From 1bfdb35e1ee8d3caa3482ed1fed77dc47c2b6f62 Mon Sep 17 00:00:00 2001 From: Gabriel Barreto Date: Thu, 13 Aug 2026 12:47:27 -0300 Subject: [PATCH 1/7] aiur: derive rotation chain tail outputs --- Ix/Aiur/Compiler/Layout.lean | 10 +++++- crates/aiur/src/constraints.rs | 64 +++++++++++++++++++++++++--------- crates/aiur/src/synthesis.rs | 51 +++++++++++++++++++++++++++ crates/aiur/src/trace.rs | 14 ++++---- 4 files changed, 114 insertions(+), 25 deletions(-) diff --git a/Ix/Aiur/Compiler/Layout.lean b/Ix/Aiur/Compiler/Layout.lean index c99e0575..86b0daa4 100644 --- a/Ix/Aiur/Compiler/Layout.lean +++ b/Ix/Aiur/Compiler/Layout.lean @@ -198,7 +198,15 @@ def opLayout : Bytecode.Op → LayoutM Unit pushDegree ((aDegree.max bDegree).max 1) bumpAuxiliaries; bumpLookups | .u8Mul .. => do pushDegrees #[1, 1]; bumpAuxiliaries 2; bumpLookups - | .u8ChainRotr7 .. | .u8ChainRotr4 .. => do pushDegrees #[1, 1, 1]; bumpAuxiliaries 3; bumpLookups + | .u8ChainRotr7 a b | .u8ChainRotr4 a b => do + let aDegree ← getDegree a + let bDegree ← getDegree b + -- The lookup witnesses the rotated byte and the high part of `b`. The + -- shifted-low part of `a` is a linear expression of those values and the + -- inputs, so the third logical output needs no column. + pushDegrees #[1, 1, (aDegree.max bDegree).max 1] + bumpAuxiliaries 2 + bumpLookups | .u8LessThan .. => do pushDegree 1; bumpAuxiliaries; bumpLookups | .u32LessThan .. => do pushDegree 1; bumpAuxiliaries 12; bumpLookups 6 | .unconstrainedU32Add a b => do diff --git a/crates/aiur/src/constraints.rs b/crates/aiur/src/constraints.rs index 17e7d623..6d711eee 100644 --- a/crates/aiur/src/constraints.rs +++ b/crates/aiur/src/constraints.rs @@ -640,22 +640,54 @@ impl Op { sel.clone(), state, ), - Op::U8ChainRotr7(i, j) => bytes2_constraints( - *i, - *j, - &Bytes2Op::ChainRotr7, - u8_chain_rotr7_channel(), - sel.clone(), - state, - ), - Op::U8ChainRotr4(i, j) => bytes2_constraints( - *i, - *j, - &Bytes2Op::ChainRotr4, - u8_chain_rotr4_channel(), - sel.clone(), - state, - ), + Op::U8ChainRotr7(i, j) => { + let (a, a_deg) = state.map[*i].clone(); + let (b, b_deg) = state.map[*j].clone(); + let rotated = state.next_auxiliary(); + let b_high = state.next_auxiliary(); + let a_high = rotated.clone() - konst(G::from_u64(2)) * b.clone() + + konst(G::from_u64(256)) * b_high.clone(); + let a_shifted = + konst(G::from_u64(2)) * a.clone() - konst(G::from_u64(256)) * a_high; + let lookup_args = vec![ + state.gate(sel, konst(u8_chain_rotr7_channel())), + state.gate(sel, a), + state.gate(sel, b), + state.gate(sel, rotated.clone()), + state.gate(sel, b_high.clone()), + state.gate(sel, a_shifted.clone()), + ]; + let lookup = state.next_lookup(); + combine_lookup_args(lookup, lookup_args); + lookup.multiplicity = lookup.multiplicity.clone() + sel.clone(); + state.map.push((rotated, 1)); + state.map.push((b_high, 1)); + state.map.push((a_shifted, a_deg.max(b_deg).max(1))); + }, + Op::U8ChainRotr4(i, j) => { + let (a, a_deg) = state.map[*i].clone(); + let (b, b_deg) = state.map[*j].clone(); + let rotated = state.next_auxiliary(); + let b_high = state.next_auxiliary(); + let b_low = b.clone() - konst(G::from_u64(16)) * b_high.clone(); + let a_high = rotated.clone() - konst(G::from_u64(16)) * b_low; + let a_shifted = + konst(G::from_u64(16)) * a.clone() - konst(G::from_u64(256)) * a_high; + let lookup_args = vec![ + state.gate(sel, konst(u8_chain_rotr4_channel())), + state.gate(sel, a), + state.gate(sel, b), + state.gate(sel, rotated.clone()), + state.gate(sel, b_high.clone()), + state.gate(sel, a_shifted.clone()), + ]; + let lookup = state.next_lookup(); + combine_lookup_args(lookup, lookup_args); + lookup.multiplicity = lookup.multiplicity.clone() + sel.clone(); + state.map.push((rotated, 1)); + state.map.push((b_high, 1)); + state.map.push((a_shifted, a_deg.max(b_deg).max(1))); + }, Op::U8RangeCheck(i, j) => { // Pure range-check lookup: no output columns (the `u8` results alias // the inputs), just require `(i, j)` from the byte chip. diff --git a/crates/aiur/src/synthesis.rs b/crates/aiur/src/synthesis.rs index d0d51f66..faf9b9a6 100644 --- a/crates/aiur/src/synthesis.rs +++ b/crates/aiur/src/synthesis.rs @@ -401,6 +401,57 @@ mod tests { Toplevel { functions: vec![function], memory_sizes: vec![] } } + fn rotation_chains_toplevel() -> Toplevel { + let body = Block { + ops: vec![Op::U8ChainRotr7(0, 1), Op::U8ChainRotr4(0, 1)], + ctrl: Ctrl::Return(0, vec![2, 3, 4, 5, 6, 7]), + }; + let function = Function { + body, + layout: FunctionLayout { + input_size: 2, + selectors: 1, + // Multiplicity plus two columns for each rotation-chain operation. + auxiliaries: 5, + // Return plus one byte-table lookup per operation. + lookups: 3, + }, + entry: true, + constrained: true, + }; + Toplevel { functions: vec![function], memory_sizes: vec![] } + } + + #[test] + fn prove_verify_virtual_rotation_chain_outputs() { + let (cp, fp) = test_parameters(); + let system = AiurSystem::build(rotation_chains_toplevel(), cp, fp); + let input = [G::from_u8(0xd3), G::from_u8(0x69)]; + let mut io_buffer = empty_io_buffer(); + + let (claim, proof) = system.prove(0, &input, &mut io_buffer); + let (r7_0, r7_1, r7_2) = Bytes2::chain_rotr7(&input[0], &input[1]); + let (r4_0, r4_1, r4_2) = Bytes2::chain_rotr4(&input[0], &input[1]); + assert_eq!( + claim, + vec![ + function_channel(), + G::ZERO, + input[0], + input[1], + r7_0, + r7_1, + r7_2, + r4_0, + r4_1, + r4_2, + ] + ); + system + .verify(&claim, &proof) + .expect("virtual rotation outputs must verify"); + } + /// Hand-build a toplevel exercising the two migrated integration paths that /// the `Mul` test does not: the cross-circuit **function-channel** lookup (a /// function calling another) and the **memory circuit** (a `Store` followed diff --git a/crates/aiur/src/trace.rs b/crates/aiur/src/trace.rs index 4215c6b7..252d6519 100644 --- a/crates/aiur/src/trace.rs +++ b/crates/aiur/src/trace.rs @@ -539,15 +539,14 @@ impl Op { ); }, Op::U8ChainRotr7(i, j) => { - let (i, _) = map[*i]; - let (j, _) = map[*j]; + let (i, i_degree) = map[*i]; + let (j, j_degree) = map[*j]; let (o0, o1, o2) = Bytes2::chain_rotr7(&i, &j); map.push((o0, 1)); map.push((o1, 1)); - map.push((o2, 1)); + map.push((o2, i_degree.max(j_degree).max(1))); slice.push_auxiliary(index, o0); slice.push_auxiliary(index, o1); - slice.push_auxiliary(index, o2); slice.push_lookup( index, G::ONE, @@ -555,15 +554,14 @@ impl Op { ); }, Op::U8ChainRotr4(i, j) => { - let (i, _) = map[*i]; - let (j, _) = map[*j]; + let (i, i_degree) = map[*i]; + let (j, j_degree) = map[*j]; let (o0, o1, o2) = Bytes2::chain_rotr4(&i, &j); map.push((o0, 1)); map.push((o1, 1)); - map.push((o2, 1)); + map.push((o2, i_degree.max(j_degree).max(1))); slice.push_auxiliary(index, o0); slice.push_auxiliary(index, o1); - slice.push_auxiliary(index, o2); slice.push_lookup( index, G::ONE, From 7b72efcfa0ffa16b129db2c3582a2f5642376b22 Mon Sep 17 00:00:00 2001 From: Gabriel Barreto Date: Thu, 13 Aug 2026 15:59:11 +0000 Subject: [PATCH 2/7] tests: re-pin FFT costs for derived rotation chain outputs --- Tests/Ix/IxVM.lean | 142 ++++++++++++++++++++++----------------------- Tests/Main.lean | 4 +- 2 files changed, 73 insertions(+), 73 deletions(-) diff --git a/Tests/Ix/IxVM.lean b/Tests/Ix/IxVM.lean index 0be0c3da..bc8bc399 100644 --- a/Tests/Ix/IxVM.lean +++ b/Tests/Ix/IxVM.lean @@ -276,77 +276,77 @@ private def nameOfString (str : String) : Lean.Name := listed constant fails the suite, so a regression cannot land quietly and an improvement has to be acknowledged by re-pinning. -/ private def kernelCheckEntries : List (String × Nat) := [ - ("HEq", 129_268_868), - ("HEq.rec", 132_311_766), - ("Eq.rec", 131_884_567), - ("Nat", 129_265_998), - ("Nat.add", 160_329_631), - ("Nat.add_comm", 271_372_066), - ("Nat.decEq", 318_056_967), - ("Nat.decLe", 662_807_105), - ("Nat.sub_le_of_le_add", 1_604_987_392), - ("Nat.shiftRight_succ", 1_193_010_958), - ("Trans.mk", 134_133_917), - ("Array.append_assoc", 7_834_569_889), - ("Vector.append", 8_016_813_877), - ("IxVMPrim.nat_add_lit", 194_681_558), - ("IxVMPrim.nat_sub_lit", 208_473_553), - ("IxVMPrim.nat_mul_lit", 187_243_429), - ("IxVMPrim.nat_mul_big", 185_932_817), - ("IxVMPrim.nat_div_lit", 1_165_198_577), - ("IxVMPrim.nat_mod_lit", 1_187_060_345), - ("IxVMPrim.nat_succ_lit", 141_290_796), - ("IxVMPrim.nat_pred_lit", 159_002_028), - ("IxVMPrim.nat_gcd_lit", 1_852_665_764), - ("IxVMPrim.nat_land_lit", 3_003_392_662), - ("IxVMPrim.nat_lor_lit", 3_005_334_518), - ("IxVMPrim.nat_xor_lit", 3_021_549_569), - ("IxVMPrim.nat_shl_lit", 210_585_307), - ("IxVMPrim.nat_shr_lit", 1_177_500_954), - ("IxVMPrim.nat_pow_big", 365_213_457), - ("IxVMPrim.nat_beq_lit", 185_905_834), - ("IxVMPrim.nat_ble_lit", 181_446_034), - ("IxVMPrim.nat_cases_big", 158_842_151), - ("IxVMPrim.nat_dec_le", 678_377_424), - ("IxVMPrim.nat_dec_lt", 687_845_585), - ("IxVMPrim.nat_dec_eq", 351_182_963), - ("IxVMPrim.str_size_lit", 2_111_825_181), - ("IxVMPrim.bv_to_nat_lit", 1_761_925_409), - ("IxVMInd.Even", 189_394_590), - ("IxVMInd.Odd", 189_397_206), - ("IxVMInd.Even.rec", 204_445_350), - ("IxVMInd.Odd.rec", 204_446_273), - ("IxVMInd.Tree", 130_469_572), - ("IxVMInd.Tree.rec", 138_242_950), - ("IxVMInd.DedupM", 133_131_547), - ("IxVMInd.DedupM.rec", 143_618_119), - ("IxVMInd.DepthM", 131_864_883), - ("IxVMInd.DepthM.rec", 140_672_986), - ("String.Internal.append", 2_088_023_789), - ("_private.Init.Prelude.0.Lean.extractMainModule._unsafe_rec", 3_086_269_801), - ("Lean.Syntax.rec", 2_134_233_690), - ("IxVMInd.AuxTie", 284_996_253), - ("IxVMInd.AuxTie.rec", 318_289_948), - ("IxVMInd.HiddenIdx", 129_759_506), - ("IxVMInd.HiddenIdx.rec", 131_949_670), - ("IxVMInd.thmMajorUse", 447_189_655), - ("IxVMInd.partialKRec", 146_687_344), - ("IxVMInd.deepRebase", 197_060_949), - ("String.Slice.Pattern.Model.NoPrefixForwardPatternModel.rec", 2_935_390_112), - ("Lean.Widget.TaggedText.rec", 2_109_457_304), - ("Lean.Doc.Part.rec", 2_145_105_862), - ("Lean.Doc.Block.rec", 2_284_572_937), - ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedup1.A", 131_541_971), - ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedup1.A.rec", 134_049_513), - ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedup1.A.rec_1", 133_391_107), - ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedup1.A.rec_2", 133_391_107), - ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedup2.A.rec_1", 133_391_107), - ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedupMixed.M", 131_740_293), - ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedupMixed.M.rec", 140_514_213), - ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedupMixed.M.rec_1", 140_513_426), - ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedupMixed.M.rec_2", 133_391_107), - ("strOfListFoldSize", 2_358_302_860), - ("strOfListFoldSizeAscii", 2_359_004_205), + ("HEq", 129_254_110), + ("HEq.rec", 132_267_746), + ("Eq.rec", 131_840_548), + ("Nat", 129_251_240), + ("Nat.add", 159_976_139), + ("Nat.add_comm", 269_826_741), + ("Nat.decEq", 316_306_475), + ("Nat.decLe", 657_633_621), + ("Nat.sub_le_of_le_add", 1_591_047_245), + ("Nat.shiftRight_succ", 1_182_784_613), + ("Trans.mk", 134_089_898), + ("Array.append_assoc", 7_776_192_966), + ("Vector.append", 7_956_366_628), + ("IxVMPrim.nat_add_lit", 193_863_574), + ("IxVMPrim.nat_sub_lit", 207_451_548), + ("IxVMPrim.nat_mul_lit", 186_496_116), + ("IxVMPrim.nat_mul_big", 185_208_889), + ("IxVMPrim.nat_div_lit", 1_155_188_110), + ("IxVMPrim.nat_mod_lit", 1_176_787_685), + ("IxVMPrim.nat_succ_lit", 141_092_091), + ("IxVMPrim.nat_pred_lit", 158_550_857), + ("IxVMPrim.nat_gcd_lit", 1_835_986_549), + ("IxVMPrim.nat_land_lit", 2_974_562_959), + ("IxVMPrim.nat_lor_lit", 2_976_470_928), + ("IxVMPrim.nat_xor_lit", 2_992_414_760), + ("IxVMPrim.nat_shl_lit", 209_514_562), + ("IxVMPrim.nat_shr_lit", 1_167_290_043), + ("IxVMPrim.nat_pow_big", 363_604_322), + ("IxVMPrim.nat_beq_lit", 185_193_565), + ("IxVMPrim.nat_ble_lit", 180_791_713), + ("IxVMPrim.nat_cases_big", 158_412_942), + ("IxVMPrim.nat_dec_le", 673_001_206), + ("IxVMPrim.nat_dec_lt", 682_338_635), + ("IxVMPrim.nat_dec_eq", 349_014_369), + ("IxVMPrim.str_size_lit", 2_091_299_048), + ("IxVMPrim.bv_to_nat_lit", 1_745_906_931), + ("IxVMInd.Even", 188_612_036), + ("IxVMInd.Odd", 188_614_652), + ("IxVMInd.Even.rec", 203_495_950), + ("IxVMInd.Odd.rec", 203_496_873), + ("IxVMInd.Tree", 130_440_848), + ("IxVMInd.Tree.rec", 138_120_963), + ("IxVMInd.DedupM", 133_054_340), + ("IxVMInd.DedupM.rec", 143_419_414), + ("IxVMInd.DepthM", 131_812_849), + ("IxVMInd.DepthM.rec", 140_522_850), + ("String.Internal.append", 2_067_826_357), + ("_private.Init.Prelude.0.Lean.extractMainModule._unsafe_rec", 3_055_690_533), + ("Lean.Syntax.rec", 2_113_411_326), + ("IxVMInd.AuxTie", 282_761_489), + ("IxVMInd.AuxTie.rec", 315_653_923), + ("IxVMInd.HiddenIdx", 129_737_969), + ("IxVMInd.HiddenIdx.rec", 131_905_650), + ("IxVMInd.thmMajorUse", 444_104_687), + ("IxVMInd.partialKRec", 146_448_547), + ("IxVMInd.deepRebase", 196_219_244), + ("String.Slice.Pattern.Model.NoPrefixForwardPatternModel.rec", 2_907_963_643), + ("Lean.Widget.TaggedText.rec", 2_089_079_145), + ("Lean.Doc.Part.rec", 2_124_332_896), + ("Lean.Doc.Block.rec", 2_262_528_860), + ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedup1.A", 131_489_937), + ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedup1.A.rec", 133_963_600), + ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedup1.A.rec_1", 133_330_856), + ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedup1.A.rec_2", 133_330_856), + ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedup2.A.rec_1", 133_330_856), + ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedupMixed.M", 131_688_259), + ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedupMixed.M.rec", 140_354_517), + ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedupMixed.M.rec_1", 140_353_730), + ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedupMixed.M.rec_2", 133_330_856), + ("strOfListFoldSize", 2_334_681_616), + ("strOfListFoldSizeAscii", 2_335_366_310), ] /-- Variant of `kernelChecks`, pinned to the baseline diff --git a/Tests/Main.lean b/Tests/Main.lean index 514110c7..e2f2dd6c 100644 --- a/Tests/Main.lean +++ b/Tests/Main.lean @@ -223,8 +223,8 @@ def ignoredRunners (env : Lean.Environment) : List (String × IO UInt32) := [ let actual := (Aiur.computeStats v2Env.compiled qc v2Env.shapes).totalFftCost.round.toUInt64.toNat pure (LSpec.test - s!"Shard pipeline FFT matches: expected 6240934073, got {actual}" - (actual = 6_240_934_073)) + s!"Shard pipeline FFT matches: expected 6160062690, got {actual}" + (actual = 6_160_062_690)) LSpec.lspecIO (.ofList [("ixvm", [fullSeq, aiurSeq, arenaSeq, exploitSeq, paritySeq, shardSeq])]) []), From 9a62f9733fedd942c03ca67456a1620c72c7a201 Mon Sep 17 00:00:00 2001 From: Gabriel Barreto Date: Thu, 13 Aug 2026 17:21:56 -0300 Subject: [PATCH 3/7] aiur: fuse xor with split rotations --- Ix/Aiur/Compiler/Check.lean | 8 +++ Ix/Aiur/Compiler/Concretize.lean | 10 +++- Ix/Aiur/Compiler/Layout.lean | 1 + Ix/Aiur/Compiler/Lower.lean | 2 + Ix/Aiur/Compiler/Match.lean | 2 + Ix/Aiur/Compiler/Simple.lean | 2 + Ix/Aiur/Interpret.lean | 8 +++ Ix/Aiur/Meta.lean | 12 ++++ Ix/Aiur/Semantics/BytecodeEval.lean | 6 ++ Ix/Aiur/Semantics/SourceEval.lean | 6 ++ Ix/Aiur/Stages/Bytecode.lean | 2 + Ix/Aiur/Stages/Codegen.lean | 5 ++ Ix/Aiur/Stages/Concrete.lean | 6 +- Ix/Aiur/Stages/Simple.lean | 6 +- Ix/Aiur/Stages/Source.lean | 14 ++++- Ix/Aiur/Stages/Typed.lean | 6 +- Ix/IxVM/Blake3.lean | 4 +- Ix/IxVM/ByteStream.lean | 53 +++++++++-------- crates/aiur/src/bytecode.rs | 2 + crates/aiur/src/constraints.rs | 17 ++++++ crates/aiur/src/execute.rs | 22 +++++++ crates/aiur/src/gadgets/bytes2.rs | 91 ++++++++++++++++++++++++++--- crates/aiur/src/lib.rs | 8 +++ crates/aiur/src/synthesis.rs | 21 +++++-- crates/aiur/src/trace.rs | 27 +++++++++ crates/ffi/src/aiur/toplevel.rs | 8 +++ 26 files changed, 302 insertions(+), 47 deletions(-) diff --git a/Ix/Aiur/Compiler/Check.lean b/Ix/Aiur/Compiler/Check.lean index 8051b752..ee3cd16d 100644 --- a/Ix/Aiur/Compiler/Check.lean +++ b/Ix/Aiur/Compiler/Check.lean @@ -761,6 +761,12 @@ def inferTerm (t : Term) : CheckM Typed.Term := match t with let a' ← checkNoEscape a .u8 let b' ← checkNoEscape b .u8 pure (Typed.Term.u8Xor .u8 false a' b') + | .u8XorSplit7 a b => do + let a' ← checkNoEscape a .u8; let b' ← checkNoEscape b .u8 + pure (Typed.Term.u8XorSplit7 (.tuple #[.u8, .u8]) false a' b') + | .u8XorSplit4 a b => do + let a' ← checkNoEscape a .u8; let b' ← checkNoEscape b .u8 + pure (Typed.Term.u8XorSplit4 (.tuple #[.u8, .u8]) false a' b') | .u8And a b => do let a' ← checkNoEscape a .u8 let b' ← checkNoEscape b .u8 @@ -1005,6 +1011,8 @@ def zonkTypedTerm (t : Typed.Term) : CheckM Typed.Term := match t with | .u8ShiftLeft τ e a => do pure (.u8ShiftLeft (← zonkTyp τ) e (← zonkTypedTerm a)) | .u8ShiftRight τ e a => do pure (.u8ShiftRight (← zonkTyp τ) e (← zonkTypedTerm a)) | .u8Xor τ e a b => do pure (.u8Xor (← zonkTyp τ) e (← zonkTypedTerm a) (← zonkTypedTerm b)) + | .u8XorSplit7 τ e a b => do pure (.u8XorSplit7 (← zonkTyp τ) e (← zonkTypedTerm a) (← zonkTypedTerm b)) + | .u8XorSplit4 τ e a b => do pure (.u8XorSplit4 (← zonkTyp τ) e (← zonkTypedTerm a) (← zonkTypedTerm b)) | .u8Add τ e a b => do pure (.u8Add (← zonkTyp τ) e (← zonkTypedTerm a) (← zonkTypedTerm b)) | .u8Mul τ e a b => do pure (.u8Mul (← zonkTyp τ) e (← zonkTypedTerm a) (← zonkTypedTerm b)) | .u8ChainRotr7 τ e a b => do pure (.u8ChainRotr7 (← zonkTyp τ) e (← zonkTypedTerm a) (← zonkTypedTerm b)) diff --git a/Ix/Aiur/Compiler/Concretize.lean b/Ix/Aiur/Compiler/Concretize.lean index 2307f880..3540a93a 100644 --- a/Ix/Aiur/Compiler/Concretize.lean +++ b/Ix/Aiur/Compiler/Concretize.lean @@ -334,6 +334,8 @@ def termToConcrete | .u8Xor τ e a b => do pure (.u8Xor (← typToConcrete mono τ) e (← termToConcrete mono a) (← termToConcrete mono b)) + | .u8XorSplit7 τ e a b => do pure (.u8XorSplit7 (← typToConcrete mono τ) e (← termToConcrete mono a) (← termToConcrete mono b)) + | .u8XorSplit4 τ e a b => do pure (.u8XorSplit4 (← typToConcrete mono τ) e (← termToConcrete mono a) (← termToConcrete mono b)) | .u8Add τ e a b => do pure (.u8Add (← typToConcrete mono τ) e (← termToConcrete mono a) (← termToConcrete mono b)) @@ -566,6 +568,8 @@ def rewriteTypedTerm (decls : Typed.Decls) .u8ShiftRight (rewriteTyp subst mono τ) e (rewriteTypedTerm decls subst mono a) | .u8Xor τ e a b => .u8Xor (rewriteTyp subst mono τ) e (rewriteTypedTerm decls subst mono a) (rewriteTypedTerm decls subst mono b) + | .u8XorSplit7 τ e a b => .u8XorSplit7 (rewriteTyp subst mono τ) e (rewriteTypedTerm decls subst mono a) (rewriteTypedTerm decls subst mono b) + | .u8XorSplit4 τ e a b => .u8XorSplit4 (rewriteTyp subst mono τ) e (rewriteTypedTerm decls subst mono a) (rewriteTypedTerm decls subst mono b) | .u8Add τ e a b => .u8Add (rewriteTyp subst mono τ) e (rewriteTypedTerm decls subst mono a) (rewriteTypedTerm decls subst mono b) | .u8Mul τ e a b => .u8Mul (rewriteTyp subst mono τ) e @@ -669,7 +673,7 @@ def collectInTypedTerm (seen : Std.HashSet (Global × Array Typ)) : let seen := tArgs.foldl collectInTyp seen args.attach.foldl (fun s ⟨a, _⟩ => collectInTypedTerm s a) seen | .add τ _ a b | .sub τ _ a b | .mul τ _ a b - | .u8Xor τ _ a b | .u8Add τ _ a b | .u8Mul τ _ a b | .u8Sub τ _ a b + | .u8Xor τ _ a b | .u8XorSplit7 τ _ a b | .u8XorSplit4 τ _ a b | .u8Add τ _ a b | .u8Mul τ _ a b | .u8Sub τ _ a b | .u8ChainRotr7 τ _ a b | .u8ChainRotr4 τ _ a b | .u8RangeCheck τ _ a b | .unconstrainedBigUintDivMod τ _ a b | .u8And τ _ a b | .u8Or τ _ a b @@ -744,7 +748,7 @@ def collectCalls (decls : Typed.Decls) let seen := collectCalls decls seen scrut bs.attach.foldl (fun s ⟨(_, b), _⟩ => collectCalls decls s b) seen | .add _ _ a b | .sub _ _ a b | .mul _ _ a b - | .u8Xor _ _ a b | .u8Add _ _ a b | .u8Mul _ _ a b | .u8Sub _ _ a b + | .u8Xor _ _ a b | .u8XorSplit7 _ _ a b | .u8XorSplit4 _ _ a b | .u8Add _ _ a b | .u8Mul _ _ a b | .u8Sub _ _ a b | .u8ChainRotr7 _ _ a b | .u8ChainRotr4 _ _ a b | .u8RangeCheck _ _ a b | .unconstrainedBigUintDivMod _ _ a b | .u8And _ _ a b | .u8Or _ _ a b @@ -849,6 +853,8 @@ def substInTypedTerm (subst : Global → Option Typ) : Typed.Term → Typed.Term .u8ShiftRight (Typ.instantiate subst τ) e (substInTypedTerm subst a) | .u8Xor τ e a b => .u8Xor (Typ.instantiate subst τ) e (substInTypedTerm subst a) (substInTypedTerm subst b) + | .u8XorSplit7 τ e a b => .u8XorSplit7 (Typ.instantiate subst τ) e (substInTypedTerm subst a) (substInTypedTerm subst b) + | .u8XorSplit4 τ e a b => .u8XorSplit4 (Typ.instantiate subst τ) e (substInTypedTerm subst a) (substInTypedTerm subst b) | .u8Add τ e a b => .u8Add (Typ.instantiate subst τ) e (substInTypedTerm subst a) (substInTypedTerm subst b) | .u8Mul τ e a b => .u8Mul (Typ.instantiate subst τ) e diff --git a/Ix/Aiur/Compiler/Layout.lean b/Ix/Aiur/Compiler/Layout.lean index 86b0daa4..c5e233a6 100644 --- a/Ix/Aiur/Compiler/Layout.lean +++ b/Ix/Aiur/Compiler/Layout.lean @@ -198,6 +198,7 @@ def opLayout : Bytecode.Op → LayoutM Unit pushDegree ((aDegree.max bDegree).max 1) bumpAuxiliaries; bumpLookups | .u8Mul .. => do pushDegrees #[1, 1]; bumpAuxiliaries 2; bumpLookups + | .u8XorSplit7 .. | .u8XorSplit4 .. => do pushDegrees #[1, 1]; bumpAuxiliaries 2; bumpLookups | .u8ChainRotr7 a b | .u8ChainRotr4 a b => do let aDegree ← getDegree a let bDegree ← getDegree b diff --git a/Ix/Aiur/Compiler/Lower.lean b/Ix/Aiur/Compiler/Lower.lean index 5ce4098e..0a763ac0 100644 --- a/Ix/Aiur/Compiler/Lower.lean +++ b/Ix/Aiur/Compiler/Lower.lean @@ -300,6 +300,8 @@ def toIndex | .u8Xor _ _ i j => do let i ← expectIdx layoutMap bindings i; let j ← expectIdx layoutMap bindings j pushOp (.u8Xor i j) + | .u8XorSplit7 _ _ i j => do let i ← expectIdx layoutMap bindings i; let j ← expectIdx layoutMap bindings j; pushOp (.u8XorSplit7 i j) 2 + | .u8XorSplit4 _ _ i j => do let i ← expectIdx layoutMap bindings i; let j ← expectIdx layoutMap bindings j; pushOp (.u8XorSplit4 i j) 2 | .u8Add _ _ i j => do let i ← expectIdx layoutMap bindings i; let j ← expectIdx layoutMap bindings j pushOp (.u8Add i j) 2 diff --git a/Ix/Aiur/Compiler/Match.lean b/Ix/Aiur/Compiler/Match.lean index e7ed1864..b9b07113 100644 --- a/Ix/Aiur/Compiler/Match.lean +++ b/Ix/Aiur/Compiler/Match.lean @@ -381,6 +381,8 @@ def typedToSimple : Term → Simple.Term | .u8ShiftLeft τ e a => .u8ShiftLeft τ e (typedToSimple a) | .u8ShiftRight τ e a => .u8ShiftRight τ e (typedToSimple a) | .u8Xor τ e a b => .u8Xor τ e (typedToSimple a) (typedToSimple b) + | .u8XorSplit7 τ e a b => .u8XorSplit7 τ e (typedToSimple a) (typedToSimple b) + | .u8XorSplit4 τ e a b => .u8XorSplit4 τ e (typedToSimple a) (typedToSimple b) | .u8Add τ e a b => .u8Add τ e (typedToSimple a) (typedToSimple b) | .u8Mul τ e a b => .u8Mul τ e (typedToSimple a) (typedToSimple b) | .u8ChainRotr7 τ e a b => .u8ChainRotr7 τ e (typedToSimple a) (typedToSimple b) diff --git a/Ix/Aiur/Compiler/Simple.lean b/Ix/Aiur/Compiler/Simple.lean index 327f44bb..7f90bd6a 100644 --- a/Ix/Aiur/Compiler/Simple.lean +++ b/Ix/Aiur/Compiler/Simple.lean @@ -124,6 +124,8 @@ def simplifyTypedTerm (decls : Source.Decls) : Term → Except CheckError Term let a' ← simplifyTypedTerm decls a let b' ← simplifyTypedTerm decls b pure (.u8LessThan τ e a' b') + | .u8XorSplit7 τ e a b => do pure (.u8XorSplit7 τ e (← simplifyTypedTerm decls a) (← simplifyTypedTerm decls b)) + | .u8XorSplit4 τ e a b => do pure (.u8XorSplit4 τ e (← simplifyTypedTerm decls a) (← simplifyTypedTerm decls b)) | .u32LessThan τ e a b => do let a' ← simplifyTypedTerm decls a let b' ← simplifyTypedTerm decls b diff --git a/Ix/Aiur/Interpret.lean b/Ix/Aiur/Interpret.lean index 4973375e..64c42355 100644 --- a/Ix/Aiur/Interpret.lean +++ b/Ix/Aiur/Interpret.lean @@ -411,6 +411,14 @@ partial def interp (decls : Decls) (bindings : Bindings) : Term → InterpM Valu match (← interp decls bindings t1), (← interp decls bindings t2) with | .field a, .field b => return .field (G.ofUInt8 (a.val.toUInt8 ^^^ b.val.toUInt8)) | _, _ => throwErr "u8Xor: expected field values" + | .u8XorSplit7 t1 t2 => do + match (← interp decls bindings t1), (← interp decls bindings t2) with + | .field a, .field b => let x := a.val.toUInt8 ^^^ b.val.toUInt8; return .tuple #[.field (G.ofUInt8 (x >>> 7)), .field (G.ofUInt8 (x <<< 1))] + | _, _ => throwErr "u8XorSplit7: expected field values" + | .u8XorSplit4 t1 t2 => do + match (← interp decls bindings t1), (← interp decls bindings t2) with + | .field a, .field b => let x := a.val.toUInt8 ^^^ b.val.toUInt8; return .tuple #[.field (G.ofUInt8 (x >>> 4)), .field (G.ofUInt8 (x <<< 4))] + | _, _ => throwErr "u8XorSplit4: expected field values" | .u8Add t1 t2 => do match (← interp decls bindings t1), (← interp decls bindings t2) with | .field a, .field b => diff --git a/Ix/Aiur/Meta.lean b/Ix/Aiur/Meta.lean index a21cf364..3b7eb0d2 100644 --- a/Ix/Aiur/Meta.lean +++ b/Ix/Aiur/Meta.lean @@ -194,6 +194,8 @@ syntax "u8_bit_decomposition" "(" aiur_trm ")" : a syntax "u8_shift_left" "(" aiur_trm ")" : aiur_trm syntax "u8_shift_right" "(" aiur_trm ")" : aiur_trm syntax "u8_xor" "(" aiur_trm ", " aiur_trm ")" : aiur_trm +syntax "u8_xor_split7" "(" aiur_trm ", " aiur_trm ")" : aiur_trm +syntax "u8_xor_split4" "(" aiur_trm ", " aiur_trm ")" : aiur_trm syntax "u8_add" "(" aiur_trm ", " aiur_trm ")" : aiur_trm syntax "u8_mul" "(" aiur_trm ", " aiur_trm ")" : aiur_trm syntax "u8_chain_rotr7" "(" aiur_trm ", " aiur_trm ")" : aiur_trm @@ -337,6 +339,10 @@ partial def elabTrm : ElabStxCat `aiur_trm mkAppM ``Source.Term.u8ShiftRight #[← elabTrm byte] | `(aiur_trm| u8_xor($i:aiur_trm, $j:aiur_trm)) => do mkAppM ``Source.Term.u8Xor #[← elabTrm i, ← elabTrm j] + | `(aiur_trm| u8_xor_split7($i:aiur_trm, $j:aiur_trm)) => do + mkAppM ``Source.Term.u8XorSplit7 #[← elabTrm i, ← elabTrm j] + | `(aiur_trm| u8_xor_split4($i:aiur_trm, $j:aiur_trm)) => do + mkAppM ``Source.Term.u8XorSplit4 #[← elabTrm i, ← elabTrm j] | `(aiur_trm| u8_add($i:aiur_trm, $j:aiur_trm)) => do mkAppM ``Source.Term.u8Add #[← elabTrm i, ← elabTrm j] | `(aiur_trm| u8_mul($i:aiur_trm, $j:aiur_trm)) => do @@ -553,6 +559,12 @@ where let i ← replaceToken old new i let j ← replaceToken old new j `(aiur_trm| u8_xor($i, $j)) + | `(aiur_trm| u8_xor_split7($i:aiur_trm, $j:aiur_trm)) => do + let i ← replaceToken old new i; let j ← replaceToken old new j + `(aiur_trm| u8_xor_split7($i, $j)) + | `(aiur_trm| u8_xor_split4($i:aiur_trm, $j:aiur_trm)) => do + let i ← replaceToken old new i; let j ← replaceToken old new j + `(aiur_trm| u8_xor_split4($i, $j)) | `(aiur_trm| u8_add($i:aiur_trm, $j:aiur_trm)) => do let i ← replaceToken old new i let j ← replaceToken old new j diff --git a/Ix/Aiur/Semantics/BytecodeEval.lean b/Ix/Aiur/Semantics/BytecodeEval.lean index 3debd1f5..480a2264 100644 --- a/Ix/Aiur/Semantics/BytecodeEval.lean +++ b/Ix/Aiur/Semantics/BytecodeEval.lean @@ -303,6 +303,12 @@ def evalOp (t : Bytecode.Toplevel) (fuel : Nat) (op : Op) (st : EvalState) : | .u8Xor a b => do let x ← readIdx st a; let y ← readIdx st b pure (pushMap st (G.ofUInt8 (x.val.toUInt8 ^^^ y.val.toUInt8))) + | .u8XorSplit7 a b => do + let x ← readIdx st a; let y ← readIdx st b; let z := x.val.toUInt8 ^^^ y.val.toUInt8 + pure (pushMap (pushMap st (G.ofUInt8 (z >>> 7))) (G.ofUInt8 (z <<< 1))) + | .u8XorSplit4 a b => do + let x ← readIdx st a; let y ← readIdx st b; let z := x.val.toUInt8 ^^^ y.val.toUInt8 + pure (pushMap (pushMap st (G.ofUInt8 (z >>> 4))) (G.ofUInt8 (z <<< 4))) | .u8Add a b => do let x ← readIdx st a; let y ← readIdx st b let sum := x.val.toUInt8.toNat + y.val.toUInt8.toNat diff --git a/Ix/Aiur/Semantics/SourceEval.lean b/Ix/Aiur/Semantics/SourceEval.lean index 50f019ee..c2f5dfdd 100644 --- a/Ix/Aiur/Semantics/SourceEval.lean +++ b/Ix/Aiur/Semantics/SourceEval.lean @@ -535,6 +535,12 @@ def interp (decls : Decls) (fuel : Nat) (bindings : Bindings) .tuple #[.field (G.ofUInt8 (i - j)), .field (if j > i then 1 else 0)]) (interp decls fuel bindings t1 st) (fun st1 => interp decls fuel bindings t2 st1) + | .u8XorSplit7 t1 t2 => + combineFieldsResult (fun a b => let x := a.val.toUInt8 ^^^ b.val.toUInt8; .tuple #[.field (G.ofUInt8 (x >>> 7)), .field (G.ofUInt8 (x <<< 1))]) + (interp decls fuel bindings t1 st) (fun st1 => interp decls fuel bindings t2 st1) + | .u8XorSplit4 t1 t2 => + combineFieldsResult (fun a b => let x := a.val.toUInt8 ^^^ b.val.toUInt8; .tuple #[.field (G.ofUInt8 (x >>> 4)), .field (G.ofUInt8 (x <<< 4))]) + (interp decls fuel bindings t1 st) (fun st1 => interp decls fuel bindings t2 st1) | .u8And t1 t2 => combineFieldsResult (fun a b => .field (G.ofUInt8 (a.val.toUInt8 &&& b.val.toUInt8))) (interp decls fuel bindings t1 st) diff --git a/Ix/Aiur/Stages/Bytecode.lean b/Ix/Aiur/Stages/Bytecode.lean index 67cfeebf..fb15ba31 100644 --- a/Ix/Aiur/Stages/Bytecode.lean +++ b/Ix/Aiur/Stages/Bytecode.lean @@ -72,6 +72,8 @@ inductive Op | unconstrainedU32Add3 : Array ValIdx → Array ValIdx → Array ValIdx → Op /-- Virtual LE-byte packing expression; allocates no auxiliary column. -/ | u32ToField : Array ValIdx → Op + | u8XorSplit7 : ValIdx → ValIdx → Op + | u8XorSplit4 : ValIdx → ValIdx → Op deriving Repr, BEq, Hashable mutual diff --git a/Ix/Aiur/Stages/Codegen.lean b/Ix/Aiur/Stages/Codegen.lean index bf28019c..4716914c 100644 --- a/Ix/Aiur/Stages/Codegen.lean +++ b/Ix/Aiur/Stages/Codegen.lean @@ -347,6 +347,7 @@ def Op.outputCount : Op → Nat | .u8ShiftLeft _ | .u8ShiftRight _ => 1 | .u8Xor _ _ | .u8And _ _ | .u8Or _ _ | .u8LessThan _ _ => 1 | .u8Mul _ _ => 2 + | .u8XorSplit7 _ _ | .u8XorSplit4 _ _ => 2 | .u8Add _ _ | .u8Sub _ _ => 2 | .u8ChainRotr7 _ _ | .u8ChainRotr4 _ _ => 3 | .u32LessThan _ _ => 1 @@ -719,6 +720,8 @@ def emitOp (out : Nat) (op : Op) : Array RustStmt := | .u8ShiftLeft b => emitU8Bytes1 out "bytes1_shift_left_value" "Bytes1::shift_left" b 1 | .u8ShiftRight b => emitU8Bytes1 out "bytes1_shift_right_value" "Bytes1::shift_right" b 1 | .u8Xor i j => emitU8Bytes2 out "bytes2_xor_value" "xor" i j 1 + | .u8XorSplit7 i j => emitU8Bytes2 out "bytes2_xor_split7_value" "xor_split7" i j 2 + | .u8XorSplit4 i j => emitU8Bytes2 out "bytes2_xor_split4_value" "xor_split4" i j 2 | .u8Mul i j => emitU8Bytes2 out "bytes2_mul_value" "mul" i j 2 | .u8And i j => emitU8Bytes2 out "bytes2_and_value" "and" i j 1 | .u8Or i j => emitU8Bytes2 out "bytes2_or_value" "or" i j 1 @@ -986,6 +989,8 @@ def optionalExecuteUses : Array (String × String) := #[ ("bytes2_sub_value", "bytes2_sub_value"), ("bytes2_chain_rotr7_value", "bytes2_chain_rotr7_value"), ("bytes2_chain_rotr4_value", "bytes2_chain_rotr4_value"), + ("bytes2_xor_split7_value", "bytes2_xor_split7_value"), + ("bytes2_xor_split4_value", "bytes2_xor_split4_value"), ("unconstrained_big_uint_div_mod_helper", "unconstrained_big_uint_div_mod_helper"), ("g_inverse_value", "g_inverse_value"), ("CodegenBytes1 as Bytes1", "Bytes1::"), diff --git a/Ix/Aiur/Stages/Concrete.lean b/Ix/Aiur/Stages/Concrete.lean index 4a220683..b426c610 100644 --- a/Ix/Aiur/Stages/Concrete.lean +++ b/Ix/Aiur/Stages/Concrete.lean @@ -78,6 +78,8 @@ inductive Term : Type where | u8ShiftLeft (typ : Typ) (escapes : Bool) (a : Term) : Term | u8ShiftRight (typ : Typ) (escapes : Bool) (a : Term) : Term | u8Xor (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term + | u8XorSplit7 (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term + | u8XorSplit4 (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term | u8Add (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term | u8Mul (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term | u8Sub (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term @@ -109,7 +111,7 @@ def Term.typ : Term → Typ | .assertEq t _ _ _ _ _ | .ioGetInfo t _ _ _ | .ioSetInfo t _ _ _ _ _ _ | .ioRead t _ _ _ _ | .ioWrite t _ _ _ _ | .u8BitDecomposition t _ _ | .u8ShiftLeft t _ _ | .u8ShiftRight t _ _ - | .u8Xor t _ _ _ | .u8Add t _ _ _ | .u8Mul t _ _ _ | .u8Sub t _ _ _ + | .u8Xor t _ _ _ | .u8XorSplit7 t _ _ _ | .u8XorSplit4 t _ _ _ | .u8Add t _ _ _ | .u8Mul t _ _ _ | .u8Sub t _ _ _ | .u8And t _ _ _ | .u8Or t _ _ _ | .u8LessThan t _ _ _ | .u32LessThan t _ _ _ | .unconstrainedU32Add t _ _ _ | .unconstrainedU32Add3 t _ _ _ _ | .u32ToField t _ _ | .u8ChainRotr7 t _ _ _ | .u8ChainRotr4 t _ _ _ | .u8RangeCheck t _ _ _ @@ -129,7 +131,7 @@ def Term.escapes : Term → Bool | .assertEq _ e _ _ _ _ | .ioGetInfo _ e _ _ | .ioSetInfo _ e _ _ _ _ _ | .ioRead _ e _ _ _ | .ioWrite _ e _ _ _ | .u8BitDecomposition _ e _ | .u8ShiftLeft _ e _ | .u8ShiftRight _ e _ - | .u8Xor _ e _ _ | .u8Add _ e _ _ | .u8Mul _ e _ _ | .u8Sub _ e _ _ + | .u8Xor _ e _ _ | .u8XorSplit7 _ e _ _ | .u8XorSplit4 _ e _ _ | .u8Add _ e _ _ | .u8Mul _ e _ _ | .u8Sub _ e _ _ | .u8And _ e _ _ | .u8Or _ e _ _ | .u8LessThan _ e _ _ | .u32LessThan _ e _ _ | .unconstrainedU32Add _ e _ _ | .unconstrainedU32Add3 _ e _ _ _ | .u32ToField _ e _ | .u8ChainRotr7 _ e _ _ | .u8ChainRotr4 _ e _ _ | .u8RangeCheck _ e _ _ diff --git a/Ix/Aiur/Stages/Simple.lean b/Ix/Aiur/Stages/Simple.lean index 7e4e2d05..ccdf9734 100644 --- a/Ix/Aiur/Stages/Simple.lean +++ b/Ix/Aiur/Stages/Simple.lean @@ -74,6 +74,8 @@ inductive Term : Type where | u8ShiftLeft (typ : Typ) (escapes : Bool) (a : Term) : Term | u8ShiftRight (typ : Typ) (escapes : Bool) (a : Term) : Term | u8Xor (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term + | u8XorSplit7 (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term + | u8XorSplit4 (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term | u8Add (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term | u8Mul (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term | u8Sub (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term @@ -106,7 +108,7 @@ def Term.typ : Term → Typ | .assertEq t _ _ _ _ _ | .ioGetInfo t _ _ _ | .ioSetInfo t _ _ _ _ _ _ | .ioRead t _ _ _ _ | .ioWrite t _ _ _ _ | .u8BitDecomposition t _ _ | .u8ShiftLeft t _ _ | .u8ShiftRight t _ _ - | .u8Xor t _ _ _ | .u8Add t _ _ _ | .u8Mul t _ _ _ | .u8Sub t _ _ _ + | .u8Xor t _ _ _ | .u8XorSplit7 t _ _ _ | .u8XorSplit4 t _ _ _ | .u8Add t _ _ _ | .u8Mul t _ _ _ | .u8Sub t _ _ _ | .u8And t _ _ _ | .u8Or t _ _ _ | .u8LessThan t _ _ _ | .u32LessThan t _ _ _ | .unconstrainedU32Add t _ _ _ | .unconstrainedU32Add3 t _ _ _ _ | .u32ToField t _ _ | .u8ChainRotr7 t _ _ _ | .u8ChainRotr4 t _ _ _ | .u8RangeCheck t _ _ _ @@ -126,7 +128,7 @@ def Term.escapes : Term → Bool | .assertEq _ e _ _ _ _ | .ioGetInfo _ e _ _ | .ioSetInfo _ e _ _ _ _ _ | .ioRead _ e _ _ _ | .ioWrite _ e _ _ _ | .u8BitDecomposition _ e _ | .u8ShiftLeft _ e _ | .u8ShiftRight _ e _ - | .u8Xor _ e _ _ | .u8Add _ e _ _ | .u8Mul _ e _ _ | .u8Sub _ e _ _ + | .u8Xor _ e _ _ | .u8XorSplit7 _ e _ _ | .u8XorSplit4 _ e _ _ | .u8Add _ e _ _ | .u8Mul _ e _ _ | .u8Sub _ e _ _ | .u8And _ e _ _ | .u8Or _ e _ _ | .u8LessThan _ e _ _ | .u32LessThan _ e _ _ | .unconstrainedU32Add _ e _ _ | .unconstrainedU32Add3 _ e _ _ _ | .u32ToField _ e _ | .u8ChainRotr7 _ e _ _ | .u8ChainRotr4 _ e _ _ | .u8RangeCheck _ e _ _ diff --git a/Ix/Aiur/Stages/Source.lean b/Ix/Aiur/Stages/Source.lean index fa327035..30e9e2de 100644 --- a/Ix/Aiur/Stages/Source.lean +++ b/Ix/Aiur/Stages/Source.lean @@ -423,6 +423,8 @@ inductive Term | u8ShiftLeft : Term → Term | u8ShiftRight : Term → Term | u8Xor : Term → Term → Term + | u8XorSplit7 : Term → Term → Term + | u8XorSplit4 : Term → Term → Term | u8Add : Term → Term → Term | u8Mul : Term → Term → Term | u8Sub : Term → Term → Term @@ -684,6 +686,8 @@ def Term.freshen (cnt : Nat) (subst : Std.HashMap Local Local) : | .u8ShiftLeft a => let (cnt, a') := Term.freshen cnt subst a; (cnt, .u8ShiftLeft a') | .u8ShiftRight a => let (cnt, a') := Term.freshen cnt subst a; (cnt, .u8ShiftRight a') | .u8Xor a b => let (cnt, a') := Term.freshen cnt subst a; let (cnt, b') := Term.freshen cnt subst b; (cnt, .u8Xor a' b') + | .u8XorSplit7 a b => let (cnt, a') := Term.freshen cnt subst a; let (cnt, b') := Term.freshen cnt subst b; (cnt, .u8XorSplit7 a' b') + | .u8XorSplit4 a b => let (cnt, a') := Term.freshen cnt subst a; let (cnt, b') := Term.freshen cnt subst b; (cnt, .u8XorSplit4 a' b') | .u8Add a b => let (cnt, a') := Term.freshen cnt subst a; let (cnt, b') := Term.freshen cnt subst b; (cnt, .u8Add a' b') | .u8Mul a b => let (cnt, a') := Term.freshen cnt subst a; let (cnt, b') := Term.freshen cnt subst b; (cnt, .u8Mul a' b') | .u8Sub a b => let (cnt, a') := Term.freshen cnt subst a; let (cnt, b') := Term.freshen cnt subst b; (cnt, .u8Sub a' b') @@ -742,7 +746,7 @@ def Term.inlineCallSites : Term → List (Global × Nat) arms.attach.foldl (fun acc ⟨(_, a), _⟩ => acc ++ a.inlineCallSites) s.inlineCallSites | .let _ v b => v.inlineCallSites ++ b.inlineCallSites | .add a b | .sub a b | .mul a b | .set a _ b - | .u8Xor a b | .u8Add a b | .u8Mul a b | .u8Sub a b | .u8And a b | .u8Or a b + | .u8Xor a b | .u8XorSplit7 a b | .u8XorSplit4 a b | .u8Add a b | .u8Mul a b | .u8Sub a b | .u8And a b | .u8Or a b | .u8LessThan a b | .u32LessThan a b | .unconstrainedU32Add a b | .u8ChainRotr7 a b | .u8ChainRotr4 a b | .unconstrainedBigUintDivMod a b | .u8RangeCheck a b | .ioGetInfo a b => a.inlineCallSites ++ b.inlineCallSites @@ -858,6 +862,8 @@ def Term.expandOnce (done : Std.HashMap Global (List Local × Term)) (cnt : Nat) | .u8ShiftLeft a => let (cnt, a') := Term.expandOnce done cnt a; (cnt, .u8ShiftLeft a') | .u8ShiftRight a => let (cnt, a') := Term.expandOnce done cnt a; (cnt, .u8ShiftRight a') | .u8Xor a b => let (cnt, a') := Term.expandOnce done cnt a; let (cnt, b') := Term.expandOnce done cnt b; (cnt, .u8Xor a' b') + | .u8XorSplit7 a b => let (cnt, a') := Term.expandOnce done cnt a; let (cnt, b') := Term.expandOnce done cnt b; (cnt, .u8XorSplit7 a' b') + | .u8XorSplit4 a b => let (cnt, a') := Term.expandOnce done cnt a; let (cnt, b') := Term.expandOnce done cnt b; (cnt, .u8XorSplit4 a' b') | .u8Add a b => let (cnt, a') := Term.expandOnce done cnt a; let (cnt, b') := Term.expandOnce done cnt b; (cnt, .u8Add a' b') | .u8Mul a b => let (cnt, a') := Term.expandOnce done cnt a; let (cnt, b') := Term.expandOnce done cnt b; (cnt, .u8Mul a' b') | .u8Sub a b => let (cnt, a') := Term.expandOnce done cnt a; let (cnt, b') := Term.expandOnce done cnt b; (cnt, .u8Sub a' b') @@ -978,6 +984,10 @@ def Term.hoistLets : Term → Term := | .unconstrainedGInverse a => let (fs, c) := Term.peelLets (Term.hoistLets a); Term.wrapLets fs (.unconstrainedGInverse c) | .u8Xor a b => let (fs, cs) := Term.peelListLets [Term.hoistLets a, Term.hoistLets b] match cs with | [a, b] => Term.wrapLets fs (.u8Xor a b) | _ => t + | .u8XorSplit7 a b => let (fs, cs) := Term.peelListLets [Term.hoistLets a, Term.hoistLets b] + match cs with | [a, b] => Term.wrapLets fs (.u8XorSplit7 a b) | _ => t + | .u8XorSplit4 a b => let (fs, cs) := Term.peelListLets [Term.hoistLets a, Term.hoistLets b] + match cs with | [a, b] => Term.wrapLets fs (.u8XorSplit4 a b) | _ => t | .u8Add a b => let (fs, cs) := Term.peelListLets [Term.hoistLets a, Term.hoistLets b] match cs with | [a, b] => Term.wrapLets fs (.u8Add a b) | _ => t | .u8Mul a b => let (fs, cs) := Term.peelListLets [Term.hoistLets a, Term.hoistLets b] @@ -1096,7 +1106,7 @@ partial def Term.collectGlobals (acc : Std.HashSet Global) : Term → Std.HashSe bs.foldl (fun a (p, b) => b.collectGlobals (patternGlobals a p)) (s.collectGlobals acc) | .app g args _ => args.foldl (fun a t => t.collectGlobals a) (acc.insert g) - | .add a b | .sub a b | .mul a b | .u8Xor a b | .u8Add a b + | .add a b | .sub a b | .mul a b | .u8Xor a b | .u8XorSplit7 a b | .u8XorSplit4 a b | .u8Add a b | .u8Mul a b | .u8Sub a b | .u8And a b | .u8Or a b | .u8LessThan a b | .u32LessThan a b | .unconstrainedU32Add a b | .u8ChainRotr7 a b | .u8ChainRotr4 a b | .u8RangeCheck a b | .unconstrainedBigUintDivMod a b | .ioGetInfo a b => diff --git a/Ix/Aiur/Stages/Typed.lean b/Ix/Aiur/Stages/Typed.lean index 4f9ffbaf..50ca8567 100644 --- a/Ix/Aiur/Stages/Typed.lean +++ b/Ix/Aiur/Stages/Typed.lean @@ -50,6 +50,8 @@ inductive Term : Type where | u8ShiftLeft (typ : Typ) (escapes : Bool) (a : Term) : Term | u8ShiftRight (typ : Typ) (escapes : Bool) (a : Term) : Term | u8Xor (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term + | u8XorSplit7 (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term + | u8XorSplit4 (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term | u8Add (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term | u8Mul (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term | u8Sub (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term @@ -82,7 +84,7 @@ def Term.typ : Term → Typ | .assertEq t _ _ _ _ _ | .ioGetInfo t _ _ _ | .ioSetInfo t _ _ _ _ _ _ | .ioRead t _ _ _ _ | .ioWrite t _ _ _ _ | .u8BitDecomposition t _ _ | .u8ShiftLeft t _ _ | .u8ShiftRight t _ _ - | .u8Xor t _ _ _ | .u8Add t _ _ _ | .u8Mul t _ _ _ | .u8Sub t _ _ _ + | .u8Xor t _ _ _ | .u8XorSplit7 t _ _ _ | .u8XorSplit4 t _ _ _ | .u8Add t _ _ _ | .u8Mul t _ _ _ | .u8Sub t _ _ _ | .u8And t _ _ _ | .u8Or t _ _ _ | .u8LessThan t _ _ _ | .u32LessThan t _ _ _ | .unconstrainedU32Add t _ _ _ | .unconstrainedU32Add3 t _ _ _ _ | .u32ToField t _ _ | .u8ChainRotr7 t _ _ _ | .u8ChainRotr4 t _ _ _ | .u8RangeCheck t _ _ _ @@ -102,7 +104,7 @@ def Term.escapes : Term → Bool | .assertEq _ e _ _ _ _ | .ioGetInfo _ e _ _ | .ioSetInfo _ e _ _ _ _ _ | .ioRead _ e _ _ _ | .ioWrite _ e _ _ _ | .u8BitDecomposition _ e _ | .u8ShiftLeft _ e _ | .u8ShiftRight _ e _ - | .u8Xor _ e _ _ | .u8Add _ e _ _ | .u8Mul _ e _ _ | .u8Sub _ e _ _ + | .u8Xor _ e _ _ | .u8XorSplit7 _ e _ _ | .u8XorSplit4 _ e _ _ | .u8Add _ e _ _ | .u8Mul _ e _ _ | .u8Sub _ e _ _ | .u8And _ e _ _ | .u8Or _ e _ _ | .u8LessThan _ e _ _ | .u32LessThan _ e _ _ | .unconstrainedU32Add _ e _ _ | .unconstrainedU32Add3 _ e _ _ _ | .u32ToField _ e _ | .u8ChainRotr7 _ e _ _ | .u8ChainRotr4 _ e _ _ | .u8RangeCheck _ e _ _ diff --git a/Ix/IxVM/Blake3.lean b/Ix/IxVM/Blake3.lean index 7ddc19e5..ce81150f 100644 --- a/Ix/IxVM/Blake3.lean +++ b/Ix/IxVM/Blake3.lean @@ -304,11 +304,11 @@ def blake3 := ⟦ let a = @u32_add3(a, b, x); let d = @u32_rotr16(@u32_xor(d, a)); let c = @u32_add(c, d); - let b = @u32_rotr12(@u32_xor(b, c)); + let b = @u32_xor_rotr12(b, c); let a = @u32_add3(a, b, y); let d = @u32_rotr8(@u32_xor(d, a)); let c = @u32_add(c, d); - let b = @u32_rotr7(@u32_xor(b, c)); + let b = @u32_xor_rotr7(b, c); [a, b, c, d] } diff --git a/Ix/IxVM/ByteStream.lean b/Ix/IxVM/ByteStream.lean index 7b3c8049..133bd9dd 100644 --- a/Ix/IxVM/ByteStream.lean +++ b/Ix/IxVM/ByteStream.lean @@ -43,12 +43,10 @@ def byteStream := ⟦ } } - -- Wrapping little-endian u32 addition. The expensive bytewise addition is - -- advice only; this circuit verifies its five witnesses directly: - -- four range-checked result bytes, a boolean carry, and the packed integer - -- identity `a + b = result + carry * 2^32`. Since both sides are < 2^33, - -- the Goldilocks field equality is the intended integer equality (no field - -- wrap), and the checked decomposition is unique. + -- Wrapping little-endian u32 addition. The four result bytes are advice and + -- are range-checked here. The carry is the virtual expression + -- `(a + b - result) / 2^32`; constraining it to be boolean uniquely pins the + -- wrapping result, so a separate packed-sum equality would be redundant. fn u32_add(a: [U8; 4], b: [U8; 4]) -> [U8; 4] { let (raw, carry) = unconstrained_u32_add(a, b); let (z0, z1) = u8_range_check(raw[0], raw[1]); @@ -56,19 +54,13 @@ def byteStream := ⟦ assert_eq!(carry * carry, carry, "u32_add: carry is not boolean"); - let av = u32_to_field(a); - let bv = u32_to_field(b); - let zv = u32_to_field([z0, z1, z2, z3]); - assert_eq!(av + bv, zv + 0x100000000 * carry, - "u32_add: witnessed sum does not match its inputs"); - [z0, z1, z2, z3] } - -- Wrapping sum of three little-endian u32s, pinned directly rather than as - -- two binary additions. The output costs two paired range-check lookups; - -- the cubic carry constraint admits exactly 0, 1, or 2. The packed integer - -- identity cannot wrap in Goldilocks because its values are below 2^34. + -- Wrapping sum of three little-endian u32s. The output costs two paired + -- range-check lookups. The virtual carry is + -- `(a + b + c - result) / 2^32`; constraining it to {0, 1, 2} uniquely pins + -- the result, so no separate packed-sum equality is needed. fn u32_add3(a: [U8; 4], b: [U8; 4], c: [U8; 4]) -> [U8; 4] { let (raw, carry) = unconstrained_u32_add3(a, b, c); let (z0, z1) = u8_range_check(raw[0], raw[1]); @@ -77,13 +69,6 @@ def byteStream := ⟦ assert_eq!(carry * (carry - 1) * (carry - 2), 0, "u32_add3: carry is not in {0, 1, 2}"); - let av = u32_to_field(a); - let bv = u32_to_field(b); - let cv = u32_to_field(c); - let zv = u32_to_field([z0, z1, z2, z3]); - assert_eq!(av + bv + cv, zv + 0x100000000 * carry, - "u32_add3: witnessed sum does not match its inputs"); - [z0, z1, z2, z3] } @@ -132,6 +117,28 @@ def byteStream := ⟦ u8_from_field_unsafe(to_field(h1) + to_field(g2))] } + fn u32_xor_rotr7(a: [U8; 4], b: [U8; 4]) -> [U8; 4] { + let (h0, l0) = u8_xor_split7(a[0], b[0]); + let (h1, l1) = u8_xor_split7(a[1], b[1]); + let (h2, l2) = u8_xor_split7(a[2], b[2]); + let (h3, l3) = u8_xor_split7(a[3], b[3]); + [u8_from_field_unsafe(to_field(h0) + to_field(l1)), + u8_from_field_unsafe(to_field(h1) + to_field(l2)), + u8_from_field_unsafe(to_field(h2) + to_field(l3)), + u8_from_field_unsafe(to_field(h3) + to_field(l0))] + } + + fn u32_xor_rotr12(a: [U8; 4], b: [U8; 4]) -> [U8; 4] { + let (h0, l0) = u8_xor_split4(a[0], b[0]); + let (h1, l1) = u8_xor_split4(a[1], b[1]); + let (h2, l2) = u8_xor_split4(a[2], b[2]); + let (h3, l3) = u8_xor_split4(a[3], b[3]); + [u8_from_field_unsafe(to_field(h1) + to_field(l2)), + u8_from_field_unsafe(to_field(h2) + to_field(l3)), + u8_from_field_unsafe(to_field(h3) + to_field(l0)), + u8_from_field_unsafe(to_field(h0) + to_field(l1))] + } + -- Byte-by-byte `u64` equality fn u64_eq(a: U64, b: U64) -> G { let [a0, a1, a2, a3, a4, a5, a6, a7] = a; diff --git a/crates/aiur/src/bytecode.rs b/crates/aiur/src/bytecode.rs index 021f1579..626063d1 100644 --- a/crates/aiur/src/bytecode.rs +++ b/crates/aiur/src/bytecode.rs @@ -51,6 +51,8 @@ pub enum Op { U8ShiftLeft(ValIdx), U8ShiftRight(ValIdx), U8Xor(ValIdx, ValIdx), + U8XorSplit7(ValIdx, ValIdx), + U8XorSplit4(ValIdx, ValIdx), U8Add(ValIdx, ValIdx), U8Mul(ValIdx, ValIdx), U8Sub(ValIdx, ValIdx), diff --git a/crates/aiur/src/constraints.rs b/crates/aiur/src/constraints.rs index 6d711eee..500c1249 100644 --- a/crates/aiur/src/constraints.rs +++ b/crates/aiur/src/constraints.rs @@ -17,6 +17,7 @@ use crate::{ u8_chain_rotr4_channel, u8_chain_rotr7_channel, u8_less_than_channel, u8_mul_channel, u8_or_channel, u8_range_check_channel, u8_shift_left_channel, u8_shift_right_channel, u8_sub_channel, u8_xor_channel, + u8_xor_split4_channel, u8_xor_split7_channel, }; type Expr = multi_stark::expr::Expr; @@ -529,6 +530,22 @@ impl Op { sel.clone(), state, ), + Op::U8XorSplit7(i, j) => bytes2_constraints( + *i, + *j, + &Bytes2Op::XorSplit7, + u8_xor_split7_channel(), + sel.clone(), + state, + ), + Op::U8XorSplit4(i, j) => bytes2_constraints( + *i, + *j, + &Bytes2Op::XorSplit4, + u8_xor_split4_channel(), + sel.clone(), + state, + ), Op::U8Add(i, j) => { // The add lookup pins only the low byte `z = (x + y) mod 256`. The // carry is then `c = (x + y - z) / 256`, a compound expression that diff --git a/crates/aiur/src/execute.rs b/crates/aiur/src/execute.rs index 17ad9051..b3488663 100644 --- a/crates/aiur/src/execute.rs +++ b/crates/aiur/src/execute.rs @@ -468,6 +468,20 @@ impl Function { bytes2_execute(*i, *j, &Bytes2Op::Xor, &mut map, record); } }, + ExecEntry::Op(Op::U8XorSplit7(i, j)) => { + let (a, b) = Bytes2::xor_split7(&map[*i], &map[*j]); + if !unconstrained { + record.bytes2_queries.bump_xor_split7(&map[*i], &map[*j]); + } + map.extend([a, b]); + }, + ExecEntry::Op(Op::U8XorSplit4(i, j)) => { + let (a, b) = Bytes2::xor_split4(&map[*i], &map[*j]); + if !unconstrained { + record.bytes2_queries.bump_xor_split4(&map[*i], &map[*j]); + } + map.extend([a, b]); + }, ExecEntry::Op(Op::U8Add(i, j)) => { // The add gadget yields only the low byte; the carry is derived // and pushed separately so the op still produces `(low, carry)`. @@ -853,6 +867,14 @@ pub fn bytes2_chain_rotr4_value( record.bytes2_queries.bump_chain_rotr4(&a, &b); Bytes2::chain_rotr4(&a, &b) } +pub fn bytes2_xor_split7_value(a: G, b: G, record: &mut QueryRecord) -> (G, G) { + record.bytes2_queries.bump_xor_split7(&a, &b); + Bytes2::xor_split7(&a, &b) +} +pub fn bytes2_xor_split4_value(a: G, b: G, record: &mut QueryRecord) -> (G, G) { + record.bytes2_queries.bump_xor_split4(&a, &b); + Bytes2::xor_split4(&a, &b) +} /// Bumps `bytes2_queries.add` and returns the full `(low, carry)` /// pair. The constrained-mode gadget only LOOKUPS `low` from the diff --git a/crates/aiur/src/gadgets/bytes2.rs b/crates/aiur/src/gadgets/bytes2.rs index 4f57f2c7..2758f9a8 100644 --- a/crates/aiur/src/gadgets/bytes2.rs +++ b/crates/aiur/src/gadgets/bytes2.rs @@ -9,7 +9,7 @@ use crate::{ G, execute::QueryRecord, gadgets::AiurGadget, u8_add_channel, u8_and_channel, u8_chain_rotr4_channel, u8_chain_rotr7_channel, u8_less_than_channel, u8_mul_channel, u8_or_channel, u8_range_check_channel, u8_sub_channel, - u8_xor_channel, + u8_xor_channel, u8_xor_split4_channel, u8_xor_split7_channel, }; /// Number of columns in the trace with multiplicities for @@ -23,7 +23,7 @@ use crate::{ /// - mul /// - chain_rotr7 /// - chain_rotr4 -const TRACE_WIDTH: usize = 10; +const TRACE_WIDTH: usize = 12; /// Number of columns in the preprocessed trace: /// - first raw byte value @@ -44,7 +44,7 @@ const TRACE_WIDTH: usize = 10; /// - chain_rotr4 output 0 (`i >> 4 + j << 4`) /// - chain_rotr4 output 1 (`j >> 4`) /// - chain_rotr4 output 2 (`i << 4`) -const PREPROCESSED_TRACE_WIDTH: usize = 16; +const PREPROCESSED_TRACE_WIDTH: usize = 20; /// AIR implementer for arity 2 byte-related lookups. pub struct Bytes2; @@ -59,6 +59,8 @@ pub enum Bytes2Op { LessThan, ChainRotr7, ChainRotr4, + XorSplit7, + XorSplit4, } impl AiurGadget for Bytes2 { @@ -72,7 +74,7 @@ impl AiurGadget for Bytes2 { | Bytes2Op::LessThan | Bytes2Op::Add | Bytes2Op::Sub => 1, - Bytes2Op::Mul => 2, + Bytes2Op::Mul | Bytes2Op::XorSplit7 | Bytes2Op::XorSplit4 => 2, Bytes2Op::ChainRotr7 | Bytes2Op::ChainRotr4 => 3, } } @@ -119,12 +121,15 @@ impl AiurGadget for Bytes2 { trace_values.push(G::from_u8(o0)); trace_values.push(G::from_u8(o1)); trace_values.push(G::from_u8(o2)); - // Chain rotr4 (combined byte, j high nibble, i low nibble) let (o0, o1, o2) = Self::chain_rotr4_u8(i, j); trace_values.push(G::from_u8(o0)); trace_values.push(G::from_u8(o1)); trace_values.push(G::from_u8(o2)); + let (hi, lo) = Self::xor_split7_u8(i, j); + trace_values.extend([G::from_u8(hi), G::from_u8(lo)]); + let (hi, lo) = Self::xor_split4_u8(i, j); + trace_values.extend([G::from_u8(hi), G::from_u8(lo)]); } } Some(RowMajorMatrix::new(trace_values, PREPROCESSED_TRACE_WIDTH)) @@ -180,6 +185,16 @@ impl AiurGadget for Bytes2 { let (o0, o1, o2) = Self::chain_rotr4(i, j); vec![o0, o1, o2] }, + Bytes2Op::XorSplit7 => { + record.bytes2_queries.bump_xor_split7(i, j); + let (hi, lo) = Self::xor_split7(i, j); + vec![hi, lo] + }, + Bytes2Op::XorSplit4 => { + record.bytes2_queries.bump_xor_split4(i, j); + let (hi, lo) = Self::xor_split4(i, j); + vec![hi, lo] + }, } } @@ -195,6 +210,8 @@ impl AiurGadget for Bytes2 { let mul_channel = Expr::constant(u8_mul_channel()); let chain_rotr7_channel = Expr::constant(u8_chain_rotr7_channel()); let chain_rotr4_channel = Expr::constant(u8_chain_rotr4_channel()); + let xor_split7_channel = Expr::constant(u8_xor_split7_channel()); + let xor_split4_channel = Expr::constant(u8_xor_split4_channel()); // Multiplicity columns let xor_multiplicity = Expr::main(0); @@ -207,6 +224,8 @@ impl AiurGadget for Bytes2 { let mul_multiplicity = Expr::main(7); let chain_rotr7_multiplicity = Expr::main(8); let chain_rotr4_multiplicity = Expr::main(9); + let xor_split7_multiplicity = Expr::main(10); + let xor_split4_multiplicity = Expr::main(11); // Preprocessed columns let i = Expr::preprocessed(0); @@ -225,6 +244,10 @@ impl AiurGadget for Bytes2 { let chain_rotr4_o0 = Expr::preprocessed(13); let chain_rotr4_o1 = Expr::preprocessed(14); let chain_rotr4_o2 = Expr::preprocessed(15); + let xor_split7_hi = Expr::preprocessed(16); + let xor_split7_lo = Expr::preprocessed(17); + let xor_split4_hi = Expr::preprocessed(18); + let xor_split4_lo = Expr::preprocessed(19); // pull = negated multiplicity. let pull_xor = Lookup { @@ -283,13 +306,27 @@ impl AiurGadget for Bytes2 { multiplicity: -chain_rotr4_multiplicity, args: vec![ chain_rotr4_channel, - i, - j, + i.clone(), + j.clone(), chain_rotr4_o0, chain_rotr4_o1, chain_rotr4_o2, ], }; + let pull_xor_split7 = Lookup { + multiplicity: -xor_split7_multiplicity, + args: vec![ + xor_split7_channel, + i.clone(), + j.clone(), + xor_split7_hi, + xor_split7_lo, + ], + }; + let pull_xor_split4 = Lookup { + multiplicity: -xor_split4_multiplicity, + args: vec![xor_split4_channel, i, j, xor_split4_hi, xor_split4_lo], + }; vec![ pull_xor, @@ -302,6 +339,8 @@ impl AiurGadget for Bytes2 { pull_mul, pull_chain_rotr7, pull_chain_rotr4, + pull_xor_split7, + pull_xor_split4, ] } @@ -326,6 +365,8 @@ impl AiurGadget for Bytes2 { let mul_channel = u8_mul_channel(); let chain_rotr7_channel = u8_chain_rotr7_channel(); let chain_rotr4_channel = u8_chain_rotr4_channel(); + let xor_split7_channel = u8_xor_split7_channel(); + let xor_split4_channel = u8_xor_split4_channel(); rows .chunks_exact_mut(TRACE_WIDTH) @@ -347,6 +388,8 @@ impl AiurGadget for Bytes2 { mul, chain_rotr7, chain_rotr4, + xor_split7, + xor_split4, ], ), row_lookups, @@ -364,6 +407,8 @@ impl AiurGadget for Bytes2 { row[7] = mul; row[8] = chain_rotr7; row[9] = chain_rotr4; + row[10] = xor_split7; + row[11] = xor_split4; // Pull xor. row_lookups.pull(0, xor, &[xor_channel, i, j, Self::xor(&i, &j)]); @@ -388,6 +433,10 @@ impl AiurGadget for Bytes2 { less_than, &[less_than_channel, i, j, Self::less_than(&i, &j)], ); + let (hi, lo) = Self::xor_split7(&i, &j); + row_lookups.pull(10, xor_split7, &[xor_split7_channel, i, j, hi, lo]); + let (hi, lo) = Self::xor_split4(&i, &j); + row_lookups.pull(11, xor_split4, &[xor_split4_channel, i, j, hi, lo]); // Pull range_check. row_lookups.pull(6, range_check, &[range_check_channel, i, j]); @@ -466,6 +515,12 @@ impl Bytes2Queries { pub(crate) fn bump_chain_rotr4(&mut self, i: &G, j: &G) { self.bump_multiplicity_for(i, j, 9) } + pub(crate) fn bump_xor_split7(&mut self, i: &G, j: &G) { + self.bump_multiplicity_for(i, j, 10) + } + pub(crate) fn bump_xor_split4(&mut self, i: &G, j: &G) { + self.bump_multiplicity_for(i, j, 11) + } pub(crate) fn bump_multiplicity_for(&mut self, i: &G, j: &G, col: usize) { let i = usize::try_from(i.as_canonical_u64()).unwrap(); @@ -476,6 +531,28 @@ impl Bytes2Queries { } impl Bytes2 { + pub fn xor_split7_u8(i: u8, j: u8) -> (u8, u8) { + let x = i ^ j; + (x >> 7, x << 1) + } + pub fn xor_split4_u8(i: u8, j: u8) -> (u8, u8) { + let x = i ^ j; + (x >> 4, x << 4) + } + pub fn xor_split7(i: &G, j: &G) -> (G, G) { + let (a, b) = Self::xor_split7_u8( + i.as_canonical_u64() as u8, + j.as_canonical_u64() as u8, + ); + (G::from_u8(a), G::from_u8(b)) + } + pub fn xor_split4(i: &G, j: &G) -> (G, G) { + let (a, b) = Self::xor_split4_u8( + i.as_canonical_u64() as u8, + j.as_canonical_u64() as u8, + ); + (G::from_u8(a), G::from_u8(b)) + } #[inline] pub fn xor(i: &G, j: &G) -> G { let i: u8 = i.as_canonical_u64().try_into().unwrap(); diff --git a/crates/aiur/src/lib.rs b/crates/aiur/src/lib.rs index 605c8382..c5afb9f8 100644 --- a/crates/aiur/src/lib.rs +++ b/crates/aiur/src/lib.rs @@ -89,3 +89,11 @@ pub fn u8_chain_rotr7_channel() -> G { pub fn u8_chain_rotr4_channel() -> G { G::from_u8(14) } +#[inline] +pub fn u8_xor_split7_channel() -> G { + G::from_u8(15) +} +#[inline] +pub fn u8_xor_split4_channel() -> G { + G::from_u8(16) +} diff --git a/crates/aiur/src/synthesis.rs b/crates/aiur/src/synthesis.rs index faf9b9a6..0de2a206 100644 --- a/crates/aiur/src/synthesis.rs +++ b/crates/aiur/src/synthesis.rs @@ -403,8 +403,13 @@ mod tests { fn rotation_chains_toplevel() -> Toplevel { let body = Block { - ops: vec![Op::U8ChainRotr7(0, 1), Op::U8ChainRotr4(0, 1)], - ctrl: Ctrl::Return(0, vec![2, 3, 4, 5, 6, 7]), + ops: vec![ + Op::U8ChainRotr7(0, 1), + Op::U8ChainRotr4(0, 1), + Op::U8XorSplit7(0, 1), + Op::U8XorSplit4(0, 1), + ], + ctrl: Ctrl::Return(0, vec![2, 3, 4, 5, 6, 7, 8, 9, 10, 11]), }; let function = Function { body, @@ -412,9 +417,9 @@ mod tests { input_size: 2, selectors: 1, // Multiplicity plus two columns for each rotation-chain operation. - auxiliaries: 5, + auxiliaries: 9, // Return plus one byte-table lookup per operation. - lookups: 3, + lookups: 5, }, entry: true, constrained: true, @@ -432,6 +437,8 @@ mod tests { let (claim, proof) = system.prove(0, &input, &mut io_buffer); let (r7_0, r7_1, r7_2) = Bytes2::chain_rotr7(&input[0], &input[1]); let (r4_0, r4_1, r4_2) = Bytes2::chain_rotr4(&input[0], &input[1]); + let (s7_hi, s7_lo) = Bytes2::xor_split7(&input[0], &input[1]); + let (s4_hi, s4_lo) = Bytes2::xor_split4(&input[0], &input[1]); assert_eq!( claim, vec![ @@ -445,6 +452,10 @@ mod tests { r4_0, r4_1, r4_2, + s7_hi, + s7_lo, + s4_hi, + s4_lo, ] ); system @@ -634,7 +645,7 @@ mod tests { // height doubles as the committed trace height. assert_eq!(shapes[3].preprocessed_width, 11); assert_eq!(shapes[3].preprocessed_height, 256); - assert_eq!(shapes[4].preprocessed_width, 16); + assert_eq!(shapes[4].preprocessed_width, 20); assert_eq!(shapes[4].preprocessed_height, 65536); } } diff --git a/crates/aiur/src/trace.rs b/crates/aiur/src/trace.rs index 252d6519..95f3d71f 100644 --- a/crates/aiur/src/trace.rs +++ b/crates/aiur/src/trace.rs @@ -24,6 +24,7 @@ use crate::{ u8_chain_rotr4_channel, u8_chain_rotr7_channel, u8_less_than_channel, u8_mul_channel, u8_or_channel, u8_range_check_channel, u8_shift_left_channel, u8_shift_right_channel, u8_sub_channel, u8_xor_channel, + u8_xor_split4_channel, u8_xor_split7_channel, }; struct ColumnIndex { @@ -454,6 +455,32 @@ impl Op { slice.push_auxiliary(index, xor); slice.push_lookup(index, G::ONE, &[u8_xor_channel(), i, j, xor]); }, + Op::U8XorSplit7(i, j) => { + let (i, _) = map[*i]; + let (j, _) = map[*j]; + let (hi, lo) = Bytes2::xor_split7(&i, &j); + map.extend([(hi, 1), (lo, 1)]); + slice.push_auxiliary(index, hi); + slice.push_auxiliary(index, lo); + slice.push_lookup( + index, + G::ONE, + &[u8_xor_split7_channel(), i, j, hi, lo], + ); + }, + Op::U8XorSplit4(i, j) => { + let (i, _) = map[*i]; + let (j, _) = map[*j]; + let (hi, lo) = Bytes2::xor_split4(&i, &j); + map.extend([(hi, 1), (lo, 1)]); + slice.push_auxiliary(index, hi); + slice.push_auxiliary(index, lo); + slice.push_lookup( + index, + G::ONE, + &[u8_xor_split4_channel(), i, j, hi, lo], + ); + }, Op::U8Add(i, j) => { let (i, _) = map[*i]; let (j, _) = map[*j]; diff --git a/crates/ffi/src/aiur/toplevel.rs b/crates/ffi/src/aiur/toplevel.rs index fffcc484..5592fdf1 100644 --- a/crates/ffi/src/aiur/toplevel.rs +++ b/crates/ffi/src/aiur/toplevel.rs @@ -189,6 +189,14 @@ fn decode_op(ctor: LeanCtor>) -> Op { let [a] = ctor.objs::<1>(); Op::U32ToField(decode_vec_val_idx(a)) }, + 34 => { + let [i, j] = ctor.objs::<2>().map(|x| lean_unbox_nat_as_usize(&x)); + Op::U8XorSplit7(i, j) + }, + 35 => { + let [i, j] = ctor.objs::<2>().map(|x| lean_unbox_nat_as_usize(&x)); + Op::U8XorSplit4(i, j) + }, _ => unreachable!(), } } From 93c2d25b8e9d90db062d0b1a79760920116b123d Mon Sep 17 00:00:00 2001 From: Gabriel Barreto Date: Thu, 13 Aug 2026 17:30:23 -0300 Subject: [PATCH 4/7] aiur: remove obsolete rotation chain operations Plus the trailing integration: the aiur test toplevels migrate off the removed builtins (u8_chain_rotr7/4 wrappers and the u32_rotr7 fixture become u8_xor_split7/4 wrappers and a two-operand u32_xor_rotr7, with freshly computed vectors), the new xor_split gadget helpers get clippy-clean byte casts, codegen regenerated, and all 71 kernel FFT pins + the shard aggregate re-measured (median -0.4%, shard -1.3%). aiur (cargo + prove + cross agreement), ixvm (pins + parity), multi-stark and recursive-verifier suites pass; fmt, clippy, deny clean. --- Ix/Aiur/Compiler/Check.lean | 10 - Ix/Aiur/Compiler/Concretize.lean | 18 +- Ix/Aiur/Compiler/Layout.lean | 9 - Ix/Aiur/Compiler/Lower.lean | 6 - Ix/Aiur/Compiler/Match.lean | 2 - Ix/Aiur/Goldilocks.lean | 7 - Ix/Aiur/Interpret.lean | 18 - Ix/Aiur/Meta.lean | 14 - Ix/Aiur/Semantics/BytecodeEval.lean | 12 - Ix/Aiur/Semantics/SourceEval.lean | 18 - Ix/Aiur/Stages/Bytecode.lean | 2 - Ix/Aiur/Stages/Codegen.lean | 7 +- Ix/Aiur/Stages/Concrete.lean | 6 +- Ix/Aiur/Stages/Simple.lean | 6 +- Ix/Aiur/Stages/Source.lean | 14 +- Ix/Aiur/Stages/Typed.lean | 6 +- Ix/IxVM/ByteStream.lean | 16 - Tests/Aiur/Aiur.lean | 26 +- Tests/Aiur/Cross.lean | 39 +- Tests/Ix/IxVM.lean | 142 +- Tests/Main.lean | 4 +- crates/aiur/src/bytecode.rs | 2 - crates/aiur/src/constraints.rs | 55 +- crates/aiur/src/execute.rs | 34 - crates/aiur/src/gadgets/bytes2.rs | 176 +- crates/aiur/src/lib.rs | 9 - crates/aiur/src/synthesis.rs | 35 +- crates/aiur/src/trace.rs | 37 +- crates/ffi/src/aiur/toplevel.rs | 26 +- crates/ixvm-codegen/src/aiur_ixvm.rs | 2208 ++++++++----------- crates/ixvm-codegen/src/aiur_multi_stark.rs | 2208 ++++++++----------- 31 files changed, 2013 insertions(+), 3159 deletions(-) diff --git a/Ix/Aiur/Compiler/Check.lean b/Ix/Aiur/Compiler/Check.lean index ee3cd16d..4e1387c2 100644 --- a/Ix/Aiur/Compiler/Check.lean +++ b/Ix/Aiur/Compiler/Check.lean @@ -786,14 +786,6 @@ def inferTerm (t : Term) : CheckM Typed.Term := match t with let a' ← checkNoEscape a .u8 let b' ← checkNoEscape b .u8 pure (Typed.Term.u8Mul (.tuple #[.u8, .u8]) false a' b') - | .u8ChainRotr7 a b => do - let a' ← checkNoEscape a .u8 - let b' ← checkNoEscape b .u8 - pure (Typed.Term.u8ChainRotr7 (.tuple #[.u8, .u8, .u8]) false a' b') - | .u8ChainRotr4 a b => do - let a' ← checkNoEscape a .u8 - let b' ← checkNoEscape b .u8 - pure (Typed.Term.u8ChainRotr4 (.tuple #[.u8, .u8, .u8]) false a' b') | .u8Sub a b => do -- Low byte and the 0/1 borrow are both `u8` (same range argument as add). let a' ← checkNoEscape a .u8 @@ -1015,8 +1007,6 @@ def zonkTypedTerm (t : Typed.Term) : CheckM Typed.Term := match t with | .u8XorSplit4 τ e a b => do pure (.u8XorSplit4 (← zonkTyp τ) e (← zonkTypedTerm a) (← zonkTypedTerm b)) | .u8Add τ e a b => do pure (.u8Add (← zonkTyp τ) e (← zonkTypedTerm a) (← zonkTypedTerm b)) | .u8Mul τ e a b => do pure (.u8Mul (← zonkTyp τ) e (← zonkTypedTerm a) (← zonkTypedTerm b)) - | .u8ChainRotr7 τ e a b => do pure (.u8ChainRotr7 (← zonkTyp τ) e (← zonkTypedTerm a) (← zonkTypedTerm b)) - | .u8ChainRotr4 τ e a b => do pure (.u8ChainRotr4 (← zonkTyp τ) e (← zonkTypedTerm a) (← zonkTypedTerm b)) | .u8Sub τ e a b => do pure (.u8Sub (← zonkTyp τ) e (← zonkTypedTerm a) (← zonkTypedTerm b)) | .u8And τ e a b => do pure (.u8And (← zonkTyp τ) e (← zonkTypedTerm a) (← zonkTypedTerm b)) | .u8Or τ e a b => do pure (.u8Or (← zonkTyp τ) e (← zonkTypedTerm a) (← zonkTypedTerm b)) diff --git a/Ix/Aiur/Compiler/Concretize.lean b/Ix/Aiur/Compiler/Concretize.lean index 3540a93a..e49519ca 100644 --- a/Ix/Aiur/Compiler/Concretize.lean +++ b/Ix/Aiur/Compiler/Concretize.lean @@ -342,12 +342,6 @@ def termToConcrete | .u8Mul τ e a b => do pure (.u8Mul (← typToConcrete mono τ) e (← termToConcrete mono a) (← termToConcrete mono b)) - | .u8ChainRotr7 τ e a b => do - pure (.u8ChainRotr7 (← typToConcrete mono τ) e - (← termToConcrete mono a) (← termToConcrete mono b)) - | .u8ChainRotr4 τ e a b => do - pure (.u8ChainRotr4 (← typToConcrete mono τ) e - (← termToConcrete mono a) (← termToConcrete mono b)) | .u8Sub τ e a b => do pure (.u8Sub (← typToConcrete mono τ) e (← termToConcrete mono a) (← termToConcrete mono b)) @@ -574,10 +568,6 @@ def rewriteTypedTerm (decls : Typed.Decls) (rewriteTypedTerm decls subst mono a) (rewriteTypedTerm decls subst mono b) | .u8Mul τ e a b => .u8Mul (rewriteTyp subst mono τ) e (rewriteTypedTerm decls subst mono a) (rewriteTypedTerm decls subst mono b) - | .u8ChainRotr7 τ e a b => .u8ChainRotr7 (rewriteTyp subst mono τ) e - (rewriteTypedTerm decls subst mono a) (rewriteTypedTerm decls subst mono b) - | .u8ChainRotr4 τ e a b => .u8ChainRotr4 (rewriteTyp subst mono τ) e - (rewriteTypedTerm decls subst mono a) (rewriteTypedTerm decls subst mono b) | .u8Sub τ e a b => .u8Sub (rewriteTyp subst mono τ) e (rewriteTypedTerm decls subst mono a) (rewriteTypedTerm decls subst mono b) | .u8And τ e a b => .u8And (rewriteTyp subst mono τ) e @@ -674,7 +664,7 @@ def collectInTypedTerm (seen : Std.HashSet (Global × Array Typ)) : args.attach.foldl (fun s ⟨a, _⟩ => collectInTypedTerm s a) seen | .add τ _ a b | .sub τ _ a b | .mul τ _ a b | .u8Xor τ _ a b | .u8XorSplit7 τ _ a b | .u8XorSplit4 τ _ a b | .u8Add τ _ a b | .u8Mul τ _ a b | .u8Sub τ _ a b - | .u8ChainRotr7 τ _ a b | .u8ChainRotr4 τ _ a b | .u8RangeCheck τ _ a b + | .u8RangeCheck τ _ a b | .unconstrainedBigUintDivMod τ _ a b | .u8And τ _ a b | .u8Or τ _ a b | .u8LessThan τ _ a b | .u32LessThan τ _ a b | .unconstrainedU32Add τ _ a b => @@ -749,7 +739,7 @@ def collectCalls (decls : Typed.Decls) bs.attach.foldl (fun s ⟨(_, b), _⟩ => collectCalls decls s b) seen | .add _ _ a b | .sub _ _ a b | .mul _ _ a b | .u8Xor _ _ a b | .u8XorSplit7 _ _ a b | .u8XorSplit4 _ _ a b | .u8Add _ _ a b | .u8Mul _ _ a b | .u8Sub _ _ a b - | .u8ChainRotr7 _ _ a b | .u8ChainRotr4 _ _ a b | .u8RangeCheck _ _ a b + | .u8RangeCheck _ _ a b | .unconstrainedBigUintDivMod _ _ a b | .u8And _ _ a b | .u8Or _ _ a b | .u8LessThan _ _ a b | .u32LessThan _ _ a b | .unconstrainedU32Add _ _ a b => @@ -859,10 +849,6 @@ def substInTypedTerm (subst : Global → Option Typ) : Typed.Term → Typed.Term (substInTypedTerm subst a) (substInTypedTerm subst b) | .u8Mul τ e a b => .u8Mul (Typ.instantiate subst τ) e (substInTypedTerm subst a) (substInTypedTerm subst b) - | .u8ChainRotr7 τ e a b => .u8ChainRotr7 (Typ.instantiate subst τ) e - (substInTypedTerm subst a) (substInTypedTerm subst b) - | .u8ChainRotr4 τ e a b => .u8ChainRotr4 (Typ.instantiate subst τ) e - (substInTypedTerm subst a) (substInTypedTerm subst b) | .u8Sub τ e a b => .u8Sub (Typ.instantiate subst τ) e (substInTypedTerm subst a) (substInTypedTerm subst b) | .u8And τ e a b => .u8And (Typ.instantiate subst τ) e diff --git a/Ix/Aiur/Compiler/Layout.lean b/Ix/Aiur/Compiler/Layout.lean index c5e233a6..ea3cc5bd 100644 --- a/Ix/Aiur/Compiler/Layout.lean +++ b/Ix/Aiur/Compiler/Layout.lean @@ -199,15 +199,6 @@ def opLayout : Bytecode.Op → LayoutM Unit bumpAuxiliaries; bumpLookups | .u8Mul .. => do pushDegrees #[1, 1]; bumpAuxiliaries 2; bumpLookups | .u8XorSplit7 .. | .u8XorSplit4 .. => do pushDegrees #[1, 1]; bumpAuxiliaries 2; bumpLookups - | .u8ChainRotr7 a b | .u8ChainRotr4 a b => do - let aDegree ← getDegree a - let bDegree ← getDegree b - -- The lookup witnesses the rotated byte and the high part of `b`. The - -- shifted-low