznzU64(&x25, x3, (arg3[3]), x18);
1760 x25 = arg3[3] ^ ((arg3[3] ^ x18) & x22_selection_mask);
17621761 var x26: u64 = undefined;
1763 cmovznzU64(&x26, x3, (arg3[4]), x20);
1762 x26 = arg3[4] ^ ((arg3[4] ^ x20) & x22_selection_mask);
17641763 var x27: u64 = undefined;
1765 cmovznzU64(&x27, x3, (arg4[0]), (arg5[0]));
1764 x27 = arg4[0] ^ ((arg4[0] ^ arg5[0]) & x22_selection_mask);
17661765 var x28: u64 = undefined;
1767 cmovznzU64(&x28, x3, (arg4[1]), (arg5[1]));
1766 x28 = arg4[1] ^ ((arg4[1] ^ arg5[1]) & x22_selection_mask);
17681767 var x29: u64 = undefined;
1769 cmovznzU64(&x29, x3, (arg4[2]), (arg5[2]));
1768 x29 = arg4[2] ^ ((arg4[2] ^ arg5[2]) & x22_selection_mask);
17701769 var x30: u64 = undefined;
1771 cmovznzU64(&x30, x3, (arg4[3]), (arg5[3]));
1770 x30 = arg4[3] ^ ((arg4[3] ^ arg5[3]) & x22_selection_mask);
17721771 var x31: u64 = undefined;
17731772 var x32: u1 = undefined;
17741773 addcarryxU64(&x31, &x32, 0x0, x27, x27);
......@@ -1795,11 +1794,11 @@ pub fn divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *[4]u64, out5: *[
17951794 subborrowxU64(&x45, &x46, x44, x37, 0xffffffffffffffff);
17961795 var x47: u64 = undefined;
17971796 var x48: u1 = undefined;
1798 subborrowxU64(&x47, &x48, x46, @as(u64, x38), 0x0);
1799 const x49 = (arg4[3]);
1800 const x50 = (arg4[2]);
1801 const x51 = (arg4[1]);
1802 const x52 = (arg4[0]);
1797 subborrowxU64(&x47, &x48, x46, x38, 0x0);
1798 const x49: u64 = arg4[3];
1799 const x50: u64 = arg4[2];
1800 const x51: u64 = arg4[1];
1801 const x52: u64 = arg4[0];
18031802 var x53: u64 = undefined;
18041803 var x54: u1 = undefined;
18051804 subborrowxU64(&x53, &x54, 0x0, 0x0, x52);
......@@ -1813,7 +1812,8 @@ pub fn divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *[4]u64, out5: *[
18131812 var x60: u1 = undefined;
18141813 subborrowxU64(&x59, &x60, x58, 0x0, x49);
18151814 var x61: u64 = undefined;
1816 cmovznzU64(&x61, x60, 0x0, 0xffffffffffffffff);
1815 const x61_selection_mask = selectionMaskU64(x60);
1816 x61 = 0x0 ^ ((0x0 ^ 0xffffffffffffffff) & x61_selection_mask);
18171817 var x62: u64 = undefined;
18181818 var x63: u1 = undefined;
18191819 addcarryxU64(&x62, &x63, 0x0, x53, (x61 & 0xfffffffefffffc2f));
......@@ -1827,24 +1827,26 @@ pub fn divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *[4]u64, out5: *[
18271827 var x69: u1 = undefined;
18281828 addcarryxU64(&x68, &x69, x67, x59, x61);
18291829 var x70: u64 = undefined;
1830 cmovznzU64(&x70, x3, (arg5[0]), x62);
1830 const x70_selection_mask = selectionMaskU64(x3);
1831 x70 = arg5[0] ^ ((arg5[0] ^ x62) & x70_selection_mask);
18311832 var x71: u64 = undefined;
1832 cmovznzU64(&x71, x3, (arg5[1]), x64);
1833 x71 = arg5[1] ^ ((arg5[1] ^ x64) & x70_selection_mask);
18331834 var x72: u64 = undefined;
1834 cmovznzU64(&x72, x3, (arg5[2]), x66);
1835 x72 = arg5[2] ^ ((arg5[2] ^ x66) & x70_selection_mask);
18351836 var x73: u64 = undefined;
1836 cmovznzU64(&x73, x3, (arg5[3]), x68);
1837 const x74 = @as(u1, @truncate((x22 & 0x1)));
1837 x73 = arg5[3] ^ ((arg5[3] ^ x68) & x70_selection_mask);
1838 const x74: u1 = @truncate(x22);
18381839 var x75: u64 = undefined;
1839 cmovznzU64(&x75, x74, 0x0, x7);
1840 const x75_selection_mask = selectionMaskU64(x74);
1841 x75 = 0x0 ^ ((0x0 ^ x7) & x75_selection_mask);
18401842 var x76: u64 = undefined;
1841 cmovznzU64(&x76, x74, 0x0, x8);
1843 x76 = 0x0 ^ ((0x0 ^ x8) & x75_selection_mask);
18421844 var x77: u64 = undefined;
1843 cmovznzU64(&x77, x74, 0x0, x9);
1845 x77 = 0x0 ^ ((0x0 ^ x9) & x75_selection_mask);
18441846 var x78: u64 = undefined;
1845 cmovznzU64(&x78, x74, 0x0, x10);
1847 x78 = 0x0 ^ ((0x0 ^ x10) & x75_selection_mask);
18461848 var x79: u64 = undefined;
1847 cmovznzU64(&x79, x74, 0x0, x11);
1849 x79 = 0x0 ^ ((0x0 ^ x11) & x75_selection_mask);
18481850 var x80: u64 = undefined;
18491851 var x81: u1 = undefined;
18501852 addcarryxU64(&x80, &x81, 0x0, x22, x75);
......@@ -1861,13 +1863,14 @@ pub fn divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *[4]u64, out5: *[
18611863 var x89: u1 = undefined;
18621864 addcarryxU64(&x88, &x89, x87, x26, x79);
18631865 var x90: u64 = undefined;
1864 cmovznzU64(&x90, x74, 0x0, x27);
1866 const x90_selection_mask = selectionMaskU64(x74);
1867 x90 = 0x0 ^ ((0x0 ^ x27) & x90_selection_mask);
18651868 var x91: u64 = undefined;
1866 cmovznzU64(&x91, x74, 0x0, x28);
1869 x91 = 0x0 ^ ((0x0 ^ x28) & x90_selection_mask);
18671870 var x92: u64 = undefined;
1868 cmovznzU64(&x92, x74, 0x0, x29);
1871 x92 = 0x0 ^ ((0x0 ^ x29) & x90_selection_mask);
18691872 var x93: u64 = undefined;
1870 cmovznzU64(&x93, x74, 0x0, x30);
1873 x93 = 0x0 ^ ((0x0 ^ x30) & x90_selection_mask);
18711874 var x94: u64 = undefined;
18721875 var x95: u1 = undefined;
18731876 addcarryxU64(&x94, &x95, 0x0, x70, x90);
......@@ -1894,31 +1897,33 @@ pub fn divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *[4]u64, out5: *[
18941897 subborrowxU64(&x108, &x109, x107, x100, 0xffffffffffffffff);
18951898 var x110: u64 = undefined;
18961899 var x111: u1 = undefined;
1897 subborrowxU64(&x110, &x111, x109, @as(u64, x101), 0x0);
1900 subborrowxU64(&x110, &x111, x109, x101, 0x0);
18981901 var x112: u64 = undefined;
18991902 var x113: u1 = undefined;
19001903 addcarryxU64(&x112, &x113, 0x0, x6, 0x1);
1901 const x114 = ((x80 >> 1) | ((x82 << 63) & 0xffffffffffffffff));
1902 const x115 = ((x82 >> 1) | ((x84 << 63) & 0xffffffffffffffff));
1903 const x116 = ((x84 >> 1) | ((x86 << 63) & 0xffffffffffffffff));
1904 const x117 = ((x86 >> 1) | ((x88 << 63) & 0xffffffffffffffff));
1905 const x118 = ((x88 & 0x8000000000000000) | (x88 >> 1));
1904 const x114: u64 = ((x80 >> 1) | ((x82 << 63) & 0xffffffffffffffff));
1905 const x115: u64 = ((x82 >> 1) | ((x84 << 63) & 0xffffffffffffffff));
1906 const x116: u64 = ((x84 >> 1) | ((x86 << 63) & 0xffffffffffffffff));
1907 const x117: u64 = ((x86 >> 1) | ((x88 << 63) & 0xffffffffffffffff));
1908 const x118: u64 = ((x88 & 0x8000000000000000) | (x88 >> 1));
19061909 var x119: u64 = undefined;
1907 cmovznzU64(&x119, x48, x39, x31);
1910 const x119_selection_mask = selectionMaskU64(x48);
1911 x119 = x39 ^ ((x39 ^ x31) & x119_selection_mask);
19081912 var x120: u64 = undefined;
1909 cmovznzU64(&x120, x48, x41, x33);
1913 x120 = x41 ^ ((x41 ^ x33) & x119_selection_mask);
19101914 var x121: u64 = undefined;
1911 cmovznzU64(&x121, x48, x43, x35);
1915 x121 = x43 ^ ((x43 ^ x35) & x119_selection_mask);
19121916 var x122: u64 = undefined;
1913 cmovznzU64(&x122, x48, x45, x37);
1917 x122 = x45 ^ ((x45 ^ x37) & x119_selection_mask);
19141918 var x123: u64 = undefined;
1915 cmovznzU64(&x123, x111, x102, x94);
1919 const x123_selection_mask = selectionMaskU64(x111);
1920 x123 = x102 ^ ((x102 ^ x94) & x123_selection_mask);
19161921 var x124: u64 = undefined;
1917 cmovznzU64(&x124, x111, x104, x96);
1922 x124 = x104 ^ ((x104 ^ x96) & x123_selection_mask);
19181923 var x125: u64 = undefined;
1919 cmovznzU64(&x125, x111, x106, x98);
1924 x125 = x106 ^ ((x106 ^ x98) & x123_selection_mask);
19201925 var x126: u64 = undefined;
1921 cmovznzU64(&x126, x111, x108, x100);
1926 x126 = x108 ^ ((x108 ^ x100) & x123_selection_mask);
19221927 out1.* = x112;
19231928 out2[0] = x7;
19241929 out2[1] = x8;
lib/std/crypto/pcurves/secp256k1/secp256k1_scalar_64.zig+363-358
......@@ -17,7 +17,6 @@
1717// twos_complement_eval z = let x1 := z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) in
1818// if x1 & (2^256-1) < 2^255 then x1 & (2^256-1) else (x1 & (2^256-1)) - 2^256
1919
20const std = @import("std");
2120const mode = @import("builtin").mode; // Checked arithmetic is disabled in non-debug modes to avoid side channels
2221
2322// The type MontgomeryDomainFieldElement is a field element in the Montgomery domain.