part of `a` is a linear expression of those values and the - -- inputs, so the third logical output needs no column. - pushDegrees #[1, 1, (aDegree.max bDegree).max 1] - bumpAuxiliaries 2 - bumpLookups | .u8LessThan .. => do pushDegree 1; bumpAuxiliaries; bumpLookups | .u32LessThan .. => do pushDegree 1; bumpAuxiliaries 12; bumpLookups 6 | .unconstrainedU32Add a b => do diff --git a/Ix/Aiur/Compiler/Lower.lean b/Ix/Aiur/Compiler/Lower.lean index 0a763ac0..0a500298 100644 --- a/Ix/Aiur/Compiler/Lower.lean +++ b/Ix/Aiur/Compiler/Lower.lean @@ -308,12 +308,6 @@ def toIndex | .u8Mul _ _ i j => do let i ← expectIdx layoutMap bindings i; let j ← expectIdx layoutMap bindings j pushOp (.u8Mul i j) 2 - | .u8ChainRotr7 _ _ i j => do - let i ← expectIdx layoutMap bindings i; let j ← expectIdx layoutMap bindings j - pushOp (.u8ChainRotr7 i j) 3 - | .u8ChainRotr4 _ _ i j => do - let i ← expectIdx layoutMap bindings i; let j ← expectIdx layoutMap bindings j - pushOp (.u8ChainRotr4 i j) 3 | .u8Sub _ _ i j => do let i ← expectIdx layoutMap bindings i; let j ← expectIdx layoutMap bindings j pushOp (.u8Sub i j) 2 diff --git a/Ix/Aiur/Compiler/Match.lean b/Ix/Aiur/Compiler/Match.lean index b9b07113..16850246 100644 --- a/Ix/Aiur/Compiler/Match.lean +++ b/Ix/Aiur/Compiler/Match.lean @@ -385,8 +385,6 @@ def typedToSimple : Term → Simple.Term | .u8XorSplit4 τ e a b => .u8XorSplit4 τ e (typedToSimple a) (typedToSimple b) | .u8Add τ e a b => .u8Add τ e (typedToSimple a) (typedToSimple b) | .u8Mul τ e a b => .u8Mul τ e (typedToSimple a) (typedToSimple b) - | .u8ChainRotr7 τ e a b => .u8ChainRotr7 τ e (typedToSimple a) (typedToSimple b) - | .u8ChainRotr4 τ e a b => .u8ChainRotr4 τ e (typedToSimple a) (typedToSimple b) | .u8Sub τ e a b => .u8Sub τ e (typedToSimple a) (typedToSimple b) | .u8And τ e a b => .u8And τ e (typedToSimple a) (typedToSimple b) | .u8Or τ e a b => .u8Or τ e (typedToSimple a) (typedToSimple b) diff --git a/Ix/Aiur/Goldilocks.lean b/Ix/Aiur/Goldilocks.lean index dc6c485c..1237453b 100644 --- a/Ix/Aiur/Goldilocks.lean +++ b/Ix/Aiur/Goldilocks.lean @@ -74,13 +74,6 @@ def G.u8Sub (a b : G) : G × G := /-- Chainable partial for a right-rotation by 7 bits over little-endian bytes. Returns `(a>>7 + b<<1, b>>7, a<<1)` (shifts mod 256). -/ -def G.u8ChainRotr7 (a b : G) : G × G × G := - (G.ofNat (a.n / 128 + (b.n * 2) % 256), G.ofNat (b.n / 128), G.ofNat ((a.n * 2) % 256)) - -/-- Chainable partial for a right-rotation by 4 bits over little-endian bytes. -Returns `(a>>4 + b<<4, b>>4, a<<4)` (shifts mod 256). -/ -def G.u8ChainRotr4 (a b : G) : G × G × G := - (G.ofNat (a.n / 16 + (b.n * 16) % 256), G.ofNat (b.n / 16), G.ofNat ((a.n * 16) % 256)) def G.u8ShiftLeft (a : G) : G := G.ofNat ((a.n * 2) % 256) def G.u8ShiftRight (a : G) : G := G.ofNat (a.n / 2) diff --git a/Ix/Aiur/Interpret.lean b/Ix/Aiur/Interpret.lean index 64c42355..bff87e8e 100644 --- a/Ix/Aiur/Interpret.lean +++ b/Ix/Aiur/Interpret.lean @@ -435,24 +435,6 @@ partial def interp (decls : Decls) (bindings : Bindings) : Term → InterpM Valu let hi : Value := .field (G.ofUInt8 (x / 256).toUInt8) return .tuple #[lo, hi] | _, _ => throwErr "u8Mul: expected field values" - | .u8ChainRotr7 t1 t2 => do - match (← interp decls bindings t1), (← interp decls bindings t2) with - | .field a, .field b => - let i := a.val.toUInt8 - let j := b.val.toUInt8 - return .tuple #[.field (G.ofUInt8 ((i >>> 7) + (j <<< 1))), - .field (G.ofUInt8 (j >>> 7)), - .field (G.ofUInt8 (i <<< 1))] - | _, _ => throwErr "u8ChainRotr7: expected field values" - | .u8ChainRotr4 t1 t2 => do - match (← interp decls bindings t1), (← interp decls bindings t2) with - | .field a, .field b => - let i := a.val.toUInt8 - let j := b.val.toUInt8 - return .tuple #[.field (G.ofUInt8 ((i >>> 4) + (j <<< 4))), - .field (G.ofUInt8 (j >>> 4)), - .field (G.ofUInt8 (i <<< 4))] - | _, _ => throwErr "u8ChainRotr4: expected field values" | .u8Sub t1 t2 => do match (← interp decls bindings t1), (← interp decls bindings t2) with | .field a, .field b => diff --git a/Ix/Aiur/Meta.lean b/Ix/Aiur/Meta.lean index 3b7eb0d2..3114305a 100644 --- a/Ix/Aiur/Meta.lean +++ b/Ix/Aiur/Meta.lean @@ -198,8 +198,6 @@ syntax "u8_xor_split7" "(" aiur_trm ", " aiur_trm ")" : ai syntax "u8_xor_split4" "(" aiur_trm ", " aiur_trm ")" : aiur_trm syntax "u8_add" "(" aiur_trm ", " aiur_trm ")" : aiur_trm syntax "u8_mul" "(" aiur_trm ", " aiur_trm ")" : aiur_trm -syntax "u8_chain_rotr7" "(" aiur_trm ", " aiur_trm ")" : aiur_trm -syntax "u8_chain_rotr4" "(" aiur_trm ", " aiur_trm ")" : aiur_trm syntax "u8_sub" "(" aiur_trm ", " aiur_trm ")" : aiur_trm syntax "u8_and" "(" aiur_trm ", " aiur_trm ")" : aiur_trm syntax "u8_or" "(" aiur_trm ", " aiur_trm ")" : aiur_trm @@ -347,10 +345,6 @@ partial def elabTrm : ElabStxCat `aiur_trm mkAppM ``Source.Term.u8Add #[← elabTrm i, ← elabTrm j] | `(aiur_trm| u8_mul($i:aiur_trm, $j:aiur_trm)) => do mkAppM ``Source.Term.u8Mul #[← elabTrm i, ← elabTrm j] - | `(aiur_trm| u8_chain_rotr7($i:aiur_trm, $j:aiur_trm)) => do - mkAppM ``Source.Term.u8ChainRotr7 #[← elabTrm i, ← elabTrm j] - | `(aiur_trm| u8_chain_rotr4($i:aiur_trm, $j:aiur_trm)) => do - mkAppM ``Source.Term.u8ChainRotr4 #[← elabTrm i, ← elabTrm j] | `(aiur_trm| u8_sub($i:aiur_trm, $j:aiur_trm)) => do mkAppM ``Source.Term.u8Sub #[← elabTrm i, ← elabTrm j] | `(aiur_trm| u8_and($i:aiur_trm, $j:aiur_trm)) => do @@ -573,14 +567,6 @@ where let i ← replaceToken old new i let j ← replaceToken old new j `(aiur_trm| u8_mul($i, $j)) - | `(aiur_trm| u8_chain_rotr7($i:aiur_trm, $j:aiur_trm)) => do - let i ← replaceToken old new i - let j ← replaceToken old new j - `(aiur_trm| u8_chain_rotr7($i, $j)) - | `(aiur_trm| u8_chain_rotr4($i:aiur_trm, $j:aiur_trm)) => do - let i ← replaceToken old new i - let j ← replaceToken old new j - `(aiur_trm| u8_chain_rotr4($i, $j)) | `(aiur_trm| u8_sub($i:aiur_trm, $j:aiur_trm)) => do let i ← replaceToken old new i let j ← replaceToken old new j diff --git a/Ix/Aiur/Semantics/BytecodeEval.lean b/Ix/Aiur/Semantics/BytecodeEval.lean index 480a2264..6655a4d1 100644 --- a/Ix/Aiur/Semantics/BytecodeEval.lean +++ b/Ix/Aiur/Semantics/BytecodeEval.lean @@ -319,18 +319,6 @@ def evalOp (t : Bytecode.Toplevel) (fuel : Nat) (op : Op) (st : EvalState) : let prod := x.val.toUInt8.toNat * y.val.toUInt8.toNat let st1 := pushMap st (G.ofUInt8 prod.toUInt8) pure (pushMap st1 (G.ofUInt8 (prod / 256).toUInt8)) - | .u8ChainRotr7 a b => do - let x ← readIdx st a; let y ← readIdx st b - let i := x.val.toUInt8; let j := y.val.toUInt8 - let st1 := pushMap st (G.ofUInt8 ((i >>> 7) + (j <<< 1))) - let st2 := pushMap st1 (G.ofUInt8 (j >>> 7)) - pure (pushMap st2 (G.ofUInt8 (i <<< 1))) - | .u8ChainRotr4 a b => do - let x ← readIdx st a; let y ← readIdx st b - let i := x.val.toUInt8; let j := y.val.toUInt8 - let st1 := pushMap st (G.ofUInt8 ((i >>> 4) + (j <<< 4))) - let st2 := pushMap st1 (G.ofUInt8 (j >>> 4)) - pure (pushMap st2 (G.ofUInt8 (i <<< 4))) | .u8Sub a b => do let x ← readIdx st a; let y ← readIdx st b let i := x.val.toUInt8; let j := y.val.toUInt8 diff --git a/Ix/Aiur/Semantics/SourceEval.lean b/Ix/Aiur/Semantics/SourceEval.lean index c2f5dfdd..206dcf50 100644 --- a/Ix/Aiur/Semantics/SourceEval.lean +++ b/Ix/Aiur/Semantics/SourceEval.lean @@ -510,24 +510,6 @@ def interp (decls : Decls) (fuel : Nat) (bindings : Bindings) .field (G.ofUInt8 (x / 256).toUInt8)]) (interp decls fuel bindings t1 st) (fun st1 => interp decls fuel bindings t2 st1) - | .u8ChainRotr7 t1 t2 => - combineFieldsResult - (fun a b => - let i := a.val.toUInt8; let j := b.val.toUInt8 - .tuple #[.field (G.ofUInt8 ((i >>> 7) + (j <<< 1))), - .field (G.ofUInt8 (j >>> 7)), - .field (G.ofUInt8 (i <<< 1))]) - (interp decls fuel bindings t1 st) - (fun st1 => interp decls fuel bindings t2 st1) - | .u8ChainRotr4 t1 t2 => - combineFieldsResult - (fun a b => - let i := a.val.toUInt8; let j := b.val.toUInt8 - .tuple #[.field (G.ofUInt8 ((i >>> 4) + (j <<< 4))), - .field (G.ofUInt8 (j >>> 4)), - .field (G.ofUInt8 (i <<< 4))]) - (interp decls fuel bindings t1 st) - (fun st1 => interp decls fuel bindings t2 st1) | .u8Sub t1 t2 => combineFieldsResult (fun a b => diff --git a/Ix/Aiur/Stages/Bytecode.lean b/Ix/Aiur/Stages/Bytecode.lean index fb15ba31..7d65d27f 100644 --- a/Ix/Aiur/Stages/Bytecode.lean +++ b/Ix/Aiur/Stages/Bytecode.lean @@ -43,8 +43,6 @@ inductive Op | u8Or : ValIdx → ValIdx → Op | u8LessThan : ValIdx → ValIdx → Op | u32LessThan : ValIdx → ValIdx → Op - | u8ChainRotr7 : ValIdx → ValIdx → Op - | u8ChainRotr4 : ValIdx → ValIdx → Op | debug : String → Option (Array ValIdx) → Op /-- Range-check the two values into `[0, 256)` via the byte chip. Produces no new values: it is a pure side-effect (lookup), and its `u8` results alias the diff --git a/Ix/Aiur/Stages/Codegen.lean b/Ix/Aiur/Stages/Codegen.lean index 4716914c..904807bb 100644 --- a/Ix/Aiur/Stages/Codegen.lean +++ b/Ix/Aiur/Stages/Codegen.lean @@ -349,7 +349,6 @@ def Op.outputCount : Op → Nat | .u8Mul _ _ => 2 | .u8XorSplit7 _ _ | .u8XorSplit4 _ _ => 2 | .u8Add _ _ | .u8Sub _ _ => 2 - | .u8ChainRotr7 _ _ | .u8ChainRotr4 _ _ => 3 | .u32LessThan _ _ => 1 | .u8RangeCheck _ _ => 0 | .unconstrainedBigUintDivMod _ _ => 2 @@ -563,7 +562,7 @@ private def emitU8Bytes2 (out : Nat) (valueHelper : String) s!" else \{ {valueHelper}(__v_{i}, __v_{j}, record) }" return #[.letStmt false s!"__v_{out}" (some "G") (.lit blockExpr)] else - -- 2-tuple outputs (Mul) or 3-tuple (ChainRotr7/4). + -- Multi-output byte operations. let blockExpr : String := s!"if unconstrained \{ Bytes2::{unconShortcut}(&__v_{i}, &__v_{j}) }" ++ s!" else \{ {valueHelper}(__v_{i}, __v_{j}, record) }" @@ -726,8 +725,6 @@ def emitOp (out : Nat) (op : Op) : Array RustStmt := | .u8And i j => emitU8Bytes2 out "bytes2_and_value" "and" i j 1 | .u8Or i j => emitU8Bytes2 out "bytes2_or_value" "or" i j 1 | .u8LessThan i j => emitU8Bytes2 out "bytes2_less_than_value" "less_than" i j 1 - | .u8ChainRotr7 i j => emitU8Bytes2 out "bytes2_chain_rotr7_value" "chain_rotr7" i j 3 - | .u8ChainRotr4 i j => emitU8Bytes2 out "bytes2_chain_rotr4_value" "chain_rotr4" i j 3 | .u8Add i j => emitU8Add out i j | .u8Sub i j => emitU8Sub out i j | .u32LessThan a b => emitU32LessThan out a b @@ -987,8 +984,6 @@ def optionalExecuteUses : Array (String × String) := #[ ("bytes2_mul_value", "bytes2_mul_value"), ("bytes2_add_value", "bytes2_add_value"), ("bytes2_sub_value", "bytes2_sub_value"), - ("bytes2_chain_rotr7_value", "bytes2_chain_rotr7_value"), - ("bytes2_chain_rotr4_value", "bytes2_chain_rotr4_value"), ("bytes2_xor_split7_value", "bytes2_xor_split7_value"), ("bytes2_xor_split4_value", "bytes2_xor_split4_value"), ("unconstrained_big_uint_div_mod_helper", "unconstrained_big_uint_div_mod_helper"), diff --git a/Ix/Aiur/Stages/Concrete.lean b/Ix/Aiur/Stages/Concrete.lean index b426c610..dca29735 100644 --- a/Ix/Aiur/Stages/Concrete.lean +++ b/Ix/Aiur/Stages/Concrete.lean @@ -90,8 +90,6 @@ inductive Term : Type where | unconstrainedU32Add (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term | unconstrainedU32Add3 (typ : Typ) (escapes : Bool) (a : Term) (b : Term) (c : Term) : Term | u32ToField (typ : Typ) (escapes : Bool) (a : Term) : Term - | u8ChainRotr7 (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term - | u8ChainRotr4 (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term | u8RangeCheck (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term | unconstrainedBigUintDivMod (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term | unconstrainedGToBytes (typ : Typ) (escapes : Bool) (a : Term) : Term @@ -114,7 +112,7 @@ def Term.typ : Term → Typ | .u8Xor t _ _ _ | .u8XorSplit7 t _ _ _ | .u8XorSplit4 t _ _ _ | .u8Add t _ _ _ | .u8Mul t _ _ _ | .u8Sub t _ _ _ | .u8And t _ _ _ | .u8Or t _ _ _ | .u8LessThan t _ _ _ | .u32LessThan t _ _ _ | .unconstrainedU32Add t _ _ _ | .unconstrainedU32Add3 t _ _ _ _ | .u32ToField t _ _ - | .u8ChainRotr7 t _ _ _ | .u8ChainRotr4 t _ _ _ | .u8RangeCheck t _ _ _ + | .u8RangeCheck t _ _ _ | .unconstrainedBigUintDivMod t _ _ _ | .unconstrainedGToBytes t _ _ | .unconstrainedGInverse t _ _ | .debug t _ _ _ _ => t @@ -134,7 +132,7 @@ def Term.escapes : Term → Bool | .u8Xor _ e _ _ | .u8XorSplit7 _ e _ _ | .u8XorSplit4 _ e _ _ | .u8Add _ e _ _ | .u8Mul _ e _ _ | .u8Sub _ e _ _ | .u8And _ e _ _ | .u8Or _ e _ _ | .u8LessThan _ e _ _ | .u32LessThan _ e _ _ | .unconstrainedU32Add _ e _ _ | .unconstrainedU32Add3 _ e _ _ _ | .u32ToField _ e _ - | .u8ChainRotr7 _ e _ _ | .u8ChainRotr4 _ e _ _ | .u8RangeCheck _ e _ _ + | .u8RangeCheck _ e _ _ | .unconstrainedBigUintDivMod _ e _ _ | .unconstrainedGToBytes _ e _ | .unconstrainedGInverse _ e _ | .debug _ e _ _ _ => e diff --git a/Ix/Aiur/Stages/Simple.lean b/Ix/Aiur/Stages/Simple.lean index ccdf9734..545390b3 100644 --- a/Ix/Aiur/Stages/Simple.lean +++ b/Ix/Aiur/Stages/Simple.lean @@ -86,8 +86,6 @@ inductive Term : Type where | unconstrainedU32Add (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term | unconstrainedU32Add3 (typ : Typ) (escapes : Bool) (a : Term) (b : Term) (c : Term) : Term | u32ToField (typ : Typ) (escapes : Bool) (a : Term) : Term - | u8ChainRotr7 (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term - | u8ChainRotr4 (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term | u8RangeCheck (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term | unconstrainedBigUintDivMod (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term | unconstrainedGToBytes (typ : Typ) (escapes : Bool) (a : Term) : Term @@ -111,7 +109,7 @@ def Term.typ : Term → Typ | .u8Xor t _ _ _ | .u8XorSplit7 t _ _ _ | .u8XorSplit4 t _ _ _ | .u8Add t _ _ _ | .u8Mul t _ _ _ | .u8Sub t _ _ _ | .u8And t _ _ _ | .u8Or t _ _ _ | .u8LessThan t _ _ _ | .u32LessThan t _ _ _ | .unconstrainedU32Add t _ _ _ | .unconstrainedU32Add3 t _ _ _ _ | .u32ToField t _ _ - | .u8ChainRotr7 t _ _ _ | .u8ChainRotr4 t _ _ _ | .u8RangeCheck t _ _ _ + | .u8RangeCheck t _ _ _ | .unconstrainedBigUintDivMod t _ _ _ | .unconstrainedGToBytes t _ _ | .unconstrainedGInverse t _ _ | .toField t _ _ | .u8FromFieldUnsafe t _ _ @@ -131,7 +129,7 @@ def Term.escapes : Term → Bool | .u8Xor _ e _ _ | .u8XorSplit7 _ e _ _ | .u8XorSplit4 _ e _ _ | .u8Add _ e _ _ | .u8Mul _ e _ _ | .u8Sub _ e _ _ | .u8And _ e _ _ | .u8Or _ e _ _ | .u8LessThan _ e _ _ | .u32LessThan _ e _ _ | .unconstrainedU32Add _ e _ _ | .unconstrainedU32Add3 _ e _ _ _ | .u32ToField _ e _ - | .u8ChainRotr7 _ e _ _ | .u8ChainRotr4 _ e _ _ | .u8RangeCheck _ e _ _ + | .u8RangeCheck _ e _ _ | .unconstrainedBigUintDivMod _ e _ _ | .unconstrainedGToBytes _ e _ | .unconstrainedGInverse _ e _ | .toField _ e _ | .u8FromFieldUnsafe _ e _ diff --git a/Ix/Aiur/Stages/Source.lean b/Ix/Aiur/Stages/Source.lean index 30e9e2de..79964453 100644 --- a/Ix/Aiur/Stages/Source.lean +++ b/Ix/Aiur/Stages/Source.lean @@ -440,8 +440,6 @@ inductive Term /-- Pack four little-endian bytes into a field value. This is a virtual linear expression and does not allocate an auxiliary column. -/ | u32ToField : Term → Term - | u8ChainRotr7 : Term → Term → Term - | u8ChainRotr4 : Term → Term → Term /-- Unconstrained LE byte-list division-modulo hint. Inputs are two `List` (klimbs) values (LE limb order). Output is a tuple of two fresh `List` values `(q, r)` with `q*b + r = a` and `0 ≤ r < b` @@ -698,8 +696,6 @@ def Term.freshen (cnt : Nat) (subst : Std.HashMap Local Local) : | .unconstrainedU32Add a b => let (cnt, a') := Term.freshen cnt subst a; let (cnt, b') := Term.freshen cnt subst b; (cnt, .unconstrainedU32Add a' b') | .unconstrainedU32Add3 a b c => let (cnt, a') := Term.freshen cnt subst a; let (cnt, b') := Term.freshen cnt subst b; let (cnt, c') := Term.freshen cnt subst c; (cnt, .unconstrainedU32Add3 a' b' c') | .u32ToField a => let (cnt, a') := Term.freshen cnt subst a; (cnt, .u32ToField a') - | .u8ChainRotr7 a b => let (cnt, a') := Term.freshen cnt subst a; let (cnt, b') := Term.freshen cnt subst b; (cnt, .u8ChainRotr7 a' b') - | .u8ChainRotr4 a b => let (cnt, a') := Term.freshen cnt subst a; let (cnt, b') := Term.freshen cnt subst b; (cnt, .u8ChainRotr4 a' b') | .unconstrainedBigUintDivMod a b => let (cnt, a') := Term.freshen cnt subst a; let (cnt, b') := Term.freshen cnt subst b; (cnt, .unconstrainedBigUintDivMod a' b') | .u8RangeCheck a b => let (cnt, a') := Term.freshen cnt subst a; let (cnt, b') := Term.freshen cnt subst b; (cnt, .u8RangeCheck a' b') @@ -747,7 +743,7 @@ def Term.inlineCallSites : Term → List (Global × Nat) | .let _ v b => v.inlineCallSites ++ b.inlineCallSites | .add a b | .sub a b | .mul a b | .set a _ b | .u8Xor a b | .u8XorSplit7 a b | .u8XorSplit4 a b | .u8Add a b | .u8Mul a b | .u8Sub a b | .u8And a b | .u8Or a b - | .u8LessThan a b | .u32LessThan a b | .unconstrainedU32Add a b | .u8ChainRotr7 a b | .u8ChainRotr4 a b + | .u8LessThan a b | .u32LessThan a b | .unconstrainedU32Add a b | .unconstrainedBigUintDivMod a b | .u8RangeCheck a b | .ioGetInfo a b => a.inlineCallSites ++ b.inlineCallSites | .assertEq a b _ c => a.inlineCallSites ++ b.inlineCallSites ++ c.inlineCallSites @@ -874,8 +870,6 @@ def Term.expandOnce (done : Std.HashMap Global (List Local × Term)) (cnt : Nat) | .unconstrainedU32Add a b => let (cnt, a') := Term.expandOnce done cnt a; let (cnt, b') := Term.expandOnce done cnt b; (cnt, .unconstrainedU32Add a' b') | .unconstrainedU32Add3 a b c => let (cnt, a') := Term.expandOnce done cnt a; let (cnt, b') := Term.expandOnce done cnt b; let (cnt, c') := Term.expandOnce done cnt c; (cnt, .unconstrainedU32Add3 a' b' c') | .u32ToField a => let (cnt, a') := Term.expandOnce done cnt a; (cnt, .u32ToField a') - | .u8ChainRotr7 a b => let (cnt, a') := Term.expandOnce done cnt a; let (cnt, b') := Term.expandOnce done cnt b; (cnt, .u8ChainRotr7 a' b') - | .u8ChainRotr4 a b => let (cnt, a') := Term.expandOnce done cnt a; let (cnt, b') := Term.expandOnce done cnt b; (cnt, .u8ChainRotr4 a' b') | .unconstrainedBigUintDivMod a b => let (cnt, a') := Term.expandOnce done cnt a; let (cnt, b') := Term.expandOnce done cnt b; (cnt, .unconstrainedBigUintDivMod a' b') | .u8RangeCheck a b => let (cnt, a') := Term.expandOnce done cnt a; let (cnt, b') := Term.expandOnce done cnt b; (cnt, .u8RangeCheck a' b') @@ -1007,10 +1001,6 @@ def Term.hoistLets : Term → Term := | .unconstrainedU32Add3 a b c => let (fs, cs) := Term.peelListLets [Term.hoistLets a, Term.hoistLets b, Term.hoistLets c] match cs with | [a, b, c] => Term.wrapLets fs (.unconstrainedU32Add3 a b c) | _ => t | .u32ToField a => let (fs, c) := Term.peelLets (Term.hoistLets a); Term.wrapLets fs (.u32ToField c) - | .u8ChainRotr7 a b => let (fs, cs) := Term.peelListLets [Term.hoistLets a, Term.hoistLets b] - match cs with | [a, b] => Term.wrapLets fs (.u8ChainRotr7 a b) | _ => t - | .u8ChainRotr4 a b => let (fs, cs) := Term.peelListLets [Term.hoistLets a, Term.hoistLets b] - match cs with | [a, b] => Term.wrapLets fs (.u8ChainRotr4 a b) | _ => t | .unconstrainedBigUintDivMod a b => let (fs, cs) := Term.peelListLets [Term.hoistLets a, Term.hoistLets b] match cs with | [a, b] => Term.wrapLets fs (.unconstrainedBigUintDivMod a b) | _ => t | .u8RangeCheck a b => let (fs, cs) := Term.peelListLets [Term.hoistLets a, Term.hoistLets b] @@ -1108,7 +1098,7 @@ partial def Term.collectGlobals (acc : Std.HashSet Global) : Term → Std.HashSe | .app g args _ => args.foldl (fun a t => t.collectGlobals a) (acc.insert g) | .add a b | .sub a b | .mul a b | .u8Xor a b | .u8XorSplit7 a b | .u8XorSplit4 a b | .u8Add a b | .u8Mul a b | .u8Sub a b | .u8And a b | .u8Or a b | .u8LessThan a b - | .u32LessThan a b | .unconstrainedU32Add a b | .u8ChainRotr7 a b | .u8ChainRotr4 a b + | .u32LessThan a b | .unconstrainedU32Add a b | .u8RangeCheck a b | .unconstrainedBigUintDivMod a b | .ioGetInfo a b => b.collectGlobals (a.collectGlobals acc) | .unconstrainedU32Add3 a b c => c.collectGlobals (b.collectGlobals (a.collectGlobals acc)) diff --git a/Ix/Aiur/Stages/Typed.lean b/Ix/Aiur/Stages/Typed.lean index 50ca8567..40ec6313 100644 --- a/Ix/Aiur/Stages/Typed.lean +++ b/Ix/Aiur/Stages/Typed.lean @@ -62,8 +62,6 @@ inductive Term : Type where | unconstrainedU32Add (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term | unconstrainedU32Add3 (typ : Typ) (escapes : Bool) (a : Term) (b : Term) (c : Term) : Term | u32ToField (typ : Typ) (escapes : Bool) (a : Term) : Term - | u8ChainRotr7 (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term - | u8ChainRotr4 (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term | u8RangeCheck (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term | unconstrainedBigUintDivMod (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term | unconstrainedGToBytes (typ : Typ) (escapes : Bool) (a : Term) : Term @@ -87,7 +85,7 @@ def Term.typ : Term → Typ | .u8Xor t _ _ _ | .u8XorSplit7 t _ _ _ | .u8XorSplit4 t _ _ _ | .u8Add t _ _ _ | .u8Mul t _ _ _ | .u8Sub t _ _ _ | .u8And t _ _ _ | .u8Or t _ _ _ | .u8LessThan t _ _ _ | .u32LessThan t _ _ _ | .unconstrainedU32Add t _ _ _ | .unconstrainedU32Add3 t _ _ _ _ | .u32ToField t _ _ - | .u8ChainRotr7 t _ _ _ | .u8ChainRotr4 t _ _ _ | .u8RangeCheck t _ _ _ + | .u8RangeCheck t _ _ _ | .unconstrainedBigUintDivMod t _ _ _ | .unconstrainedGToBytes t _ _ | .unconstrainedGInverse t _ _ | .toField t _ _ | .u8FromFieldUnsafe t _ _ @@ -107,7 +105,7 @@ def Term.escapes : Term → Bool | .u8Xor _ e _ _ | .u8XorSplit7 _ e _ _ | .u8XorSplit4 _ e _ _ | .u8Add _ e _ _ | .u8Mul _ e _ _ | .u8Sub _ e _ _ | .u8And _ e _ _ | .u8Or _ e _ _ | .u8LessThan _ e _ _ | .u32LessThan _ e _ _ | .unconstrainedU32Add _ e _ _ | .unconstrainedU32Add3 _ e _ _ _ | .u32ToField _ e _ - | .u8ChainRotr7 _ e _ _ | .u8ChainRotr4 _ e _ _ | .u8RangeCheck _ e _ _ + | .u8RangeCheck _ e _ _ | .unconstrainedBigUintDivMod _ e _ _ | .unconstrainedGToBytes _ e _ | .unconstrainedGInverse _ e _ | .toField _ e _ | .u8FromFieldUnsafe _ e _ diff --git a/Ix/IxVM/ByteStream.lean b/Ix/IxVM/ByteStream.lean index 133bd9dd..77193d01 100644 --- a/Ix/IxVM/ByteStream.lean +++ b/Ix/IxVM/ByteStream.lean @@ -101,22 +101,6 @@ def byteStream := ⟦ [w1, w2, w3, w0] } - fn u32_rotr12(w: [U8; 4]) -> [U8; 4] { - let [w0, w1, w2, w3] = w; - let (e0, e1, e2) = u8_chain_rotr4(w1, w2); - let (f0, f1, f2) = u8_chain_rotr4(w3, w0); - [e0, u8_from_field_unsafe(to_field(e1) + to_field(f2)), f0, - u8_from_field_unsafe(to_field(f1) + to_field(e2))] - } - - fn u32_rotr7(w: [U8; 4]) -> [U8; 4] { - let [w0, w1, w2, w3] = w; - let (g0, g1, g2) = u8_chain_rotr7(w0, w1); - let (h0, h1, h2) = u8_chain_rotr7(w2, w3); - [g0, u8_from_field_unsafe(to_field(g1) + to_field(h2)), h0, - u8_from_field_unsafe(to_field(h1) + to_field(g2))] - } - fn u32_xor_rotr7(a: [U8; 4], b: [U8; 4]) -> [U8; 4] { let (h0, l0) = u8_xor_split7(a[0], b[0]); let (h1, l1) = u8_xor_split7(a[1], b[1]); diff --git a/Tests/Aiur/Aiur.lean b/Tests/Aiur/Aiur.lean index 5a9688d3..d78fa2f6 100644 --- a/Tests/Aiur/Aiur.lean +++ b/Tests/Aiur/Aiur.lean @@ -246,16 +246,17 @@ def toplevel := ⟦ (u8_add(i_xor_j, i), u8_add(i_xor_j, j)) } - -- Full u32 right-rotation by 7, built by chaining the partial gadget over - -- adjacent little-endian byte pairs (2 lookups + 2 free field adds). - pub fn u32_rotr7(b: [U8; 4]) -> [U8; 4] { - let [b0, b1, b2, b3] = b; - let (a0, a1, a2) = u8_chain_rotr7(b0, b1); - let (c0, c1, c2) = u8_chain_rotr7(b2, b3); - -- The two combined parts occupy disjoint bit positions, so their sum never - -- overflows a byte: add cheaply as `G`, then reinterpret as `U8`. - [a0, u8_from_field_unsafe(to_field(a1) + to_field(c2)), c0, - u8_from_field_unsafe(to_field(c1) + to_field(a2))] + -- Full u32 xor + right-rotation by 7, built from the fused per-byte + -- xor-split gadget (4 lookups + 4 free field adds). + pub fn u32_xor_rotr7(a: [U8; 4], b: [U8; 4]) -> [U8; 4] { + let (h0, l0) = u8_xor_split7(a[0], b[0]); + let (h1, l1) = u8_xor_split7(a[1], b[1]); + let (h2, l2) = u8_xor_split7(a[2], b[2]); + let (h3, l3) = u8_xor_split7(a[3], b[3]); + [u8_from_field_unsafe(to_field(h0) + to_field(l1)), + u8_from_field_unsafe(to_field(h1) + to_field(l2)), + u8_from_field_unsafe(to_field(h2) + to_field(l3)), + u8_from_field_unsafe(to_field(h3) + to_field(l0))] } --------------------------------------------------------------------------- @@ -812,7 +813,10 @@ def aiurTestCases : List AiurTestCase := [ -- single-op wrappers repeat the same lookup mechanics in aiur-cross. .prove `shr_shr_shl_decompose #[87] #[0, 1, 0, 1, 0, 1, 0, 0], .prove `u8_add_xor #[45, 131] #[219, 0, 49, 1], - .prove `u32_rotr7 #[45, 131, 200, 17] #[6, 145, 35, 90], + .prove `u32_xor_rotr7 #[45, 131, 200, 17, 0, 0, 0, 0] #[6, 145, 35, 90] + (label := "u32_xor_rotr7(x, 0) = rotr7(x)"), + .prove `u32_xor_rotr7 #[45, 131, 200, 17, 200, 17, 45, 131] #[37, 203, 37, 203] + (label := "u32_xor_rotr7(a, b)"), -- u8 range-check: prove the boundary case (U8RangeCheck circuit op) .prove `range_check_id #[0, 255] #[0, 255], diff --git a/Tests/Aiur/Cross.lean b/Tests/Aiur/Cross.lean index 0c30d5c2..d67fb002 100644 --- a/Tests/Aiur/Cross.lean +++ b/Tests/Aiur/Cross.lean @@ -392,19 +392,20 @@ def toplevel : Source.Toplevel := ⟦ pub fn u8_less_than_function(i: U8, j: U8) -> G { u8_less_than(i, j) } pub fn u8_and_function(i: U8, j: U8) -> U8 { u8_and(i, j) } pub fn u8_or_function(i: U8, j: U8) -> U8 { u8_or(i, j) } - pub fn u8_chain_rotr7_function(i: U8, j: U8) -> (U8, U8, U8) { u8_chain_rotr7(i, j) } - pub fn u8_chain_rotr4_function(i: U8, j: U8) -> (U8, U8, U8) { u8_chain_rotr4(i, j) } - - -- Full u32 right-rotation by 7, built by chaining the partial gadget over - -- adjacent little-endian byte pairs (2 lookups + 2 free field adds). - pub fn u32_rotr7(b: [U8; 4]) -> [U8; 4] { - let [b0, b1, b2, b3] = b; - let (a0, a1, a2) = u8_chain_rotr7(b0, b1); - let (c0, c1, c2) = u8_chain_rotr7(b2, b3); - -- The two combined parts occupy disjoint bit positions, so their sum never - -- overflows a byte: add cheaply as `G`, then reinterpret as `U8`. - [a0, u8_from_field_unsafe(to_field(a1) + to_field(c2)), c0, - u8_from_field_unsafe(to_field(c1) + to_field(a2))] + pub fn u8_xor_split7_function(i: U8, j: U8) -> (U8, U8) { u8_xor_split7(i, j) } + pub fn u8_xor_split4_function(i: U8, j: U8) -> (U8, U8) { u8_xor_split4(i, j) } + + -- Full u32 xor + right-rotation by 7, built from the fused per-byte + -- xor-split gadget (4 lookups + 4 free field adds). + pub fn u32_xor_rotr7(a: [U8; 4], b: [U8; 4]) -> [U8; 4] { + let (h0, l0) = u8_xor_split7(a[0], b[0]); + let (h1, l1) = u8_xor_split7(a[1], b[1]); + let (h2, l2) = u8_xor_split7(a[2], b[2]); + let (h3, l3) = u8_xor_split7(a[3], b[3]); + [u8_from_field_unsafe(to_field(h0) + to_field(l1)), + u8_from_field_unsafe(to_field(h1) + to_field(l2)), + u8_from_field_unsafe(to_field(h2) + to_field(l3)), + u8_from_field_unsafe(to_field(h3) + to_field(l0))] } -- u32 less-than wrapper (named to match Aiur) @@ -1463,12 +1464,12 @@ def tests : TestSeq := runAgreement "u8_less_than_function(131,45)" "u8_less_than_function" [131, 45] ++ runAgreement "u8_and_function(45,131)" "u8_and_function" [45, 131] ++ runAgreement "u8_or_function(45,131)" "u8_or_function" [45, 131] ++ - runAgreement "u8_chain_rotr7_function(45,131)" "u8_chain_rotr7_function" [45, 131] ++ - runAgreement "u8_chain_rotr7_function(0,255)" "u8_chain_rotr7_function" [0, 255] ++ - runAgreement "u8_chain_rotr4_function(45,131)" "u8_chain_rotr4_function" [45, 131] ++ - runAgreement "u8_chain_rotr4_function(255,255)" "u8_chain_rotr4_function" [255, 255] ++ - runAgreement "u32_rotr7(45,131,200,17)" "u32_rotr7" - [.array #[45, 131, 200, 17]] ++ + runAgreement "u8_xor_split7_function(45,131)" "u8_xor_split7_function" [45, 131] ++ + runAgreement "u8_xor_split7_function(0,255)" "u8_xor_split7_function" [0, 255] ++ + runAgreement "u8_xor_split4_function(45,131)" "u8_xor_split4_function" [45, 131] ++ + runAgreement "u8_xor_split4_function(255,255)" "u8_xor_split4_function" [255, 255] ++ + runAgreement "u32_xor_rotr7(a,b)" "u32_xor_rotr7" + [.array #[45, 131, 200, 17], .array #[200, 17, 45, 131]] ++ runAgreement "range_check_id(45,200)" "range_check_id" [45, 200] ++ runAgreement "range_check_id(0,255)" "range_check_id" [0, 255] ++ runAgreement "u8_lit_xor(45)" "u8_lit_xor" [45] ++ diff --git a/Tests/Ix/IxVM.lean b/Tests/Ix/IxVM.lean index bc8bc399..1f430c5e 100644 --- a/Tests/Ix/IxVM.lean +++ b/Tests/Ix/IxVM.lean @@ -276,77 +276,77 @@ private def nameOfString (str : String) : Lean.Name := listed constant fails the suite, so a regression cannot land quietly and an improvement has to be acknowledged by re-pinning. -/ private def kernelCheckEntries : List (String × Nat) := [ - ("HEq", 129_254_110), - ("HEq.rec", 132_267_746), - ("Eq.rec", 131_840_548), - ("Nat", 129_251_240), - ("Nat.add", 159_976_139), - ("Nat.add_comm", 269_826_741), - ("Nat.decEq", 316_306_475), - ("Nat.decLe", 657_633_621), - ("Nat.sub_le_of_le_add", 1_591_047_245), - ("Nat.shiftRight_succ", 1_182_784_613), - ("Trans.mk", 134_089_898), - ("Array.append_assoc", 7_776_192_966), - ("Vector.append", 7_956_366_628), - ("IxVMPrim.nat_add_lit", 193_863_574), - ("IxVMPrim.nat_sub_lit", 207_451_548), - ("IxVMPrim.nat_mul_lit", 186_496_116), - ("IxVMPrim.nat_mul_big", 185_208_889), - ("IxVMPrim.nat_div_lit", 1_155_188_110), - ("IxVMPrim.nat_mod_lit", 1_176_787_685), - ("IxVMPrim.nat_succ_lit", 141_092_091), - ("IxVMPrim.nat_pred_lit", 158_550_857), - ("IxVMPrim.nat_gcd_lit", 1_835_986_549), - ("IxVMPrim.nat_land_lit", 2_974_562_959), - ("IxVMPrim.nat_lor_lit", 2_976_470_928), - ("IxVMPrim.nat_xor_lit", 2_992_414_760), - ("IxVMPrim.nat_shl_lit", 209_514_562), - ("IxVMPrim.nat_shr_lit", 1_167_290_043), - ("IxVMPrim.nat_pow_big", 363_604_322), - ("IxVMPrim.nat_beq_lit", 185_193_565), - ("IxVMPrim.nat_ble_lit", 180_791_713), - ("IxVMPrim.nat_cases_big", 158_412_942), - ("IxVMPrim.nat_dec_le", 673_001_206), - ("IxVMPrim.nat_dec_lt", 682_338_635), - ("IxVMPrim.nat_dec_eq", 349_014_369), - ("IxVMPrim.str_size_lit", 2_091_299_048), - ("IxVMPrim.bv_to_nat_lit", 1_745_906_931), - ("IxVMInd.Even", 188_612_036), - ("IxVMInd.Odd", 188_614_652), - ("IxVMInd.Even.rec", 203_495_950), - ("IxVMInd.Odd.rec", 203_496_873), - ("IxVMInd.Tree", 130_440_848), - ("IxVMInd.Tree.rec", 138_120_963), - ("IxVMInd.DedupM", 133_054_340), - ("IxVMInd.DedupM.rec", 143_419_414), - ("IxVMInd.DepthM", 131_812_849), - ("IxVMInd.DepthM.rec", 140_522_850), - ("String.Internal.append", 2_067_826_357), - ("_private.Init.Prelude.0.Lean.extractMainModule._unsafe_rec", 3_055_690_533), - ("Lean.Syntax.rec", 2_113_411_326), - ("IxVMInd.AuxTie", 282_761_489), - ("IxVMInd.AuxTie.rec", 315_653_923), - ("IxVMInd.HiddenIdx", 129_737_969), - ("IxVMInd.HiddenIdx.rec", 131_905_650), - ("IxVMInd.thmMajorUse", 444_104_687), - ("IxVMInd.partialKRec", 146_448_547), - ("IxVMInd.deepRebase", 196_219_244), - ("String.Slice.Pattern.Model.NoPrefixForwardPatternModel.rec", 2_907_963_643), - ("Lean.Widget.TaggedText.rec", 2_089_079_145), - ("Lean.Doc.Part.rec", 2_124_332_896), - ("Lean.Doc.Block.rec", 2_262_528_860), - ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedup1.A", 131_489_937), - ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedup1.A.rec", 133_963_600), - ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedup1.A.rec_1", 133_330_856), - ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedup1.A.rec_2", 133_330_856), - ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedup2.A.rec_1", 133_330_856), - ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedupMixed.M", 131_688_259), - ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedupMixed.M.rec", 140_354_517), - ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedupMixed.M.rec_1", 140_353_730), - ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedupMixed.M.rec_2", 133_330_856), - ("strOfListFoldSize", 2_334_681_616), - ("strOfListFoldSizeAscii", 2_335_366_310), + ("HEq", 129_239_352), + ("HEq.rec", 132_223_727), + ("Eq.rec", 131_796_529), + ("Nat", 129_236_482), + ("Nat.add", 159_622_648), + ("Nat.add_comm", 268_281_415), + ("Nat.decEq", 314_555_983), + ("Nat.decLe", 652_460_137), + ("Nat.sub_le_of_le_add", 1_577_107_099), + ("Nat.shiftRight_succ", 1_172_558_269), + ("Trans.mk", 134_045_879), + ("Array.append_assoc", 7_717_816_042), + ("Vector.append", 7_895_919_380), + ("IxVMPrim.nat_add_lit", 193_045_591), + ("IxVMPrim.nat_sub_lit", 206_429_542), + ("IxVMPrim.nat_mul_lit", 185_748_803), + ("IxVMPrim.nat_mul_big", 184_484_961), + ("IxVMPrim.nat_div_lit", 1_145_177_643), + ("IxVMPrim.nat_mod_lit", 1_166_515_024), + ("IxVMPrim.nat_succ_lit", 140_893_385), + ("IxVMPrim.nat_pred_lit", 158_099_686), + ("IxVMPrim.nat_gcd_lit", 1_819_307_333), + ("IxVMPrim.nat_land_lit", 2_945_733_257), + ("IxVMPrim.nat_lor_lit", 2_947_607_339), + ("IxVMPrim.nat_xor_lit", 2_963_279_952), + ("IxVMPrim.nat_shl_lit", 208_443_817), + ("IxVMPrim.nat_shr_lit", 1_157_079_133), + ("IxVMPrim.nat_pow_big", 361_995_186), + ("IxVMPrim.nat_beq_lit", 184_481_296), + ("IxVMPrim.nat_ble_lit", 180_137_392), + ("IxVMPrim.nat_cases_big", 157_983_733), + ("IxVMPrim.nat_dec_le", 667_624_988), + ("IxVMPrim.nat_dec_lt", 676_831_686), + ("IxVMPrim.nat_dec_eq", 346_845_775), + ("IxVMPrim.str_size_lit", 2_070_772_915), + ("IxVMPrim.bv_to_nat_lit", 1_729_888_453), + ("IxVMInd.Even", 187_829_482), + ("IxVMInd.Odd", 187_832_098), + ("IxVMInd.Even.rec", 202_546_550), + ("IxVMInd.Odd.rec", 202_547_473), + ("IxVMInd.Tree", 130_412_124), + ("IxVMInd.Tree.rec", 137_998_975), + ("IxVMInd.DedupM", 132_977_133), + ("IxVMInd.DedupM.rec", 143_220_708), + ("IxVMInd.DepthM", 131_760_815), + ("IxVMInd.DepthM.rec", 140_372_714), + ("String.Internal.append", 2_047_628_926), + ("_private.Init.Prelude.0.Lean.extractMainModule._unsafe_rec", 3_025_111_266), + ("Lean.Syntax.rec", 2_092_588_961), + ("IxVMInd.AuxTie", 280_526_725), + ("IxVMInd.AuxTie.rec", 313_017_899), + ("IxVMInd.HiddenIdx", 129_716_432), + ("IxVMInd.HiddenIdx.rec", 131_861_631), + ("IxVMInd.thmMajorUse", 441_019_720), + ("IxVMInd.partialKRec", 146_209_750), + ("IxVMInd.deepRebase", 195_377_539), + ("String.Slice.Pattern.Model.NoPrefixForwardPatternModel.rec", 2_880_537_174), + ("Lean.Widget.TaggedText.rec", 2_068_700_986), + ("Lean.Doc.Part.rec", 2_103_559_929), + ("Lean.Doc.Block.rec", 2_240_484_783), + ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedup1.A", 131_437_903), + ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedup1.A.rec", 133_877_688), + ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedup1.A.rec_1", 133_270_605), + ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedup1.A.rec_2", 133_270_605), + ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedup2.A.rec_1", 133_270_605), + ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedupMixed.M", 131_636_225), + ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedupMixed.M.rec", 140_194_821), + ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedupMixed.M.rec_1", 140_194_035), + ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedupMixed.M.rec_2", 133_270_605), + ("strOfListFoldSize", 2_311_060_373), + ("strOfListFoldSizeAscii", 2_311_728_414), ] /-- Variant of `kernelChecks`, pinned to the baseline diff --git a/Tests/Main.lean b/Tests/Main.lean index e2f2dd6c..59203355 100644 --- a/Tests/Main.lean +++ b/Tests/Main.lean @@ -223,8 +223,8 @@ def ignoredRunners (env : Lean.Environment) : List (String × IO UInt32) := [ let actual := (Aiur.computeStats v2Env.compiled qc v2Env.shapes).totalFftCost.round.toUInt64.toNat pure (LSpec.test - s!"Shard pipeline FFT matches: expected 6160062690, got {actual}" - (actual = 6_160_062_690)) + s!"Shard pipeline FFT matches: expected 6079191308, got {actual}" + (actual = 6_079_191_308)) LSpec.lspecIO (.ofList [("ixvm", [fullSeq, aiurSeq, arenaSeq, exploitSeq, paritySeq, shardSeq])]) []), diff --git a/crates/aiur/src/bytecode.rs b/crates/aiur/src/bytecode.rs index 626063d1..da521d83 100644 --- a/crates/aiur/src/bytecode.rs +++ b/crates/aiur/src/bytecode.rs @@ -60,8 +60,6 @@ pub enum Op { U8Or(ValIdx, ValIdx), U8LessThan(ValIdx, ValIdx), U32LessThan(ValIdx, ValIdx), - U8ChainRotr7(ValIdx, ValIdx), - U8ChainRotr4(ValIdx, ValIdx), Debug(String, Option>), /// Range-check two values into `[0, 256)` via the byte chip. Produces no new /// values: its `u8` results alias the two inputs (cf. `AssertEq`). diff --git a/crates/aiur/src/constraints.rs b/crates/aiur/src/constraints.rs index 500c1249..2ecd46fd 100644 --- a/crates/aiur/src/constraints.rs +++ b/crates/aiur/src/constraints.rs @@ -14,10 +14,9 @@ use crate::{ bytes2::{Bytes2, Bytes2Op}, }, memory_channel, u8_add_channel, u8_and_channel, u8_bit_decomposition_channel, - u8_chain_rotr4_channel, u8_chain_rotr7_channel, u8_less_than_channel, - u8_mul_channel, u8_or_channel, u8_range_check_channel, u8_shift_left_channel, - u8_shift_right_channel, u8_sub_channel, u8_xor_channel, - u8_xor_split4_channel, u8_xor_split7_channel, + u8_less_than_channel, u8_mul_channel, u8_or_channel, u8_range_check_channel, + u8_shift_left_channel, u8_shift_right_channel, u8_sub_channel, + u8_xor_channel, u8_xor_split4_channel, u8_xor_split7_channel, }; type Expr = multi_stark::expr::Expr; @@ -657,54 +656,6 @@ impl Op { sel.clone(), state, ), - Op::U8ChainRotr7(i, j) => { - let (a, a_deg) = state.map[*i].clone(); - let (b, b_deg) = state.map[*j].clone(); - let rotated = state.next_auxiliary(); - let b_high = state.next_auxiliary(); - let a_high = rotated.clone() - konst(G::from_u64(2)) * b.clone() - + konst(G::from_u64(256)) * b_high.clone(); - let a_shifted = - konst(G::from_u64(2)) * a.clone() - konst(G::from_u64(256)) * a_high; - let lookup_args = vec![ - state.gate(sel, konst(u8_chain_rotr7_channel())), - state.gate(sel, a), - state.gate(sel, b), - state.gate(sel, rotated.clone()), - state.gate(sel, b_high.clone()), - state.gate(sel, a_shifted.clone()), - ]; - let lookup = state.next_lookup(); - combine_lookup_args(lookup, lookup_args); - lookup.multiplicity = lookup.multiplicity.clone() + sel.clone(); - state.map.push((rotated, 1)); - state.map.push((b_high, 1)); - state.map.push((a_shifted, a_deg.max(b_deg).max(1))); - }, - Op::U8ChainRotr4(i, j) => { - let (a, a_deg) = state.map[*i].clone(); - let (b, b_deg) = state.map[*j].clone(); - let rotated = state.next_auxiliary(); - let b_high = state.next_auxiliary(); - let b_low = b.clone() - konst(G::from_u64(16)) * b_high.clone(); - let a_high = rotated.clone() - konst(G::from_u64(16)) * b_low; - let a_shifted = - konst(G::from_u64(16)) * a.clone() - konst(G::from_u64(256)) * a_high; - let lookup_args = vec![ - state.gate(sel, konst(u8_chain_rotr4_channel())), - state.gate(sel, a), - state.gate(sel, b), - state.gate(sel, rotated.clone()), - state.gate(sel, b_high.clone()), - state.gate(sel, a_shifted.clone()), - ]; - let lookup = state.next_lookup(); - combine_lookup_args(lookup, lookup_args); - lookup.multiplicity = lookup.multiplicity.clone() + sel.clone(); - state.map.push((rotated, 1)); - state.map.push((b_high, 1)); - state.map.push((a_shifted, a_deg.max(b_deg).max(1))); - }, Op::U8RangeCheck(i, j) => { // Pure range-check lookup: no output columns (the `u8` results alias // the inputs), just require `(i, j)` from the byte chip. diff --git a/crates/aiur/src/execute.rs b/crates/aiur/src/execute.rs index b3488663..61235c49 100644 --- a/crates/aiur/src/execute.rs +++ b/crates/aiur/src/execute.rs @@ -580,22 +580,6 @@ impl Function { } } }, - ExecEntry::Op(Op::U8ChainRotr7(i, j)) => { - if unconstrained { - let (o0, o1, o2) = Bytes2::chain_rotr7(&map[*i], &map[*j]); - map.extend([o0, o1, o2]); - } else { - bytes2_execute(*i, *j, &Bytes2Op::ChainRotr7, &mut map, record); - } - }, - ExecEntry::Op(Op::U8ChainRotr4(i, j)) => { - if unconstrained { - let (o0, o1, o2) = Bytes2::chain_rotr4(&map[*i], &map[*j]); - map.extend([o0, o1, o2]); - } else { - bytes2_execute(*i, *j, &Bytes2Op::ChainRotr4, &mut map, record); - } - }, ExecEntry::Op(Op::U8RangeCheck(i, j)) => { // No `map.push`: the two `u8` outputs alias the inputs `i`, `j`. // Records a range-check query so the byte-chip lookup is satisfied. @@ -849,24 +833,6 @@ pub fn bytes2_mul_value(a: G, b: G, record: &mut QueryRecord) -> (G, G) { } #[inline] -pub fn bytes2_chain_rotr7_value( - a: G, - b: G, - record: &mut QueryRecord, -) -> (G, G, G) { - record.bytes2_queries.bump_chain_rotr7(&a, &b); - Bytes2::chain_rotr7(&a, &b) -} - -#[inline] -pub fn bytes2_chain_rotr4_value( - a: G, - b: G, - record: &mut QueryRecord, -) -> (G, G, G) { - record.bytes2_queries.bump_chain_rotr4(&a, &b); - Bytes2::chain_rotr4(&a, &b) -} pub fn bytes2_xor_split7_value(a: G, b: G, record: &mut QueryRecord) -> (G, G) { record.bytes2_queries.bump_xor_split7(&a, &b); Bytes2::xor_split7(&a, &b) diff --git a/crates/aiur/src/gadgets/bytes2.rs b/crates/aiur/src/gadgets/bytes2.rs index 2758f9a8..1fffd666 100644 --- a/crates/aiur/src/gadgets/bytes2.rs +++ b/crates/aiur/src/gadgets/bytes2.rs @@ -7,9 +7,8 @@ use multi_stark::{ use crate::{ G, execute::QueryRecord, gadgets::AiurGadget, u8_add_channel, u8_and_channel, - u8_chain_rotr4_channel, u8_chain_rotr7_channel, u8_less_than_channel, - u8_mul_channel, u8_or_channel, u8_range_check_channel, u8_sub_channel, - u8_xor_channel, u8_xor_split4_channel, u8_xor_split7_channel, + u8_less_than_channel, u8_mul_channel, u8_or_channel, u8_range_check_channel, + u8_sub_channel, u8_xor_channel, u8_xor_split4_channel, u8_xor_split7_channel, }; /// Number of columns in the trace with multiplicities for @@ -21,9 +20,9 @@ use crate::{ /// - less_than /// - range_check /// - mul -/// - chain_rotr7 -/// - chain_rotr4 -const TRACE_WIDTH: usize = 12; +/// - xor_split7 +/// - xor_split4 +const TRACE_WIDTH: usize = 10; /// Number of columns in the preprocessed trace: /// - first raw byte value @@ -38,13 +37,9 @@ const TRACE_WIDTH: usize = 12; /// - less_than result /// - mul low byte /// - mul high byte -/// - chain_rotr7 output 0 (`i >> 7 + j << 1`) -/// - chain_rotr7 output 1 (`j >> 7`) -/// - chain_rotr7 output 2 (`i << 1`) -/// - chain_rotr4 output 0 (`i >> 4 + j << 4`) -/// - chain_rotr4 output 1 (`j >> 4`) -/// - chain_rotr4 output 2 (`i << 4`) -const PREPROCESSED_TRACE_WIDTH: usize = 20; +/// - xor_split7 high and shifted-low outputs +/// - xor_split4 high and shifted-low outputs +const PREPROCESSED_TRACE_WIDTH: usize = 14; /// AIR implementer for arity 2 byte-related lookups. pub struct Bytes2; @@ -57,8 +52,6 @@ pub enum Bytes2Op { And, Or, LessThan, - ChainRotr7, - ChainRotr4, XorSplit7, XorSplit4, } @@ -75,7 +68,6 @@ impl AiurGadget for Bytes2 { | Bytes2Op::Add | Bytes2Op::Sub => 1, Bytes2Op::Mul | Bytes2Op::XorSplit7 | Bytes2Op::XorSplit4 => 2, - Bytes2Op::ChainRotr7 | Bytes2Op::ChainRotr4 => 3, } } @@ -116,16 +108,6 @@ impl AiurGadget for Bytes2 { trace_values.push(G::from_u8((p & 0xff) as u8)); trace_values.push(G::from_u8((p >> 8) as u8)); - // Chain rotr7 (combined byte, j high bit, i low part) - let (o0, o1, o2) = Self::chain_rotr7_u8(i, j); - trace_values.push(G::from_u8(o0)); - trace_values.push(G::from_u8(o1)); - trace_values.push(G::from_u8(o2)); - // Chain rotr4 (combined byte, j high nibble, i low nibble) - let (o0, o1, o2) = Self::chain_rotr4_u8(i, j); - trace_values.push(G::from_u8(o0)); - trace_values.push(G::from_u8(o1)); - trace_values.push(G::from_u8(o2)); let (hi, lo) = Self::xor_split7_u8(i, j); trace_values.extend([G::from_u8(hi), G::from_u8(lo)]); let (hi, lo) = Self::xor_split4_u8(i, j); @@ -175,16 +157,6 @@ impl AiurGadget for Bytes2 { record.bytes2_queries.bump_less_than(i, j); vec![Self::less_than(i, j)] }, - Bytes2Op::ChainRotr7 => { - record.bytes2_queries.bump_chain_rotr7(i, j); - let (o0, o1, o2) = Self::chain_rotr7(i, j); - vec![o0, o1, o2] - }, - Bytes2Op::ChainRotr4 => { - record.bytes2_queries.bump_chain_rotr4(i, j); - let (o0, o1, o2) = Self::chain_rotr4(i, j); - vec![o0, o1, o2] - }, Bytes2Op::XorSplit7 => { record.bytes2_queries.bump_xor_split7(i, j); let (hi, lo) = Self::xor_split7(i, j); @@ -208,8 +180,6 @@ impl AiurGadget for Bytes2 { let less_than_channel = Expr::constant(u8_less_than_channel()); let range_check_channel = Expr::constant(u8_range_check_channel()); let mul_channel = Expr::constant(u8_mul_channel()); - let chain_rotr7_channel = Expr::constant(u8_chain_rotr7_channel()); - let chain_rotr4_channel = Expr::constant(u8_chain_rotr4_channel()); let xor_split7_channel = Expr::constant(u8_xor_split7_channel()); let xor_split4_channel = Expr::constant(u8_xor_split4_channel()); @@ -222,10 +192,8 @@ impl AiurGadget for Bytes2 { let less_than_multiplicity = Expr::main(5); let range_check_multiplicity = Expr::main(6); let mul_multiplicity = Expr::main(7); - let chain_rotr7_multiplicity = Expr::main(8); - let chain_rotr4_multiplicity = Expr::main(9); - let xor_split7_multiplicity = Expr::main(10); - let xor_split4_multiplicity = Expr::main(11); + let xor_split7_multiplicity = Expr::main(8); + let xor_split4_multiplicity = Expr::main(9); // Preprocessed columns let i = Expr::preprocessed(0); @@ -238,16 +206,10 @@ impl AiurGadget for Bytes2 { let less_than = Expr::preprocessed(7); let mul_lo = Expr::preprocessed(8); let mul_hi = Expr::preprocessed(9); - let chain_rotr7_o0 = Expr::preprocessed(10); - let chain_rotr7_o1 = Expr::preprocessed(11); - let chain_rotr7_o2 = Expr::preprocessed(12); - let chain_rotr4_o0 = Expr::preprocessed(13); - let chain_rotr4_o1 = Expr::preprocessed(14); - let chain_rotr4_o2 = Expr::preprocessed(15); - let xor_split7_hi = Expr::preprocessed(16); - let xor_split7_lo = Expr::preprocessed(17); - let xor_split4_hi = Expr::preprocessed(18); - let xor_split4_lo = Expr::preprocessed(19); + let xor_split7_hi = Expr::preprocessed(10); + let xor_split7_lo = Expr::preprocessed(11); + let xor_split4_hi = Expr::preprocessed(12); + let xor_split4_lo = Expr::preprocessed(13); // pull = negated multiplicity. let pull_xor = Lookup { @@ -290,29 +252,6 @@ impl AiurGadget for Bytes2 { args: vec![range_check_channel, i.clone(), j.clone()], }; - let pull_chain_rotr7 = Lookup { - multiplicity: -chain_rotr7_multiplicity, - args: vec![ - chain_rotr7_channel, - i.clone(), - j.clone(), - chain_rotr7_o0, - chain_rotr7_o1, - chain_rotr7_o2, - ], - }; - - let pull_chain_rotr4 = Lookup { - multiplicity: -chain_rotr4_multiplicity, - args: vec![ - chain_rotr4_channel, - i.clone(), - j.clone(), - chain_rotr4_o0, - chain_rotr4_o1, - chain_rotr4_o2, - ], - }; let pull_xor_split7 = Lookup { multiplicity: -xor_split7_multiplicity, args: vec![ @@ -337,8 +276,6 @@ impl AiurGadget for Bytes2 { pull_less_than, pull_range_check, pull_mul, - pull_chain_rotr7, - pull_chain_rotr4, pull_xor_split7, pull_xor_split4, ] @@ -363,8 +300,6 @@ impl AiurGadget for Bytes2 { let less_than_channel = u8_less_than_channel(); let range_check_channel = u8_range_check_channel(); let mul_channel = u8_mul_channel(); - let chain_rotr7_channel = u8_chain_rotr7_channel(); - let chain_rotr4_channel = u8_chain_rotr4_channel(); let xor_split7_channel = u8_xor_split7_channel(); let xor_split4_channel = u8_xor_split4_channel(); @@ -386,8 +321,6 @@ impl AiurGadget for Bytes2 { less_than, range_check, mul, - chain_rotr7, - chain_rotr4, xor_split7, xor_split4, ], @@ -405,10 +338,8 @@ impl AiurGadget for Bytes2 { row[5] = less_than; row[6] = range_check; row[7] = mul; - row[8] = chain_rotr7; - row[9] = chain_rotr4; - row[10] = xor_split7; - row[11] = xor_split4; + row[8] = xor_split7; + row[9] = xor_split4; // Pull xor. row_lookups.pull(0, xor, &[xor_channel, i, j, Self::xor(&i, &j)]); @@ -434,9 +365,9 @@ impl AiurGadget for Bytes2 { &[less_than_channel, i, j, Self::less_than(&i, &j)], ); let (hi, lo) = Self::xor_split7(&i, &j); - row_lookups.pull(10, xor_split7, &[xor_split7_channel, i, j, hi, lo]); + row_lookups.pull(8, xor_split7, &[xor_split7_channel, i, j, hi, lo]); let (hi, lo) = Self::xor_split4(&i, &j); - row_lookups.pull(11, xor_split4, &[xor_split4_channel, i, j, hi, lo]); + row_lookups.pull(9, xor_split4, &[xor_split4_channel, i, j, hi, lo]); // Pull range_check. row_lookups.pull(6, range_check, &[range_check_channel, i, j]); @@ -444,22 +375,6 @@ impl AiurGadget for Bytes2 { // Pull mul. let (lo, hi) = Self::mul(&i, &j); row_lookups.pull(7, mul, &[mul_channel, i, j, lo, hi]); - - // Pull chain_rotr7. - let (o0, o1, o2) = Self::chain_rotr7(&i, &j); - row_lookups.pull( - 8, - chain_rotr7, - &[chain_rotr7_channel, i, j, o0, o1, o2], - ); - - // Pull chain_rotr4. - let (o0, o1, o2) = Self::chain_rotr4(&i, &j); - row_lookups.pull( - 9, - chain_rotr4, - &[chain_rotr4_channel, i, j, o0, o1, o2], - ); }, ); drop(row_writers); @@ -508,18 +423,11 @@ impl Bytes2Queries { self.bump_multiplicity_for(i, j, 7) } - pub(crate) fn bump_chain_rotr7(&mut self, i: &G, j: &G) { - self.bump_multiplicity_for(i, j, 8) - } - - pub(crate) fn bump_chain_rotr4(&mut self, i: &G, j: &G) { - self.bump_multiplicity_for(i, j, 9) - } pub(crate) fn bump_xor_split7(&mut self, i: &G, j: &G) { - self.bump_multiplicity_for(i, j, 10) + self.bump_multiplicity_for(i, j, 8) } pub(crate) fn bump_xor_split4(&mut self, i: &G, j: &G) { - self.bump_multiplicity_for(i, j, 11) + self.bump_multiplicity_for(i, j, 9) } pub(crate) fn bump_multiplicity_for(&mut self, i: &G, j: &G, col: usize) { @@ -541,15 +449,15 @@ impl Bytes2 { } pub fn xor_split7(i: &G, j: &G) -> (G, G) { let (a, b) = Self::xor_split7_u8( - i.as_canonical_u64() as u8, - j.as_canonical_u64() as u8, + u8::try_from(i.as_canonical_u64()).expect("byte-table input"), + u8::try_from(j.as_canonical_u64()).expect("byte-table input"), ); (G::from_u8(a), G::from_u8(b)) } pub fn xor_split4(i: &G, j: &G) -> (G, G) { let (a, b) = Self::xor_split4_u8( - i.as_canonical_u64() as u8, - j.as_canonical_u64() as u8, + u8::try_from(i.as_canonical_u64()).expect("byte-table input"), + u8::try_from(j.as_canonical_u64()).expect("byte-table input"), ); (G::from_u8(a), G::from_u8(b)) } @@ -605,40 +513,4 @@ impl Bytes2 { let p = u16::from(i) * u16::from(j); (G::from_u8((p & 0xff) as u8), G::from_u8((p >> 8) as u8)) } - - /// Chainable building block for a right-rotation by 7 bits over a sequence - /// of little-endian bytes. Given adjacent bytes `i`, `j`, returns - /// `(i>>7 + j<<1, j>>7, i<<1)` where shifts are taken mod 256. Chaining the - /// outputs across all adjacent byte pairs yields a `rotr7` of any width - /// (u16, u32, u64, ...): e.g. the u32 `rotr7` of `[b0,b1,b2,b3]` is - /// `[A0, A1+B2, B0, B1+A2]` for `A = chain_rotr7(b0,b1)`, - /// `B = chain_rotr7(b2,b3)`. - #[inline] - pub fn chain_rotr7_u8(i: u8, j: u8) -> (u8, u8, u8) { - ((i >> 7) + (j << 1), j >> 7, i << 1) - } - - /// Chainable building block for a right-rotation by 4 bits over a sequence - /// of little-endian bytes. Given adjacent bytes `i`, `j`, returns - /// `(i>>4 + j<<4, j>>4, i<<4)` where shifts are taken mod 256. - #[inline] - pub fn chain_rotr4_u8(i: u8, j: u8) -> (u8, u8, u8) { - ((i >> 4) + (j << 4), j >> 4, i << 4) - } - - #[inline] - pub fn chain_rotr7(i: &G, j: &G) -> (G, G, G) { - let i: u8 = i.as_canonical_u64().try_into().unwrap(); - let j: u8 = j.as_canonical_u64().try_into().unwrap(); - let (o0, o1, o2) = Self::chain_rotr7_u8(i, j); - (G::from_u8(o0), G::from_u8(o1), G::from_u8(o2)) - } - - #[inline] - pub fn chain_rotr4(i: &G, j: &G) -> (G, G, G) { - let i: u8 = i.as_canonical_u64().try_into().unwrap(); - let j: u8 = j.as_canonical_u64().try_into().unwrap(); - let (o0, o1, o2) = Self::chain_rotr4_u8(i, j); - (G::from_u8(o0), G::from_u8(o1), G::from_u8(o2)) - } } diff --git a/crates/aiur/src/lib.rs b/crates/aiur/src/lib.rs index c5afb9f8..8f34e8e0 100644 --- a/crates/aiur/src/lib.rs +++ b/crates/aiur/src/lib.rs @@ -80,15 +80,6 @@ pub fn u8_mul_channel() -> G { G::from_u8(12) } -#[inline] -pub fn u8_chain_rotr7_channel() -> G { - G::from_u8(13) -} - -#[inline] -pub fn u8_chain_rotr4_channel() -> G { - G::from_u8(14) -} #[inline] pub fn u8_xor_split7_channel() -> G { G::from_u8(15) diff --git a/crates/aiur/src/synthesis.rs b/crates/aiur/src/synthesis.rs index 0de2a206..47d7ea37 100644 --- a/crates/aiur/src/synthesis.rs +++ b/crates/aiur/src/synthesis.rs @@ -401,25 +401,18 @@ mod tests { Toplevel { functions: vec![function], memory_sizes: vec![] } } - fn rotation_chains_toplevel() -> Toplevel { + fn xor_splits_toplevel() -> Toplevel { let body = Block { - ops: vec![ - Op::U8ChainRotr7(0, 1), - Op::U8ChainRotr4(0, 1), - Op::U8XorSplit7(0, 1), - Op::U8XorSplit4(0, 1), - ], - ctrl: Ctrl::Return(0, vec![2, 3, 4, 5, 6, 7, 8, 9, 10, 11]), + ops: vec![Op::U8XorSplit7(0, 1), Op::U8XorSplit4(0, 1)], + ctrl: Ctrl::Return(0, vec![2, 3, 4, 5]), }; let function = Function { body, layout: FunctionLayout { input_size: 2, selectors: 1, - // Multiplicity plus two columns for each rotation-chain operation. - auxiliaries: 9, - // Return plus one byte-table lookup per operation. - lookups: 5, + auxiliaries: 5, + lookups: 3, }, entry: true, constrained: true, @@ -428,15 +421,13 @@ mod tests { } #[test] - fn prove_verify_virtual_rotation_chain_outputs() { + fn prove_verify_xor_splits() { let (cp, fp) = test_parameters(); - let system = AiurSystem::build(rotation_chains_toplevel(), cp, fp); + let system = AiurSystem::build(xor_splits_toplevel(), cp, fp); let input = [G::from_u8(0xd3), G::from_u8(0x69)]; let mut io_buffer = empty_io_buffer(); let (claim, proof) = system.prove(0, &input, &mut io_buffer); - let (r7_0, r7_1, r7_2) = Bytes2::chain_rotr7(&input[0], &input[1]); - let (r4_0, r4_1, r4_2) = Bytes2::chain_rotr4(&input[0], &input[1]); let (s7_hi, s7_lo) = Bytes2::xor_split7(&input[0], &input[1]); let (s4_hi, s4_lo) = Bytes2::xor_split4(&input[0], &input[1]); assert_eq!( @@ -446,21 +437,13 @@ mod tests { G::ZERO, input[0], input[1], - r7_0, - r7_1, - r7_2, - r4_0, - r4_1, - r4_2, s7_hi, s7_lo, s4_hi, s4_lo, ] ); - system - .verify(&claim, &proof) - .expect("virtual rotation outputs must verify"); + system.verify(&claim, &proof).expect("xor split outputs must verify"); } /// Hand-build a toplevel exercising the two migrated integration paths that @@ -645,7 +628,7 @@ mod tests { // height doubles as the committed trace height. assert_eq!(shapes[3].preprocessed_width, 11); assert_eq!(shapes[3].preprocessed_height, 256); - assert_eq!(shapes[4].preprocessed_width, 20); + assert_eq!(shapes[4].preprocessed_width, 14); assert_eq!(shapes[4].preprocessed_height, 65536); } } diff --git a/crates/aiur/src/trace.rs b/crates/aiur/src/trace.rs index 95f3d71f..e1cd9c1e 100644 --- a/crates/aiur/src/trace.rs +++ b/crates/aiur/src/trace.rs @@ -21,10 +21,9 @@ use crate::{ gadgets::{bytes1::Bytes1, bytes2::Bytes2}, memory::Memory, u8_add_channel, u8_and_channel, u8_bit_decomposition_channel, - u8_chain_rotr4_channel, u8_chain_rotr7_channel, u8_less_than_channel, - u8_mul_channel, u8_or_channel, u8_range_check_channel, u8_shift_left_channel, - u8_shift_right_channel, u8_sub_channel, u8_xor_channel, - u8_xor_split4_channel, u8_xor_split7_channel, + u8_less_than_channel, u8_mul_channel, u8_or_channel, u8_range_check_channel, + u8_shift_left_channel, u8_shift_right_channel, u8_sub_channel, + u8_xor_channel, u8_xor_split4_channel, u8_xor_split7_channel, }; struct ColumnIndex { @@ -565,36 +564,6 @@ impl Op { &[u8_less_than_channel(), i, j, less_than], ); }, - Op::U8ChainRotr7(i, j) => { - let (i, i_degree) = map[*i]; - let (j, j_degree) = map[*j]; - let (o0, o1, o2) = Bytes2::chain_rotr7(&i, &j); - map.push((o0, 1)); - map.push((o1, 1)); - map.push((o2, i_degree.max(j_degree).max(1))); - slice.push_auxiliary(index, o0); - slice.push_auxiliary(index, o1); - slice.push_lookup( - index, - G::ONE, - &[u8_chain_rotr7_channel(), i, j, o0, o1, o2], - ); - }, - Op::U8ChainRotr4(i, j) => { - let (i, i_degree) = map[*i]; - let (j, j_degree) = map[*j]; - let (o0, o1, o2) = Bytes2::chain_rotr4(&i, &j); - map.push((o0, 1)); - map.push((o1, 1)); - map.push((o2, i_degree.max(j_degree).max(1))); - slice.push_auxiliary(index, o0); - slice.push_auxiliary(index, o1); - slice.push_lookup( - index, - G::ONE, - &[u8_chain_rotr4_channel(), i, j, o0, o1, o2], - ); - }, Op::U32LessThan(x_idx, y_idx) => { let (a, _) = map[*x_idx]; let (b, _) = map[*y_idx]; diff --git a/crates/ffi/src/aiur/toplevel.rs b/crates/ffi/src/aiur/toplevel.rs index 5592fdf1..8e3ebfba 100644 --- a/crates/ffi/src/aiur/toplevel.rs +++ b/crates/ffi/src/aiur/toplevel.rs @@ -139,14 +139,6 @@ fn decode_op(ctor: LeanCtor>) -> Op { Op::U32LessThan(i, j) }, 24 => { - let [i, j] = ctor.objs::<2>().map(|x| lean_unbox_nat_as_usize(&x)); - Op::U8ChainRotr7(i, j) - }, - 25 => { - let [i, j] = ctor.objs::<2>().map(|x| lean_unbox_nat_as_usize(&x)); - Op::U8ChainRotr4(i, j) - }, - 26 => { let [label_obj, idxs_obj] = ctor.objs::<2>(); let label = label_obj.as_string().to_string(); let idxs = if idxs_obj.is_scalar() { @@ -157,27 +149,27 @@ fn decode_op(ctor: LeanCtor>) -> Op { }; Op::Debug(label, idxs) }, - 27 => { + 25 => { let [i, j] = ctor.objs::<2>().map(|x| lean_unbox_nat_as_usize(&x)); Op::U8RangeCheck(i, j) }, - 28 => { + 26 => { let [i, j] = ctor.objs::<2>().map(|x| lean_unbox_nat_as_usize(&x)); Op::UnconstrainedBigUintDivMod(i, j) }, - 29 => { + 27 => { let [a] = ctor.objs::<1>().map(|x| lean_unbox_nat_as_usize(&x)); Op::UnconstrainedGToBytes(a) }, - 30 => { + 28 => { let [a] = ctor.objs::<1>().map(|x| lean_unbox_nat_as_usize(&x)); Op::UnconstrainedGInverse(a) }, - 31 => { + 29 => { let [a, b] = ctor.objs::<2>(); Op::UnconstrainedU32Add(decode_vec_val_idx(a), decode_vec_val_idx(b)) }, - 32 => { + 30 => { let [a, b, c] = ctor.objs::<3>(); Op::UnconstrainedU32Add3( decode_vec_val_idx(a), @@ -185,15 +177,15 @@ fn decode_op(ctor: LeanCtor>) -> Op { decode_vec_val_idx(c), ) }, - 33 => { + 31 => { let [a] = ctor.objs::<1>(); Op::U32ToField(decode_vec_val_idx(a)) }, - 34 => { + 32 => { let [i, j] = ctor.objs::<2>().map(|x| lean_unbox_nat_as_usize(&x)); Op::U8XorSplit7(i, j) }, - 35 => { + 33 => { let [i, j] = ctor.objs::<2>().map(|x| lean_unbox_nat_as_usize(&x)); Op::U8XorSplit4(i, j) }, diff --git a/crates/ixvm-codegen/src/aiur_ixvm.rs b/crates/ixvm-codegen/src/aiur_ixvm.rs index b4bab9da..daaa0263 100644 --- a/crates/ixvm-codegen/src/aiur_ixvm.rs +++ b/crates/ixvm-codegen/src/aiur_ixvm.rs @@ -14,7 +14,7 @@ use multi_stark::p3_field::{PrimeCharacteristicRing, PrimeField64}; use aiur::G; -use aiur::execute::{ ExecError, IOBuffer, QueryRecord, bytes1_bit_decompose_value, bytes2_xor_value, bytes2_and_value, bytes2_or_value, bytes2_less_than_value, bytes2_add_value, bytes2_sub_value, bytes2_chain_rotr7_value, bytes2_chain_rotr4_value, unconstrained_big_uint_div_mod_helper, CodegenBytes1 as Bytes1, CodegenBytes2 as Bytes2 }; +use aiur::execute::{ ExecError, IOBuffer, QueryRecord, bytes1_bit_decompose_value, bytes2_xor_value, bytes2_and_value, bytes2_or_value, bytes2_less_than_value, bytes2_add_value, bytes2_sub_value, bytes2_xor_split7_value, bytes2_xor_split4_value, unconstrained_big_uint_div_mod_helper, CodegenBytes1 as Bytes1, CodegenBytes2 as Bytes2 }; const INPUT_SIZE_0: usize = 2; const IN_0: usize = 2; @@ -1877,19 +1877,9 @@ fn aiur_fn_5( let __v_12: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); if !unconstrained { let __vi = __v_8; let __vj = __v_9; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; if !unconstrained { let __vi = __v_10; let __vj = __v_11; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_13: G = G::from_u64(((__v_0.as_canonical_u64() << 0) | (__v_1.as_canonical_u64() << 8) | (__v_2.as_canonical_u64() << 16) | (__v_3.as_canonical_u64() << 24))); - let __v_14: G = G::from_u64(((__v_4.as_canonical_u64() << 0) | (__v_5.as_canonical_u64() << 8) | (__v_6.as_canonical_u64() << 16) | (__v_7.as_canonical_u64() << 24))); - let __v_15: G = G::from_u64(((__v_8.as_canonical_u64() << 0) | (__v_9.as_canonical_u64() << 8) | (__v_10.as_canonical_u64() << 16) | (__v_11.as_canonical_u64() << 24))); - let __v_16: G = (__v_12 * __v_12); - if (__v_16 != __v_12) { - return Err(ExecError::AssertEqMismatch { lhs: __v_16.as_canonical_u64(), rhs: __v_12.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); - } - let __v_17: G = (__v_13 + __v_14); - let __v_18: G = G::from_u64(4294967296); - let __v_19: G = (__v_18 * __v_12); - let __v_20: G = (__v_15 + __v_19); - if (__v_17 != __v_20) { - return Err(ExecError::AssertEqMismatch { lhs: __v_17.as_canonical_u64(), rhs: __v_20.as_canonical_u64(), msg: Some("u32_add: witnessed sum does not match its inputs".to_string()) }); + let __v_13: G = (__v_12 * __v_12); + if (__v_13 != __v_12) { + return Err(ExecError::AssertEqMismatch { lhs: __v_13.as_canonical_u64(), rhs: __v_12.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); } let __ret: [G; OUT_5] = [__v_8, __v_9, __v_10, __v_11]; record.function_queries[5].insert(&inp[..], &__ret[..], G::from_bool(!unconstrained)); @@ -1928,27 +1918,15 @@ fn aiur_fn_6( let __v_16: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); if !unconstrained { let __vi = __v_12; let __vj = __v_13; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; if !unconstrained { let __vi = __v_14; let __vj = __v_15; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_17: G = G::from_u64(((__v_0.as_canonical_u64() << 0) | (__v_1.as_canonical_u64() << 8) | (__v_2.as_canonical_u64() << 16) | (__v_3.as_canonical_u64() << 24))); - let __v_18: G = G::from_u64(((__v_4.as_canonical_u64() << 0) | (__v_5.as_canonical_u64() << 8) | (__v_6.as_canonical_u64() << 16) | (__v_7.as_canonical_u64() << 24))); - let __v_19: G = G::from_u64(((__v_8.as_canonical_u64() << 0) | (__v_9.as_canonical_u64() << 8) | (__v_10.as_canonical_u64() << 16) | (__v_11.as_canonical_u64() << 24))); - let __v_20: G = G::from_u64(((__v_12.as_canonical_u64() << 0) | (__v_13.as_canonical_u64() << 8) | (__v_14.as_canonical_u64() << 16) | (__v_15.as_canonical_u64() << 24))); - let __v_21: G = G::from_u64(1); - let __v_22: G = (__v_16 - __v_21); - let __v_23: G = G::from_u64(2); - let __v_24: G = (__v_16 - __v_23); - let __v_25: G = (__v_22 * __v_24); - let __v_26: G = (__v_16 * __v_25); - let __v_27: G = G::from_u64(0); - if (__v_26 != __v_27) { - return Err(ExecError::AssertEqMismatch { lhs: __v_26.as_canonical_u64(), rhs: __v_27.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); - } - let __v_28: G = (__v_18 + __v_19); - let __v_29: G = (__v_17 + __v_28); - let __v_30: G = G::from_u64(4294967296); - let __v_31: G = (__v_30 * __v_16); - let __v_32: G = (__v_20 + __v_31); - if (__v_29 != __v_32) { - return Err(ExecError::AssertEqMismatch { lhs: __v_29.as_canonical_u64(), rhs: __v_32.as_canonical_u64(), msg: Some("u32_add3: witnessed sum does not match its inputs".to_string()) }); + let __v_17: G = G::from_u64(1); + let __v_18: G = (__v_16 - __v_17); + let __v_19: G = G::from_u64(2); + let __v_20: G = (__v_16 - __v_19); + let __v_21: G = (__v_18 * __v_20); + let __v_22: G = (__v_16 * __v_21); + let __v_23: G = G::from_u64(0); + if (__v_22 != __v_23) { + return Err(ExecError::AssertEqMismatch { lhs: __v_22.as_canonical_u64(), rhs: __v_23.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); } let __ret: [G; OUT_6] = [__v_12, __v_13, __v_14, __v_15]; record.function_queries[6].insert(&inp[..], &__ret[..], G::from_bool(!unconstrained)); @@ -2024,8 +2002,8 @@ fn aiur_fn_9( }) } -const INPUT_SIZE_10: usize = 4; -const IN_10: usize = 4; +const INPUT_SIZE_10: usize = 8; +const IN_10: usize = 8; const OUT_10: usize = 4; fn aiur_fn_10( inp: [G; IN_10], @@ -2038,24 +2016,34 @@ fn aiur_fn_10( let __v_1: G = inp[1]; let __v_2: G = inp[2]; let __v_3: G = inp[3]; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr4(&__v_1, &__v_2) } else { bytes2_chain_rotr4_value(__v_1, __v_2, record) }; - let __v_4: G = __b2_out.0; - let __v_5: G = __b2_out.1; - let __v_6: G = __b2_out.2; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr4(&__v_3, &__v_0) } else { bytes2_chain_rotr4_value(__v_3, __v_0, record) }; - let __v_7: G = __b2_out.0; - let __v_8: G = __b2_out.1; - let __v_9: G = __b2_out.2; - let __v_10: G = (__v_5 + __v_9); - let __v_11: G = (__v_8 + __v_6); - let __ret: [G; OUT_10] = [__v_4, __v_10, __v_7, __v_11]; + let __v_4: G = inp[4]; + let __v_5: G = inp[5]; + let __v_6: G = inp[6]; + let __v_7: G = inp[7]; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_0, &__v_4) } else { bytes2_xor_split7_value(__v_0, __v_4, record) }; + let __v_8: G = __b2_out.0; + let __v_9: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_1, &__v_5) } else { bytes2_xor_split7_value(__v_1, __v_5, record) }; + let __v_10: G = __b2_out.0; + let __v_11: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_2, &__v_6) } else { bytes2_xor_split7_value(__v_2, __v_6, record) }; + let __v_12: G = __b2_out.0; + let __v_13: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_3, &__v_7) } else { bytes2_xor_split7_value(__v_3, __v_7, record) }; + let __v_14: G = __b2_out.0; + let __v_15: G = __b2_out.1; + let __v_16: G = (__v_8 + __v_11); + let __v_17: G = (__v_10 + __v_13); + let __v_18: G = (__v_12 + __v_15); + let __v_19: G = (__v_14 + __v_9); + let __ret: [G; OUT_10] = [__v_16, __v_17, __v_18, __v_19]; record.function_queries[10].insert(&inp[..], &__ret[..], G::from_bool(!unconstrained)); return Ok(__ret); }) } -const INPUT_SIZE_11: usize = 4; -const IN_11: usize = 4; +const INPUT_SIZE_11: usize = 8; +const IN_11: usize = 8; const OUT_11: usize = 4; fn aiur_fn_11( inp: [G; IN_11], @@ -2068,17 +2056,27 @@ fn aiur_fn_11( let __v_1: G = inp[1]; let __v_2: G = inp[2]; let __v_3: G = inp[3]; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr7(&__v_0, &__v_1) } else { bytes2_chain_rotr7_value(__v_0, __v_1, record) }; - let __v_4: G = __b2_out.0; - let __v_5: G = __b2_out.1; - let __v_6: G = __b2_out.2; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr7(&__v_2, &__v_3) } else { bytes2_chain_rotr7_value(__v_2, __v_3, record) }; - let __v_7: G = __b2_out.0; - let __v_8: G = __b2_out.1; - let __v_9: G = __b2_out.2; - let __v_10: G = (__v_5 + __v_9); - let __v_11: G = (__v_8 + __v_6); - let __ret: [G; OUT_11] = [__v_4, __v_10, __v_7, __v_11]; + let __v_4: G = inp[4]; + let __v_5: G = inp[5]; + let __v_6: G = inp[6]; + let __v_7: G = inp[7]; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_0, &__v_4) } else { bytes2_xor_split4_value(__v_0, __v_4, record) }; + let __v_8: G = __b2_out.0; + let __v_9: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_1, &__v_5) } else { bytes2_xor_split4_value(__v_1, __v_5, record) }; + let __v_10: G = __b2_out.0; + let __v_11: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_2, &__v_6) } else { bytes2_xor_split4_value(__v_2, __v_6, record) }; + let __v_12: G = __b2_out.0; + let __v_13: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_3, &__v_7) } else { bytes2_xor_split4_value(__v_3, __v_7, record) }; + let __v_14: G = __b2_out.0; + let __v_15: G = __b2_out.1; + let __v_16: G = (__v_10 + __v_13); + let __v_17: G = (__v_12 + __v_15); + let __v_18: G = (__v_14 + __v_9); + let __v_19: G = (__v_8 + __v_11); + let __ret: [G; OUT_11] = [__v_16, __v_17, __v_18, __v_19]; record.function_queries[11].insert(&inp[..], &__ret[..], G::from_bool(!unconstrained)); return Ok(__ret); }) @@ -5319,70 +5317,73 @@ fn aiur_fn_27( let __v_28: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); if !unconstrained { let __vi = __v_24; let __vj = __v_25; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; if !unconstrained { let __vi = __v_26; let __vj = __v_27; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_29: G = G::from_u64(((__v_0.as_canonical_u64() << 0) | (__v_1.as_canonical_u64() << 8) | (__v_2.as_canonical_u64() << 16) | (__v_3.as_canonical_u64() << 24))); - let __v_30: G = G::from_u64(((__v_4.as_canonical_u64() << 0) | (__v_5.as_canonical_u64() << 8) | (__v_6.as_canonical_u64() << 16) | (__v_7.as_canonical_u64() << 24))); - let __v_31: G = G::from_u64(((__v_16.as_canonical_u64() << 0) | (__v_17.as_canonical_u64() << 8) | (__v_18.as_canonical_u64() << 16) | (__v_19.as_canonical_u64() << 24))); - let __v_32: G = G::from_u64(((__v_24.as_canonical_u64() << 0) | (__v_25.as_canonical_u64() << 8) | (__v_26.as_canonical_u64() << 16) | (__v_27.as_canonical_u64() << 24))); - let __v_33: G = G::from_u64(1); - let __v_34: G = (__v_28 - __v_33); - let __v_35: G = G::from_u64(2); - let __v_36: G = (__v_28 - __v_35); - let __v_37: G = (__v_34 * __v_36); - let __v_38: G = (__v_28 * __v_37); - let __v_39: G = G::from_u64(0); - if (__v_38 != __v_39) { - return Err(ExecError::AssertEqMismatch { lhs: __v_38.as_canonical_u64(), rhs: __v_39.