......@@ -28,80 +27,70 @@ pub const MontgomeryDomainFieldElement = [4]u64;
2827// Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
2928pub const NonMontgomeryDomainFieldElement = [4]u64;
3029
31/// The function addcarryxU64 is an addition with carry.
32///
33/// Postconditions:
34/// out1 = (arg1 + arg2 + arg3) mod 2^64
35/// out2 = ⌊(arg1 + arg2 + arg3) / 2^64⌋
36///
37/// Input Bounds:
38/// arg1: [0x0 ~> 0x1]
39/// arg2: [0x0 ~> 0xffffffffffffffff]
40/// arg3: [0x0 ~> 0xffffffffffffffff]
41/// Output Bounds:
42/// out1: [0x0 ~> 0xffffffffffffffff]
43/// out2: [0x0 ~> 0x1]
30/// Add two limbs and a carry bit, returning the sum modulo 2^64 and the carry bit.
4431fn addcarryxU64(out1: *u64, out2: *u1, arg1: u1, arg2: u64, arg3: u64) void {
45 const x = @as(u128, arg2) +% arg3 +% arg1;
46 out1.* = @truncate(x);
47 out2.* = @truncate(x >> 64);
32 @setRuntimeSafety(mode == .debug);
33
34 const x = @addWithOverflow(arg2, arg3);
35 const y = @addWithOverflow(x[0], arg1);
36 out1.* = y[0];
37 out2.* = x[1] | y[1];
4838}
4939
50/// The function subborrowxU64 is a subtraction with borrow.
51///
52/// Postconditions:
53/// out1 = (-arg1 + arg2 + -arg3) mod 2^64
54/// out2 = -⌊(-arg1 + arg2 + -arg3) / 2^64⌋
55///
56/// Input Bounds:
57/// arg1: [0x0 ~> 0x1]
58/// arg2: [0x0 ~> 0xffffffffffffffff]
59/// arg3: [0x0 ~> 0xffffffffffffffff]
60/// Output Bounds:
61/// out1: [0x0 ~> 0xffffffffffffffff]
62/// out2: [0x0 ~> 0x1]
40/// Subtract two limbs and a borrow bit, returning the difference modulo 2^64 and the borrow bit.
6341fn subborrowxU64(out1: *u64, out2: *u1, arg1: u1, arg2: u64, arg3: u64) void {
64 const x = @as(u128, arg2) -% arg3 -% arg1;
65 out1.* = @truncate(x);
66 out2.* = @truncate(x >> 64);
42 @setRuntimeSafety(mode == .debug);
43
44 const x = @subWithOverflow(arg2, arg3);
45 const y = @subWithOverflow(x[0], arg1);
46 out1.* = y[0];
47 out2.* = x[1] | y[1];
6748}
6849
69/// The function mulxU64 is a multiplication, returning the full double-width result.
70///
71/// Postconditions:
72/// out1 = (arg1 * arg2) mod 2^64
73/// out2 = ⌊arg1 * arg2 / 2^64⌋
74///
75/// Input Bounds:
76/// arg1: [0x0 ~> 0xffffffffffffffff]
77/// arg2: [0x0 ~> 0xffffffffffffffff]
78/// Output Bounds:
79/// out1: [0x0 ~> 0xffffffffffffffff]
80/// out2: [0x0 ~> 0xffffffffffffffff]
50/// Multiply two limbs, returning the low and high halves of the product.
8151fn mulxU64(out1: *u64, out2: *u64, arg1: u64, arg2: u64) void {
8252 @setRuntimeSafety(mode == .debug);
8353
84 const x = @as(u128, arg1) * @as(u128, arg2);
85 out1.* = @as(u64, @truncate(x));
86 out2.* = @as(u64, @truncate(x >> 64));
54 const x = @as(u128, arg1) * arg2;
55 out1.* = @truncate(x);
56 out2.* = @intCast(x >> 64);
8757}
8858
89/// The function cmovznzU64 is a single-word conditional move.
90///
91/// Postconditions:
92/// out1 = (if arg1 = 0 then arg2 else arg3)
93///
94/// Input Bounds:
95/// arg1: [0x0 ~> 0x1]
96/// arg2: [0x0 ~> 0xffffffffffffffff]
97/// arg3: [0x0 ~> 0xffffffffffffffff]
98/// Output Bounds:
99/// out1: [0x0 ~> 0xffffffffffffffff]
59/// Keep selection masks opaque to the optimizer without adding instructions.
60fn selectionMaskU64(arg1: u1) u64 {
61 @setRuntimeSafety(mode == .debug);
62
63 const value: u64 = 0 -% @as(u64, arg1);
64 if (@inComptime()) return value;
65 switch (@import("builtin").zig_backend) {
66 .stage2_c, .stage2_wasm => return value,
67 else => {},
68 }
69 if (@bitSizeOf(u64) <= @bitSizeOf(usize)) {
70 return asm (""
71 : [mask] "=r" (-> u64),
72 : [value] "0" (value),
73 );
74 }
75 var mask: u64 = 0;
76 inline for (0..@divExact(@bitSizeOf(u64), @bitSizeOf(usize))) |i| {
77 const shift = i * @bitSizeOf(usize);
78 const chunk: usize = @truncate(value >> shift);
79 const part = asm (""
80 : [mask] "=r" (-> usize),
81 : [value] "0" (chunk),
82 );
83 mask |= @as(u64, part) << shift;
84 }
85 return mask;
86}
87
88/// Select arg2 when arg1 is zero and arg3 otherwise, using a bit mask.
10089fn cmovznzU64(out1: *u64, arg1: u1, arg2: u64, arg3: u64) void {
10190 @setRuntimeSafety(mode == .debug);
10291
103 const mask = 0 -% @as(u64, arg1);
104 out1.* = (mask & arg3) | ((~mask) & arg2);
92 const mask = selectionMaskU64(arg1);
93 out1.* = arg2 ^ ((arg2 ^ arg3) & mask);
10594}
10695
10796/// The function mul multiplies two field elements in the Montgomery domain.
......@@ -116,22 +105,22 @@ fn cmovznzU64(out1: *u64, arg1: u1, arg2: u64, arg3: u64) void {
116105pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldElement, arg2: MontgomeryDomainFieldElement) void {
117106 @setRuntimeSafety(mode == .debug);
118107
119 const x1 = (arg1[1]);
120 const x2 = (arg1[2]);
121 const x3 = (arg1[3]);
122 const x4 = (arg1[0]);
108 const x1: u64 = arg1[1];
109 const x2: u64 = arg1[2];
110 const x3: u64 = arg1[3];
111 const x4: u64 = arg1[0];
123112 var x5: u64 = undefined;
124113 var x6: u64 = undefined;
125 mulxU64(&x5, &x6, x4, (arg2[3]));
114 mulxU64(&x5, &x6, x4, arg2[3]);
126115 var x7: u64 = undefined;
127116 var x8: u64 = undefined;
128 mulxU64(&x7, &x8, x4, (arg2[2]));
117 mulxU64(&x7, &x8, x4, arg2[2]);
129118 var x9: u64 = undefined;
130119 var x10: u64 = undefined;
131 mulxU64(&x9, &x10, x4, (arg2[1]));
120 mulxU64(&x9, &x10, x4, arg2[1]);
132121 var x11: u64 = undefined;
133122 var x12: u64 = undefined;
134 mulxU64(&x11, &x12, x4, (arg2[0]));
123 mulxU64(&x11, &x12, x4, arg2[0]);
135124 var x13: u64 = undefined;
136125 var x14: u1 = undefined;
137126 addcarryxU64(&x13, &x14, 0x0, x12, x9);
......@@ -141,7 +130,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
141130 var x17: u64 = undefined;
142131 var x18: u1 = undefined;
143132 addcarryxU64(&x17, &x18, x16, x8, x5);
144 const x19 = (@as(u64, x18) + x6);
133 const x19: u64 = (x18 + x6);
145134 var x20: u64 = undefined;
146135 var x21: u64 = undefined;
147136 mulxU64(&x20, &x21, x11, 0x4b0dff665588b13f);
......@@ -166,7 +155,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
166155 var x34: u64 = undefined;
167156 var x35: u1 = undefined;
168157 addcarryxU64(&x34, &x35, x33, x25, x22);
169 const x36 = (@as(u64, x35) + x23);
158 const x36: u64 = (x35 + x23);
170159 var x37: u64 = undefined;
171160 var x38: u1 = undefined;
172161 addcarryxU64(&x37, &x38, 0x0, x11, x28);
......@@ -184,16 +173,16 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
184173 addcarryxU64(&x45, &x46, x44, x19, x36);
185174 var x47: u64 = undefined;
186175 var x48: u64 = undefined;
187 mulxU64(&x47, &x48, x1, (arg2[3]));
176 mulxU64(&x47, &x48, x1, arg2[3]);
188177 var x49: u64 = undefined;
189178 var x50: u64 = undefined;
190 mulxU64(&x49, &x50, x1, (arg2[2]));
179 mulxU64(&x49, &x50, x1, arg2[2]);
191180 var x51: u64 = undefined;
192181 var x52: u64 = undefined;
193 mulxU64(&x51, &x52, x1, (arg2[1]));
182 mulxU64(&x51, &x52, x1, arg2[1]);
194183 var x53: u64 = undefined;
195184 var x54: u64 = undefined;
196 mulxU64(&x53, &x54, x1, (arg2[0]));
185 mulxU64(&x53, &x54, x1, arg2[0]);
197186 var x55: u64 = undefined;
198187 var x56: u1 = undefined;
199188 addcarryxU64(&x55, &x56, 0x0, x54, x51);
......@@ -203,7 +192,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
203192 var x59: u64 = undefined;
204193 var x60: u1 = undefined;
205194 addcarryxU64(&x59, &x60, x58, x50, x47);
206 const x61 = (@as(u64, x60) + x48);
195 const x61: u64 = (x60 + x48);
207196 var x62: u64 = undefined;
208197 var x63: u1 = undefined;
209198 addcarryxU64(&x62, &x63, 0x0, x39, x53);
......@@ -218,7 +207,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
218207 addcarryxU64(&x68, &x69, x67, x45, x59);
219208 var x70: u64 = undefined;
220209 var x71: u1 = undefined;
221 addcarryxU64(&x70, &x71, x69, @as(u64, x46), x61);
210 addcarryxU64(&x70, &x71, x69, x46, x61);
222211 var x72: u64 = undefined;
223212 var x73: u64 = undefined;
224213 mulxU64(&x72, &x73, x62, 0x4b0dff665588b13f);
......@@ -243,7 +232,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
243232 var x86: u64 = undefined;
244233 var x87: u1 = undefined;
245234 addcarryxU64(&x86, &x87, x85, x77, x74);
246 const x88 = (@as(u64, x87) + x75);
235 const x88: u64 = (x87 + x75);
247236 var x89: u64 = undefined;
248237 var x90: u1 = undefined;
249238 addcarryxU64(&x89, &x90, 0x0, x62, x80);
......@@ -259,19 +248,19 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
259248 var x97: u64 = undefined;
260249 var x98: u1 = undefined;
261250 addcarryxU64(&x97, &x98, x96, x70, x88);
262 const x99 = (@as(u64, x98) + @as(u64, x71));
251 const x99: u64 = (@as(u64, x98) + x71);
263252 var x100: u64 = undefined;
264253 var x101: u64 = undefined;
265 mulxU64(&x100, &x101, x2, (arg2[3]));
254 mulxU64(&x100, &x101, x2, arg2[3]);
266255 var x102: u64 = undefined;
267256 var x103: u64 = undefined;
268 mulxU64(&x102, &x103, x2, (arg2[2]));
257 mulxU64(&x102, &x103, x2, arg2[2]);
269258 var x104: u64 = undefined;
270259 var x105: u64 = undefined;
271 mulxU64(&x104, &x105, x2, (arg2[1]));
260 mulxU64(&x104, &x105, x2, arg2[1]);
272261 var x106: u64 = undefined;
273262 var x107: u64 = undefined;
274 mulxU64(&x106, &x107, x2, (arg2[0]));
263 mulxU64(&x106, &x107, x2, arg2[0]);
275264 var x108: u64 = undefined;
276265 var x109: u1 = undefined;
277266 addcarryxU64(&x108, &x109, 0x0, x107, x104);
......@@ -281,7 +270,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
281270 var x112: u64 = undefined;
282271 var x113: u1 = undefined;
283272 addcarryxU64(&x112, &x113, x111, x103, x100);
284 const x114 = (@as(u64, x113) + x101);
273 const x114: u64 = (x113 + x101);
285274 var x115: u64 = undefined;
286275 var x116: u1 = undefined;
287276 addcarryxU64(&x115, &x116, 0x0, x91, x106);
......@@ -321,7 +310,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
321310 var x139: u64 = undefined;
322311 var x140: u1 = undefined;
323312 addcarryxU64(&x139, &x140, x138, x130, x127);
324 const x141 = (@as(u64, x140) + x128);
313 const x141: u64 = (x140 + x128);
325314 var x142: u64 = undefined;
326315 var x143: u1 = undefined;
327316 addcarryxU64(&x142, &x143, 0x0, x115, x133);
......@@ -337,19 +326,19 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
337326 var x150: u64 = undefined;
338327 var x151: u1 = undefined;
339328 addcarryxU64(&x150, &x151, x149, x123, x141);
340 const x152 = (@as(u64, x151) + @as(u64, x124));
329 const x152: u64 = (@as(u64, x151) + x124);
341330 var x153: u64 = undefined;
342331 var x154: u64 = undefined;
343 mulxU64(&x153, &x154, x3, (arg2[3]));
332 mulxU64(&x153, &x154, x3, arg2[3]);
344333 var x155: u64 = undefined;
345334 var x156: u64 = undefined;
346 mulxU64(&x155, &x156, x3, (arg2[2]));
335 mulxU64(&x155, &x156, x3, arg2[2]);
347336 var x157: u64 = undefined;
348337 var x158: u64 = undefined;
349 mulxU64(&x157, &x158, x3, (arg2[1]));
338 mulxU64(&x157, &x158, x3, arg2[1]);
350339 var x159: u64 = undefined;
351340 var x160: u64 = undefined;
352 mulxU64(&x159, &x160, x3, (arg2[0]));
341 mulxU64(&x159, &x160, x3, arg2[0]);
353342 var x161: u64 = undefined;
354343 var x162: u1 = undefined;
355344 addcarryxU64(&x161, &x162, 0x0, x160, x157);
......@@ -359,7 +348,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
359348 var x165: u64 = undefined;
360349 var x166: u1 = undefined;
361350 addcarryxU64(&x165, &x166, x164, x156, x153);
362 const x167 = (@as(u64, x166) + x154);
351 const x167: u64 = (x166 + x154);
363352 var x168: u64 = undefined;
364353 var x169: u1 = undefined;
365354 addcarryxU64(&x168, &x169, 0x0, x144, x159);
......@@ -399,7 +388,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
399388 var x192: u64 = undefined;
400389 var x193: u1 = undefined;
401390 addcarryxU64(&x192, &x193, x191, x183, x180);
402 const x194 = (@as(u64, x193) + x181);
391 const x194: u64 = (x193 + x181);
403392 var x195: u64 = undefined;
404393 var x196: u1 = undefined;
405394 addcarryxU64(&x195, &x196, 0x0, x168, x186);
......@@ -415,7 +404,7 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
415404 var x203: u64 = undefined;
416405 var x204: u1 = undefined;
417406 addcarryxU64(&x203, &x204, x202, x176, x194);
418 const x205 = (@as(u64, x204) + @as(u64, x177));
407 const x205: u64 = (@as(u64, x204) + x177);
419408 var x206: u64 = undefined;
420409 var x207: u1 = undefined;
421410 subborrowxU64(&x206, &x207, 0x0, x197, 0xbfd25e8cd0364141);
......@@ -432,13 +421,14 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
432421 var x215: u1 = undefined;
433422 subborrowxU64(&x214, &x215, x213, x205, 0x0);
434423 var x216: u64 = undefined;
435 cmovznzU64(&x216, x215, x206, x197);
424 const x216_selection_mask = selectionMaskU64(x215);
425 x216 = x206 ^ ((x206 ^ x197) & x216_selection_mask);
436426 var x217: u64 = undefined;
437 cmovznzU64(&x217, x215, x208, x199);
427 x217 = x208 ^ ((x208 ^ x199) & x216_selection_mask);
438428 var x218: u64 = undefined;
439 cmovznzU64(&x218, x215, x210, x201);
429 x218 = x210 ^ ((x210 ^ x201) & x216_selection_mask);
440430 var x219: u64 = undefined;
441 cmovznzU64(&x219, x215, x212, x203);
431 x219 = x212 ^ ((x212 ^ x203) & x216_selection_mask);
442432 out1[0] = x216;
443433 out1[1] = x217;
444434 out1[2] = x218;
......@@ -456,22 +446,22 @@ pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
456446pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldElement) void {
457447 @setRuntimeSafety(mode == .debug);
458448
459 const x1 = (arg1[1]);
460 const x2 = (arg1[2]);
461 const x3 = (arg1[3]);
462 const x4 = (arg1[0]);
449 const x1: u64 = arg1[1];
450 const x2: u64 = arg1[2];
451 const x3: u64 = arg1[3];
452 const x4: u64 = arg1[0];
463453 var x5: u64 = undefined;
464454 var x6: u64 = undefined;
465 mulxU64(&x5, &x6, x4, (arg1[3]));
455 mulxU64(&x5, &x6, x4, arg1[3]);
466456 var x7: u64 = undefined;
467457 var x8: u64 = undefined;
468 mulxU64(&x7, &x8, x4, (arg1[2]));
458 mulxU64(&x7, &x8, x4, arg1[2]);
469459 var x9: u64 = undefined;
470460 var x10: u64 = undefined;
471 mulxU64(&x9, &x10, x4, (arg1[1]));
461 mulxU64(&x9, &x10, x4, arg1[1]);
472462 var x11: u64 = undefined;
473463 var x12: u64 = undefined;
474 mulxU64(&x11, &x12, x4, (arg1[0]));
464 mulxU64(&x11, &x12, x4, arg1[0]);
475465 var x13: u64 = undefined;
476466 var x14: u1 = undefined;
477467 addcarryxU64(&x13, &x14, 0x0, x12, x9);
......@@ -481,7 +471,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
481471 var x17: u64 = undefined;
482472 var x18: u1 = undefined;
483473 addcarryxU64(&x17, &x18, x16, x8, x5);
484 const x19 = (@as(u64, x18) + x6);
474 const x19: u64 = (x18 + x6);
485475 var x20: u64 = undefined;
486476 var x21: u64 = undefined;
487477 mulxU64(&x20, &x21, x11, 0x4b0dff665588b13f);
......@@ -506,7 +496,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
506496 var x34: u64 = undefined;
507497 var x35: u1 = undefined;
508498 addcarryxU64(&x34, &x35, x33, x25, x22);
509 const x36 = (@as(u64, x35) + x23);
499 const x36: u64 = (x35 + x23);
510500 var x37: u64 = undefined;
511501 var x38: u1 = undefined;
512502 addcarryxU64(&x37, &x38, 0x0, x11, x28);
......@@ -524,16 +514,16 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
524514 addcarryxU64(&x45, &x46, x44, x19, x36);
525515 var x47: u64 = undefined;
526516 var x48: u64 = undefined;
527 mulxU64(&x47, &x48, x1, (arg1[3]));
517 mulxU64(&x47, &x48, x1, arg1[3]);
528518 var x49: u64 = undefined;
529519 var x50: u64 = undefined;
530 mulxU64(&x49, &x50, x1, (arg1[2]));
520 mulxU64(&x49, &x50, x1, arg1[2]);
531521 var x51: u64 = undefined;
532522 var x52: u64 = undefined;
533 mulxU64(&x51, &x52, x1, (arg1[1]));
523 mulxU64(&x51, &x52, x1, arg1[1]);
534524 var x53: u64 = undefined;
535525 var x54: u64 = undefined;