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); - } - let __v_40: G = (__v_30 + __v_31); - let __v_41: G = (__v_29 + __v_40); - let __v_42: G = G::from_u64(4294967296); - let __v_43: G = (__v_42 * __v_28); - let __v_44: G = (__v_32 + __v_43); - if (__v_41 != __v_44) { - return Err(ExecError::AssertEqMismatch { lhs: __v_41.as_canonical_u64(), rhs: __v_44.as_canonical_u64(), msg: Some("u32_add3: witnessed sum does not match its inputs".to_string()) }); - } - let __v_45: G = if unconstrained { Bytes2::xor(&__v_12, &__v_24) } else { bytes2_xor_value(__v_12, __v_24, record) }; - let __v_46: G = if unconstrained { Bytes2::xor(&__v_13, &__v_25) } else { bytes2_xor_value(__v_13, __v_25, record) }; - let __v_47: G = if unconstrained { Bytes2::xor(&__v_14, &__v_26) } else { bytes2_xor_value(__v_14, __v_26, record) }; - let __v_48: G = if unconstrained { Bytes2::xor(&__v_15, &__v_27) } else { bytes2_xor_value(__v_15, __v_27, record) }; - let __u32_sum: u128 = u128::from(((__v_8.as_canonical_u64() << 0) | (__v_9.as_canonical_u64() << 8) | (__v_10.as_canonical_u64() << 16) | (__v_11.as_canonical_u64() << 24))) + u128::from(((__v_47.as_canonical_u64() << 0) | (__v_48.as_canonical_u64() << 8) | (__v_45.as_canonical_u64() << 16) | (__v_46.as_canonical_u64() << 24))); + let __v_29: G = G::from_u64(1); + let __v_30: G = (__v_28 - __v_29); + let __v_31: G = G::from_u64(2); + let __v_32: G = (__v_28 - __v_31); + let __v_33: G = (__v_30 * __v_32); + let __v_34: G = (__v_28 * __v_33); + let __v_35: G = G::from_u64(0); + if (__v_34 != __v_35) { + return Err(ExecError::AssertEqMismatch { lhs: __v_34.as_canonical_u64(), rhs: __v_35.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); + } + let __v_36: G = if unconstrained { Bytes2::xor(&__v_12, &__v_24) } else { bytes2_xor_value(__v_12, __v_24, record) }; + let __v_37: G = if unconstrained { Bytes2::xor(&__v_13, &__v_25) } else { bytes2_xor_value(__v_13, __v_25, record) }; + let __v_38: G = if unconstrained { Bytes2::xor(&__v_14, &__v_26) } else { bytes2_xor_value(__v_14, __v_26, record) }; + let __v_39: G = if unconstrained { Bytes2::xor(&__v_15, &__v_27) } else { bytes2_xor_value(__v_15, __v_27, record) }; + let __u32_sum: u128 = u128::from(((__v_8.as_canonical_u64() << 0) | (__v_9.as_canonical_u64() << 8) | (__v_10.as_canonical_u64() << 16) | (__v_11.as_canonical_u64() << 24))) + u128::from(((__v_38.as_canonical_u64() << 0) | (__v_39.as_canonical_u64() << 8) | (__v_36.as_canonical_u64() << 16) | (__v_37.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_49: G = G::from_u8(__u32_bytes[0]); - let __v_50: G = G::from_u8(__u32_bytes[1]); - let __v_51: G = G::from_u8(__u32_bytes[2]); - let __v_52: G = G::from_u8(__u32_bytes[3]); - let __v_53: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_49; let __vj = __v_50; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_51; let __vj = __v_52; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_54: G = G::from_u64(((__v_8.as_canonical_u64() << 0) | (__v_9.as_canonical_u64() << 8) | (__v_10.as_canonical_u64() << 16) | (__v_11.as_canonical_u64() << 24))); - let __v_55: G = G::from_u64(((__v_47.as_canonical_u64() << 0) | (__v_48.as_canonical_u64() << 8) | (__v_45.as_canonical_u64() << 16) | (__v_46.as_canonical_u64() << 24))); - let __v_56: G = G::from_u64(((__v_49.as_canonical_u64() << 0) | (__v_50.as_canonical_u64() << 8) | (__v_51.as_canonical_u64() << 16) | (__v_52.as_canonical_u64() << 24))); - let __v_57: G = (__v_53 * __v_53); - if (__v_57 != __v_53) { - return Err(ExecError::AssertEqMismatch { lhs: __v_57.as_canonical_u64(), rhs: __v_53.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); - } - let __v_58: G = (__v_54 + __v_55); - let __v_59: G = G::from_u64(4294967296); - let __v_60: G = (__v_59 * __v_53); - let __v_61: G = (__v_56 + __v_60); - if (__v_58 != __v_61) { - return Err(ExecError::AssertEqMismatch { lhs: __v_58.as_canonical_u64(), rhs: __v_61.as_canonical_u64(), msg: Some("u32_add: witnessed sum does not match its inputs".to_string()) }); - } - let __v_62: G = if unconstrained { Bytes2::xor(&__v_4, &__v_49) } else { bytes2_xor_value(__v_4, __v_49, record) }; - let __v_63: G = if unconstrained { Bytes2::xor(&__v_5, &__v_50) } else { bytes2_xor_value(__v_5, __v_50, record) }; - let __v_64: G = if unconstrained { Bytes2::xor(&__v_6, &__v_51) } else { bytes2_xor_value(__v_6, __v_51, record) }; - let __v_65: G = if unconstrained { Bytes2::xor(&__v_7, &__v_52) } else { bytes2_xor_value(__v_7, __v_52, record) }; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr4(&__v_63, &__v_64) } else { bytes2_chain_rotr4_value(__v_63, __v_64, record) }; - let __v_66: G = __b2_out.0; - let __v_67: G = __b2_out.1; - let __v_68: G = __b2_out.2; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr4(&__v_65, &__v_62) } else { bytes2_chain_rotr4_value(__v_65, __v_62, record) }; - let __v_69: G = __b2_out.0; - let __v_70: G = __b2_out.1; - let __v_71: G = __b2_out.2; - let __v_72: G = (__v_67 + __v_71); - let __v_73: G = (__v_70 + __v_68); - let __u32_sum: u128 = u128::from(((__v_24.as_canonical_u64() << 0) | (__v_25.as_canonical_u64() << 8) | (__v_26.as_canonical_u64() << 16) | (__v_27.as_canonical_u64() << 24))) + u128::from(((__v_66.as_canonical_u64() << 0) | (__v_72.as_canonical_u64() << 8) | (__v_69.as_canonical_u64() << 16) | (__v_73.as_canonical_u64() << 24))) + u128::from(((__v_20.as_canonical_u64() << 0) | (__v_21.as_canonical_u64() << 8) | (__v_22.as_canonical_u64() << 16) | (__v_23.as_canonical_u64() << 24))); + let __v_40: G = G::from_u8(__u32_bytes[0]); + let __v_41: G = G::from_u8(__u32_bytes[1]); + let __v_42: G = G::from_u8(__u32_bytes[2]); + let __v_43: G = G::from_u8(__u32_bytes[3]); + let __v_44: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_40; let __vj = __v_41; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_42; let __vj = __v_43; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_45: G = (__v_44 * __v_44); + if (__v_45 != __v_44) { + return Err(ExecError::AssertEqMismatch { lhs: __v_45.as_canonical_u64(), rhs: __v_44.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); + } + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_4, &__v_40) } else { bytes2_xor_split4_value(__v_4, __v_40, record) }; + let __v_46: G = __b2_out.0; + let __v_47: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_5, &__v_41) } else { bytes2_xor_split4_value(__v_5, __v_41, record) }; + let __v_48: G = __b2_out.0; + let __v_49: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_6, &__v_42) } else { bytes2_xor_split4_value(__v_6, __v_42, record) }; + let __v_50: G = __b2_out.0; + let __v_51: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_7, &__v_43) } else { bytes2_xor_split4_value(__v_7, __v_43, record) }; + let __v_52: G = __b2_out.0; + let __v_53: G = __b2_out.1; + let __v_54: G = (__v_48 + __v_51); + let __v_55: G = (__v_50 + __v_53); + let __v_56: G = (__v_52 + __v_47); + let __v_57: G = (__v_46 + __v_49); + let __u32_sum: u128 = u128::from(((__v_24.as_canonical_u64() << 0) | (__v_25.as_canonical_u64() << 8) | (__v_26.as_canonical_u64() << 16) | (__v_27.as_canonical_u64() << 24))) + u128::from(((__v_54.as_canonical_u64() << 0) | (__v_55.as_canonical_u64() << 8) | (__v_56.as_canonical_u64() << 16) | (__v_57.as_canonical_u64() << 24))) + u128::from(((__v_20.as_canonical_u64() << 0) | (__v_21.as_canonical_u64() << 8) | (__v_22.as_canonical_u64() << 16) | (__v_23.as_canonical_u64() << 24))); + let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); + let __v_58: G = G::from_u8(__u32_bytes[0]); + let __v_59: G = G::from_u8(__u32_bytes[1]); + let __v_60: G = G::from_u8(__u32_bytes[2]); + let __v_61: G = G::from_u8(__u32_bytes[3]); + let __v_62: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_58; let __vj = __v_59; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_60; let __vj = __v_61; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_63: G = G::from_u64(1); + let __v_64: G = (__v_62 - __v_63); + let __v_65: G = G::from_u64(2); + let __v_66: G = (__v_62 - __v_65); + let __v_67: G = (__v_64 * __v_66); + let __v_68: G = (__v_62 * __v_67); + let __v_69: G = G::from_u64(0); + if (__v_68 != __v_69) { + return Err(ExecError::AssertEqMismatch { lhs: __v_68.as_canonical_u64(), rhs: __v_69.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); + } + let __v_70: G = if unconstrained { Bytes2::xor(&__v_38, &__v_58) } else { bytes2_xor_value(__v_38, __v_58, record) }; + let __v_71: G = if unconstrained { Bytes2::xor(&__v_39, &__v_59) } else { bytes2_xor_value(__v_39, __v_59, record) }; + let __v_72: G = if unconstrained { Bytes2::xor(&__v_36, &__v_60) } else { bytes2_xor_value(__v_36, __v_60, record) }; + let __v_73: G = if unconstrained { Bytes2::xor(&__v_37, &__v_61) } else { bytes2_xor_value(__v_37, __v_61, record) }; + let __u32_sum: u128 = u128::from(((__v_40.as_canonical_u64() << 0) | (__v_41.as_canonical_u64() << 8) | (__v_42.as_canonical_u64() << 16) | (__v_43.as_canonical_u64() << 24))) + u128::from(((__v_71.as_canonical_u64() << 0) | (__v_72.as_canonical_u64() << 8) | (__v_73.as_canonical_u64() << 16) | (__v_70.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); let __v_74: G = G::from_u8(__u32_bytes[0]); let __v_75: G = G::from_u8(__u32_bytes[1]); @@ -5391,70 +5392,27 @@ fn aiur_fn_27( let __v_78: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); if !unconstrained { let __vi = __v_74; let __vj = __v_75; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; if !unconstrained { let __vi = __v_76; let __vj = __v_77; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_79: G = G::from_u64(((__v_24.as_canonical_u64() << 0) | (__v_25.as_canonical_u64() << 8) | (__v_26.as_canonical_u64() << 16) | (__v_27.as_canonical_u64() << 24))); - let __v_80: G = G::from_u64(((__v_66.as_canonical_u64() << 0) | (__v_72.as_canonical_u64() << 8) | (__v_69.as_canonical_u64() << 16) | (__v_73.as_canonical_u64() << 24))); - let __v_81: G = G::from_u64(((__v_20.as_canonical_u64() << 0) | (__v_21.as_canonical_u64() << 8) | (__v_22.as_canonical_u64() << 16) | (__v_23.as_canonical_u64() << 24))); - let __v_82: G = G::from_u64(((__v_74.as_canonical_u64() << 0) | (__v_75.as_canonical_u64() << 8) | (__v_76.as_canonical_u64() << 16) | (__v_77.as_canonical_u64() << 24))); - let __v_83: G = G::from_u64(1); - let __v_84: G = (__v_78 - __v_83); - let __v_85: G = G::from_u64(2); - let __v_86: G = (__v_78 - __v_85); - let __v_87: G = (__v_84 * __v_86); - let __v_88: G = (__v_78 * __v_87); - let __v_89: G = G::from_u64(0); - if (__v_88 != __v_89) { - return Err(ExecError::AssertEqMismatch { lhs: __v_88.as_canonical_u64(), rhs: __v_89.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); - } - let __v_90: G = (__v_80 + __v_81); - let __v_91: G = (__v_79 + __v_90); - let __v_92: G = G::from_u64(4294967296); - let __v_93: G = (__v_92 * __v_78); - let __v_94: G = (__v_82 + __v_93); - if (__v_91 != __v_94) { - return Err(ExecError::AssertEqMismatch { lhs: __v_91.as_canonical_u64(), rhs: __v_94.as_canonical_u64(), msg: Some("u32_add3: witnessed sum does not match its inputs".to_string()) }); - } - let __v_95: G = if unconstrained { Bytes2::xor(&__v_47, &__v_74) } else { bytes2_xor_value(__v_47, __v_74, record) }; - let __v_96: G = if unconstrained { Bytes2::xor(&__v_48, &__v_75) } else { bytes2_xor_value(__v_48, __v_75, record) }; - let __v_97: G = if unconstrained { Bytes2::xor(&__v_45, &__v_76) } else { bytes2_xor_value(__v_45, __v_76, record) }; - let __v_98: G = if unconstrained { Bytes2::xor(&__v_46, &__v_77) } else { bytes2_xor_value(__v_46, __v_77, record) }; - let __u32_sum: u128 = u128::from(((__v_49.as_canonical_u64() << 0) | (__v_50.as_canonical_u64() << 8) | (__v_51.as_canonical_u64() << 16) | (__v_52.as_canonical_u64() << 24))) + u128::from(((__v_96.as_canonical_u64() << 0) | (__v_97.as_canonical_u64() << 8) | (__v_98.as_canonical_u64() << 16) | (__v_95.as_canonical_u64() << 24))); - let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_99: G = G::from_u8(__u32_bytes[0]); - let __v_100: G = G::from_u8(__u32_bytes[1]); - let __v_101: G = G::from_u8(__u32_bytes[2]); - let __v_102: G = G::from_u8(__u32_bytes[3]); - let __v_103: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_99; let __vj = __v_100; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_101; let __vj = __v_102; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_104: G = G::from_u64(((__v_49.as_canonical_u64() << 0) | (__v_50.as_canonical_u64() << 8) | (__v_51.as_canonical_u64() << 16) | (__v_52.as_canonical_u64() << 24))); - let __v_105: G = G::from_u64(((__v_96.as_canonical_u64() << 0) | (__v_97.as_canonical_u64() << 8) | (__v_98.as_canonical_u64() << 16) | (__v_95.as_canonical_u64() << 24))); - let __v_106: G = G::from_u64(((__v_99.as_canonical_u64() << 0) | (__v_100.as_canonical_u64() << 8) | (__v_101.as_canonical_u64() << 16) | (__v_102.as_canonical_u64() << 24))); - let __v_107: G = (__v_103 * __v_103); - if (__v_107 != __v_103) { - return Err(ExecError::AssertEqMismatch { lhs: __v_107.as_canonical_u64(), rhs: __v_103.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); - } - let __v_108: G = (__v_104 + __v_105); - let __v_109: G = G::from_u64(4294967296); - let __v_110: G = (__v_109 * __v_103); - let __v_111: G = (__v_106 + __v_110); - if (__v_108 != __v_111) { - return Err(ExecError::AssertEqMismatch { lhs: __v_108.as_canonical_u64(), rhs: __v_111.as_canonical_u64(), msg: Some("u32_add: witnessed sum does not match its inputs".to_string()) }); - } - let __v_112: G = if unconstrained { Bytes2::xor(&__v_66, &__v_99) } else { bytes2_xor_value(__v_66, __v_99, record) }; - let __v_113: G = if unconstrained { Bytes2::xor(&__v_72, &__v_100) } else { bytes2_xor_value(__v_72, __v_100, record) }; - let __v_114: G = if unconstrained { Bytes2::xor(&__v_69, &__v_101) } else { bytes2_xor_value(__v_69, __v_101, record) }; - let __v_115: G = if unconstrained { Bytes2::xor(&__v_73, &__v_102) } else { bytes2_xor_value(__v_73, __v_102, record) }; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr7(&__v_112, &__v_113) } else { bytes2_chain_rotr7_value(__v_112, __v_113, record) }; - let __v_116: G = __b2_out.0; - let __v_117: G = __b2_out.1; - let __v_118: G = __b2_out.2; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr7(&__v_114, &__v_115) } else { bytes2_chain_rotr7_value(__v_114, __v_115, record) }; - let __v_119: G = __b2_out.0; - let __v_120: G = __b2_out.1; - let __v_121: G = __b2_out.2; - let __v_122: G = (__v_117 + __v_121); - let __v_123: G = (__v_120 + __v_118); - let __ret: [G; OUT_27] = [__v_74, __v_75, __v_76, __v_77, __v_116, __v_122, __v_119, __v_123, __v_99, __v_100, __v_101, __v_102, __v_96, __v_97, __v_98, __v_95]; + let __v_79: G = (__v_78 * __v_78); + if (__v_79 != __v_78) { + return Err(ExecError::AssertEqMismatch { lhs: __v_79.as_canonical_u64(), rhs: __v_78.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); + } + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_54, &__v_74) } else { bytes2_xor_split7_value(__v_54, __v_74, record) }; + let __v_80: G = __b2_out.0; + let __v_81: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_55, &__v_75) } else { bytes2_xor_split7_value(__v_55, __v_75, record) }; + let __v_82: G = __b2_out.0; + let __v_83: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_56, &__v_76) } else { bytes2_xor_split7_value(__v_56, __v_76, record) }; + let __v_84: G = __b2_out.0; + let __v_85: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_57, &__v_77) } else { bytes2_xor_split7_value(__v_57, __v_77, record) }; + let __v_86: G = __b2_out.0; + let __v_87: G = __b2_out.1; + let __v_88: G = (__v_80 + __v_83); + let __v_89: G = (__v_82 + __v_85); + let __v_90: G = (__v_84 + __v_87); + let __v_91: G = (__v_86 + __v_81); + let __ret: [G; OUT_27] = [__v_58, __v_59, __v_60, __v_61, __v_88, __v_89, __v_90, __v_91, __v_74, __v_75, __v_76, __v_77, __v_71, __v_72, __v_73, __v_70]; record.function_queries[27].insert(&inp[..], &__ret[..], G::from_bool(!unconstrained)); return Ok(__ret); }) @@ -5607,70 +5565,73 @@ fn aiur_fn_28( let __v_132: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); if !unconstrained { let __vi = __v_128; let __vj = __v_129; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; if !unconstrained { let __vi = __v_130; let __vj = __v_131; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_133: G = G::from_u64(((__v_0.as_canonical_u64() << 0) | (__v_1.as_canonical_u64() << 8) | (__v_2.as_canonical_u64() << 16) | (__v_3.as_canonical_u64() << 24))); - let __v_134: G = G::from_u64(((__v_16.as_canonical_u64() << 0) | (__v_17.as_canonical_u64() << 8) | (__v_18.as_canonical_u64() << 16) | (__v_19.as_canonical_u64() << 24))); - let __v_135: G = G::from_u64(((__v_64.as_canonical_u64() << 0) | (__v_65.as_canonical_u64() << 8) | (__v_66.as_canonical_u64() << 16) | (__v_67.as_canonical_u64() << 24))); - let __v_136: G = G::from_u64(((__v_128.as_canonical_u64() << 0) | (__v_129.as_canonical_u64() << 8) | (__v_130.as_canonical_u64() << 16) | (__v_131.as_canonical_u64() << 24))); - let __v_137: G = G::from_u64(1); - let __v_138: G = (__v_132 - __v_137); - let __v_139: G = G::from_u64(2); - let __v_140: G = (__v_132 - __v_139); - let __v_141: G = (__v_138 * __v_140); - let __v_142: G = (__v_132 * __v_141); - let __v_143: G = G::from_u64(0); - if (__v_142 != __v_143) { - return Err(ExecError::AssertEqMismatch { lhs: __v_142.as_canonical_u64(), rhs: __v_143.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); - } - let __v_144: G = (__v_134 + __v_135); - let __v_145: G = (__v_133 + __v_144); - let __v_146: G = G::from_u64(4294967296); - let __v_147: G = (__v_146 * __v_132); - let __v_148: G = (__v_136 + __v_147); - if (__v_145 != __v_148) { - return Err(ExecError::AssertEqMismatch { lhs: __v_145.as_canonical_u64(), rhs: __v_148.as_canonical_u64(), msg: Some("u32_add3: witnessed sum does not match its inputs".to_string()) }); - } - let __v_149: G = if unconstrained { Bytes2::xor(&__v_48, &__v_128) } else { bytes2_xor_value(__v_48, __v_128, record) }; - let __v_150: G = if unconstrained { Bytes2::xor(&__v_49, &__v_129) } else { bytes2_xor_value(__v_49, __v_129, record) }; - let __v_151: G = if unconstrained { Bytes2::xor(&__v_50, &__v_130) } else { bytes2_xor_value(__v_50, __v_130, record) }; - let __v_152: G = if unconstrained { Bytes2::xor(&__v_51, &__v_131) } else { bytes2_xor_value(__v_51, __v_131, record) }; - let __u32_sum: u128 = u128::from(((__v_32.as_canonical_u64() << 0) | (__v_33.as_canonical_u64() << 8) | (__v_34.as_canonical_u64() << 16) | (__v_35.as_canonical_u64() << 24))) + u128::from(((__v_151.as_canonical_u64() << 0) | (__v_152.as_canonical_u64() << 8) | (__v_149.as_canonical_u64() << 16) | (__v_150.as_canonical_u64() << 24))); + let __v_133: G = G::from_u64(1); + let __v_134: G = (__v_132 - __v_133); + let __v_135: G = G::from_u64(2); + let __v_136: G = (__v_132 - __v_135); + let __v_137: G = (__v_134 * __v_136); + let __v_138: G = (__v_132 * __v_137); + let __v_139: G = G::from_u64(0); + if (__v_138 != __v_139) { + return Err(ExecError::AssertEqMismatch { lhs: __v_138.as_canonical_u64(), rhs: __v_139.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); + } + let __v_140: G = if unconstrained { Bytes2::xor(&__v_48, &__v_128) } else { bytes2_xor_value(__v_48, __v_128, record) }; + let __v_141: G = if unconstrained { Bytes2::xor(&__v_49, &__v_129) } else { bytes2_xor_value(__v_49, __v_129, record) }; + let __v_142: G = if unconstrained { Bytes2::xor(&__v_50, &__v_130) } else { bytes2_xor_value(__v_50, __v_130, record) }; + let __v_143: G = if unconstrained { Bytes2::xor(&__v_51, &__v_131) } else { bytes2_xor_value(__v_51, __v_131, record) }; + let __u32_sum: u128 = u128::from(((__v_32.as_canonical_u64() << 0) | (__v_33.as_canonical_u64() << 8) | (__v_34.as_canonical_u64() << 16) | (__v_35.as_canonical_u64() << 24))) + u128::from(((__v_142.as_canonical_u64() << 0) | (__v_143.as_canonical_u64() << 8) | (__v_140.as_canonical_u64() << 16) | (__v_141.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_153: G = G::from_u8(__u32_bytes[0]); - let __v_154: G = G::from_u8(__u32_bytes[1]); - let __v_155: G = G::from_u8(__u32_bytes[2]); - let __v_156: G = G::from_u8(__u32_bytes[3]); - let __v_157: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_153; let __vj = __v_154; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_155; let __vj = __v_156; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_158: G = G::from_u64(((__v_32.as_canonical_u64() << 0) | (__v_33.as_canonical_u64() << 8) | (__v_34.as_canonical_u64() << 16) | (__v_35.as_canonical_u64() << 24))); - let __v_159: G = G::from_u64(((__v_151.as_canonical_u64() << 0) | (__v_152.as_canonical_u64() << 8) | (__v_149.as_canonical_u64() << 16) | (__v_150.as_canonical_u64() << 24))); - let __v_160: G = G::from_u64(((__v_153.as_canonical_u64() << 0) | (__v_154.as_canonical_u64() << 8) | (__v_155.as_canonical_u64() << 16) | (__v_156.as_canonical_u64() << 24))); - let __v_161: G = (__v_157 * __v_157); - if (__v_161 != __v_157) { - return Err(ExecError::AssertEqMismatch { lhs: __v_161.as_canonical_u64(), rhs: __v_157.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); - } - let __v_162: G = (__v_158 + __v_159); - let __v_163: G = G::from_u64(4294967296); - let __v_164: G = (__v_163 * __v_157); - let __v_165: G = (__v_160 + __v_164); - if (__v_162 != __v_165) { - return Err(ExecError::AssertEqMismatch { lhs: __v_162.as_canonical_u64(), rhs: __v_165.as_canonical_u64(), msg: Some("u32_add: witnessed sum does not match its inputs".to_string()) }); - } - let __v_166: G = if unconstrained { Bytes2::xor(&__v_16, &__v_153) } else { bytes2_xor_value(__v_16, __v_153, record) }; - let __v_167: G = if unconstrained { Bytes2::xor(&__v_17, &__v_154) } else { bytes2_xor_value(__v_17, __v_154, record) }; - let __v_168: G = if unconstrained { Bytes2::xor(&__v_18, &__v_155) } else { bytes2_xor_value(__v_18, __v_155, record) }; - let __v_169: G = if unconstrained { Bytes2::xor(&__v_19, &__v_156) } else { bytes2_xor_value(__v_19, __v_156, record) }; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr4(&__v_167, &__v_168) } else { bytes2_chain_rotr4_value(__v_167, __v_168, record) }; - let __v_170: G = __b2_out.0; - let __v_171: G = __b2_out.1; - let __v_172: G = __b2_out.2; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr4(&__v_169, &__v_166) } else { bytes2_chain_rotr4_value(__v_169, __v_166, record) }; - let __v_173: G = __b2_out.0; - let __v_174: G = __b2_out.1; - let __v_175: G = __b2_out.2; - let __v_176: G = (__v_171 + __v_175); - let __v_177: G = (__v_174 + __v_172); - let __u32_sum: u128 = u128::from(((__v_128.as_canonical_u64() << 0) | (__v_129.as_canonical_u64() << 8) | (__v_130.as_canonical_u64() << 16) | (__v_131.as_canonical_u64() << 24))) + u128::from(((__v_170.as_canonical_u64() << 0) | (__v_176.as_canonical_u64() << 8) | (__v_173.as_canonical_u64() << 16) | (__v_177.as_canonical_u64() << 24))) + u128::from(((__v_68.as_canonical_u64() << 0) | (__v_69.as_canonical_u64() << 8) | (__v_70.as_canonical_u64() << 16) | (__v_71.as_canonical_u64() << 24))); + let __v_144: G = G::from_u8(__u32_bytes[0]); + let __v_145: G = G::from_u8(__u32_bytes[1]); + let __v_146: G = G::from_u8(__u32_bytes[2]); + let __v_147: G = G::from_u8(__u32_bytes[3]); + let __v_148: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_144; let __vj = __v_145; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_146; let __vj = __v_147; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_149: G = (__v_148 * __v_148); + if (__v_149 != __v_148) { + return Err(ExecError::AssertEqMismatch { lhs: __v_149.as_canonical_u64(), rhs: __v_148.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); + } + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_16, &__v_144) } else { bytes2_xor_split4_value(__v_16, __v_144, record) }; + let __v_150: G = __b2_out.0; + let __v_151: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_17, &__v_145) } else { bytes2_xor_split4_value(__v_17, __v_145, record) }; + let __v_152: G = __b2_out.0; + let __v_153: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_18, &__v_146) } else { bytes2_xor_split4_value(__v_18, __v_146, record) }; + let __v_154: G = __b2_out.0; + let __v_155: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_19, &__v_147) } else { bytes2_xor_split4_value(__v_19, __v_147, record) }; + let __v_156: G = __b2_out.0; + let __v_157: G = __b2_out.1; + let __v_158: G = (__v_152 + __v_155); + let __v_159: G = (__v_154 + __v_157); + let __v_160: G = (__v_156 + __v_151); + let __v_161: G = (__v_150 + __v_153); + let __u32_sum: u128 = u128::from(((__v_128.as_canonical_u64() << 0) | (__v_129.as_canonical_u64() << 8) | (__v_130.as_canonical_u64() << 16) | (__v_131.as_canonical_u64() << 24))) + u128::from(((__v_158.as_canonical_u64() << 0) | (__v_159.as_canonical_u64() << 8) | (__v_160.as_canonical_u64() << 16) | (__v_161.as_canonical_u64() << 24))) + u128::from(((__v_68.as_canonical_u64() << 0) | (__v_69.as_canonical_u64() << 8) | (__v_70.as_canonical_u64() << 16) | (__v_71.as_canonical_u64() << 24))); + let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); + let __v_162: G = G::from_u8(__u32_bytes[0]); + let __v_163: G = G::from_u8(__u32_bytes[1]); + let __v_164: G = G::from_u8(__u32_bytes[2]); + let __v_165: G = G::from_u8(__u32_bytes[3]); + let __v_166: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_162; let __vj = __v_163; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_164; let __vj = __v_165; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_167: G = G::from_u64(1); + let __v_168: G = (__v_166 - __v_167); + let __v_169: G = G::from_u64(2); + let __v_170: G = (__v_166 - __v_169); + let __v_171: G = (__v_168 * __v_170); + let __v_172: G = (__v_166 * __v_171); + let __v_173: G = G::from_u64(0); + if (__v_172 != __v_173) { + return Err(ExecError::AssertEqMismatch { lhs: __v_172.as_canonical_u64(), rhs: __v_173.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); + } + let __v_174: G = if unconstrained { Bytes2::xor(&__v_142, &__v_162) } else { bytes2_xor_value(__v_142, __v_162, record) }; + let __v_175: G = if unconstrained { Bytes2::xor(&__v_143, &__v_163) } else { bytes2_xor_value(__v_143, __v_163, record) }; + let __v_176: G = if unconstrained { Bytes2::xor(&__v_140, &__v_164) } else { bytes2_xor_value(__v_140, __v_164, record) }; + let __v_177: G = if unconstrained { Bytes2::xor(&__v_141, &__v_165) } else { bytes2_xor_value(__v_141, __v_165, record) }; + let __u32_sum: u128 = u128::from(((__v_144.as_canonical_u64() << 0) | (__v_145.as_canonical_u64() << 8) | (__v_146.as_canonical_u64() << 16) | (__v_147.as_canonical_u64() << 24))) + u128::from(((__v_175.as_canonical_u64() << 0) | (__v_176.as_canonical_u64() << 8) | (__v_177.as_canonical_u64() << 16) | (__v_174.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); let __v_178: G = G::from_u8(__u32_bytes[0]); let __v_179: G = G::from_u8(__u32_bytes[1]); @@ -5679,1078 +5640,755 @@ fn aiur_fn_28( let __v_182: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); if !unconstrained { let __vi = __v_178; let __vj = __v_179; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; if !unconstrained { let __vi = __v_180; let __vj = __v_181; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_183: G = G::from_u64(((__v_128.as_canonical_u64() << 0) | (__v_129.as_canonical_u64() << 8) | (__v_130.as_canonical_u64() << 16) | (__v_131.as_canonical_u64() << 24))); - let __v_184: G = G::from_u64(((__v_170.as_canonical_u64() << 0) | (__v_176.as_canonical_u64() << 8) | (__v_173.as_canonical_u64() << 16) | (__v_177.as_canonical_u64() << 24))); - let __v_185: G = G::from_u64(((__v_68.as_canonical_u64() << 0) | (__v_69.as_canonical_u64() << 8) | (__v_70.as_canonical_u64() << 16) | (__v_71.as_canonical_u64() << 24))); - let __v_186: G = G::from_u64(((__v_178.as_canonical_u64() << 0) | (__v_179.as_canonical_u64() << 8) | (__v_180.as_canonical_u64() << 16) | (__v_181.as_canonical_u64() << 24))); - let __v_187: G = G::from_u64(1); - let __v_188: G = (__v_182 - __v_187); - let __v_189: G = G::from_u64(2); - let __v_190: G = (__v_182 - __v_189); - let __v_191: G = (__v_188 * __v_190); - let __v_192: G = (__v_182 * __v_191); - let __v_193: G = G::from_u64(0); - if (__v_192 != __v_193) { - return Err(ExecError::AssertEqMismatch { lhs: __v_192.as_canonical_u64(), rhs: __v_193.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); - } - let __v_194: G = (__v_184 + __v_185); - let __v_195: G = (__v_183 + __v_194); - let __v_196: G = G::from_u64(4294967296); - let __v_197: G = (__v_196 * __v_182); - let __v_198: G = (__v_186 + __v_197); - if (__v_195 != __v_198) { - return Err(ExecError::AssertEqMismatch { lhs: __v_195.as_canonical_u64(), rhs: __v_198.as_canonical_u64(), msg: Some("u32_add3: witnessed sum does not match its inputs".to_string()) }); - } - let __v_199: G = if unconstrained { Bytes2::xor(&__v_151, &__v_178) } else { bytes2_xor_value(__v_151, __v_178, record) }; - let __v_200: G = if unconstrained { Bytes2::xor(&__v_152, &__v_179) } else { bytes2_xor_value(__v_152, __v_179, record) }; - let __v_201: G = if unconstrained { Bytes2::xor(&__v_149, &__v_180) } else { bytes2_xor_value(__v_149, __v_180, record) }; - let __v_202: G = if unconstrained { Bytes2::xor(&__v_150, &__v_181) } else { bytes2_xor_value(__v_150, __v_181, record) }; - let __u32_sum: u128 = u128::from(((__v_153.as_canonical_u64() << 0) | (__v_154.as_canonical_u64() << 8) | (__v_155.as_canonical_u64() << 16) | (__v_156.as_canonical_u64() << 24))) + u128::from(((__v_200.as_canonical_u64() << 0) | (__v_201.as_canonical_u64() << 8) | (__v_202.as_canonical_u64() << 16) | (__v_199.as_canonical_u64() << 24))); + let __v_183: G = (__v_182 * __v_182); + if (__v_183 != __v_182) { + return Err(ExecError::AssertEqMismatch { lhs: __v_183.as_canonical_u64(), rhs: __v_182.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); + } + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_158, &__v_178) } else { bytes2_xor_split7_value(__v_158, __v_178, record) }; + let __v_184: G = __b2_out.0; + let __v_185: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_159, &__v_179) } else { bytes2_xor_split7_value(__v_159, __v_179, record) }; + let __v_186: G = __b2_out.0; + let __v_187: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_160, &__v_180) } else { bytes2_xor_split7_value(__v_160, __v_180, record) }; + let __v_188: G = __b2_out.0; + let __v_189: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_161, &__v_181) } else { bytes2_xor_split7_value(__v_161, __v_181, record) }; + let __v_190: G = __b2_out.0; + let __v_191: G = __b2_out.1; + let __v_192: G = (__v_184 + __v_187); + let __v_193: G = (__v_186 + __v_189); + let __v_194: G = (__v_188 + __v_191); + let __v_195: G = (__v_190 + __v_185); + let __u32_sum: u128 = u128::from(((__v_4.as_canonical_u64() << 0) | (__v_5.as_canonical_u64() << 8) | (__v_6.as_canonical_u64() << 16) | (__v_7.as_canonical_u64() << 24))) + u128::from(((__v_20.as_canonical_u64() << 0) | (__v_21.as_canonical_u64() << 8) | (__v_22.as_canonical_u64() << 16) | (__v_23.as_canonical_u64() << 24))) + u128::from(((__v_72.as_canonical_u64() << 0) | (__v_73.as_canonical_u64() << 8) | (__v_74.as_canonical_u64() << 16) | (__v_75.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_203: G = G::from_u8(__u32_bytes[0]); - let __v_204: G = G::from_u8(__u32_bytes[1]); - let __v_205: G = G::from_u8(__u32_bytes[2]); - let __v_206: G = G::from_u8(__u32_bytes[3]); - let __v_207: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_203; let __vj = __v_204; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_205; let __vj = __v_206; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_208: G = G::from_u64(((__v_153.as_canonical_u64() << 0) | (__v_154.as_canonical_u64() << 8) | (__v_155.as_canonical_u64() << 16) | (__v_156.as_canonical_u64() << 24))); - let __v_209: G = G::from_u64(((__v_200.as_canonical_u64() << 0) | (__v_201.as_canonical_u64() << 8) | (__v_202.as_canonical_u64() << 16) | (__v_199.as_canonical_u64() << 24))); - let __v_210: G = G::from_u64(((__v_203.as_canonical_u64() << 0) | (__v_204.as_canonical_u64() << 8) | (__v_205.as_canonical_u64() << 16) | (__v_206.as_canonical_u64() << 24))); - let __v_211: G = (__v_207 * __v_207); - if (__v_211 != __v_207) { - return Err(ExecError::AssertEqMismatch { lhs: __v_211.as_canonical_u64(), rhs: __v_207.