536 mulxU64(&x53, &x54, x1, (arg1[0]));
526 mulxU64(&x53, &x54, x1, arg1[0]);
537527 var x55: u64 = undefined;
538528 var x56: u1 = undefined;
539529 addcarryxU64(&x55, &x56, 0x0, x54, x51);
......@@ -543,7 +533,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
543533 var x59: u64 = undefined;
544534 var x60: u1 = undefined;
545535 addcarryxU64(&x59, &x60, x58, x50, x47);
546 const x61 = (@as(u64, x60) + x48);
536 const x61: u64 = (x60 + x48);
547537 var x62: u64 = undefined;
548538 var x63: u1 = undefined;
549539 addcarryxU64(&x62, &x63, 0x0, x39, x53);
......@@ -558,7 +548,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
558548 addcarryxU64(&x68, &x69, x67, x45, x59);
559549 var x70: u64 = undefined;
560550 var x71: u1 = undefined;
561 addcarryxU64(&x70, &x71, x69, @as(u64, x46), x61);
551 addcarryxU64(&x70, &x71, x69, x46, x61);
562552 var x72: u64 = undefined;
563553 var x73: u64 = undefined;
564554 mulxU64(&x72, &x73, x62, 0x4b0dff665588b13f);
......@@ -583,7 +573,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
583573 var x86: u64 = undefined;
584574 var x87: u1 = undefined;
585575 addcarryxU64(&x86, &x87, x85, x77, x74);
586 const x88 = (@as(u64, x87) + x75);
576 const x88: u64 = (x87 + x75);
587577 var x89: u64 = undefined;
588578 var x90: u1 = undefined;
589579 addcarryxU64(&x89, &x90, 0x0, x62, x80);
......@@ -599,19 +589,19 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
599589 var x97: u64 = undefined;
600590 var x98: u1 = undefined;
601591 addcarryxU64(&x97, &x98, x96, x70, x88);
602 const x99 = (@as(u64, x98) + @as(u64, x71));
592 const x99: u64 = (@as(u64, x98) + x71);
603593 var x100: u64 = undefined;
604594 var x101: u64 = undefined;
605 mulxU64(&x100, &x101, x2, (arg1[3]));
595 mulxU64(&x100, &x101, x2, arg1[3]);
606596 var x102: u64 = undefined;
607597 var x103: u64 = undefined;
608 mulxU64(&x102, &x103, x2, (arg1[2]));
598 mulxU64(&x102, &x103, x2, arg1[2]);
609599 var x104: u64 = undefined;
610600 var x105: u64 = undefined;
611 mulxU64(&x104, &x105, x2, (arg1[1]));
601 mulxU64(&x104, &x105, x2, arg1[1]);
612602 var x106: u64 = undefined;
613603 var x107: u64 = undefined;
614 mulxU64(&x106, &x107, x2, (arg1[0]));
604 mulxU64(&x106, &x107, x2, arg1[0]);
615605 var x108: u64 = undefined;
616606 var x109: u1 = undefined;
617607 addcarryxU64(&x108, &x109, 0x0, x107, x104);
......@@ -621,7 +611,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
621611 var x112: u64 = undefined;
622612 var x113: u1 = undefined;
623613 addcarryxU64(&x112, &x113, x111, x103, x100);
624 const x114 = (@as(u64, x113) + x101);
614 const x114: u64 = (x113 + x101);
625615 var x115: u64 = undefined;
626616 var x116: u1 = undefined;
627617 addcarryxU64(&x115, &x116, 0x0, x91, x106);
......@@ -661,7 +651,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
661651 var x139: u64 = undefined;
662652 var x140: u1 = undefined;
663653 addcarryxU64(&x139, &x140, x138, x130, x127);
664 const x141 = (@as(u64, x140) + x128);
654 const x141: u64 = (x140 + x128);
665655 var x142: u64 = undefined;
666656 var x143: u1 = undefined;
667657 addcarryxU64(&x142, &x143, 0x0, x115, x133);
......@@ -677,19 +667,19 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
677667 var x150: u64 = undefined;
678668 var x151: u1 = undefined;
679669 addcarryxU64(&x150, &x151, x149, x123, x141);
680 const x152 = (@as(u64, x151) + @as(u64, x124));
670 const x152: u64 = (@as(u64, x151) + x124);
681671 var x153: u64 = undefined;
682672 var x154: u64 = undefined;
683 mulxU64(&x153, &x154, x3, (arg1[3]));
673 mulxU64(&x153, &x154, x3, arg1[3]);
684674 var x155: u64 = undefined;
685675 var x156: u64 = undefined;
686 mulxU64(&x155, &x156, x3, (arg1[2]));
676 mulxU64(&x155, &x156, x3, arg1[2]);
687677 var x157: u64 = undefined;
688678 var x158: u64 = undefined;
689 mulxU64(&x157, &x158, x3, (arg1[1]));
679 mulxU64(&x157, &x158, x3, arg1[1]);
690680 var x159: u64 = undefined;
691681 var x160: u64 = undefined;
692 mulxU64(&x159, &x160, x3, (arg1[0]));
682 mulxU64(&x159, &x160, x3, arg1[0]);
693683 var x161: u64 = undefined;
694684 var x162: u1 = undefined;
695685 addcarryxU64(&x161, &x162, 0x0, x160, x157);
......@@ -699,7 +689,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
699689 var x165: u64 = undefined;
700690 var x166: u1 = undefined;
701691 addcarryxU64(&x165, &x166, x164, x156, x153);
702 const x167 = (@as(u64, x166) + x154);
692 const x167: u64 = (x166 + x154);
703693 var x168: u64 = undefined;
704694 var x169: u1 = undefined;
705695 addcarryxU64(&x168, &x169, 0x0, x144, x159);
......@@ -739,7 +729,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
739729 var x192: u64 = undefined;
740730 var x193: u1 = undefined;
741731 addcarryxU64(&x192, &x193, x191, x183, x180);
742 const x194 = (@as(u64, x193) + x181);
732 const x194: u64 = (x193 + x181);
743733 var x195: u64 = undefined;
744734 var x196: u1 = undefined;
745735 addcarryxU64(&x195, &x196, 0x0, x168, x186);
......@@ -755,7 +745,7 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
755745 var x203: u64 = undefined;
756746 var x204: u1 = undefined;
757747 addcarryxU64(&x203, &x204, x202, x176, x194);
758 const x205 = (@as(u64, x204) + @as(u64, x177));
748 const x205: u64 = (@as(u64, x204) + x177);
759749 var x206: u64 = undefined;
760750 var x207: u1 = undefined;
761751 subborrowxU64(&x206, &x207, 0x0, x197, 0xbfd25e8cd0364141);
......@@ -772,13 +762,14 @@ pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEl
772762 var x215: u1 = undefined;
773763 subborrowxU64(&x214, &x215, x213, x205, 0x0);
774764 var x216: u64 = undefined;
775 cmovznzU64(&x216, x215, x206, x197);
765 const x216_selection_mask = selectionMaskU64(x215);
766 x216 = x206 ^ ((x206 ^ x197) & x216_selection_mask);
776767 var x217: u64 = undefined;
777 cmovznzU64(&x217, x215, x208, x199);
768 x217 = x208 ^ ((x208 ^ x199) & x216_selection_mask);
778769 var x218: u64 = undefined;
779 cmovznzU64(&x218, x215, x210, x201);
770 x218 = x210 ^ ((x210 ^ x201) & x216_selection_mask);
780771 var x219: u64 = undefined;
781 cmovznzU64(&x219, x215, x212, x203);
772 x219 = x212 ^ ((x212 ^ x203) & x216_selection_mask);
782773 out1[0] = x216;
783774 out1[1] = x217;
784775 out1[2] = x218;
......@@ -799,16 +790,16 @@ pub fn add(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
799790
800791 var x1: u64 = undefined;
801792 var x2: u1 = undefined;
802 addcarryxU64(&x1, &x2, 0x0, (arg1[0]), (arg2[0]));
793 addcarryxU64(&x1, &x2, 0x0, arg1[0], arg2[0]);
803794 var x3: u64 = undefined;
804795 var x4: u1 = undefined;
805 addcarryxU64(&x3, &x4, x2, (arg1[1]), (arg2[1]));
796 addcarryxU64(&x3, &x4, x2, arg1[1], arg2[1]);
806797 var x5: u64 = undefined;
807798 var x6: u1 = undefined;
808 addcarryxU64(&x5, &x6, x4, (arg1[2]), (arg2[2]));
799 addcarryxU64(&x5, &x6, x4, arg1[2], arg2[2]);
809800 var x7: u64 = undefined;
810801 var x8: u1 = undefined;
811 addcarryxU64(&x7, &x8, x6, (arg1[3]), (arg2[3]));
802 addcarryxU64(&x7, &x8, x6, arg1[3], arg2[3]);
812803 var x9: u64 = undefined;
813804 var x10: u1 = undefined;
814805 subborrowxU64(&x9, &x10, 0x0, x1, 0xbfd25e8cd0364141);
......@@ -823,15 +814,16 @@ pub fn add(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
823814 subborrowxU64(&x15, &x16, x14, x7, 0xffffffffffffffff);
824815 var x17: u64 = undefined;
825816 var x18: u1 = undefined;
826 subborrowxU64(&x17, &x18, x16, @as(u64, x8), 0x0);
817 subborrowxU64(&x17, &x18, x16, x8, 0x0);
827818 var x19: u64 = undefined;
828 cmovznzU64(&x19, x18, x9, x1);
819 const x19_selection_mask = selectionMaskU64(x18);
820 x19 = x9 ^ ((x9 ^ x1) & x19_selection_mask);
829821 var x20: u64 = undefined;
830 cmovznzU64(&x20, x18, x11, x3);
822 x20 = x11 ^ ((x11 ^ x3) & x19_selection_mask);
831823 var x21: u64 = undefined;
832 cmovznzU64(&x21, x18, x13, x5);
824 x21 = x13 ^ ((x13 ^ x5) & x19_selection_mask);
833825 var x22: u64 = undefined;
834 cmovznzU64(&x22, x18, x15, x7);
826 x22 = x15 ^ ((x15 ^ x7) & x19_selection_mask);
835827 out1[0] = x19;
836828 out1[1] = x20;
837829 out1[2] = x21;
......@@ -852,18 +844,19 @@ pub fn sub(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
852844
853845 var x1: u64 = undefined;
854846 var x2: u1 = undefined;
855 subborrowxU64(&x1, &x2, 0x0, (arg1[0]), (arg2[0]));
847 subborrowxU64(&x1, &x2, 0x0, arg1[0], arg2[0]);
856848 var x3: u64 = undefined;
857849 var x4: u1 = undefined;
858 subborrowxU64(&x3, &x4, x2, (arg1[1]), (arg2[1]));
850 subborrowxU64(&x3, &x4, x2, arg1[1], arg2[1]);
859851 var x5: u64 = undefined;
860852 var x6: u1 = undefined;
861 subborrowxU64(&x5, &x6, x4, (arg1[2]), (arg2[2]));
853 subborrowxU64(&x5, &x6, x4, arg1[2], arg2[2]);
862854 var x7: u64 = undefined;
863855 var x8: u1 = undefined;
864 subborrowxU64(&x7, &x8, x6, (arg1[3]), (arg2[3]));
856 subborrowxU64(&x7, &x8, x6, arg1[3], arg2[3]);
865857 var x9: u64 = undefined;
866 cmovznzU64(&x9, x8, 0x0, 0xffffffffffffffff);
858 const x9_selection_mask = selectionMaskU64(x8);
859 x9 = 0x0 ^ ((0x0 ^ 0xffffffffffffffff) & x9_selection_mask);
867860 var x10: u64 = undefined;
868861 var x11: u1 = undefined;
869862 addcarryxU64(&x10, &x11, 0x0, x1, (x9 & 0xbfd25e8cd0364141));
......@@ -895,18 +888,19 @@ pub fn opp(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
895888
896889 var x1: u64 = undefined;
897890 var x2: u1 = undefined;
898 subborrowxU64(&x1, &x2, 0x0, 0x0, (arg1[0]));
891 subborrowxU64(&x1, &x2, 0x0, 0x0, arg1[0]);
899892 var x3: u64 = undefined;
900893 var x4: u1 = undefined;
901 subborrowxU64(&x3, &x4, x2, 0x0, (arg1[1]));
894 subborrowxU64(&x3, &x4, x2, 0x0, arg1[1]);
902895 var x5: u64 = undefined;
903896 var x6: u1 = undefined;
904 subborrowxU64(&x5, &x6, x4, 0x0, (arg1[2]));
897 subborrowxU64(&x5, &x6, x4, 0x0, arg1[2]);
905898 var x7: u64 = undefined;
906899 var x8: u1 = undefined;
907 subborrowxU64(&x7, &x8, x6, 0x0, (arg1[3]));
900 subborrowxU64(&x7, &x8, x6, 0x0, arg1[3]);
908901 var x9: u64 = undefined;
909 cmovznzU64(&x9, x8, 0x0, 0xffffffffffffffff);
902 const x9_selection_mask = selectionMaskU64(x8);
903 x9 = 0x0 ^ ((0x0 ^ 0xffffffffffffffff) & x9_selection_mask);
910904 var x10: u64 = undefined;
911905 var x11: u1 = undefined;
912906 addcarryxU64(&x10, &x11, 0x0, x1, (x9 & 0xbfd25e8cd0364141));
......@@ -936,7 +930,7 @@ pub fn opp(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldEleme
936930pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldElement) void {
937931 @setRuntimeSafety(mode == .debug);
938932
939 const x1 = (arg1[0]);
933 const x1: u64 = arg1[0];
940934 var x2: u64 = undefined;
941935 var x3: u64 = undefined;
942936 mulxU64(&x2, &x3, x1, 0x4b0dff665588b13f);
......@@ -975,10 +969,10 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo
975969 addcarryxU64(&x24, &x25, x23, 0x0, x16);
976970 var x26: u64 = undefined;
977971 var x27: u1 = undefined;
978 addcarryxU64(&x26, &x27, x25, 0x0, (@as(u64, x17) + x5));
972 addcarryxU64(&x26, &x27, x25, 0x0, (x17 + x5));
979973 var x28: u64 = undefined;
980974 var x29: u1 = undefined;
981 addcarryxU64(&x28, &x29, 0x0, x20, (arg1[1]));
975 addcarryxU64(&x28, &x29, 0x0, x20, arg1[1]);
982976 var x30: u64 = undefined;
983977 var x31: u1 = undefined;
984978 addcarryxU64(&x30, &x31, x29, x22, 0x0);
......@@ -1026,10 +1020,10 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo
10261020 addcarryxU64(&x58, &x59, x57, x34, x50);
10271021 var x60: u64 = undefined;
10281022 var x61: u1 = undefined;
1029 addcarryxU64(&x60, &x61, x59, (@as(u64, x35) + @as(u64, x27)), (@as(u64, x51) + x39));
1023 addcarryxU64(&x60, &x61, x59, (@as(u64, x35) + x27), (x51 + x39));
10301024 var x62: u64 = undefined;
10311025 var x63: u1 = undefined;
1032 addcarryxU64(&x62, &x63, 0x0, x54, (arg1[2]));
1026 addcarryxU64(&x62, &x63, 0x0, x54, arg1[2]);
10331027 var x64: u64 = undefined;
10341028 var x65: u1 = undefined;
10351029 addcarryxU64(&x64, &x65, x63, x56, 0x0);
......@@ -1077,10 +1071,10 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo
10771071 addcarryxU64(&x92, &x93, x91, x68, x84);
10781072 var x94: u64 = undefined;
10791073 var x95: u1 = undefined;
1080 addcarryxU64(&x94, &x95, x93, (@as(u64, x69) + @as(u64, x61)), (@as(u64, x85) + x73));
1074 addcarryxU64(&x94, &x95, x93, (@as(u64, x69) + x61), (x85 + x73));
10811075 var x96: u64 = undefined;
10821076 var x97: u1 = undefined;
1083 addcarryxU64(&x96, &x97, 0x0, x88, (arg1[3]));
1077 addcarryxU64(&x96, &x97, 0x0, x88, arg1[3]);
10841078 var x98: u64 = undefined;
10851079 var x99: u1 = undefined;
10861080 addcarryxU64(&x98, &x99, x97, x90, 0x0);
......@@ -1128,7 +1122,7 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo
11281122 addcarryxU64(&x126, &x127, x125, x102, x118);
11291123 var x128: u64 = undefined;
11301124 var x129: u1 = undefined;
1131 addcarryxU64(&x128, &x129, x127, (@as(u64, x103) + @as(u64, x95)), (@as(u64, x119) + x107));
1125 addcarryxU64(&x128, &x129, x127, (@as(u64, x103) + x95), (x119 + x107));
11321126 var x130: u64 = undefined;
11331127 var x131: u1 = undefined;
11341128 subborrowxU64(&x130, &x131, 0x0, x122, 0xbfd25e8cd0364141);
......@@ -1143,15 +1137,16 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo
11431137 subborrowxU64(&x136, &x137, x135, x128, 0xffffffffffffffff);
11441138 var x138: u64 = undefined;
11451139 var x139: u1 = undefined;
1146 subborrowxU64(&x138, &x139, x137, @as(u64, x129), 0x0);
1140 subborrowxU64(&x138, &x139, x137, x129, 0x0);
11471141 var x140: u64 = undefined;
1148 cmovznzU64(&x140, x139, x130, x122);
1142 const x140_selection_mask = selectionMaskU64(x139);
1143 x140 = x130 ^ ((x130 ^ x122) & x140_selection_mask);
11491144 var x141: u64 = undefined;
1150 cmovznzU64(&x141, x139, x132, x124);
1145 x141 = x132 ^ ((x132 ^ x124) & x140_selection_mask);
11511146 var x142: u64 = undefined;
1152 cmovznzU64(&x142, x139, x134, x126);
1147 x142 = x134 ^ ((x134 ^ x126) & x140_selection_mask);
11531148 var x143: u64 = undefined;
1154 cmovznzU64(&x143, x139, x136, x128);
1149 x143 = x136 ^ ((x136 ^ x128) & x140_selection_mask);
11551150 out1[0] = x140;
11561151 out1[1] = x141;
11571152 out1[2] = x142;
......@@ -1169,10 +1164,10 @@ pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDo
11691164pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDomainFieldElement) void {
11701165 @setRuntimeSafety(mode == .debug);
11711166
1172 const x1 = (arg1[1]);
1173 const x2 = (arg1[2]);
1174 const x3 = (arg1[3]);
1175 const x4 = (arg1[0]);
1167 const x1: u64 = arg1[1];
1168 const x2: u64 = arg1[2];
1169 const x3: u64 = arg1[3];
1170 const x4: u64 = arg1[0];
11761171 var x5: u64 = undefined;
11771172 var x6: u64 = undefined;
11781173 mulxU64(&x5, &x6, x4, 0x9d671cd581c69bc5);
......@@ -1232,7 +1227,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma
12321227 addcarryxU64(&x41, &x42, x40, x17, x33);
12331228 var x43: u64 = undefined;
12341229 var x44: u1 = undefined;
1235 addcarryxU64(&x43, &x44, x42, (@as(u64, x18) + x6), (@as(u64, x34) + x22));
1230 addcarryxU64(&x43, &x44, x42, (x18 + x6), (x34 + x22));
12361231 var x45: u64 = undefined;
12371232 var x46: u64 = undefined;
12381233 mulxU64(&x45, &x46, x1, 0x9d671cd581c69bc5);
......@@ -1304,7 +1299,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma
13041299 addcarryxU64(&x89, &x90, x88, x65, x81);
13051300 var x91: u64 = undefined;
13061301 var x92: u1 = undefined;
1307 addcarryxU64(&x91, &x92, x90, ((@as(u64, x66) + @as(u64, x44)) + (@as(u64, x58) + x46)), (@as(u64, x82) + x70));
1302 addcarryxU64(&x91, &x92, x90, ((@as(u64, x66) + x44) + (x58 + x46)), (x82 + x70));
13081303 var x93: u64 = undefined;
13091304 var x94: u64 = undefined;