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); - } - let __v_212: G = (__v_208 + __v_209); - let __v_213: G = G::from_u64(4294967296); - let __v_214: G = (__v_213 * __v_207); - let __v_215: G = (__v_210 + __v_214); - if (__v_212 != __v_215) { - return Err(ExecError::AssertEqMismatch { lhs: __v_212.as_canonical_u64(), rhs: __v_215.as_canonical_u64(), msg: Some("u32_add: witnessed sum does not match its inputs".to_string()) }); - } - let __v_216: G = if unconstrained { Bytes2::xor(&__v_170, &__v_203) } else { bytes2_xor_value(__v_170, __v_203, record) }; - let __v_217: G = if unconstrained { Bytes2::xor(&__v_176, &__v_204) } else { bytes2_xor_value(__v_176, __v_204, record) }; - let __v_218: G = if unconstrained { Bytes2::xor(&__v_173, &__v_205) } else { bytes2_xor_value(__v_173, __v_205, record) }; - let __v_219: G = if unconstrained { Bytes2::xor(&__v_177, &__v_206) } else { bytes2_xor_value(__v_177, __v_206, record) }; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr7(&__v_216, &__v_217) } else { bytes2_chain_rotr7_value(__v_216, __v_217, record) }; + let __v_196: G = G::from_u8(__u32_bytes[0]); + let __v_197: G = G::from_u8(__u32_bytes[1]); + let __v_198: G = G::from_u8(__u32_bytes[2]); + let __v_199: G = G::from_u8(__u32_bytes[3]); + let __v_200: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_196; let __vj = __v_197; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_198; let __vj = __v_199; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_201: G = G::from_u64(1); + let __v_202: G = (__v_200 - __v_201); + let __v_203: G = G::from_u64(2); + let __v_204: G = (__v_200 - __v_203); + let __v_205: G = (__v_202 * __v_204); + let __v_206: G = (__v_200 * __v_205); + let __v_207: G = G::from_u64(0); + if (__v_206 != __v_207) { + return Err(ExecError::AssertEqMismatch { lhs: __v_206.as_canonical_u64(), rhs: __v_207.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); + } + let __v_208: G = if unconstrained { Bytes2::xor(&__v_52, &__v_196) } else { bytes2_xor_value(__v_52, __v_196, record) }; + let __v_209: G = if unconstrained { Bytes2::xor(&__v_53, &__v_197) } else { bytes2_xor_value(__v_53, __v_197, record) }; + let __v_210: G = if unconstrained { Bytes2::xor(&__v_54, &__v_198) } else { bytes2_xor_value(__v_54, __v_198, record) }; + let __v_211: G = if unconstrained { Bytes2::xor(&__v_55, &__v_199) } else { bytes2_xor_value(__v_55, __v_199, record) }; + let __u32_sum: u128 = u128::from(((__v_36.as_canonical_u64() << 0) | (__v_37.as_canonical_u64() << 8) | (__v_38.as_canonical_u64() << 16) | (__v_39.as_canonical_u64() << 24))) + u128::from(((__v_210.as_canonical_u64() << 0) | (__v_211.as_canonical_u64() << 8) | (__v_208.as_canonical_u64() << 16) | (__v_209.as_canonical_u64() << 24))); + let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); + let __v_212: G = G::from_u8(__u32_bytes[0]); + let __v_213: G = G::from_u8(__u32_bytes[1]); + let __v_214: G = G::from_u8(__u32_bytes[2]); + let __v_215: G = G::from_u8(__u32_bytes[3]); + let __v_216: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_212; let __vj = __v_213; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_214; let __vj = __v_215; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_217: G = (__v_216 * __v_216); + if (__v_217 != __v_216) { + return Err(ExecError::AssertEqMismatch { lhs: __v_217.as_canonical_u64(), rhs: __v_216.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); + } + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_20, &__v_212) } else { bytes2_xor_split4_value(__v_20, __v_212, record) }; + let __v_218: G = __b2_out.0; + let __v_219: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_21, &__v_213) } else { bytes2_xor_split4_value(__v_21, __v_213, record) }; let __v_220: G = __b2_out.0; let __v_221: G = __b2_out.1; - let __v_222: G = __b2_out.2; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr7(&__v_218, &__v_219) } else { bytes2_chain_rotr7_value(__v_218, __v_219, record) }; - let __v_223: G = __b2_out.0; - let __v_224: G = __b2_out.1; - let __v_225: G = __b2_out.2; - let __v_226: G = (__v_221 + __v_225); - let __v_227: G = (__v_224 + __v_222); - let __u32_sum: u128 = u128::from(((__v_4.as_canonical_u64() << 0) | (__v_5.as_canonical_u64() << 8) | (__v_6.as_canonical_u64() << 16) | (__v_7.as_canonical_u64() << 24))) + u128::from(((__v_20.as_canonical_u64() << 0) | (__v_21.as_canonical_u64() << 8) | (__v_22.as_canonical_u64() << 16) | (__v_23.as_canonical_u64() << 24))) + u128::from(((__v_72.as_canonical_u64() << 0) | (__v_73.as_canonical_u64() << 8) | (__v_74.as_canonical_u64() << 16) | (__v_75.as_canonical_u64() << 24))); + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_22, &__v_214) } else { bytes2_xor_split4_value(__v_22, __v_214, record) }; + let __v_222: G = __b2_out.0; + let __v_223: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_23, &__v_215) } else { bytes2_xor_split4_value(__v_23, __v_215, record) }; + let __v_224: G = __b2_out.0; + let __v_225: G = __b2_out.1; + let __v_226: G = (__v_220 + __v_223); + let __v_227: G = (__v_222 + __v_225); + let __v_228: G = (__v_224 + __v_219); + let __v_229: G = (__v_218 + __v_221); + let __u32_sum: u128 = u128::from(((__v_196.as_canonical_u64() << 0) | (__v_197.as_canonical_u64() << 8) | (__v_198.as_canonical_u64() << 16) | (__v_199.as_canonical_u64() << 24))) + u128::from(((__v_226.as_canonical_u64() << 0) | (__v_227.as_canonical_u64() << 8) | (__v_228.as_canonical_u64() << 16) | (__v_229.as_canonical_u64() << 24))) + u128::from(((__v_76.as_canonical_u64() << 0) | (__v_77.as_canonical_u64() << 8) | (__v_78.as_canonical_u64() << 16) | (__v_79.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_228: G = G::from_u8(__u32_bytes[0]); - let __v_229: G = G::from_u8(__u32_bytes[1]); - let __v_230: G = G::from_u8(__u32_bytes[2]); - let __v_231: G = G::from_u8(__u32_bytes[3]); - let __v_232: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_228; let __vj = __v_229; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_230: G = G::from_u8(__u32_bytes[0]); + let __v_231: G = G::from_u8(__u32_bytes[1]); + let __v_232: G = G::from_u8(__u32_bytes[2]); + let __v_233: G = G::from_u8(__u32_bytes[3]); + let __v_234: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); if !unconstrained { let __vi = __v_230; let __vj = __v_231; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_233: G = G::from_u64(((__v_4.as_canonical_u64() << 0) | (__v_5.as_canonical_u64() << 8) | (__v_6.as_canonical_u64() << 16) | (__v_7.as_canonical_u64() << 24))); - let __v_234: G = G::from_u64(((__v_20.as_canonical_u64() << 0) | (__v_21.as_canonical_u64() << 8) | (__v_22.as_canonical_u64() << 16) | (__v_23.as_canonical_u64() << 24))); - let __v_235: G = G::from_u64(((__v_72.as_canonical_u64() << 0) | (__v_73.as_canonical_u64() << 8) | (__v_74.as_canonical_u64() << 16) | (__v_75.as_canonical_u64() << 24))); - let __v_236: G = G::from_u64(((__v_228.as_canonical_u64() << 0) | (__v_229.as_canonical_u64() << 8) | (__v_230.as_canonical_u64() << 16) | (__v_231.as_canonical_u64() << 24))); - let __v_237: G = G::from_u64(1); - let __v_238: G = (__v_232 - __v_237); - let __v_239: G = G::from_u64(2); - let __v_240: G = (__v_232 - __v_239); - let __v_241: G = (__v_238 * __v_240); - let __v_242: G = (__v_232 * __v_241); - let __v_243: G = G::from_u64(0); - if (__v_242 != __v_243) { - return Err(ExecError::AssertEqMismatch { lhs: __v_242.as_canonical_u64(), rhs: __v_243.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); - } - let __v_244: G = (__v_234 + __v_235); - let __v_245: G = (__v_233 + __v_244); - let __v_246: G = G::from_u64(4294967296); - let __v_247: G = (__v_246 * __v_232); - let __v_248: G = (__v_236 + __v_247); - if (__v_245 != __v_248) { - return Err(ExecError::AssertEqMismatch { lhs: __v_245.as_canonical_u64(), rhs: __v_248.as_canonical_u64(), msg: Some("u32_add3: witnessed sum does not match its inputs".to_string()) }); - } - let __v_249: G = if unconstrained { Bytes2::xor(&__v_52, &__v_228) } else { bytes2_xor_value(__v_52, __v_228, record) }; - let __v_250: G = if unconstrained { Bytes2::xor(&__v_53, &__v_229) } else { bytes2_xor_value(__v_53, __v_229, record) }; - let __v_251: G = if unconstrained { Bytes2::xor(&__v_54, &__v_230) } else { bytes2_xor_value(__v_54, __v_230, record) }; - let __v_252: G = if unconstrained { Bytes2::xor(&__v_55, &__v_231) } else { bytes2_xor_value(__v_55, __v_231, record) }; - let __u32_sum: u128 = u128::from(((__v_36.as_canonical_u64() << 0) | (__v_37.as_canonical_u64() << 8) | (__v_38.as_canonical_u64() << 16) | (__v_39.as_canonical_u64() << 24))) + u128::from(((__v_251.as_canonical_u64() << 0) | (__v_252.as_canonical_u64() << 8) | (__v_249.as_canonical_u64() << 16) | (__v_250.as_canonical_u64() << 24))); + if !unconstrained { let __vi = __v_232; let __vj = __v_233; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_235: G = G::from_u64(1); + let __v_236: G = (__v_234 - __v_235); + let __v_237: G = G::from_u64(2); + let __v_238: G = (__v_234 - __v_237); + let __v_239: G = (__v_236 * __v_238); + let __v_240: G = (__v_234 * __v_239); + let __v_241: G = G::from_u64(0); + if (__v_240 != __v_241) { + return Err(ExecError::AssertEqMismatch { lhs: __v_240.as_canonical_u64(), rhs: __v_241.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); + } + let __v_242: G = if unconstrained { Bytes2::xor(&__v_210, &__v_230) } else { bytes2_xor_value(__v_210, __v_230, record) }; + let __v_243: G = if unconstrained { Bytes2::xor(&__v_211, &__v_231) } else { bytes2_xor_value(__v_211, __v_231, record) }; + let __v_244: G = if unconstrained { Bytes2::xor(&__v_208, &__v_232) } else { bytes2_xor_value(__v_208, __v_232, record) }; + let __v_245: G = if unconstrained { Bytes2::xor(&__v_209, &__v_233) } else { bytes2_xor_value(__v_209, __v_233, record) }; + let __u32_sum: u128 = u128::from(((__v_212.as_canonical_u64() << 0) | (__v_213.as_canonical_u64() << 8) | (__v_214.as_canonical_u64() << 16) | (__v_215.as_canonical_u64() << 24))) + u128::from(((__v_243.as_canonical_u64() << 0) | (__v_244.as_canonical_u64() << 8) | (__v_245.as_canonical_u64() << 16) | (__v_242.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_253: G = G::from_u8(__u32_bytes[0]); - let __v_254: G = G::from_u8(__u32_bytes[1]); - let __v_255: G = G::from_u8(__u32_bytes[2]); - let __v_256: G = G::from_u8(__u32_bytes[3]); - let __v_257: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_253; let __vj = __v_254; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_255; let __vj = __v_256; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_258: G = G::from_u64(((__v_36.as_canonical_u64() << 0) | (__v_37.as_canonical_u64() << 8) | (__v_38.as_canonical_u64() << 16) | (__v_39.as_canonical_u64() << 24))); - let __v_259: G = G::from_u64(((__v_251.as_canonical_u64() << 0) | (__v_252.as_canonical_u64() << 8) | (__v_249.as_canonical_u64() << 16) | (__v_250.as_canonical_u64() << 24))); - let __v_260: G = G::from_u64(((__v_253.as_canonical_u64() << 0) | (__v_254.as_canonical_u64() << 8) | (__v_255.as_canonical_u64() << 16) | (__v_256.as_canonical_u64() << 24))); - let __v_261: G = (__v_257 * __v_257); - if (__v_261 != __v_257) { - return Err(ExecError::AssertEqMismatch { lhs: __v_261.as_canonical_u64(), rhs: __v_257.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); - } - let __v_262: G = (__v_258 + __v_259); - let __v_263: G = G::from_u64(4294967296); - let __v_264: G = (__v_263 * __v_257); - let __v_265: G = (__v_260 + __v_264); - if (__v_262 != __v_265) { - return Err(ExecError::AssertEqMismatch { lhs: __v_262.as_canonical_u64(), rhs: __v_265.as_canonical_u64(), msg: Some("u32_add: witnessed sum does not match its inputs".to_string()) }); - } - let __v_266: G = if unconstrained { Bytes2::xor(&__v_20, &__v_253) } else { bytes2_xor_value(__v_20, __v_253, record) }; - let __v_267: G = if unconstrained { Bytes2::xor(&__v_21, &__v_254) } else { bytes2_xor_value(__v_21, __v_254, record) }; - let __v_268: G = if unconstrained { Bytes2::xor(&__v_22, &__v_255) } else { bytes2_xor_value(__v_22, __v_255, record) }; - let __v_269: G = if unconstrained { Bytes2::xor(&__v_23, &__v_256) } else { bytes2_xor_value(__v_23, __v_256, record) }; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr4(&__v_267, &__v_268) } else { bytes2_chain_rotr4_value(__v_267, __v_268, record) }; - let __v_270: G = __b2_out.0; - let __v_271: G = __b2_out.1; - let __v_272: G = __b2_out.2; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr4(&__v_269, &__v_266) } else { bytes2_chain_rotr4_value(__v_269, __v_266, record) }; - let __v_273: G = __b2_out.0; - let __v_274: G = __b2_out.1; - let __v_275: G = __b2_out.2; - let __v_276: G = (__v_271 + __v_275); - let __v_277: G = (__v_274 + __v_272); - let __u32_sum: u128 = u128::from(((__v_228.as_canonical_u64() << 0) | (__v_229.as_canonical_u64() << 8) | (__v_230.as_canonical_u64() << 16) | (__v_231.as_canonical_u64() << 24))) + u128::from(((__v_270.as_canonical_u64() << 0) | (__v_276.as_canonical_u64() << 8) | (__v_273.as_canonical_u64() << 16) | (__v_277.as_canonical_u64() << 24))) + u128::from(((__v_76.as_canonical_u64() << 0) | (__v_77.as_canonical_u64() << 8) | (__v_78.as_canonical_u64() << 16) | (__v_79.as_canonical_u64() << 24))); + let __v_246: G = G::from_u8(__u32_bytes[0]); + let __v_247: G = G::from_u8(__u32_bytes[1]); + let __v_248: G = G::from_u8(__u32_bytes[2]); + let __v_249: G = G::from_u8(__u32_bytes[3]); + let __v_250: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_246; let __vj = __v_247; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_248; let __vj = __v_249; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_251: G = (__v_250 * __v_250); + if (__v_251 != __v_250) { + return Err(ExecError::AssertEqMismatch { lhs: __v_251.as_canonical_u64(), rhs: __v_250.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); + } + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_226, &__v_246) } else { bytes2_xor_split7_value(__v_226, __v_246, record) }; + let __v_252: G = __b2_out.0; + let __v_253: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_227, &__v_247) } else { bytes2_xor_split7_value(__v_227, __v_247, record) }; + let __v_254: G = __b2_out.0; + let __v_255: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_228, &__v_248) } else { bytes2_xor_split7_value(__v_228, __v_248, record) }; + let __v_256: G = __b2_out.0; + let __v_257: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_229, &__v_249) } else { bytes2_xor_split7_value(__v_229, __v_249, record) }; + let __v_258: G = __b2_out.0; + let __v_259: G = __b2_out.1; + let __v_260: G = (__v_252 + __v_255); + let __v_261: G = (__v_254 + __v_257); + let __v_262: G = (__v_256 + __v_259); + let __v_263: G = (__v_258 + __v_253); + let __u32_sum: u128 = u128::from(((__v_8.as_canonical_u64() << 0) | (__v_9.as_canonical_u64() << 8) | (__v_10.as_canonical_u64() << 16) | (__v_11.as_canonical_u64() << 24))) + u128::from(((__v_24.as_canonical_u64() << 0) | (__v_25.as_canonical_u64() << 8) | (__v_26.as_canonical_u64() << 16) | (__v_27.as_canonical_u64() << 24))) + u128::from(((__v_80.as_canonical_u64() << 0) | (__v_81.as_canonical_u64() << 8) | (__v_82.as_canonical_u64() << 16) | (__v_83.as_canonical_u64() << 24))); + let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); + let __v_264: G = G::from_u8(__u32_bytes[0]); + let __v_265: G = G::from_u8(__u32_bytes[1]); + let __v_266: G = G::from_u8(__u32_bytes[2]); + let __v_267: G = G::from_u8(__u32_bytes[3]); + let __v_268: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_264; let __vj = __v_265; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_266; let __vj = __v_267; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_269: G = G::from_u64(1); + let __v_270: G = (__v_268 - __v_269); + let __v_271: G = G::from_u64(2); + let __v_272: G = (__v_268 - __v_271); + let __v_273: G = (__v_270 * __v_272); + let __v_274: G = (__v_268 * __v_273); + let __v_275: G = G::from_u64(0); + if (__v_274 != __v_275) { + return Err(ExecError::AssertEqMismatch { lhs: __v_274.as_canonical_u64(), rhs: __v_275.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); + } + let __v_276: G = if unconstrained { Bytes2::xor(&__v_56, &__v_264) } else { bytes2_xor_value(__v_56, __v_264, record) }; + let __v_277: G = if unconstrained { Bytes2::xor(&__v_57, &__v_265) } else { bytes2_xor_value(__v_57, __v_265, record) }; + let __v_278: G = if unconstrained { Bytes2::xor(&__v_58, &__v_266) } else { bytes2_xor_value(__v_58, __v_266, record) }; + let __v_279: G = if unconstrained { Bytes2::xor(&__v_59, &__v_267) } else { bytes2_xor_value(__v_59, __v_267, record) }; + let __u32_sum: u128 = u128::from(((__v_40.as_canonical_u64() << 0) | (__v_41.as_canonical_u64() << 8) | (__v_42.as_canonical_u64() << 16) | (__v_43.as_canonical_u64() << 24))) + u128::from(((__v_278.as_canonical_u64() << 0) | (__v_279.as_canonical_u64() << 8) | (__v_276.as_canonical_u64() << 16) | (__v_277.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_278: G = G::from_u8(__u32_bytes[0]); - let __v_279: G = G::from_u8(__u32_bytes[1]); - let __v_280: G = G::from_u8(__u32_bytes[2]); - let __v_281: G = G::from_u8(__u32_bytes[3]); - let __v_282: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_278; let __vj = __v_279; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_280: G = G::from_u8(__u32_bytes[0]); + let __v_281: G = G::from_u8(__u32_bytes[1]); + let __v_282: G = G::from_u8(__u32_bytes[2]); + let __v_283: G = G::from_u8(__u32_bytes[3]); + let __v_284: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); if !unconstrained { let __vi = __v_280; let __vj = __v_281; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_283: G = G::from_u64(((__v_228.as_canonical_u64() << 0) | (__v_229.as_canonical_u64() << 8) | (__v_230.as_canonical_u64() << 16) | (__v_231.as_canonical_u64() << 24))); - let __v_284: G = G::from_u64(((__v_270.as_canonical_u64() << 0) | (__v_276.as_canonical_u64() << 8) | (__v_273.as_canonical_u64() << 16) | (__v_277.as_canonical_u64() << 24))); - let __v_285: G = G::from_u64(((__v_76.as_canonical_u64() << 0) | (__v_77.as_canonical_u64() << 8) | (__v_78.as_canonical_u64() << 16) | (__v_79.as_canonical_u64() << 24))); - let __v_286: G = G::from_u64(((__v_278.as_canonical_u64() << 0) | (__v_279.as_canonical_u64() << 8) | (__v_280.as_canonical_u64() << 16) | (__v_281.as_canonical_u64() << 24))); - let __v_287: G = G::from_u64(1); - let __v_288: G = (__v_282 - __v_287); - let __v_289: G = G::from_u64(2); - let __v_290: G = (__v_282 - __v_289); - let __v_291: G = (__v_288 * __v_290); - let __v_292: G = (__v_282 * __v_291); - let __v_293: G = G::from_u64(0); - if (__v_292 != __v_293) { - return Err(ExecError::AssertEqMismatch { lhs: __v_292.as_canonical_u64(), rhs: __v_293.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); - } - let __v_294: G = (__v_284 + __v_285); - let __v_295: G = (__v_283 + __v_294); - let __v_296: G = G::from_u64(4294967296); - let __v_297: G = (__v_296 * __v_282); - let __v_298: G = (__v_286 + __v_297); - if (__v_295 != __v_298) { - return Err(ExecError::AssertEqMismatch { lhs: __v_295.as_canonical_u64(), rhs: __v_298.as_canonical_u64(), msg: Some("u32_add3: witnessed sum does not match its inputs".to_string()) }); - } - let __v_299: G = if unconstrained { Bytes2::xor(&__v_251, &__v_278) } else { bytes2_xor_value(__v_251, __v_278, record) }; - let __v_300: G = if unconstrained { Bytes2::xor(&__v_252, &__v_279) } else { bytes2_xor_value(__v_252, __v_279, record) }; - let __v_301: G = if unconstrained { Bytes2::xor(&__v_249, &__v_280) } else { bytes2_xor_value(__v_249, __v_280, record) }; - let __v_302: G = if unconstrained { Bytes2::xor(&__v_250, &__v_281) } else { bytes2_xor_value(__v_250, __v_281, record) }; - let __u32_sum: u128 = u128::from(((__v_253.as_canonical_u64() << 0) | (__v_254.as_canonical_u64() << 8) | (__v_255.as_canonical_u64() << 16) | (__v_256.as_canonical_u64() << 24))) + u128::from(((__v_300.as_canonical_u64() << 0) | (__v_301.as_canonical_u64() << 8) | (__v_302.as_canonical_u64() << 16) | (__v_299.as_canonical_u64() << 24))); + if !unconstrained { let __vi = __v_282; let __vj = __v_283; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_285: G = (__v_284 * __v_284); + if (__v_285 != __v_284) { + return Err(ExecError::AssertEqMismatch { lhs: __v_285.as_canonical_u64(), rhs: __v_284.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); + } + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_24, &__v_280) } else { bytes2_xor_split4_value(__v_24, __v_280, record) }; + let __v_286: G = __b2_out.0; + let __v_287: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_25, &__v_281) } else { bytes2_xor_split4_value(__v_25, __v_281, record) }; + let __v_288: G = __b2_out.0; + let __v_289: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_26, &__v_282) } else { bytes2_xor_split4_value(__v_26, __v_282, record) }; + let __v_290: G = __b2_out.0; + let __v_291: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_27, &__v_283) } else { bytes2_xor_split4_value(__v_27, __v_283, record) }; + let __v_292: G = __b2_out.0; + let __v_293: G = __b2_out.1; + let __v_294: G = (__v_288 + __v_291); + let __v_295: G = (__v_290 + __v_293); + let __v_296: G = (__v_292 + __v_287); + let __v_297: G = (__v_286 + __v_289); + let __u32_sum: u128 = u128::from(((__v_264.as_canonical_u64() << 0) | (__v_265.as_canonical_u64() << 8) | (__v_266.as_canonical_u64() << 16) | (__v_267.as_canonical_u64() << 24))) + u128::from(((__v_294.as_canonical_u64() << 0) | (__v_295.as_canonical_u64() << 8) | (__v_296.as_canonical_u64() << 16) | (__v_297.as_canonical_u64() << 24))) + u128::from(((__v_84.as_canonical_u64() << 0) | (__v_85.as_canonical_u64() << 8) | (__v_86.as_canonical_u64() << 16) | (__v_87.as_canonical_u64() << 24))); + let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); + let __v_298: G = G::from_u8(__u32_bytes[0]); + let __v_299: G = G::from_u8(__u32_bytes[1]); + let __v_300: G = G::from_u8(__u32_bytes[2]); + let __v_301: G = G::from_u8(__u32_bytes[3]); + let __v_302: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_298; let __vj = __v_299; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_300; let __vj = __v_301; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_303: G = G::from_u64(1); + let __v_304: G = (__v_302 - __v_303); + let __v_305: G = G::from_u64(2); + let __v_306: G = (__v_302 - __v_305); + let __v_307: G = (__v_304 * __v_306); + let __v_308: G = (__v_302 * __v_307); + let __v_309: G = G::from_u64(0); + if (__v_308 != __v_309) { + return Err(ExecError::AssertEqMismatch { lhs: __v_308.as_canonical_u64(), rhs: __v_309.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); + } + let __v_310: G = if unconstrained { Bytes2::xor(&__v_278, &__v_298) } else { bytes2_xor_value(__v_278, __v_298, record) }; + let __v_311: G = if unconstrained { Bytes2::xor(&__v_279, &__v_299) } else { bytes2_xor_value(__v_279, __v_299, record) }; + let __v_312: G = if unconstrained { Bytes2::xor(&__v_276, &__v_300) } else { bytes2_xor_value(__v_276, __v_300, record) }; + let __v_313: G = if unconstrained { Bytes2::xor(&__v_277, &__v_301) } else { bytes2_xor_value(__v_277, __v_301, record) }; + let __u32_sum: u128 = u128::from(((__v_280.as_canonical_u64() << 0) | (__v_281.as_canonical_u64() << 8) | (__v_282.as_canonical_u64() << 16) | (__v_283.as_canonical_u64() << 24))) + u128::from(((__v_311.as_canonical_u64() << 0) | (__v_312.as_canonical_u64() << 8) | (__v_313.as_canonical_u64() << 16) | (__v_310.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_303: G = G::from_u8(__u32_bytes[0]); - let __v_304: G = G::from_u8(__u32_bytes[1]); - let __v_305: G = G::from_u8(__u32_bytes[2]); - let __v_306: G = G::from_u8(__u32_bytes[3]); - let __v_307: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_303; let __vj = __v_304; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_305; let __vj = __v_306; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_308: G = G::from_u64(((__v_253.as_canonical_u64() << 0) | (__v_254.as_canonical_u64() << 8) | (__v_255.as_canonical_u64() << 16) | (__v_256.as_canonical_u64() << 24))); - let __v_309: G = G::from_u64(((__v_300.as_canonical_u64() << 0) | (__v_301.as_canonical_u64() << 8) | (__v_302.as_canonical_u64() << 16) | (__v_299.as_canonical_u64() << 24))); - let __v_310: G = G::from_u64(((__v_303.as_canonical_u64() << 0) | (__v_304.as_canonical_u64() << 8) | (__v_305.as_canonical_u64() << 16) | (__v_306.as_canonical_u64() << 24))); - let __v_311: G = (__v_307 * __v_307); - if (__v_311 != __v_307) { - return Err(ExecError::AssertEqMismatch { lhs: __v_311.as_canonical_u64(), rhs: __v_307.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); - } - let __v_312: G = (__v_308 + __v_309); - let __v_313: G = G::from_u64(4294967296); - let __v_314: G = (__v_313 * __v_307); - let __v_315: G = (__v_310 + __v_314); - if (__v_312 != __v_315) { - return Err(ExecError::AssertEqMismatch { lhs: __v_312.as_canonical_u64(), rhs: __v_315.as_canonical_u64(), msg: Some("u32_add: witnessed sum does not match its inputs".to_string()) }); - } - let __v_316: G = if unconstrained { Bytes2::xor(&__v_270, &__v_303) } else { bytes2_xor_value(__v_270, __v_303, record) }; - let __v_317: G = if unconstrained { Bytes2::xor(&__v_276, &__v_304) } else { bytes2_xor_value(__v_276, __v_304, record) }; - let __v_318: G = if unconstrained { Bytes2::xor(&__v_273, &__v_305) } else { bytes2_xor_value(__v_273, __v_305, record) }; - let __v_319: G = if unconstrained { Bytes2::xor(&__v_277, &__v_306) } else { bytes2_xor_value(__v_277, __v_306, record) }; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr7(&__v_316, &__v_317) } else { bytes2_chain_rotr7_value(__v_316, __v_317, record) }; + let __v_314: G = G::from_u8(__u32_bytes[0]); + let __v_315: G = G::from_u8(__u32_bytes[1]); + let __v_316: G = G::from_u8(__u32_bytes[2]); + let __v_317: G = G::from_u8(__u32_bytes[3]); + let __v_318: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_314; let __vj = __v_315; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_316; let __vj = __v_317; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_319: G = (__v_318 * __v_318); + if (__v_319 != __v_318) { + return Err(ExecError::AssertEqMismatch { lhs: __v_319.as_canonical_u64(), rhs: __v_318.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); + } + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_294, &__v_314) } else { bytes2_xor_split7_value(__v_294, __v_314, record) }; let __v_320: G = __b2_out.0; let __v_321: G = __b2_out.1; - let __v_322: G = __b2_out.2; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr7(&__v_318, &__v_319) } else { bytes2_chain_rotr7_value(__v_318, __v_319, record) }; - let __v_323: G = __b2_out.0; - let __v_324: G = __b2_out.1; - let __v_325: G = __b2_out.2; - let __v_326: G = (__v_321 + __v_325); - let __v_327: G = (__v_324 + __v_322); - let __u32_sum: u128 = u128::from(((__v_8.as_canonical_u64() << 0) | (__v_9.as_canonical_u64() << 8) | (__v_10.as_canonical_u64() << 16) | (__v_11.as_canonical_u64() << 24))) + u128::from(((__v_24.as_canonical_u64() << 0) | (__v_25.as_canonical_u64() << 8) | (__v_26.as_canonical_u64() << 16) | (__v_27.as_canonical_u64() << 24))) + u128::from(((__v_80.as_canonical_u64() << 0) | (__v_81.as_canonical_u64() << 8) | (__v_82.as_canonical_u64() << 16) | (__v_83.as_canonical_u64() << 24))); + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_295, &__v_315) } else { bytes2_xor_split7_value(__v_295, __v_315, record) }; + let __v_322: G = __b2_out.0; + let __v_323: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_296, &__v_316) } else { bytes2_xor_split7_value(__v_296, __v_316, record) }; + let __v_324: G = __b2_out.0; + let __v_325: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_297, &__v_317) } else { bytes2_xor_split7_value(__v_297, __v_317, record) }; + let __v_326: G = __b2_out.0; + let __v_327: G = __b2_out.1; + let __v_328: G = (__v_320 + __v_323); + let __v_329: G = (__v_322 + __v_325); + let __v_330: G = (__v_324 + __v_327); + let __v_331: G = (__v_326 + __v_321); + let __u32_sum: u128 = u128::from(((__v_12.as_canonical_u64() << 0) | (__v_13.as_canonical_u64() << 8) | (__v_14.as_canonical_u64() << 16) | (__v_15.as_canonical_u64() << 24))) + u128::from(((__v_28.as_canonical_u64() << 0) | (__v_29.as_canonical_u64() << 8) | (__v_30.as_canonical_u64() << 16) | (__v_31.as_canonical_u64() << 24))) + u128::from(((__v_88.as_canonical_u64() << 0) | (__v_89.as_canonical_u64() << 8) | (__v_90.as_canonical_u64() << 16) | (__v_91.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_328: G = G::from_u8(__u32_bytes[0]); - let __v_329: G = G::from_u8(__u32_bytes[1]); - let __v_330: G = G::from_u8(__u32_bytes[2]); - let __v_331: G = G::from_u8(__u32_bytes[3]); - let __v_332: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_328; let __vj = __v_329; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_330; let __vj = __v_331; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_333: G = G::from_u64(((__v_8.as_canonical_u64() << 0) | (__v_9.as_canonical_u64() << 8) | (__v_10.as_canonical_u64() << 16) | (__v_11.as_canonical_u64() << 24))); - let __v_334: G = G::from_u64(((__v_24.as_canonical_u64() << 0) | (__v_25.as_canonical_u64() << 8) | (__v_26.as_canonical_u64() << 16) | (__v_27.as_canonical_u64() << 24))); - let __v_335: G = G::from_u64(((__v_80.as_canonical_u64() << 0) | (__v_81.as_canonical_u64() << 8) | (__v_82.as_canonical_u64() << 16) | (__v_83.as_canonical_u64() << 24))); - let __v_336: G = G::from_u64(((__v_328.as_canonical_u64() << 0) | (__v_329.as_canonical_u64() << 8) | (__v_330.as_canonical_u64() << 16) | (__v_331.as_canonical_u64() << 24))); + let __v_332: G = G::from_u8(__u32_bytes[0]); + let __v_333: G = G::from_u8(__u32_bytes[1]); + let __v_334: G = G::from_u8(__u32_bytes[2]); + let __v_335: G = G::from_u8(__u32_bytes[3]); + let __v_336: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_332; let __vj = __v_333; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_334; let __vj = __v_335; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; let __v_337: G = G::from_u64(1); - let __v_338: G = (__v_332 - __v_337); + let __v_338: G = (__v_336 - __v_337); let __v_339: G = G::from_u64(2); - let __v_340: G = (__v_332 - __v_339); + let __v_340: G = (__v_336 - __v_339); let __v_341: G = (__v_338 * __v_340); - let __v_342: G = (__v_332 * __v_341); + let __v_342: G = (__v_336 * __v_341); let __v_343: G = G::from_u64(0); if (__v_342 != __v_343) { return Err(ExecError::AssertEqMismatch { lhs: __v_342.as_canonical_u64(), rhs: __v_343.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); } - let __v_344: G = (__v_334 + __v_335); - let __v_345: G = (__v_333 + __v_344); - let __v_346: G = G::from_u64(4294967296); - let __v_347: G = (__v_346 * __v_332); - let __v_348: G = (__v_336 + __v_347); - if (__v_345 != __v_348) { - return Err(ExecError::AssertEqMismatch { lhs: __v_345.as_canonical_u64(), rhs: __v_348.as_canonical_u64(), msg: Some("u32_add3: witnessed sum does not match its inputs".to_string()) }); - } - let __v_349: G = if unconstrained { Bytes2::xor(&__v_56, &__v_328) } else { bytes2_xor_value(__v_56, __v_328, record) }; - let __v_350: G = if unconstrained { Bytes2::xor(&__v_57, &__v_329) } else { bytes2_xor_value(__v_57, __v_329, record) }; - let __v_351: G = if unconstrained { Bytes2::xor(&__v_58, &__v_330) } else { bytes2_xor_value(__v_58, __v_330, record) }; - let __v_352: G = if unconstrained { Bytes2::xor(&__v_59, &__v_331) } else { bytes2_xor_value(__v_59, __v_331, record) }; - let __u32_sum: u128 = u128::from(((__v_40.as_canonical_u64() << 0) | (__v_41.as_canonical_u64() << 8) | (__v_42.as_canonical_u64() << 16) | (__v_43.as_canonical_u64() << 24))) + u128::from(((__v_351.as_canonical_u64() << 0) | (__v_352.as_canonical_u64() << 8) | (__v_349.as_canonical_u64() << 16) | (__v_350.as_canonical_u64() << 24))); - let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_353: G = G::from_u8(__u32_bytes[0]); - let __v_354: G = G::from_u8(__u32_bytes[1]); - let __v_355: G = G::from_u8(__u32_bytes[2]); - let __v_356: G = G::from_u8(__u32_bytes[3]); - let __v_357: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_353; let __vj = __v_354; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_355; let __vj = __v_356; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_358: G = G::from_u64(((__v_40.as_canonical_u64() << 0) | (__v_41.as_canonical_u64() << 8) | (__v_42.as_canonical_u64() << 16) | (__v_43.as_canonical_u64() << 24))); - let __v_359: G = G::from_u64(((__v_351.as_canonical_u64() << 0) | (__v_352.as_canonical_u64() << 8) | (__v_349.as_canonical_u64() << 16) | (__v_350.as_canonical_u64() << 24))); - let __v_360: G = G::from_u64(((__v_353.as_canonical_u64() << 0) | (__v_354.as_canonical_u64() << 8) | (__v_355.as_canonical_u64() << 16) | (__v_356.as_canonical_u64() << 24))); - let __v_361: G = (__v_357 * __v_357); - if (__v_361 != __v_357) { - return Err(ExecError::AssertEqMismatch { lhs: __v_361.as_canonical_u64(), rhs: __v_357.