13101305 mulxU64(&x93, &x94, x2, 0x9d671cd581c69bc5);
......@@ -1376,7 +1371,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma
13761371 addcarryxU64(&x137, &x138, x136, x113, x129);
13771372 var x139: u64 = undefined;
13781373 var x140: u1 = undefined;
1379 addcarryxU64(&x139, &x140, x138, ((@as(u64, x114) + @as(u64, x92)) + (@as(u64, x106) + x94)), (@as(u64, x130) + x118));
1374 addcarryxU64(&x139, &x140, x138, ((@as(u64, x114) + x92) + (x106 + x94)), (x130 + x118));
13801375 var x141: u64 = undefined;
13811376 var x142: u64 = undefined;
13821377 mulxU64(&x141, &x142, x3, 0x9d671cd581c69bc5);
......@@ -1448,7 +1443,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma
14481443 addcarryxU64(&x185, &x186, x184, x161, x177);
14491444 var x187: u64 = undefined;
14501445 var x188: u1 = undefined;
1451 addcarryxU64(&x187, &x188, x186, ((@as(u64, x162) + @as(u64, x140)) + (@as(u64, x154) + x142)), (@as(u64, x178) + x166));
1446 addcarryxU64(&x187, &x188, x186, ((@as(u64, x162) + x140) + (x154 + x142)), (x178 + x166));
14521447 var x189: u64 = undefined;
14531448 var x190: u1 = undefined;
14541449 subborrowxU64(&x189, &x190, 0x0, x181, 0xbfd25e8cd0364141);
......@@ -1463,15 +1458,16 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma
14631458 subborrowxU64(&x195, &x196, x194, x187, 0xffffffffffffffff);
14641459 var x197: u64 = undefined;
14651460 var x198: u1 = undefined;
1466 subborrowxU64(&x197, &x198, x196, @as(u64, x188), 0x0);
1461 subborrowxU64(&x197, &x198, x196, x188, 0x0);
14671462 var x199: u64 = undefined;
1468 cmovznzU64(&x199, x198, x189, x181);
1463 const x199_selection_mask = selectionMaskU64(x198);
1464 x199 = x189 ^ ((x189 ^ x181) & x199_selection_mask);
14691465 var x200: u64 = undefined;
1470 cmovznzU64(&x200, x198, x191, x183);
1466 x200 = x191 ^ ((x191 ^ x183) & x199_selection_mask);
14711467 var x201: u64 = undefined;
1472 cmovznzU64(&x201, x198, x193, x185);
1468 x201 = x193 ^ ((x193 ^ x185) & x199_selection_mask);
14731469 var x202: u64 = undefined;
1474 cmovznzU64(&x202, x198, x195, x187);
1470 x202 = x195 ^ ((x195 ^ x187) & x199_selection_mask);
14751471 out1[0] = x199;
14761472 out1[1] = x200;
14771473 out1[2] = x201;
......@@ -1492,7 +1488,7 @@ pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDoma
14921488pub fn nonzero(out1: *u64, arg1: [4]u64) void {
14931489 @setRuntimeSafety(mode == .debug);
14941490
1495 const x1 = ((arg1[0]) | ((arg1[1]) | ((arg1[2]) | (arg1[3]))));
1491 const x1: u64 = (arg1[0] | (arg1[1] | (arg1[2] | arg1[3])));
14961492 out1.* = x1;
14971493}
14981494
......@@ -1511,13 +1507,14 @@ pub fn selectznz(out1: *[4]u64, arg1: u1, arg2: [4]u64, arg3: [4]u64) void {
15111507 @setRuntimeSafety(mode == .debug);
15121508
15131509 var x1: u64 = undefined;
1514 cmovznzU64(&x1, arg1, (arg2[0]), (arg3[0]));
1510 const x1_selection_mask = selectionMaskU64(arg1);
1511 x1 = arg2[0] ^ ((arg2[0] ^ arg3[0]) & x1_selection_mask);
15151512 var x2: u64 = undefined;
1516 cmovznzU64(&x2, arg1, (arg2[1]), (arg3[1]));
1513 x2 = arg2[1] ^ ((arg2[1] ^ arg3[1]) & x1_selection_mask);
15171514 var x3: u64 = undefined;
1518 cmovznzU64(&x3, arg1, (arg2[2]), (arg3[2]));
1515 x3 = arg2[2] ^ ((arg2[2] ^ arg3[2]) & x1_selection_mask);
15191516 var x4: u64 = undefined;
1520 cmovznzU64(&x4, arg1, (arg2[3]), (arg3[3]));
1517 x4 = arg2[3] ^ ((arg2[3] ^ arg3[3]) & x1_selection_mask);
15211518 out1[0] = x1;
15221519 out1[1] = x2;
15231520 out1[2] = x3;
......@@ -1538,66 +1535,66 @@ pub fn selectznz(out1: *[4]u64, arg1: u1, arg2: [4]u64, arg3: [4]u64) void {
15381535pub fn toBytes(out1: *[32]u8, arg1: [4]u64) void {
15391536 @setRuntimeSafety(mode == .debug);
15401537
1541 const x1 = (arg1[3]);
1542 const x2 = (arg1[2]);
1543 const x3 = (arg1[1]);
1544 const x4 = (arg1[0]);
1545 const x5 = @as(u8, @truncate((x4 & 0xff)));
1546 const x6 = (x4 >> 8);
1547 const x7 = @as(u8, @truncate((x6 & 0xff)));
1548 const x8 = (x6 >> 8);
1549 const x9 = @as(u8, @truncate((x8 & 0xff)));
1550 const x10 = (x8 >> 8);
1551 const x11 = @as(u8, @truncate((x10 & 0xff)));
1552 const x12 = (x10 >> 8);
1553 const x13 = @as(u8, @truncate((x12 & 0xff)));
1554 const x14 = (x12 >> 8);
1555 const x15 = @as(u8, @truncate((x14 & 0xff)));
1556 const x16 = (x14 >> 8);
1557 const x17 = @as(u8, @truncate((x16 & 0xff)));
1558 const x18 = @as(u8, @truncate((x16 >> 8)));
1559 const x19 = @as(u8, @truncate((x3 & 0xff)));
1560 const x20 = (x3 >> 8);
1561 const x21 = @as(u8, @truncate((x20 & 0xff)));
1562 const x22 = (x20 >> 8);
1563 const x23 = @as(u8, @truncate((x22 & 0xff)));
1564 const x24 = (x22 >> 8);
1565 const x25 = @as(u8, @truncate((x24 & 0xff)));
1566 const x26 = (x24 >> 8);
1567 const x27 = @as(u8, @truncate((x26 & 0xff)));
1568 const x28 = (x26 >> 8);
1569 const x29 = @as(u8, @truncate((x28 & 0xff)));
1570 const x30 = (x28 >> 8);
1571 const x31 = @as(u8, @truncate((x30 & 0xff)));
1572 const x32 = @as(u8, @truncate((x30 >> 8)));
1573 const x33 = @as(u8, @truncate((x2 & 0xff)));
1574 const x34 = (x2 >> 8);
1575 const x35 = @as(u8, @truncate((x34 & 0xff)));
1576 const x36 = (x34 >> 8);
1577 const x37 = @as(u8, @truncate((x36 & 0xff)));
1578 const x38 = (x36 >> 8);
1579 const x39 = @as(u8, @truncate((x38 & 0xff)));
1580 const x40 = (x38 >> 8);
1581 const x41 = @as(u8, @truncate((x40 & 0xff)));
1582 const x42 = (x40 >> 8);
1583 const x43 = @as(u8, @truncate((x42 & 0xff)));
1584 const x44 = (x42 >> 8);
1585 const x45 = @as(u8, @truncate((x44 & 0xff)));
1586 const x46 = @as(u8, @truncate((x44 >> 8)));
1587 const x47 = @as(u8, @truncate((x1 & 0xff)));
1588 const x48 = (x1 >> 8);
1589 const x49 = @as(u8, @truncate((x48 & 0xff)));
1590 const x50 = (x48 >> 8);
1591 const x51 = @as(u8, @truncate((x50 & 0xff)));
1592 const x52 = (x50 >> 8);
1593 const x53 = @as(u8, @truncate((x52 & 0xff)));
1594 const x54 = (x52 >> 8);
1595 const x55 = @as(u8, @truncate((x54 & 0xff)));
1596 const x56 = (x54 >> 8);
1597 const x57 = @as(u8, @truncate((x56 & 0xff)));
1598 const x58 = (x56 >> 8);
1599 const x59 = @as(u8, @truncate((x58 & 0xff)));
1600 const x60 = @as(u8, @truncate((x58 >> 8)));
1538 const x1: u64 = arg1[3];
1539 const x2: u64 = arg1[2];
1540 const x3: u64 = arg1[1];
1541 const x4: u64 = arg1[0];
1542 const x5: u8 = @truncate(x4);
1543 const x6: u64 = (x4 >> 8);
1544 const x7: u8 = @truncate(x6);
1545 const x8: u64 = (x6 >> 8);
1546 const x9: u8 = @truncate(x8);
1547 const x10: u64 = (x8 >> 8);
1548 const x11: u8 = @truncate(x10);
1549 const x12: u64 = (x10 >> 8);
1550 const x13: u8 = @truncate(x12);
1551 const x14: u64 = (x12 >> 8);
1552 const x15: u8 = @truncate(x14);
1553 const x16: u64 = (x14 >> 8);
1554 const x17: u8 = @truncate(x16);
1555 const x18: u8 = @truncate((x16 >> 8));
1556 const x19: u8 = @truncate(x3);
1557 const x20: u64 = (x3 >> 8);
1558 const x21: u8 = @truncate(x20);
1559 const x22: u64 = (x20 >> 8);
1560 const x23: u8 = @truncate(x22);
1561 const x24: u64 = (x22 >> 8);
1562 const x25: u8 = @truncate(x24);
1563 const x26: u64 = (x24 >> 8);
1564 const x27: u8 = @truncate(x26);
1565 const x28: u64 = (x26 >> 8);
1566 const x29: u8 = @truncate(x28);
1567 const x30: u64 = (x28 >> 8);
1568 const x31: u8 = @truncate(x30);
1569 const x32: u8 = @truncate((x30 >> 8));
1570 const x33: u8 = @truncate(x2);
1571 const x34: u64 = (x2 >> 8);
1572 const x35: u8 = @truncate(x34);
1573 const x36: u64 = (x34 >> 8);
1574 const x37: u8 = @truncate(x36);
1575 const x38: u64 = (x36 >> 8);
1576 const x39: u8 = @truncate(x38);
1577 const x40: u64 = (x38 >> 8);
1578 const x41: u8 = @truncate(x40);
1579 const x42: u64 = (x40 >> 8);
1580 const x43: u8 = @truncate(x42);
1581 const x44: u64 = (x42 >> 8);
1582 const x45: u8 = @truncate(x44);
1583 const x46: u8 = @truncate((x44 >> 8));
1584 const x47: u8 = @truncate(x1);
1585 const x48: u64 = (x1 >> 8);
1586 const x49: u8 = @truncate(x48);
1587 const x50: u64 = (x48 >> 8);
1588 const x51: u8 = @truncate(x50);
1589 const x52: u64 = (x50 >> 8);
1590 const x53: u8 = @truncate(x52);
1591 const x54: u64 = (x52 >> 8);
1592 const x55: u8 = @truncate(x54);
1593 const x56: u64 = (x54 >> 8);
1594 const x57: u8 = @truncate(x56);
1595 const x58: u64 = (x56 >> 8);
1596 const x59: u8 = @truncate(x58);
1597 const x60: u8 = @truncate((x58 >> 8));
16011598 out1[0] = x5;
16021599 out1[1] = x7;
16031600 out1[2] = x9;
......@@ -1647,66 +1644,66 @@ pub fn toBytes(out1: *[32]u8, arg1: [4]u64) void {
16471644pub fn fromBytes(out1: *[4]u64, arg1: [32]u8) void {
16481645 @setRuntimeSafety(mode == .debug);
16491646
1650 const x1 = (@as(u64, (arg1[31])) << 56);
1651 const x2 = (@as(u64, (arg1[30])) << 48);
1652 const x3 = (@as(u64, (arg1[29])) << 40);
1653 const x4 = (@as(u64, (arg1[28])) << 32);
1654 const x5 = (@as(u64, (arg1[27])) << 24);
1655 const x6 = (@as(u64, (arg1[26])) << 16);
1656 const x7 = (@as(u64, (arg1[25])) << 8);
1657 const x8 = (arg1[24]);
1658 const x9 = (@as(u64, (arg1[23])) << 56);
1659 const x10 = (@as(u64, (arg1[22])) << 48);
1660 const x11 = (@as(u64, (arg1[21])) << 40);
1661 const x12 = (@as(u64, (arg1[20])) << 32);
1662 const x13 = (@as(u64, (arg1[19])) << 24);
1663 const x14 = (@as(u64, (arg1[18])) << 16);
1664 const x15 = (@as(u64, (arg1[17])) << 8);
1665 const x16 = (arg1[16]);
1666 const x17 = (@as(u64, (arg1[15])) << 56);
1667 const x18 = (@as(u64, (arg1[14])) << 48);
1668 const x19 = (@as(u64, (arg1[13])) << 40);
1669 const x20 = (@as(u64, (arg1[12])) << 32);
1670 const x21 = (@as(u64, (arg1[11])) << 24);
1671 const x22 = (@as(u64, (arg1[10])) << 16);
1672 const x23 = (@as(u64, (arg1[9])) << 8);
1673 const x24 = (arg1[8]);
1674 const x25 = (@as(u64, (arg1[7])) << 56);
1675 const x26 = (@as(u64, (arg1[6])) << 48);
1676 const x27 = (@as(u64, (arg1[5])) << 40);
1677 const x28 = (@as(u64, (arg1[4])) << 32);
1678 const x29 = (@as(u64, (arg1[3])) << 24);
1679 const x30 = (@as(u64, (arg1[2])) << 16);
1680 const x31 = (@as(u64, (arg1[1])) << 8);
1681 const x32 = (arg1[0]);
1682 const x33 = (x31 + @as(u64, x32));
1683 const x34 = (x30 + x33);
1684 const x35 = (x29 + x34);
1685 const x36 = (x28 + x35);
1686 const x37 = (x27 + x36);
1687 const x38 = (x26 + x37);
1688 const x39 = (x25 + x38);
1689 const x40 = (x23 + @as(u64, x24));
1690 const x41 = (x22 + x40);
1691 const x42 = (x21 + x41);
1692 const x43 = (x20 + x42);
1693 const x44 = (x19 + x43);
1694 const x45 = (x18 + x44);
1695 const x46 = (x17 + x45);
1696 const x47 = (x15 + @as(u64, x16));
1697 const x48 = (x14 + x47);
1698 const x49 = (x13 + x48);
1699 const x50 = (x12 + x49);
1700 const x51 = (x11 + x50);
1701 const x52 = (x10 + x51);
1702 const x53 = (x9 + x52);
1703 const x54 = (x7 + @as(u64, x8));
1704 const x55 = (x6 + x54);
1705 const x56 = (x5 + x55);
1706 const x57 = (x4 + x56);
1707 const x58 = (x3 + x57);
1708 const x59 = (x2 + x58);
1709 const x60 = (x1 + x59);
1647 const x1: u64 = (@as(u64, arg1[31]) << 56);
1648 const x2: u64 = (@as(u64, arg1[30]) << 48);
1649 const x3: u64 = (@as(u64, arg1[29]) << 40);
1650 const x4: u64 = (@as(u64, arg1[28]) << 32);
1651 const x5: u64 = (@as(u64, arg1[27]) << 24);
1652 const x6: u64 = (@as(u64, arg1[26]) << 16);
1653 const x7: u64 = (@as(u64, arg1[25]) << 8);
1654 const x8: u8 = arg1[24];
1655 const x9: u64 = (@as(u64, arg1[23]) << 56);
1656 const x10: u64 = (@as(u64, arg1[22]) << 48);
1657 const x11: u64 = (@as(u64, arg1[21]) << 40);
1658 const x12: u64 = (@as(u64, arg1[20]) << 32);
1659 const x13: u64 = (@as(u64, arg1[19]) << 24);
1660 const x14: u64 = (@as(u64, arg1[18]) << 16);
1661 const x15: u64 = (@as(u64, arg1[17]) << 8);
1662 const x16: u8 = arg1[16];
1663 const x17: u64 = (@as(u64, arg1[15]) << 56);
1664 const x18: u64 = (@as(u64, arg1[14]) << 48);
1665 const x19: u64 = (@as(u64, arg1[13]) << 40);
1666 const x20: u64 = (@as(u64, arg1[12]) << 32);
1667 const x21: u64 = (@as(u64, arg1[11]) << 24);
1668 const x22: u64 = (@as(u64, arg1[10]) << 16);
1669 const x23: u64 = (@as(u64, arg1[9]) << 8);
1670 const x24: u8 = arg1[8];
1671 const x25: u64 = (@as(u64, arg1[7]) << 56);
1672 const x26: u64 = (@as(u64, arg1[6]) << 48);
1673 const x27: u64 = (@as(u64, arg1[5]) << 40);
1674 const x28: u64 = (@as(u64, arg1[4]) << 32);
1675 const x29: u64 = (@as(u64, arg1[3]) << 24);
1676 const x30: u64 = (@as(u64, arg1[2]) << 16);
1677 const x31: u64 = (@as(u64, arg1[1]) << 8);
1678 const x32: u8 = arg1[0];
1679 const x33: u64 = (x31 + x32);
1680 const x34: u64 = (x30 + x33);
1681 const x35: u64 = (x29 + x34);
1682 const x36: u64 = (x28 + x35);
1683 const x37: u64 = (x27 + x36);
1684 const x38: u64 = (x26 + x37);
1685 const x39: u64 = (x25 + x38);
1686 const x40: u64 = (x23 + x24);
1687 const x41: u64 = (x22 + x40);
1688 const x42: u64 = (x21 + x41);
1689 const x43: u64 = (x20 + x42);
1690 const x44: u64 = (x19 + x43);
1691 const x45: u64 = (x18 + x44);
1692 const x46: u64 = (x17 + x45);
1693 const x47: u64 = (x15 + x16);
1694 const x48: u64 = (x14 + x47);
1695 const x49: u64 = (x13 + x48);
1696 const x50: u64 = (x12 + x49);
1697 const x51: u64 = (x11 + x50);
1698 const x52: u64 = (x10 + x51);
1699 const x53: u64 = (x9 + x52);
1700 const x54: u64 = (x7 + x8);
1701 const x55: u64 = (x6 + x54);
1702 const x56: u64 = (x5 + x55);
1703 const x57: u64 = (x4 + x56);
1704 const x58: u64 = (x3 + x57);
1705 const x59: u64 = (x2 + x58);
1706 const x60: u64 = (x1 + x59);
17101707 out1[0] = x39;
17111708 out1[1] = x46;
17121709 out1[2] = x53;
......@@ -1780,55 +1777,57 @@ pub fn divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *[4]u64, out5: *[
17801777 var x1: u64 = undefined;
17811778 var x2: u1 = undefined;
17821779 addcarryxU64(&x1, &x2, 0x0, (~arg1), 0x1);
1783 const x3 = (@as(u1, @truncate((x1 >> 63))) & @as(u1, @truncate(((arg3[0]) & 0x1))));
1780 const x3: u1 = (@as(u1, @truncate((x1 >> 63))) & @as(u1, @truncate(arg3[0])));
17841781 var x4: u64 = undefined;
17851782 var x5: u1 = undefined;
17861783 addcarryxU64(&x4, &x5, 0x0, (~arg1), 0x1);
17871784 var x6: u64 = undefined;
1788 cmovznzU64(&x6, x3, arg1, x4);
1785 const x6_selection_mask = selectionMaskU64(x3);
1786 x6 = arg1 ^ ((arg1 ^ x4) & x6_selection_mask);
17891787 var x7: u64 = undefined;
1790 cmovznzU64(&x7, x3, (arg2[0]), (arg3[0]));
1788 x7 = arg2[0] ^ ((arg2[0] ^ arg3[0]) & x6_selection_mask);
17911789 var x8: u64 = undefined;
1792 cmovznzU64(&x8, x3, (arg2[1]), (arg3[1]));
1790 x8 = arg2[1] ^ ((arg2[1] ^ arg3[1]) & x6_selection_mask);
17931791 var x9: u64 = undefined;
1794 cmovznzU64(&x9, x3, (arg2[2]), (arg3[2]));
1792 x9 = arg2[2] ^ ((arg2[2] ^ arg3[2]) & x6_selection_mask);
17951793 var x10: u64 = undefined;
1796 cmovznzU64(&x10, x3, (arg2[3]), (arg3[3]));
1794 x10 = arg2[3] ^ ((arg2[3] ^ arg3[3]) & x6_selection_mask);
17971795 var x11: u64 = undefined;
1798 cmovznzU64(&x11, x3, (arg2[4]), (arg3[4]));
1796 x11 = arg2[4] ^ ((arg2[4] ^ arg3[4]) & x6_selection_mask);
17991797 var x12: u64 = undefined;
18001798 var x13: u1 = undefined;
1801 addcarryxU64(&x12, &x13, 0x0, 0x1, (~(arg2[0])));
1799 addcarryxU64(&x12, &x13, 0x0, 0x1, (~arg2[0]));
18021800 var x14: u64 = undefined;
18031801 var x15: u1 = undefined;
1804 addcarryxU64(&x14, &x15, x13, 0x0, (~(arg2[1])));
1802 addcarryxU64(&x14, &x15, x13, 0x0, (~arg2[1]));
18051803 var x16: u64 = undefined;
18061804 var x17: u1 = undefined;
1807 addcarryxU64(&x16, &x17, x15, 0x0, (~(arg2[2])));
1805 addcarryxU64(&x16, &x17, x15, 0x0, (~arg2[2]));
18081806 var x18: u64 = undefined;
18091807 var x19: u1 = undefined;
1810 addcarryxU64(&x18, &x19, x17, 0x0, (~(arg2[3])));
1808 addcarryxU64(&x18, &x19, x17, 0x0, (~arg2[3]));
18111809 var x20: u64 = undefined;
18121810 var x21: u1 = undefined;
1813 addcarryxU64(&x20, &x21, x19, 0x0, (~(arg2[4])));