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); - } - let __v_362: G = (__v_358 + __v_359); - let __v_363: G = G::from_u64(4294967296); - let __v_364: G = (__v_363 * __v_357); - let __v_365: G = (__v_360 + __v_364); - if (__v_362 != __v_365) { - return Err(ExecError::AssertEqMismatch { lhs: __v_362.as_canonical_u64(), rhs: __v_365.as_canonical_u64(), msg: Some("u32_add: witnessed sum does not match its inputs".to_string()) }); - } - let __v_366: G = if unconstrained { Bytes2::xor(&__v_24, &__v_353) } else { bytes2_xor_value(__v_24, __v_353, record) }; - let __v_367: G = if unconstrained { Bytes2::xor(&__v_25, &__v_354) } else { bytes2_xor_value(__v_25, __v_354, record) }; - let __v_368: G = if unconstrained { Bytes2::xor(&__v_26, &__v_355) } else { bytes2_xor_value(__v_26, __v_355, record) }; - let __v_369: G = if unconstrained { Bytes2::xor(&__v_27, &__v_356) } else { bytes2_xor_value(__v_27, __v_356, record) }; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr4(&__v_367, &__v_368) } else { bytes2_chain_rotr4_value(__v_367, __v_368, record) }; - let __v_370: G = __b2_out.0; - let __v_371: G = __b2_out.1; - let __v_372: G = __b2_out.2; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr4(&__v_369, &__v_366) } else { bytes2_chain_rotr4_value(__v_369, __v_366, record) }; - let __v_373: G = __b2_out.0; - let __v_374: G = __b2_out.1; - let __v_375: G = __b2_out.2; - let __v_376: G = (__v_371 + __v_375); - let __v_377: G = (__v_374 + __v_372); - let __u32_sum: u128 = u128::from(((__v_328.as_canonical_u64() << 0) | (__v_329.as_canonical_u64() << 8) | (__v_330.as_canonical_u64() << 16) | (__v_331.as_canonical_u64() << 24))) + u128::from(((__v_370.as_canonical_u64() << 0) | (__v_376.as_canonical_u64() << 8) | (__v_373.as_canonical_u64() << 16) | (__v_377.as_canonical_u64() << 24))) + u128::from(((__v_84.as_canonical_u64() << 0) | (__v_85.as_canonical_u64() << 8) | (__v_86.as_canonical_u64() << 16) | (__v_87.as_canonical_u64() << 24))); - let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_378: G = G::from_u8(__u32_bytes[0]); - let __v_379: G = G::from_u8(__u32_bytes[1]); - let __v_380: G = G::from_u8(__u32_bytes[2]); - let __v_381: G = G::from_u8(__u32_bytes[3]); - let __v_382: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_378; let __vj = __v_379; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_380; let __vj = __v_381; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_383: G = G::from_u64(((__v_328.as_canonical_u64() << 0) | (__v_329.as_canonical_u64() << 8) | (__v_330.as_canonical_u64() << 16) | (__v_331.as_canonical_u64() << 24))); - let __v_384: G = G::from_u64(((__v_370.as_canonical_u64() << 0) | (__v_376.as_canonical_u64() << 8) | (__v_373.as_canonical_u64() << 16) | (__v_377.as_canonical_u64() << 24))); - let __v_385: G = G::from_u64(((__v_84.as_canonical_u64() << 0) | (__v_85.as_canonical_u64() << 8) | (__v_86.as_canonical_u64() << 16) | (__v_87.as_canonical_u64() << 24))); - let __v_386: G = G::from_u64(((__v_378.as_canonical_u64() << 0) | (__v_379.as_canonical_u64() << 8) | (__v_380.as_canonical_u64() << 16) | (__v_381.as_canonical_u64() << 24))); - let __v_387: G = G::from_u64(1); - let __v_388: G = (__v_382 - __v_387); - let __v_389: G = G::from_u64(2); - let __v_390: G = (__v_382 - __v_389); - let __v_391: G = (__v_388 * __v_390); - let __v_392: G = (__v_382 * __v_391); - let __v_393: G = G::from_u64(0); - if (__v_392 != __v_393) { - return Err(ExecError::AssertEqMismatch { lhs: __v_392.as_canonical_u64(), rhs: __v_393.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); - } - let __v_394: G = (__v_384 + __v_385); - let __v_395: G = (__v_383 + __v_394); - let __v_396: G = G::from_u64(4294967296); - let __v_397: G = (__v_396 * __v_382); - let __v_398: G = (__v_386 + __v_397); - if (__v_395 != __v_398) { - return Err(ExecError::AssertEqMismatch { lhs: __v_395.as_canonical_u64(), rhs: __v_398.as_canonical_u64(), msg: Some("u32_add3: witnessed sum does not match its inputs".to_string()) }); - } - let __v_399: G = if unconstrained { Bytes2::xor(&__v_351, &__v_378) } else { bytes2_xor_value(__v_351, __v_378, record) }; - let __v_400: G = if unconstrained { Bytes2::xor(&__v_352, &__v_379) } else { bytes2_xor_value(__v_352, __v_379, record) }; - let __v_401: G = if unconstrained { Bytes2::xor(&__v_349, &__v_380) } else { bytes2_xor_value(__v_349, __v_380, record) }; - let __v_402: G = if unconstrained { Bytes2::xor(&__v_350, &__v_381) } else { bytes2_xor_value(__v_350, __v_381, record) }; - let __u32_sum: u128 = u128::from(((__v_353.as_canonical_u64() << 0) | (__v_354.as_canonical_u64() << 8) | (__v_355.as_canonical_u64() << 16) | (__v_356.as_canonical_u64() << 24))) + u128::from(((__v_400.as_canonical_u64() << 0) | (__v_401.as_canonical_u64() << 8) | (__v_402.as_canonical_u64() << 16) | (__v_399.as_canonical_u64() << 24))); - let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_403: G = G::from_u8(__u32_bytes[0]); - let __v_404: G = G::from_u8(__u32_bytes[1]); - let __v_405: G = G::from_u8(__u32_bytes[2]); - let __v_406: G = G::from_u8(__u32_bytes[3]); - let __v_407: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_403; let __vj = __v_404; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_405; let __vj = __v_406; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_408: G = G::from_u64(((__v_353.as_canonical_u64() << 0) | (__v_354.as_canonical_u64() << 8) | (__v_355.as_canonical_u64() << 16) | (__v_356.as_canonical_u64() << 24))); - let __v_409: G = G::from_u64(((__v_400.as_canonical_u64() << 0) | (__v_401.as_canonical_u64() << 8) | (__v_402.as_canonical_u64() << 16) | (__v_399.as_canonical_u64() << 24))); - let __v_410: G = G::from_u64(((__v_403.as_canonical_u64() << 0) | (__v_404.as_canonical_u64() << 8) | (__v_405.as_canonical_u64() << 16) | (__v_406.as_canonical_u64() << 24))); - let __v_411: G = (__v_407 * __v_407); - if (__v_411 != __v_407) { - return Err(ExecError::AssertEqMismatch { lhs: __v_411.as_canonical_u64(), rhs: __v_407.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); - } - let __v_412: G = (__v_408 + __v_409); - let __v_413: G = G::from_u64(4294967296); - let __v_414: G = (__v_413 * __v_407); - let __v_415: G = (__v_410 + __v_414); - if (__v_412 != __v_415) { - return Err(ExecError::AssertEqMismatch { lhs: __v_412.as_canonical_u64(), rhs: __v_415.as_canonical_u64(), msg: Some("u32_add: witnessed sum does not match its inputs".to_string()) }); - } - let __v_416: G = if unconstrained { Bytes2::xor(&__v_370, &__v_403) } else { bytes2_xor_value(__v_370, __v_403, record) }; - let __v_417: G = if unconstrained { Bytes2::xor(&__v_376, &__v_404) } else { bytes2_xor_value(__v_376, __v_404, record) }; - let __v_418: G = if unconstrained { Bytes2::xor(&__v_373, &__v_405) } else { bytes2_xor_value(__v_373, __v_405, record) }; - let __v_419: G = if unconstrained { Bytes2::xor(&__v_377, &__v_406) } else { bytes2_xor_value(__v_377, __v_406, record) }; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr7(&__v_416, &__v_417) } else { bytes2_chain_rotr7_value(__v_416, __v_417, record) }; - let __v_420: G = __b2_out.0; - let __v_421: G = __b2_out.1; - let __v_422: G = __b2_out.2; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr7(&__v_418, &__v_419) } else { bytes2_chain_rotr7_value(__v_418, __v_419, record) }; - let __v_423: G = __b2_out.0; - let __v_424: G = __b2_out.1; - let __v_425: G = __b2_out.2; - let __v_426: G = (__v_421 + __v_425); - let __v_427: G = (__v_424 + __v_422); - let __u32_sum: u128 = u128::from(((__v_12.as_canonical_u64() << 0) | (__v_13.as_canonical_u64() << 8) | (__v_14.as_canonical_u64() << 16) | (__v_15.as_canonical_u64() << 24))) + u128::from(((__v_28.as_canonical_u64() << 0) | (__v_29.as_canonical_u64() << 8) | (__v_30.as_canonical_u64() << 16) | (__v_31.as_canonical_u64() << 24))) + u128::from(((__v_88.as_canonical_u64() << 0) | (__v_89.as_canonical_u64() << 8) | (__v_90.as_canonical_u64() << 16) | (__v_91.as_canonical_u64() << 24))); - let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_428: G = G::from_u8(__u32_bytes[0]); - let __v_429: G = G::from_u8(__u32_bytes[1]); - let __v_430: G = G::from_u8(__u32_bytes[2]); - let __v_431: G = G::from_u8(__u32_bytes[3]); - let __v_432: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_428; let __vj = __v_429; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_430; let __vj = __v_431; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_433: G = G::from_u64(((__v_12.as_canonical_u64() << 0) | (__v_13.as_canonical_u64() << 8) | (__v_14.as_canonical_u64() << 16) | (__v_15.as_canonical_u64() << 24))); - let __v_434: G = G::from_u64(((__v_28.as_canonical_u64() << 0) | (__v_29.as_canonical_u64() << 8) | (__v_30.as_canonical_u64() << 16) | (__v_31.as_canonical_u64() << 24))); - let __v_435: G = G::from_u64(((__v_88.as_canonical_u64() << 0) | (__v_89.as_canonical_u64() << 8) | (__v_90.as_canonical_u64() << 16) | (__v_91.as_canonical_u64() << 24))); - let __v_436: G = G::from_u64(((__v_428.as_canonical_u64() << 0) | (__v_429.as_canonical_u64() << 8) | (__v_430.as_canonical_u64() << 16) | (__v_431.as_canonical_u64() << 24))); - let __v_437: G = G::from_u64(1); - let __v_438: G = (__v_432 - __v_437); - let __v_439: G = G::from_u64(2); - let __v_440: G = (__v_432 - __v_439); - let __v_441: G = (__v_438 * __v_440); - let __v_442: G = (__v_432 * __v_441); - let __v_443: G = G::from_u64(0); - if (__v_442 != __v_443) { - return Err(ExecError::AssertEqMismatch { lhs: __v_442.as_canonical_u64(), rhs: __v_443.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); - } - let __v_444: G = (__v_434 + __v_435); - let __v_445: G = (__v_433 + __v_444); - let __v_446: G = G::from_u64(4294967296); - let __v_447: G = (__v_446 * __v_432); - let __v_448: G = (__v_436 + __v_447); - if (__v_445 != __v_448) { - return Err(ExecError::AssertEqMismatch { lhs: __v_445.as_canonical_u64(), rhs: __v_448.as_canonical_u64(), msg: Some("u32_add3: witnessed sum does not match its inputs".to_string()) }); - } - let __v_449: G = if unconstrained { Bytes2::xor(&__v_60, &__v_428) } else { bytes2_xor_value(__v_60, __v_428, record) }; - let __v_450: G = if unconstrained { Bytes2::xor(&__v_61, &__v_429) } else { bytes2_xor_value(__v_61, __v_429, record) }; - let __v_451: G = if unconstrained { Bytes2::xor(&__v_62, &__v_430) } else { bytes2_xor_value(__v_62, __v_430, record) }; - let __v_452: G = if unconstrained { Bytes2::xor(&__v_63, &__v_431) } else { bytes2_xor_value(__v_63, __v_431, record) }; - let __u32_sum: u128 = u128::from(((__v_44.as_canonical_u64() << 0) | (__v_45.as_canonical_u64() << 8) | (__v_46.as_canonical_u64() << 16) | (__v_47.as_canonical_u64() << 24))) + u128::from(((__v_451.as_canonical_u64() << 0) | (__v_452.as_canonical_u64() << 8) | (__v_449.as_canonical_u64() << 16) | (__v_450.as_canonical_u64() << 24))); + let __v_344: G = if unconstrained { Bytes2::xor(&__v_60, &__v_332) } else { bytes2_xor_value(__v_60, __v_332, record) }; + let __v_345: G = if unconstrained { Bytes2::xor(&__v_61, &__v_333) } else { bytes2_xor_value(__v_61, __v_333, record) }; + let __v_346: G = if unconstrained { Bytes2::xor(&__v_62, &__v_334) } else { bytes2_xor_value(__v_62, __v_334, record) }; + let __v_347: G = if unconstrained { Bytes2::xor(&__v_63, &__v_335) } else { bytes2_xor_value(__v_63, __v_335, record) }; + let __u32_sum: u128 = u128::from(((__v_44.as_canonical_u64() << 0) | (__v_45.as_canonical_u64() << 8) | (__v_46.as_canonical_u64() << 16) | (__v_47.as_canonical_u64() << 24))) + u128::from(((__v_346.as_canonical_u64() << 0) | (__v_347.as_canonical_u64() << 8) | (__v_344.as_canonical_u64() << 16) | (__v_345.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_453: G = G::from_u8(__u32_bytes[0]); - let __v_454: G = G::from_u8(__u32_bytes[1]); - let __v_455: G = G::from_u8(__u32_bytes[2]); - let __v_456: G = G::from_u8(__u32_bytes[3]); - let __v_457: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_453; let __vj = __v_454; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_455; let __vj = __v_456; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_458: G = G::from_u64(((__v_44.as_canonical_u64() << 0) | (__v_45.as_canonical_u64() << 8) | (__v_46.as_canonical_u64() << 16) | (__v_47.as_canonical_u64() << 24))); - let __v_459: G = G::from_u64(((__v_451.as_canonical_u64() << 0) | (__v_452.as_canonical_u64() << 8) | (__v_449.as_canonical_u64() << 16) | (__v_450.as_canonical_u64() << 24))); - let __v_460: G = G::from_u64(((__v_453.as_canonical_u64() << 0) | (__v_454.as_canonical_u64() << 8) | (__v_455.as_canonical_u64() << 16) | (__v_456.as_canonical_u64() << 24))); - let __v_461: G = (__v_457 * __v_457); - if (__v_461 != __v_457) { - return Err(ExecError::AssertEqMismatch { lhs: __v_461.as_canonical_u64(), rhs: __v_457.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); - } - let __v_462: G = (__v_458 + __v_459); - let __v_463: G = G::from_u64(4294967296); - let __v_464: G = (__v_463 * __v_457); - let __v_465: G = (__v_460 + __v_464); - if (__v_462 != __v_465) { - return Err(ExecError::AssertEqMismatch { lhs: __v_462.as_canonical_u64(), rhs: __v_465.as_canonical_u64(), msg: Some("u32_add: witnessed sum does not match its inputs".to_string()) }); - } - let __v_466: G = if unconstrained { Bytes2::xor(&__v_28, &__v_453) } else { bytes2_xor_value(__v_28, __v_453, record) }; - let __v_467: G = if unconstrained { Bytes2::xor(&__v_29, &__v_454) } else { bytes2_xor_value(__v_29, __v_454, record) }; - let __v_468: G = if unconstrained { Bytes2::xor(&__v_30, &__v_455) } else { bytes2_xor_value(__v_30, __v_455, record) }; - let __v_469: G = if unconstrained { Bytes2::xor(&__v_31, &__v_456) } else { bytes2_xor_value(__v_31, __v_456, record) }; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr4(&__v_467, &__v_468) } else { bytes2_chain_rotr4_value(__v_467, __v_468, record) }; - let __v_470: G = __b2_out.0; - let __v_471: G = __b2_out.1; - let __v_472: G = __b2_out.2; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr4(&__v_469, &__v_466) } else { bytes2_chain_rotr4_value(__v_469, __v_466, record) }; - let __v_473: G = __b2_out.0; - let __v_474: G = __b2_out.1; - let __v_475: G = __b2_out.2; - let __v_476: G = (__v_471 + __v_475); - let __v_477: G = (__v_474 + __v_472); - let __u32_sum: u128 = u128::from(((__v_428.as_canonical_u64() << 0) | (__v_429.as_canonical_u64() << 8) | (__v_430.as_canonical_u64() << 16) | (__v_431.as_canonical_u64() << 24))) + u128::from(((__v_470.as_canonical_u64() << 0) | (__v_476.as_canonical_u64() << 8) | (__v_473.as_canonical_u64() << 16) | (__v_477.as_canonical_u64() << 24))) + u128::from(((__v_92.as_canonical_u64() << 0) | (__v_93.as_canonical_u64() << 8) | (__v_94.as_canonical_u64() << 16) | (__v_95.as_canonical_u64() << 24))); + let __v_348: G = G::from_u8(__u32_bytes[0]); + let __v_349: G = G::from_u8(__u32_bytes[1]); + let __v_350: G = G::from_u8(__u32_bytes[2]); + let __v_351: G = G::from_u8(__u32_bytes[3]); + let __v_352: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_348; let __vj = __v_349; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_350; let __vj = __v_351; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_353: G = (__v_352 * __v_352); + if (__v_353 != __v_352) { + return Err(ExecError::AssertEqMismatch { lhs: __v_353.as_canonical_u64(), rhs: __v_352.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); + } + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_28, &__v_348) } else { bytes2_xor_split4_value(__v_28, __v_348, record) }; + let __v_354: G = __b2_out.0; + let __v_355: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_29, &__v_349) } else { bytes2_xor_split4_value(__v_29, __v_349, record) }; + let __v_356: G = __b2_out.0; + let __v_357: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_30, &__v_350) } else { bytes2_xor_split4_value(__v_30, __v_350, record) }; + let __v_358: G = __b2_out.0; + let __v_359: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_31, &__v_351) } else { bytes2_xor_split4_value(__v_31, __v_351, record) }; + let __v_360: G = __b2_out.0; + let __v_361: G = __b2_out.1; + let __v_362: G = (__v_356 + __v_359); + let __v_363: G = (__v_358 + __v_361); + let __v_364: G = (__v_360 + __v_355); + let __v_365: G = (__v_354 + __v_357); + let __u32_sum: u128 = u128::from(((__v_332.as_canonical_u64() << 0) | (__v_333.as_canonical_u64() << 8) | (__v_334.as_canonical_u64() << 16) | (__v_335.as_canonical_u64() << 24))) + u128::from(((__v_362.as_canonical_u64() << 0) | (__v_363.as_canonical_u64() << 8) | (__v_364.as_canonical_u64() << 16) | (__v_365.as_canonical_u64() << 24))) + u128::from(((__v_92.as_canonical_u64() << 0) | (__v_93.as_canonical_u64() << 8) | (__v_94.as_canonical_u64() << 16) | (__v_95.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_478: G = G::from_u8(__u32_bytes[0]); - let __v_479: G = G::from_u8(__u32_bytes[1]); - let __v_480: G = G::from_u8(__u32_bytes[2]); - let __v_481: G = G::from_u8(__u32_bytes[3]); - let __v_482: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_478; let __vj = __v_479; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_480; let __vj = __v_481; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_483: G = G::from_u64(((__v_428.as_canonical_u64() << 0) | (__v_429.as_canonical_u64() << 8) | (__v_430.as_canonical_u64() << 16) | (__v_431.as_canonical_u64() << 24))); - let __v_484: G = G::from_u64(((__v_470.as_canonical_u64() << 0) | (__v_476.as_canonical_u64() << 8) | (__v_473.as_canonical_u64() << 16) | (__v_477.as_canonical_u64() << 24))); - let __v_485: G = G::from_u64(((__v_92.as_canonical_u64() << 0) | (__v_93.as_canonical_u64() << 8) | (__v_94.as_canonical_u64() << 16) | (__v_95.as_canonical_u64() << 24))); - let __v_486: G = G::from_u64(((__v_478.as_canonical_u64() << 0) | (__v_479.as_canonical_u64() << 8) | (__v_480.as_canonical_u64() << 16) | (__v_481.as_canonical_u64() << 24))); - let __v_487: G = G::from_u64(1); - let __v_488: G = (__v_482 - __v_487); - let __v_489: G = G::from_u64(2); - let __v_490: G = (__v_482 - __v_489); - let __v_491: G = (__v_488 * __v_490); - let __v_492: G = (__v_482 * __v_491); - let __v_493: G = G::from_u64(0); - if (__v_492 != __v_493) { - return Err(ExecError::AssertEqMismatch { lhs: __v_492.as_canonical_u64(), rhs: __v_493.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); - } - let __v_494: G = (__v_484 + __v_485); - let __v_495: G = (__v_483 + __v_494); - let __v_496: G = G::from_u64(4294967296); - let __v_497: G = (__v_496 * __v_482); - let __v_498: G = (__v_486 + __v_497); - if (__v_495 != __v_498) { - return Err(ExecError::AssertEqMismatch { lhs: __v_495.as_canonical_u64(), rhs: __v_498.as_canonical_u64(), msg: Some("u32_add3: witnessed sum does not match its inputs".to_string()) }); - } - let __v_499: G = if unconstrained { Bytes2::xor(&__v_451, &__v_478) } else { bytes2_xor_value(__v_451, __v_478, record) }; - let __v_500: G = if unconstrained { Bytes2::xor(&__v_452, &__v_479) } else { bytes2_xor_value(__v_452, __v_479, record) }; - let __v_501: G = if unconstrained { Bytes2::xor(&__v_449, &__v_480) } else { bytes2_xor_value(__v_449, __v_480, record) }; - let __v_502: G = if unconstrained { Bytes2::xor(&__v_450, &__v_481) } else { bytes2_xor_value(__v_450, __v_481, record) }; - let __u32_sum: u128 = u128::from(((__v_453.as_canonical_u64() << 0) | (__v_454.as_canonical_u64() << 8) | (__v_455.as_canonical_u64() << 16) | (__v_456.as_canonical_u64() << 24))) + u128::from(((__v_500.as_canonical_u64() << 0) | (__v_501.as_canonical_u64() << 8) | (__v_502.as_canonical_u64() << 16) | (__v_499.as_canonical_u64() << 24))); + let __v_366: G = G::from_u8(__u32_bytes[0]); + let __v_367: G = G::from_u8(__u32_bytes[1]); + let __v_368: G = G::from_u8(__u32_bytes[2]); + let __v_369: G = G::from_u8(__u32_bytes[3]); + let __v_370: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_366; let __vj = __v_367; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_368; let __vj = __v_369; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_371: G = G::from_u64(1); + let __v_372: G = (__v_370 - __v_371); + let __v_373: G = G::from_u64(2); + let __v_374: G = (__v_370 - __v_373); + let __v_375: G = (__v_372 * __v_374); + let __v_376: G = (__v_370 * __v_375); + let __v_377: G = G::from_u64(0); + if (__v_376 != __v_377) { + return Err(ExecError::AssertEqMismatch { lhs: __v_376.as_canonical_u64(), rhs: __v_377.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); + } + let __v_378: G = if unconstrained { Bytes2::xor(&__v_346, &__v_366) } else { bytes2_xor_value(__v_346, __v_366, record) }; + let __v_379: G = if unconstrained { Bytes2::xor(&__v_347, &__v_367) } else { bytes2_xor_value(__v_347, __v_367, record) }; + let __v_380: G = if unconstrained { Bytes2::xor(&__v_344, &__v_368) } else { bytes2_xor_value(__v_344, __v_368, record) }; + let __v_381: G = if unconstrained { Bytes2::xor(&__v_345, &__v_369) } else { bytes2_xor_value(__v_345, __v_369, record) }; + let __u32_sum: u128 = u128::from(((__v_348.as_canonical_u64() << 0) | (__v_349.as_canonical_u64() << 8) | (__v_350.as_canonical_u64() << 16) | (__v_351.as_canonical_u64() << 24))) + u128::from(((__v_379.as_canonical_u64() << 0) | (__v_380.as_canonical_u64() << 8) | (__v_381.as_canonical_u64() << 16) | (__v_378.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_503: G = G::from_u8(__u32_bytes[0]); - let __v_504: G = G::from_u8(__u32_bytes[1]); - let __v_505: G = G::from_u8(__u32_bytes[2]); - let __v_506: G = G::from_u8(__u32_bytes[3]); - let __v_507: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_503; let __vj = __v_504; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_505; let __vj = __v_506; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_508: G = G::from_u64(((__v_453.as_canonical_u64() << 0) | (__v_454.as_canonical_u64() << 8) | (__v_455.as_canonical_u64() << 16) | (__v_456.as_canonical_u64() << 24))); - let __v_509: G = G::from_u64(((__v_500.as_canonical_u64() << 0) | (__v_501.as_canonical_u64() << 8) | (__v_502.as_canonical_u64() << 16) | (__v_499.as_canonical_u64() << 24))); - let __v_510: G = G::from_u64(((__v_503.as_canonical_u64() << 0) | (__v_504.as_canonical_u64() << 8) | (__v_505.as_canonical_u64() << 16) | (__v_506.as_canonical_u64() << 24))); - let __v_511: G = (__v_507 * __v_507); - if (__v_511 != __v_507) { - return Err(ExecError::AssertEqMismatch { lhs: __v_511.as_canonical_u64(), rhs: __v_507.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); - } - let __v_512: G = (__v_508 + __v_509); - let __v_513: G = G::from_u64(4294967296); - let __v_514: G = (__v_513 * __v_507); - let __v_515: G = (__v_510 + __v_514); - if (__v_512 != __v_515) { - return Err(ExecError::AssertEqMismatch { lhs: __v_512.as_canonical_u64(), rhs: __v_515.as_canonical_u64(), msg: Some("u32_add: witnessed sum does not match its inputs".to_string()) }); - } - let __v_516: G = if unconstrained { Bytes2::xor(&__v_470, &__v_503) } else { bytes2_xor_value(__v_470, __v_503, record) }; - let __v_517: G = if unconstrained { Bytes2::xor(&__v_476, &__v_504) } else { bytes2_xor_value(__v_476, __v_504, record) }; - let __v_518: G = if unconstrained { Bytes2::xor(&__v_473, &__v_505) } else { bytes2_xor_value(__v_473, __v_505, record) }; - let __v_519: G = if unconstrained { Bytes2::xor(&__v_477, &__v_506) } else { bytes2_xor_value(__v_477, __v_506, record) }; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr7(&__v_516, &__v_517) } else { bytes2_chain_rotr7_value(__v_516, __v_517, record) }; - let __v_520: G = __b2_out.0; - let __v_521: G = __b2_out.1; - let __v_522: G = __b2_out.2; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr7(&__v_518, &__v_519) } else { bytes2_chain_rotr7_value(__v_518, __v_519, record) }; - let __v_523: G = __b2_out.0; - let __v_524: G = __b2_out.1; - let __v_525: G = __b2_out.2; - let __v_526: G = (__v_521 + __v_525); - let __v_527: G = (__v_524 + __v_522); - let __u32_sum: u128 = u128::from(((__v_178.as_canonical_u64() << 0) | (__v_179.as_canonical_u64() << 8) | (__v_180.as_canonical_u64() << 16) | (__v_181.as_canonical_u64() << 24))) + u128::from(((__v_320.as_canonical_u64() << 0) | (__v_326.as_canonical_u64() << 8) | (__v_323.as_canonical_u64() << 16) | (__v_327.as_canonical_u64() << 24))) + u128::from(((__v_96.as_canonical_u64() << 0) | (__v_97.as_canonical_u64() << 8) | (__v_98.as_canonical_u64() << 16) | (__v_99.as_canonical_u64() << 24))); + let __v_382: G = G::from_u8(__u32_bytes[0]); + let __v_383: G = G::from_u8(__u32_bytes[1]); + let __v_384: G = G::from_u8(__u32_bytes[2]); + let __v_385: G = G::from_u8(__u32_bytes[3]); + let __v_386: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_382; let __vj = __v_383; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_384; let __vj = __v_385; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_387: G = (__v_386 * __v_386); + if (__v_387 != __v_386) { + return Err(ExecError::AssertEqMismatch { lhs: __v_387.as_canonical_u64(), rhs: __v_386.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); + } + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_362, &__v_382) } else { bytes2_xor_split7_value(__v_362, __v_382, record) }; + let __v_388: G = __b2_out.0; + let __v_389: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_363, &__v_383) } else { bytes2_xor_split7_value(__v_363, __v_383, record) }; + let __v_390: G = __b2_out.0; + let __v_391: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_364, &__v_384) } else { bytes2_xor_split7_value(__v_364, __v_384, record) }; + let __v_392: G = __b2_out.0; + let __v_393: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_365, &__v_385) } else { bytes2_xor_split7_value(__v_365, __v_385, record) }; + let __v_394: G = __b2_out.0; + let __v_395: G = __b2_out.1; + let __v_396: G = (__v_388 + __v_391); + let __v_397: G = (__v_390 + __v_393); + let __v_398: G = (__v_392 + __v_395); + let __v_399: G = (__v_394 + __v_389); + let __u32_sum: u128 = u128::from(((__v_162.as_canonical_u64() << 0) | (__v_163.as_canonical_u64() << 8) | (__v_164.as_canonical_u64() << 16) | (__v_165.as_canonical_u64() << 24))) + u128::from(((__v_260.as_canonical_u64() << 0) | (__v_261.as_canonical_u64() << 8) | (__v_262.as_canonical_u64() << 16) | (__v_263.as_canonical_u64() << 24))) + u128::from(((__v_96.as_canonical_u64() << 0) | (__v_97.as_canonical_u64() << 8) | (__v_98.as_canonical_u64() << 16) | (__v_99.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_528: G = G::from_u8(__u32_bytes[0]); - let __v_529: G = G::from_u8(__u32_bytes[1]); - let __v_530: G = G::from_u8(__u32_bytes[2]); - let __v_531: G = G::from_u8(__u32_bytes[3]); - let __v_532: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_528; let __vj = __v_529; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_530; let __vj = __v_531; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_533: G = G::from_u64(((__v_178.as_canonical_u64() << 0) | (__v_179.as_canonical_u64() << 8) | (__v_180.as_canonical_u64() << 16) | (__v_181.as_canonical_u64() << 24))); - let __v_534: G = G::from_u64(((__v_320.as_canonical_u64() << 0) | (__v_326.as_canonical_u64() << 8) | (__v_323.as_canonical_u64() << 16) | (__v_327.as_canonical_u64() << 24))); - let __v_535: G = G::from_u64(((__v_96.as_canonical_u64() << 0) | (__v_97.as_canonical_u64() << 8) | (__v_98.as_canonical_u64() << 16) | (__v_99.as_canonical_u64() << 24))); - let __v_536: G = G::from_u64(((__v_528.as_canonical_u64() << 0) | (__v_529.as_canonical_u64() << 8) | (__v_530.as_canonical_u64() << 16) | (__v_531.as_canonical_u64() << 24))); - let __v_537: G = G::from_u64(1); - let __v_538: G = (__v_532 - __v_537); - let __v_539: G = G::from_u64(2); - let __v_540: G = (__v_532 - __v_539); - let __v_541: G = (__v_538 * __v_540); - let __v_542: G = (__v_532 * __v_541); - let __v_543: G = G::from_u64(0); - if (__v_542 != __v_543) { - return Err(ExecError::AssertEqMismatch { lhs: __v_542.as_canonical_u64(), rhs: __v_543.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); - } - let __v_544: G = (__v_534 + __v_535); - let __v_545: G = (__v_533 + __v_544); - let __v_546: G = G::from_u64(4294967296); - let __v_547: G = (__v_546 * __v_532); - let __v_548: G = (__v_536 + __v_547); - if (__v_545 != __v_548) { - return Err(ExecError::AssertEqMismatch { lhs: __v_545.as_canonical_u64(), rhs: __v_548.as_canonical_u64(), msg: Some("u32_add3: witnessed sum does not match its inputs".to_string()) }); - } - let __v_549: G = if unconstrained { Bytes2::xor(&__v_500, &__v_528) } else { bytes2_xor_value(__v_500, __v_528, record) }; - let __v_550: G = if unconstrained { Bytes2::xor(&__v_501, &__v_529) } else { bytes2_xor_value(__v_501, __v_529, record) }; - let __v_551: G = if unconstrained { Bytes2::xor(&__v_502, &__v_530) } else { bytes2_xor_value(__v_502, __v_530, record) }; - let __v_552: G = if unconstrained { Bytes2::xor(&__v_499, &__v_531) } else { bytes2_xor_value(__v_499, __v_531, record) }; - let __u32_sum: u128 = u128::from(((__v_403.as_canonical_u64() << 0) | (__v_404.as_canonical_u64() << 8) | (__v_405.as_canonical_u64() << 16) | (__v_406.as_canonical_u64() << 24))) + u128::from(((__v_551.as_canonical_u64() << 0) | (__v_552.as_canonical_u64() << 8) | (__v_549.as_canonical_u64() << 16) | (__v_550.as_canonical_u64() << 24))); + let __v_400: G = G::from_u8(__u32_bytes[0]); + let __v_401: G = G::from_u8(__u32_bytes[1]); + let __v_402: G = G::from_u8(__u32_bytes[2]); + let __v_403: G = G::from_u8(__u32_bytes[3]); + let __v_404: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_400; let __vj = __v_401; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_402; let __vj = __v_403; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_405: G = G::from_u64(1); + let __v_406: G = (__v_404 - __v_405); + let __v_407: G = G::from_u64(2); + let __v_408: G = (__v_404 - __v_407); + let __v_409: G = (__v_406 * __v_408); + let __v_410: G = (__v_404 * __v_409); + let __v_411: G = G::from_u64(0); + if (__v_410 != __v_411) { + return Err(ExecError::AssertEqMismatch { lhs: __v_410.as_canonical_u64(), rhs: __v_411.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); + } + let __v_412: G = if unconstrained { Bytes2::xor(&__v_379, &__v_400) } else { bytes2_xor_value(__v_379, __v_400, record) }; + let __v_413: G = if unconstrained { Bytes2::xor(&__v_380, &__v_401) } else { bytes2_xor_value(__v_380, __v_401, record) }; + let __v_414: G = if unconstrained { Bytes2::xor(&__v_381, &__v_402) } else { bytes2_xor_value(__v_381, __v_402, record) }; + let __v_415: G = if unconstrained { Bytes2::xor(&__v_378, &__v_403) } else { bytes2_xor_value(__v_378, __v_403, record) }; + let __u32_sum: u128 = u128::from(((__v_314.as_canonical_u64() << 0) | (__v_315.as_canonical_u64() << 8) | (__v_316.as_canonical_u64() << 16) | (__v_317.as_canonical_u64() << 24))) + u128::from(((__v_414.as_canonical_u64() << 0) | (__v_415.as_canonical_u64() << 8) | (__v_412.as_canonical_u64() << 16) | (__v_413.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_553: G = G::from_u8(__u32_bytes[0]); - let __v_554: G = G::from_u8(__u32_bytes[1]); - let __v_555: G = G::from_u8(__u32_bytes[2]); - let __v_556: G = G::from_u8(__u32_bytes[3]); - let __v_557: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_553; let __vj = __v_554; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_555; let __vj = __v_556; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_558: G = G::from_u64(((__v_403.as_canonical_u64() << 0) | (__v_404.as_canonical_u64() << 8) | (__v_405.as_canonical_u64() << 16) | (__v_406.as_canonical_u64() << 24))); - let __v_559: G = G::from_u64(((__v_551.as_canonical_u64() << 0) | (__v_552.as_canonical_u64() << 8) | (__v_549.as_canonical_u64() << 16) | (__v_550.as_canonical_u64() << 24))); - let __v_560: G = G::from_u64(((__v_553.as_canonical_u64() << 0) | (__v_554.as_canonical_u64() << 8) | (__v_555.as_canonical_u64() << 16) | (__v_556.as_canonical_u64() << 24))); - let __v_561: G = (__v_557 * __v_557); - if (__v_561 != __v_557) { - return Err(ExecError::AssertEqMismatch { lhs: __v_561.as_canonical_u64(), rhs: __v_557.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); - } - let __v_562: G = (__v_558 + __v_559); - let __v_563: G = G::from_u64(4294967296); - let __v_564: G = (__v_563 * __v_557); - let __v_565: G = (__v_560 + __v_564); - if (__v_562 != __v_565) { - return Err(ExecError::AssertEqMismatch { lhs: __v_562.as_canonical_u64(), rhs: __v_565.as_canonical_u64(), msg: Some("u32_add: witnessed sum does not match its inputs".to_string()) }); - } - let __v_566: G = if unconstrained { Bytes2::xor(&__v_320, &__v_553) } else { bytes2_xor_value(__v_320, __v_553, record) }; - let __v_567: G = if unconstrained { Bytes2::xor(&__v_326, &__v_554) } else { bytes2_xor_value(__v_326, __v_554, record) }; - let __v_568: G = if unconstrained { Bytes2::xor(&__v_323, &__v_555) } else { bytes2_xor_value(__v_323, __v_555, record) }; - let __v_569: G = if unconstrained { Bytes2::xor(&__v_327, &__v_556) } else { bytes2_xor_value(__v_327, __v_556, record) }; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr4(&__v_567, &__v_568) } else { bytes2_chain_rotr4_value(__v_567, __v_568, record) }; - let __v_570: G = __b2_out.0; - let __v_571: G = __b2_out.1; - let __v_572: G = __b2_out.2; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr4(&__v_569, &__v_566) } else { bytes2_chain_rotr4_value(__v_569, __v_566, record) }; - let __v_573: G = __b2_out.0; - let __v_574: G = __b2_out.1; - let __v_575: G = __b2_out.2; - let __v_576: G = (__v_571 + __v_575); - let __v_577: G = (__v_574 + __v_572); - let __u32_sum: u128 = u128::from(((__v_528.as_canonical_u64() << 0) | (__v_529.as_canonical_u64() << 8) | (__v_530.as_canonical_u64() << 16) | (__v_531.as_canonical_u64() << 24))) + u128::from(((__v_570.as_canonical_u64() << 0) | (__v_576.as_canonical_u64() << 8) | (__v_573.as_canonical_u64() << 16) | (__v_577.as_canonical_u64() << 24))) + u128::from(((__v_100.as_canonical_u64() << 0) | (__v_101.as_canonical_u64() << 8) | (__v_102.as_canonical_u64() << 16) | (__v_103.as_canonical_u64() << 24))); + let __v_416: G = G::from_u8(__u32_bytes[0]); + let __v_417: G = G::from_u8(__u32_bytes[1]); + let __v_418: G = G::from_u8(__u32_bytes[2]); + let __v_419: G = G::from_u8(__u32_bytes[3]); + let __v_420: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_416; let __vj = __v_417; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_418; let __vj = __v_419; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_421: G = (__v_420 * __v_420); + if (__v_421 != __v_420) { + return Err(ExecError::AssertEqMismatch { lhs: __v_421.as_canonical_u64(), rhs: __v_420.