1811 addcarryxU64(&x20, &x21, x19, 0x0, (~arg2[4]));
18141812 var x22: u64 = undefined;
1815 cmovznzU64(&x22, x3, (arg3[0]), x12);
1813 const x22_selection_mask = selectionMaskU64(x3);
1814 x22 = arg3[0] ^ ((arg3[0] ^ x12) & x22_selection_mask);
18161815 var x23: u64 = undefined;
1817 cmovznzU64(&x23, x3, (arg3[1]), x14);
1816 x23 = arg3[1] ^ ((arg3[1] ^ x14) & x22_selection_mask);
18181817 var x24: u64 = undefined;
1819 cmovznzU64(&x24, x3, (arg3[2]), x16);
1818 x24 = arg3[2] ^ ((arg3[2] ^ x16) & x22_selection_mask);
18201819 var x25: u64 = undefined;
1821 cmovznzU64(&x25, x3, (arg3[3]), x18);
1820 x25 = arg3[3] ^ ((arg3[3] ^ x18) & x22_selection_mask);
18221821 var x26: u64 = undefined;
1823 cmovznzU64(&x26, x3, (arg3[4]), x20);
1822 x26 = arg3[4] ^ ((arg3[4] ^ x20) & x22_selection_mask);
18241823 var x27: u64 = undefined;
1825 cmovznzU64(&x27, x3, (arg4[0]), (arg5[0]));
1824 x27 = arg4[0] ^ ((arg4[0] ^ arg5[0]) & x22_selection_mask);
18261825 var x28: u64 = undefined;
1827 cmovznzU64(&x28, x3, (arg4[1]), (arg5[1]));
1826 x28 = arg4[1] ^ ((arg4[1] ^ arg5[1]) & x22_selection_mask);
18281827 var x29: u64 = undefined;
1829 cmovznzU64(&x29, x3, (arg4[2]), (arg5[2]));
1828 x29 = arg4[2] ^ ((arg4[2] ^ arg5[2]) & x22_selection_mask);
18301829 var x30: u64 = undefined;
1831 cmovznzU64(&x30, x3, (arg4[3]), (arg5[3]));
1830 x30 = arg4[3] ^ ((arg4[3] ^ arg5[3]) & x22_selection_mask);
18321831 var x31: u64 = undefined;
18331832 var x32: u1 = undefined;
18341833 addcarryxU64(&x31, &x32, 0x0, x27, x27);
......@@ -1855,11 +1854,11 @@ pub fn divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *[4]u64, out5: *[
18551854 subborrowxU64(&x45, &x46, x44, x37, 0xffffffffffffffff);
18561855 var x47: u64 = undefined;
18571856 var x48: u1 = undefined;
1858 subborrowxU64(&x47, &x48, x46, @as(u64, x38), 0x0);
1859 const x49 = (arg4[3]);
1860 const x50 = (arg4[2]);
1861 const x51 = (arg4[1]);
1862 const x52 = (arg4[0]);
1857 subborrowxU64(&x47, &x48, x46, x38, 0x0);
1858 const x49: u64 = arg4[3];
1859 const x50: u64 = arg4[2];
1860 const x51: u64 = arg4[1];
1861 const x52: u64 = arg4[0];
18631862 var x53: u64 = undefined;
18641863 var x54: u1 = undefined;
18651864 subborrowxU64(&x53, &x54, 0x0, 0x0, x52);
......@@ -1873,7 +1872,8 @@ pub fn divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *[4]u64, out5: *[
18731872 var x60: u1 = undefined;
18741873 subborrowxU64(&x59, &x60, x58, 0x0, x49);
18751874 var x61: u64 = undefined;
1876 cmovznzU64(&x61, x60, 0x0, 0xffffffffffffffff);
1875 const x61_selection_mask = selectionMaskU64(x60);
1876 x61 = 0x0 ^ ((0x0 ^ 0xffffffffffffffff) & x61_selection_mask);
18771877 var x62: u64 = undefined;
18781878 var x63: u1 = undefined;
18791879 addcarryxU64(&x62, &x63, 0x0, x53, (x61 & 0xbfd25e8cd0364141));
......@@ -1887,24 +1887,26 @@ pub fn divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *[4]u64, out5: *[
18871887 var x69: u1 = undefined;
18881888 addcarryxU64(&x68, &x69, x67, x59, x61);
18891889 var x70: u64 = undefined;
1890 cmovznzU64(&x70, x3, (arg5[0]), x62);
1890 const x70_selection_mask = selectionMaskU64(x3);
1891 x70 = arg5[0] ^ ((arg5[0] ^ x62) & x70_selection_mask);
18911892 var x71: u64 = undefined;
1892 cmovznzU64(&x71, x3, (arg5[1]), x64);
1893 x71 = arg5[1] ^ ((arg5[1] ^ x64) & x70_selection_mask);
18931894 var x72: u64 = undefined;
1894 cmovznzU64(&x72, x3, (arg5[2]), x66);
1895 x72 = arg5[2] ^ ((arg5[2] ^ x66) & x70_selection_mask);
18951896 var x73: u64 = undefined;
1896 cmovznzU64(&x73, x3, (arg5[3]), x68);
1897 const x74 = @as(u1, @truncate((x22 & 0x1)));
1897 x73 = arg5[3] ^ ((arg5[3] ^ x68) & x70_selection_mask);
1898 const x74: u1 = @truncate(x22);
18981899 var x75: u64 = undefined;
1899 cmovznzU64(&x75, x74, 0x0, x7);
1900 const x75_selection_mask = selectionMaskU64(x74);
1901 x75 = 0x0 ^ ((0x0 ^ x7) & x75_selection_mask);
19001902 var x76: u64 = undefined;
1901 cmovznzU64(&x76, x74, 0x0, x8);
1903 x76 = 0x0 ^ ((0x0 ^ x8) & x75_selection_mask);
19021904 var x77: u64 = undefined;
1903 cmovznzU64(&x77, x74, 0x0, x9);
1905 x77 = 0x0 ^ ((0x0 ^ x9) & x75_selection_mask);
19041906 var x78: u64 = undefined;
1905 cmovznzU64(&x78, x74, 0x0, x10);
1907 x78 = 0x0 ^ ((0x0 ^ x10) & x75_selection_mask);
19061908 var x79: u64 = undefined;
1907 cmovznzU64(&x79, x74, 0x0, x11);
1909 x79 = 0x0 ^ ((0x0 ^ x11) & x75_selection_mask);
19081910 var x80: u64 = undefined;
19091911 var x81: u1 = undefined;
19101912 addcarryxU64(&x80, &x81, 0x0, x22, x75);
......@@ -1921,13 +1923,14 @@ pub fn divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *[4]u64, out5: *[
19211923 var x89: u1 = undefined;
19221924 addcarryxU64(&x88, &x89, x87, x26, x79);
19231925 var x90: u64 = undefined;
1924 cmovznzU64(&x90, x74, 0x0, x27);
1926 const x90_selection_mask = selectionMaskU64(x74);
1927 x90 = 0x0 ^ ((0x0 ^ x27) & x90_selection_mask);
19251928 var x91: u64 = undefined;
1926 cmovznzU64(&x91, x74, 0x0, x28);
1929 x91 = 0x0 ^ ((0x0 ^ x28) & x90_selection_mask);
19271930 var x92: u64 = undefined;
1928 cmovznzU64(&x92, x74, 0x0, x29);
1931 x92 = 0x0 ^ ((0x0 ^ x29) & x90_selection_mask);
19291932 var x93: u64 = undefined;
1930 cmovznzU64(&x93, x74, 0x0, x30);
1933 x93 = 0x0 ^ ((0x0 ^ x30) & x90_selection_mask);
19311934 var x94: u64 = undefined;
19321935 var x95: u1 = undefined;
19331936 addcarryxU64(&x94, &x95, 0x0, x70, x90);
......@@ -1954,31 +1957,33 @@ pub fn divstep(out1: *u64, out2: *[5]u64, out3: *[5]u64, out4: *[4]u64, out5: *[
19541957 subborrowxU64(&x108, &x109, x107, x100, 0xffffffffffffffff);
19551958 var x110: u64 = undefined;
19561959 var x111: u1 = undefined;
1957 subborrowxU64(&x110, &x111, x109, @as(u64, x101), 0x0);
1960 subborrowxU64(&x110, &x111, x109, x101, 0x0);
19581961 var x112: u64 = undefined;
19591962 var x113: u1 = undefined;
19601963 addcarryxU64(&x112, &x113, 0x0, x6, 0x1);
1961 const x114 = ((x80 >> 1) | ((x82 << 63) & 0xffffffffffffffff));
1962 const x115 = ((x82 >> 1) | ((x84 << 63) & 0xffffffffffffffff));
1963 const x116 = ((x84 >> 1) | ((x86 << 63) & 0xffffffffffffffff));
1964 const x117 = ((x86 >> 1) | ((x88 << 63) & 0xffffffffffffffff));
1965 const x118 = ((x88 & 0x8000000000000000) | (x88 >> 1));
1964 const x114: u64 = ((x80 >> 1) | ((x82 << 63) & 0xffffffffffffffff));
1965 const x115: u64 = ((x82 >> 1) | ((x84 << 63) & 0xffffffffffffffff));
1966 const x116: u64 = ((x84 >> 1) | ((x86 << 63) & 0xffffffffffffffff));
1967 const x117: u64 = ((x86 >> 1) | ((x88 << 63) & 0xffffffffffffffff));
1968 const x118: u64 = ((x88 & 0x8000000000000000) | (x88 >> 1));
19661969 var x119: u64 = undefined;
1967 cmovznzU64(&x119, x48, x39, x31);
1970 const x119_selection_mask = selectionMaskU64(x48);
1971 x119 = x39 ^ ((x39 ^ x31) & x119_selection_mask);
19681972 var x120: u64 = undefined;
1969 cmovznzU64(&x120, x48, x41, x33);
1973 x120 = x41 ^ ((x41 ^ x33) & x119_selection_mask);
19701974 var x121: u64 = undefined;
1971 cmovznzU64(&x121, x48, x43, x35);
1975 x121 = x43 ^ ((x43 ^ x35) & x119_selection_mask);
19721976 var x122: u64 = undefined;
1973 cmovznzU64(&x122, x48, x45, x37);
1977 x122 = x45 ^ ((x45 ^ x37) & x119_selection_mask);
19741978 var x123: u64 = undefined;
1975 cmovznzU64(&x123, x111, x102, x94);
1979 const x123_selection_mask = selectionMaskU64(x111);
1980 x123 = x102 ^ ((x102 ^ x94) & x123_selection_mask);
19761981 var x124: u64 = undefined;
1977 cmovznzU64(&x124, x111, x104, x96);
1982 x124 = x104 ^ ((x104 ^ x96) & x123_selection_mask);
19781983 var x125: u64 = undefined;
1979 cmovznzU64(&x125, x111, x106, x98);
1984 x125 = x106 ^ ((x106 ^ x98) & x123_selection_mask);
19801985 var x126: u64 = undefined;
1981 cmovznzU64(&x126, x111, x108, x100);
1986 x126 = x108 ^ ((x108 ^ x100) & x123_selection_mask);
19821987 out1.* = x112;
19831988 out2[0] = x7;
19841989 out2[1] = x8;