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); + } + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_260, &__v_416) } else { bytes2_xor_split4_value(__v_260, __v_416, record) }; + let __v_422: G = __b2_out.0; + let __v_423: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_261, &__v_417) } else { bytes2_xor_split4_value(__v_261, __v_417, record) }; + let __v_424: G = __b2_out.0; + let __v_425: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_262, &__v_418) } else { bytes2_xor_split4_value(__v_262, __v_418, record) }; + let __v_426: G = __b2_out.0; + let __v_427: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_263, &__v_419) } else { bytes2_xor_split4_value(__v_263, __v_419, record) }; + let __v_428: G = __b2_out.0; + let __v_429: G = __b2_out.1; + let __v_430: G = (__v_424 + __v_427); + let __v_431: G = (__v_426 + __v_429); + let __v_432: G = (__v_428 + __v_423); + let __v_433: G = (__v_422 + __v_425); + let __u32_sum: u128 = u128::from(((__v_400.as_canonical_u64() << 0) | (__v_401.as_canonical_u64() << 8) | (__v_402.as_canonical_u64() << 16) | (__v_403.as_canonical_u64() << 24))) + u128::from(((__v_430.as_canonical_u64() << 0) | (__v_431.as_canonical_u64() << 8) | (__v_432.as_canonical_u64() << 16) | (__v_433.as_canonical_u64() << 24))) + u128::from(((__v_100.as_canonical_u64() << 0) | (__v_101.as_canonical_u64() << 8) | (__v_102.as_canonical_u64() << 16) | (__v_103.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_578: G = G::from_u8(__u32_bytes[0]); - let __v_579: G = G::from_u8(__u32_bytes[1]); - let __v_580: G = G::from_u8(__u32_bytes[2]); - let __v_581: G = G::from_u8(__u32_bytes[3]); - let __v_582: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_578; let __vj = __v_579; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_580; let __vj = __v_581; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_583: G = G::from_u64(((__v_528.as_canonical_u64() << 0) | (__v_529.as_canonical_u64() << 8) | (__v_530.as_canonical_u64() << 16) | (__v_531.as_canonical_u64() << 24))); - let __v_584: G = G::from_u64(((__v_570.as_canonical_u64() << 0) | (__v_576.as_canonical_u64() << 8) | (__v_573.as_canonical_u64() << 16) | (__v_577.as_canonical_u64() << 24))); - let __v_585: G = G::from_u64(((__v_100.as_canonical_u64() << 0) | (__v_101.as_canonical_u64() << 8) | (__v_102.as_canonical_u64() << 16) | (__v_103.as_canonical_u64() << 24))); - let __v_586: G = G::from_u64(((__v_578.as_canonical_u64() << 0) | (__v_579.as_canonical_u64() << 8) | (__v_580.as_canonical_u64() << 16) | (__v_581.as_canonical_u64() << 24))); - let __v_587: G = G::from_u64(1); - let __v_588: G = (__v_582 - __v_587); - let __v_589: G = G::from_u64(2); - let __v_590: G = (__v_582 - __v_589); - let __v_591: G = (__v_588 * __v_590); - let __v_592: G = (__v_582 * __v_591); - let __v_593: G = G::from_u64(0); - if (__v_592 != __v_593) { - return Err(ExecError::AssertEqMismatch { lhs: __v_592.as_canonical_u64(), rhs: __v_593.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); - } - let __v_594: G = (__v_584 + __v_585); - let __v_595: G = (__v_583 + __v_594); - let __v_596: G = G::from_u64(4294967296); - let __v_597: G = (__v_596 * __v_582); - let __v_598: G = (__v_586 + __v_597); - if (__v_595 != __v_598) { - return Err(ExecError::AssertEqMismatch { lhs: __v_595.as_canonical_u64(), rhs: __v_598.as_canonical_u64(), msg: Some("u32_add3: witnessed sum does not match its inputs".to_string()) }); - } - let __v_599: G = if unconstrained { Bytes2::xor(&__v_551, &__v_578) } else { bytes2_xor_value(__v_551, __v_578, record) }; - let __v_600: G = if unconstrained { Bytes2::xor(&__v_552, &__v_579) } else { bytes2_xor_value(__v_552, __v_579, record) }; - let __v_601: G = if unconstrained { Bytes2::xor(&__v_549, &__v_580) } else { bytes2_xor_value(__v_549, __v_580, record) }; - let __v_602: G = if unconstrained { Bytes2::xor(&__v_550, &__v_581) } else { bytes2_xor_value(__v_550, __v_581, record) }; - let __u32_sum: u128 = u128::from(((__v_553.as_canonical_u64() << 0) | (__v_554.as_canonical_u64() << 8) | (__v_555.as_canonical_u64() << 16) | (__v_556.as_canonical_u64() << 24))) + u128::from(((__v_600.as_canonical_u64() << 0) | (__v_601.as_canonical_u64() << 8) | (__v_602.as_canonical_u64() << 16) | (__v_599.as_canonical_u64() << 24))); + let __v_434: G = G::from_u8(__u32_bytes[0]); + let __v_435: G = G::from_u8(__u32_bytes[1]); + let __v_436: G = G::from_u8(__u32_bytes[2]); + let __v_437: G = G::from_u8(__u32_bytes[3]); + let __v_438: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_434; let __vj = __v_435; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_436; let __vj = __v_437; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_439: G = G::from_u64(1); + let __v_440: G = (__v_438 - __v_439); + let __v_441: G = G::from_u64(2); + let __v_442: G = (__v_438 - __v_441); + let __v_443: G = (__v_440 * __v_442); + let __v_444: G = (__v_438 * __v_443); + let __v_445: G = G::from_u64(0); + if (__v_444 != __v_445) { + return Err(ExecError::AssertEqMismatch { lhs: __v_444.as_canonical_u64(), rhs: __v_445.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); + } + let __v_446: G = if unconstrained { Bytes2::xor(&__v_414, &__v_434) } else { bytes2_xor_value(__v_414, __v_434, record) }; + let __v_447: G = if unconstrained { Bytes2::xor(&__v_415, &__v_435) } else { bytes2_xor_value(__v_415, __v_435, record) }; + let __v_448: G = if unconstrained { Bytes2::xor(&__v_412, &__v_436) } else { bytes2_xor_value(__v_412, __v_436, record) }; + let __v_449: G = if unconstrained { Bytes2::xor(&__v_413, &__v_437) } else { bytes2_xor_value(__v_413, __v_437, record) }; + let __u32_sum: u128 = u128::from(((__v_416.as_canonical_u64() << 0) | (__v_417.as_canonical_u64() << 8) | (__v_418.as_canonical_u64() << 16) | (__v_419.as_canonical_u64() << 24))) + u128::from(((__v_447.as_canonical_u64() << 0) | (__v_448.as_canonical_u64() << 8) | (__v_449.as_canonical_u64() << 16) | (__v_446.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_603: G = G::from_u8(__u32_bytes[0]); - let __v_604: G = G::from_u8(__u32_bytes[1]); - let __v_605: G = G::from_u8(__u32_bytes[2]); - let __v_606: G = G::from_u8(__u32_bytes[3]); - let __v_607: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_603; let __vj = __v_604; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_605; let __vj = __v_606; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_608: G = G::from_u64(((__v_553.as_canonical_u64() << 0) | (__v_554.as_canonical_u64() << 8) | (__v_555.as_canonical_u64() << 16) | (__v_556.as_canonical_u64() << 24))); - let __v_609: G = G::from_u64(((__v_600.as_canonical_u64() << 0) | (__v_601.as_canonical_u64() << 8) | (__v_602.as_canonical_u64() << 16) | (__v_599.as_canonical_u64() << 24))); - let __v_610: G = G::from_u64(((__v_603.as_canonical_u64() << 0) | (__v_604.as_canonical_u64() << 8) | (__v_605.as_canonical_u64() << 16) | (__v_606.as_canonical_u64() << 24))); - let __v_611: G = (__v_607 * __v_607); - if (__v_611 != __v_607) { - return Err(ExecError::AssertEqMismatch { lhs: __v_611.as_canonical_u64(), rhs: __v_607.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); - } - let __v_612: G = (__v_608 + __v_609); - let __v_613: G = G::from_u64(4294967296); - let __v_614: G = (__v_613 * __v_607); - let __v_615: G = (__v_610 + __v_614); - if (__v_612 != __v_615) { - return Err(ExecError::AssertEqMismatch { lhs: __v_612.as_canonical_u64(), rhs: __v_615.as_canonical_u64(), msg: Some("u32_add: witnessed sum does not match its inputs".to_string()) }); - } - let __v_616: G = if unconstrained { Bytes2::xor(&__v_570, &__v_603) } else { bytes2_xor_value(__v_570, __v_603, record) }; - let __v_617: G = if unconstrained { Bytes2::xor(&__v_576, &__v_604) } else { bytes2_xor_value(__v_576, __v_604, record) }; - let __v_618: G = if unconstrained { Bytes2::xor(&__v_573, &__v_605) } else { bytes2_xor_value(__v_573, __v_605, record) }; - let __v_619: G = if unconstrained { Bytes2::xor(&__v_577, &__v_606) } else { bytes2_xor_value(__v_577, __v_606, record) }; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr7(&__v_616, &__v_617) } else { bytes2_chain_rotr7_value(__v_616, __v_617, record) }; - let __v_620: G = __b2_out.0; - let __v_621: G = __b2_out.1; - let __v_622: G = __b2_out.2; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr7(&__v_618, &__v_619) } else { bytes2_chain_rotr7_value(__v_618, __v_619, record) }; - let __v_623: G = __b2_out.0; - let __v_624: G = __b2_out.1; - let __v_625: G = __b2_out.2; - let __v_626: G = (__v_621 + __v_625); - let __v_627: G = (__v_624 + __v_622); - let __u32_sum: u128 = u128::from(((__v_278.as_canonical_u64() << 0) | (__v_279.as_canonical_u64() << 8) | (__v_280.as_canonical_u64() << 16) | (__v_281.as_canonical_u64() << 24))) + u128::from(((__v_420.as_canonical_u64() << 0) | (__v_426.as_canonical_u64() << 8) | (__v_423.as_canonical_u64() << 16) | (__v_427.as_canonical_u64() << 24))) + u128::from(((__v_104.as_canonical_u64() << 0) | (__v_105.as_canonical_u64() << 8) | (__v_106.as_canonical_u64() << 16) | (__v_107.as_canonical_u64() << 24))); + let __v_450: G = G::from_u8(__u32_bytes[0]); + let __v_451: G = G::from_u8(__u32_bytes[1]); + let __v_452: G = G::from_u8(__u32_bytes[2]); + let __v_453: G = G::from_u8(__u32_bytes[3]); + let __v_454: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_450; let __vj = __v_451; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_452; let __vj = __v_453; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_455: G = (__v_454 * __v_454); + if (__v_455 != __v_454) { + return Err(ExecError::AssertEqMismatch { lhs: __v_455.as_canonical_u64(), rhs: __v_454.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); + } + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_430, &__v_450) } else { bytes2_xor_split7_value(__v_430, __v_450, record) }; + let __v_456: G = __b2_out.0; + let __v_457: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_431, &__v_451) } else { bytes2_xor_split7_value(__v_431, __v_451, record) }; + let __v_458: G = __b2_out.0; + let __v_459: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_432, &__v_452) } else { bytes2_xor_split7_value(__v_432, __v_452, record) }; + let __v_460: G = __b2_out.0; + let __v_461: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_433, &__v_453) } else { bytes2_xor_split7_value(__v_433, __v_453, record) }; + let __v_462: G = __b2_out.0; + let __v_463: G = __b2_out.1; + let __v_464: G = (__v_456 + __v_459); + let __v_465: G = (__v_458 + __v_461); + let __v_466: G = (__v_460 + __v_463); + let __v_467: G = (__v_462 + __v_457); + let __u32_sum: u128 = u128::from(((__v_230.as_canonical_u64() << 0) | (__v_231.as_canonical_u64() << 8) | (__v_232.as_canonical_u64() << 16) | (__v_233.as_canonical_u64() << 24))) + u128::from(((__v_328.as_canonical_u64() << 0) | (__v_329.as_canonical_u64() << 8) | (__v_330.as_canonical_u64() << 16) | (__v_331.as_canonical_u64() << 24))) + u128::from(((__v_104.as_canonical_u64() << 0) | (__v_105.as_canonical_u64() << 8) | (__v_106.as_canonical_u64() << 16) | (__v_107.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_628: G = G::from_u8(__u32_bytes[0]); - let __v_629: G = G::from_u8(__u32_bytes[1]); - let __v_630: G = G::from_u8(__u32_bytes[2]); - let __v_631: G = G::from_u8(__u32_bytes[3]); - let __v_632: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_628; let __vj = __v_629; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_630; let __vj = __v_631; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_633: G = G::from_u64(((__v_278.as_canonical_u64() << 0) | (__v_279.as_canonical_u64() << 8) | (__v_280.as_canonical_u64() << 16) | (__v_281.as_canonical_u64() << 24))); - let __v_634: G = G::from_u64(((__v_420.as_canonical_u64() << 0) | (__v_426.as_canonical_u64() << 8) | (__v_423.as_canonical_u64() << 16) | (__v_427.as_canonical_u64() << 24))); - let __v_635: G = G::from_u64(((__v_104.as_canonical_u64() << 0) | (__v_105.as_canonical_u64() << 8) | (__v_106.as_canonical_u64() << 16) | (__v_107.as_canonical_u64() << 24))); - let __v_636: G = G::from_u64(((__v_628.as_canonical_u64() << 0) | (__v_629.as_canonical_u64() << 8) | (__v_630.as_canonical_u64() << 16) | (__v_631.as_canonical_u64() << 24))); - let __v_637: G = G::from_u64(1); - let __v_638: G = (__v_632 - __v_637); - let __v_639: G = G::from_u64(2); - let __v_640: G = (__v_632 - __v_639); - let __v_641: G = (__v_638 * __v_640); - let __v_642: G = (__v_632 * __v_641); - let __v_643: G = G::from_u64(0); - if (__v_642 != __v_643) { - return Err(ExecError::AssertEqMismatch { lhs: __v_642.as_canonical_u64(), rhs: __v_643.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); - } - let __v_644: G = (__v_634 + __v_635); - let __v_645: G = (__v_633 + __v_644); - let __v_646: G = G::from_u64(4294967296); - let __v_647: G = (__v_646 * __v_632); - let __v_648: G = (__v_636 + __v_647); - if (__v_645 != __v_648) { - return Err(ExecError::AssertEqMismatch { lhs: __v_645.as_canonical_u64(), rhs: __v_648.as_canonical_u64(), msg: Some("u32_add3: witnessed sum does not match its inputs".to_string()) }); - } - let __v_649: G = if unconstrained { Bytes2::xor(&__v_200, &__v_628) } else { bytes2_xor_value(__v_200, __v_628, record) }; - let __v_650: G = if unconstrained { Bytes2::xor(&__v_201, &__v_629) } else { bytes2_xor_value(__v_201, __v_629, record) }; - let __v_651: G = if unconstrained { Bytes2::xor(&__v_202, &__v_630) } else { bytes2_xor_value(__v_202, __v_630, record) }; - let __v_652: G = if unconstrained { Bytes2::xor(&__v_199, &__v_631) } else { bytes2_xor_value(__v_199, __v_631, record) }; - let __u32_sum: u128 = u128::from(((__v_503.as_canonical_u64() << 0) | (__v_504.as_canonical_u64() << 8) | (__v_505.as_canonical_u64() << 16) | (__v_506.as_canonical_u64() << 24))) + u128::from(((__v_651.as_canonical_u64() << 0) | (__v_652.as_canonical_u64() << 8) | (__v_649.as_canonical_u64() << 16) | (__v_650.as_canonical_u64() << 24))); + let __v_468: G = G::from_u8(__u32_bytes[0]); + let __v_469: G = G::from_u8(__u32_bytes[1]); + let __v_470: G = G::from_u8(__u32_bytes[2]); + let __v_471: G = G::from_u8(__u32_bytes[3]); + let __v_472: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_468; let __vj = __v_469; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_470; let __vj = __v_471; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_473: G = G::from_u64(1); + let __v_474: G = (__v_472 - __v_473); + let __v_475: G = G::from_u64(2); + let __v_476: G = (__v_472 - __v_475); + let __v_477: G = (__v_474 * __v_476); + let __v_478: G = (__v_472 * __v_477); + let __v_479: G = G::from_u64(0); + if (__v_478 != __v_479) { + return Err(ExecError::AssertEqMismatch { lhs: __v_478.as_canonical_u64(), rhs: __v_479.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); + } + let __v_480: G = if unconstrained { Bytes2::xor(&__v_175, &__v_468) } else { bytes2_xor_value(__v_175, __v_468, record) }; + let __v_481: G = if unconstrained { Bytes2::xor(&__v_176, &__v_469) } else { bytes2_xor_value(__v_176, __v_469, record) }; + let __v_482: G = if unconstrained { Bytes2::xor(&__v_177, &__v_470) } else { bytes2_xor_value(__v_177, __v_470, record) }; + let __v_483: G = if unconstrained { Bytes2::xor(&__v_174, &__v_471) } else { bytes2_xor_value(__v_174, __v_471, record) }; + let __u32_sum: u128 = u128::from(((__v_382.as_canonical_u64() << 0) | (__v_383.as_canonical_u64() << 8) | (__v_384.as_canonical_u64() << 16) | (__v_385.as_canonical_u64() << 24))) + u128::from(((__v_482.as_canonical_u64() << 0) | (__v_483.as_canonical_u64() << 8) | (__v_480.as_canonical_u64() << 16) | (__v_481.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_653: G = G::from_u8(__u32_bytes[0]); - let __v_654: G = G::from_u8(__u32_bytes[1]); - let __v_655: G = G::from_u8(__u32_bytes[2]); - let __v_656: G = G::from_u8(__u32_bytes[3]); - let __v_657: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_653; let __vj = __v_654; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_655; let __vj = __v_656; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_658: G = G::from_u64(((__v_503.as_canonical_u64() << 0) | (__v_504.as_canonical_u64() << 8) | (__v_505.as_canonical_u64() << 16) | (__v_506.as_canonical_u64() << 24))); - let __v_659: G = G::from_u64(((__v_651.as_canonical_u64() << 0) | (__v_652.as_canonical_u64() << 8) | (__v_649.as_canonical_u64() << 16) | (__v_650.as_canonical_u64() << 24))); - let __v_660: G = G::from_u64(((__v_653.as_canonical_u64() << 0) | (__v_654.as_canonical_u64() << 8) | (__v_655.as_canonical_u64() << 16) | (__v_656.as_canonical_u64() << 24))); - let __v_661: G = (__v_657 * __v_657); - if (__v_661 != __v_657) { - return Err(ExecError::AssertEqMismatch { lhs: __v_661.as_canonical_u64(), rhs: __v_657.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); - } - let __v_662: G = (__v_658 + __v_659); - let __v_663: G = G::from_u64(4294967296); - let __v_664: G = (__v_663 * __v_657); - let __v_665: G = (__v_660 + __v_664); - if (__v_662 != __v_665) { - return Err(ExecError::AssertEqMismatch { lhs: __v_662.as_canonical_u64(), rhs: __v_665.as_canonical_u64(), msg: Some("u32_add: witnessed sum does not match its inputs".to_string()) }); - } - let __v_666: G = if unconstrained { Bytes2::xor(&__v_420, &__v_653) } else { bytes2_xor_value(__v_420, __v_653, record) }; - let __v_667: G = if unconstrained { Bytes2::xor(&__v_426, &__v_654) } else { bytes2_xor_value(__v_426, __v_654, record) }; - let __v_668: G = if unconstrained { Bytes2::xor(&__v_423, &__v_655) } else { bytes2_xor_value(__v_423, __v_655, record) }; - let __v_669: G = if unconstrained { Bytes2::xor(&__v_427, &__v_656) } else { bytes2_xor_value(__v_427, __v_656, record) }; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr4(&__v_667, &__v_668) } else { bytes2_chain_rotr4_value(__v_667, __v_668, record) }; - let __v_670: G = __b2_out.0; - let __v_671: G = __b2_out.1; - let __v_672: G = __b2_out.2; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr4(&__v_669, &__v_666) } else { bytes2_chain_rotr4_value(__v_669, __v_666, record) }; - let __v_673: G = __b2_out.0; - let __v_674: G = __b2_out.1; - let __v_675: G = __b2_out.2; - let __v_676: G = (__v_671 + __v_675); - let __v_677: G = (__v_674 + __v_672); - let __u32_sum: u128 = u128::from(((__v_628.as_canonical_u64() << 0) | (__v_629.as_canonical_u64() << 8) | (__v_630.as_canonical_u64() << 16) | (__v_631.as_canonical_u64() << 24))) + u128::from(((__v_670.as_canonical_u64() << 0) | (__v_676.as_canonical_u64() << 8) | (__v_673.as_canonical_u64() << 16) | (__v_677.as_canonical_u64() << 24))) + u128::from(((__v_108.as_canonical_u64() << 0) | (__v_109.as_canonical_u64() << 8) | (__v_110.as_canonical_u64() << 16) | (__v_111.as_canonical_u64() << 24))); + let __v_484: G = G::from_u8(__u32_bytes[0]); + let __v_485: G = G::from_u8(__u32_bytes[1]); + let __v_486: G = G::from_u8(__u32_bytes[2]); + let __v_487: G = G::from_u8(__u32_bytes[3]); + let __v_488: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_484; let __vj = __v_485; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_486; let __vj = __v_487; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_489: G = (__v_488 * __v_488); + if (__v_489 != __v_488) { + return Err(ExecError::AssertEqMismatch { lhs: __v_489.as_canonical_u64(), rhs: __v_488.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); + } + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_328, &__v_484) } else { bytes2_xor_split4_value(__v_328, __v_484, record) }; + let __v_490: G = __b2_out.0; + let __v_491: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_329, &__v_485) } else { bytes2_xor_split4_value(__v_329, __v_485, record) }; + let __v_492: G = __b2_out.0; + let __v_493: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_330, &__v_486) } else { bytes2_xor_split4_value(__v_330, __v_486, record) }; + let __v_494: G = __b2_out.0; + let __v_495: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_331, &__v_487) } else { bytes2_xor_split4_value(__v_331, __v_487, record) }; + let __v_496: G = __b2_out.0; + let __v_497: G = __b2_out.1; + let __v_498: G = (__v_492 + __v_495); + let __v_499: G = (__v_494 + __v_497); + let __v_500: G = (__v_496 + __v_491); + let __v_501: G = (__v_490 + __v_493); + let __u32_sum: u128 = u128::from(((__v_468.as_canonical_u64() << 0) | (__v_469.as_canonical_u64() << 8) | (__v_470.as_canonical_u64() << 16) | (__v_471.as_canonical_u64() << 24))) + u128::from(((__v_498.as_canonical_u64() << 0) | (__v_499.as_canonical_u64() << 8) | (__v_500.as_canonical_u64() << 16) | (__v_501.as_canonical_u64() << 24))) + u128::from(((__v_108.as_canonical_u64() << 0) | (__v_109.as_canonical_u64() << 8) | (__v_110.as_canonical_u64() << 16) | (__v_111.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_678: G = G::from_u8(__u32_bytes[0]); - let __v_679: G = G::from_u8(__u32_bytes[1]); - let __v_680: G = G::from_u8(__u32_bytes[2]); - let __v_681: G = G::from_u8(__u32_bytes[3]); - let __v_682: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_678; let __vj = __v_679; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_680; let __vj = __v_681; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_683: G = G::from_u64(((__v_628.as_canonical_u64() << 0) | (__v_629.as_canonical_u64() << 8) | (__v_630.as_canonical_u64() << 16) | (__v_631.as_canonical_u64() << 24))); - let __v_684: G = G::from_u64(((__v_670.as_canonical_u64() << 0) | (__v_676.as_canonical_u64() << 8) | (__v_673.as_canonical_u64() << 16) | (__v_677.as_canonical_u64() << 24))); - let __v_685: G = G::from_u64(((__v_108.as_canonical_u64() << 0) | (__v_109.as_canonical_u64() << 8) | (__v_110.as_canonical_u64() << 16) | (__v_111.as_canonical_u64() << 24))); - let __v_686: G = G::from_u64(((__v_678.as_canonical_u64() << 0) | (__v_679.as_canonical_u64() << 8) | (__v_680.as_canonical_u64() << 16) | (__v_681.as_canonical_u64() << 24))); - let __v_687: G = G::from_u64(1); - let __v_688: G = (__v_682 - __v_687); - let __v_689: G = G::from_u64(2); - let __v_690: G = (__v_682 - __v_689); - let __v_691: G = (__v_688 * __v_690); - let __v_692: G = (__v_682 * __v_691); - let __v_693: G = G::from_u64(0); - if (__v_692 != __v_693) { - return Err(ExecError::AssertEqMismatch { lhs: __v_692.as_canonical_u64(), rhs: __v_693.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); - } - let __v_694: G = (__v_684 + __v_685); - let __v_695: G = (__v_683 + __v_694); - let __v_696: G = G::from_u64(4294967296); - let __v_697: G = (__v_696 * __v_682); - let __v_698: G = (__v_686 + __v_697); - if (__v_695 != __v_698) { - return Err(ExecError::AssertEqMismatch { lhs: __v_695.as_canonical_u64(), rhs: __v_698.as_canonical_u64(), msg: Some("u32_add3: witnessed sum does not match its inputs".to_string()) }); - } - let __v_699: G = if unconstrained { Bytes2::xor(&__v_651, &__v_678) } else { bytes2_xor_value(__v_651, __v_678, record) }; - let __v_700: G = if unconstrained { Bytes2::xor(&__v_652, &__v_679) } else { bytes2_xor_value(__v_652, __v_679, record) }; - let __v_701: G = if unconstrained { Bytes2::xor(&__v_649, &__v_680) } else { bytes2_xor_value(__v_649, __v_680, record) }; - let __v_702: G = if unconstrained { Bytes2::xor(&__v_650, &__v_681) } else { bytes2_xor_value(__v_650, __v_681, record) }; - let __u32_sum: u128 = u128::from(((__v_653.as_canonical_u64() << 0) | (__v_654.as_canonical_u64() << 8) | (__v_655.as_canonical_u64() << 16) | (__v_656.as_canonical_u64() << 24))) + u128::from(((__v_700.as_canonical_u64() << 0) | (__v_701.as_canonical_u64() << 8) | (__v_702.as_canonical_u64() << 16) | (__v_699.as_canonical_u64() << 24))); + let __v_502: G = G::from_u8(__u32_bytes[0]); + let __v_503: G = G::from_u8(__u32_bytes[1]); + let __v_504: G = G::from_u8(__u32_bytes[2]); + let __v_505: G = G::from_u8(__u32_bytes[3]); + let __v_506: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_502; let __vj = __v_503; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_504; let __vj = __v_505; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_507: G = G::from_u64(1); + let __v_508: G = (__v_506 - __v_507); + let __v_509: G = G::from_u64(2); + let __v_510: G = (__v_506 - __v_509); + let __v_511: G = (__v_508 * __v_510); + let __v_512: G = (__v_506 * __v_511); + let __v_513: G = G::from_u64(0); + if (__v_512 != __v_513) { + return Err(ExecError::AssertEqMismatch { lhs: __v_512.as_canonical_u64(), rhs: __v_513.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); + } + let __v_514: G = if unconstrained { Bytes2::xor(&__v_482, &__v_502) } else { bytes2_xor_value(__v_482, __v_502, record) }; + let __v_515: G = if unconstrained { Bytes2::xor(&__v_483, &__v_503) } else { bytes2_xor_value(__v_483, __v_503, record) }; + let __v_516: G = if unconstrained { Bytes2::xor(&__v_480, &__v_504) } else { bytes2_xor_value(__v_480, __v_504, record) }; + let __v_517: G = if unconstrained { Bytes2::xor(&__v_481, &__v_505) } else { bytes2_xor_value(__v_481, __v_505, record) }; + let __u32_sum: u128 = u128::from(((__v_484.as_canonical_u64() << 0) | (__v_485.as_canonical_u64() << 8) | (__v_486.as_canonical_u64() << 16) | (__v_487.as_canonical_u64() << 24))) + u128::from(((__v_515.as_canonical_u64() << 0) | (__v_516.as_canonical_u64() << 8) | (__v_517.as_canonical_u64() << 16) | (__v_514.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_703: G = G::from_u8(__u32_bytes[0]); - let __v_704: G = G::from_u8(__u32_bytes[1]); - let __v_705: G = G::from_u8(__u32_bytes[2]); - let __v_706: G = G::from_u8(__u32_bytes[3]); - let __v_707: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_703; let __vj = __v_704; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_705; let __vj = __v_706; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_708: G = G::from_u64(((__v_653.as_canonical_u64() << 0) | (__v_654.as_canonical_u64() << 8) | (__v_655.as_canonical_u64() << 16) | (__v_656.as_canonical_u64() << 24))); - let __v_709: G = G::from_u64(((__v_700.as_canonical_u64() << 0) | (__v_701.as_canonical_u64() << 8) | (__v_702.as_canonical_u64() << 16) | (__v_699.as_canonical_u64() << 24))); - let __v_710: G = G::from_u64(((__v_703.as_canonical_u64() << 0) | (__v_704.as_canonical_u64() << 8) | (__v_705.as_canonical_u64() << 16) | (__v_706.as_canonical_u64() << 24))); - let __v_711: G = (__v_707 * __v_707); - if (__v_711 != __v_707) { - return Err(ExecError::AssertEqMismatch { lhs: __v_711.as_canonical_u64(), rhs: __v_707.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); - } - let __v_712: G = (__v_708 + __v_709); - let __v_713: G = G::from_u64(4294967296); - let __v_714: G = (__v_713 * __v_707); - let __v_715: G = (__v_710 + __v_714); - if (__v_712 != __v_715) { - return Err(ExecError::AssertEqMismatch { lhs: __v_712.as_canonical_u64(), rhs: __v_715.as_canonical_u64(), msg: Some("u32_add: witnessed sum does not match its inputs".to_string()) }); - } - let __v_716: G = if unconstrained { Bytes2::xor(&__v_670, &__v_703) } else { bytes2_xor_value(__v_670, __v_703, record) }; - let __v_717: G = if unconstrained { Bytes2::xor(&__v_676, &__v_704) } else { bytes2_xor_value(__v_676, __v_704, record) }; - let __v_718: G = if unconstrained { Bytes2::xor(&__v_673, &__v_705) } else { bytes2_xor_value(__v_673, __v_705, record) }; - let __v_719: G = if unconstrained { Bytes2::xor(&__v_677, &__v_706) } else { bytes2_xor_value(__v_677, __v_706, record) }; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr7(&__v_716, &__v_717) } else { bytes2_chain_rotr7_value(__v_716, __v_717, record) }; - let __v_720: G = __b2_out.0; - let __v_721: G = __b2_out.1; - let __v_722: G = __b2_out.2; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr7(&__v_718, &__v_719) } else { bytes2_chain_rotr7_value(__v_718, __v_719, record) }; - let __v_723: G = __b2_out.0; - let __v_724: G = __b2_out.1; - let __v_725: G = __b2_out.2; - let __v_726: G = (__v_721 + __v_725); - let __v_727: G = (__v_724 + __v_722); - let __u32_sum: u128 = u128::from(((__v_378.as_canonical_u64() << 0) | (__v_379.as_canonical_u64() << 8) | (__v_380.as_canonical_u64() << 16) | (__v_381.as_canonical_u64() << 24))) + u128::from(((__v_520.as_canonical_u64() << 0) | (__v_526.as_canonical_u64() << 8) | (__v_523.as_canonical_u64() << 16) | (__v_527.as_canonical_u64() << 24))) + u128::from(((__v_112.as_canonical_u64() << 0) | (__v_113.as_canonical_u64() << 8) | (__v_114.as_canonical_u64() << 16) | (__v_115.as_canonical_u64() << 24))); + let __v_518: G = G::from_u8(__u32_bytes[0]); + let __v_519: G = G::from_u8(__u32_bytes[1]); + let __v_520: G = G::from_u8(__u32_bytes[2]); + let __v_521: G = G::from_u8(__u32_bytes[3]); + let __v_522: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_518; let __vj = __v_519; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_520; let __vj = __v_521; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_523: G = (__v_522 * __v_522); + if (__v_523 != __v_522) { + return Err(ExecError::AssertEqMismatch { lhs: __v_523.as_canonical_u64(), rhs: __v_522.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); + } + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_498, &__v_518) } else { bytes2_xor_split7_value(__v_498, __v_518, record) }; + let __v_524: G = __b2_out.0; + let __v_525: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_499, &__v_519) } else { bytes2_xor_split7_value(__v_499, __v_519, record) }; + let __v_526: G = __b2_out.0; + let __v_527: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_500, &__v_520) } else { bytes2_xor_split7_value(__v_500, __v_520, record) }; + let __v_528: G = __b2_out.0; + let __v_529: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_501, &__v_521) } else { bytes2_xor_split7_value(__v_501, __v_521, record) }; + let __v_530: G = __b2_out.0; + let __v_531: G = __b2_out.1; + let __v_532: G = (__v_524 + __v_527); + let __v_533: G = (__v_526 + __v_529); + let __v_534: G = (__v_528 + __v_531); + let __v_535: G = (__v_530 + __v_525); + let __u32_sum: u128 = u128::from(((__v_298.as_canonical_u64() << 0) | (__v_299.as_canonical_u64() << 8) | (__v_300.as_canonical_u64() << 16) | (__v_301.as_canonical_u64() << 24))) + u128::from(((__v_396.as_canonical_u64() << 0) | (__v_397.as_canonical_u64() << 8) | (__v_398.as_canonical_u64() << 16) | (__v_399.as_canonical_u64() << 24))) + u128::from(((__v_112.as_canonical_u64() << 0) | (__v_113.as_canonical_u64() << 8) | (__v_114.as_canonical_u64() << 16) | (__v_115.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_728: G = G::from_u8(__u32_bytes[0]); - let __v_729: G = G::from_u8(__u32_bytes[1]); - let __v_730: G = G::from_u8(__u32_bytes[2]); - let __v_731: G = G::from_u8(__u32_bytes[3]); - let __v_732: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_728; let __vj = __v_729; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_730; let __vj = __v_731; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_733: G = G::from_u64(((__v_378.as_canonical_u64() << 0) | (__v_379.as_canonical_u64() << 8) | (__v_380.as_canonical_u64() << 16) | (__v_381.as_canonical_u64() << 24))); - let __v_734: G = G::from_u64(((__v_520.as_canonical_u64() << 0) | (__v_526.as_canonical_u64() << 8) | (__v_523.as_canonical_u64() << 16) | (__v_527.as_canonical_u64() << 24))); - let __v_735: G = G::from_u64(((__v_112.as_canonical_u64() << 0) | (__v_113.as_canonical_u64() << 8) | (__v_114.as_canonical_u64() << 16) | (__v_115.as_canonical_u64() << 24))); - let __v_736: G = G::from_u64(((__v_728.as_canonical_u64() << 0) | (__v_729.as_canonical_u64() << 8) | (__v_730.as_canonical_u64() << 16) | (__v_731.as_canonical_u64() << 24))); - let __v_737: G = G::from_u64(1); - let __v_738: G = (__v_732 - __v_737); - let __v_739: G = G::from_u64(2); - let __v_740: G = (__v_732 - __v_739); - let __v_741: G = (__v_738 * __v_740); - let __v_742: G = (__v_732 * __v_741); - let __v_743: G = G::from_u64(0); - if (__v_742 != __v_743) { - return Err(ExecError::AssertEqMismatch { lhs: __v_742.as_canonical_u64(), rhs: __v_743.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); - } - let __v_744: G = (__v_734 + __v_735); - let __v_745: G = (__v_733 + __v_744); - let __v_746: G = G::from_u64(4294967296); - let __v_747: G = (__v_746 * __v_732); - let __v_748: G = (__v_736 + __v_747); - if (__v_745 != __v_748) { - return Err(ExecError::AssertEqMismatch { lhs: __v_745.as_canonical_u64(), rhs: __v_748.as_canonical_u64(), msg: Some("u32_add3: witnessed sum does not match its inputs".to_string()) }); - } - let __v_749: G = if unconstrained { Bytes2::xor(&__v_300, &__v_728) } else { bytes2_xor_value(__v_300, __v_728, record) }; - let __v_750: G = if unconstrained { Bytes2::xor(&__v_301, &__v_729) } else { bytes2_xor_value(__v_301, __v_729, record) }; - let __v_751: G = if unconstrained { Bytes2::xor(&__v_302, &__v_730) } else { bytes2_xor_value(__v_302, __v_730, record) }; - let __v_752: G = if unconstrained { Bytes2::xor(&__v_299, &__v_731) } else { bytes2_xor_value(__v_299, __v_731, record) }; - let __u32_sum: u128 = u128::from(((__v_203.as_canonical_u64() << 0) | (__v_204.as_canonical_u64() << 8) | (__v_205.as_canonical_u64() << 16) | (__v_206.as_canonical_u64() << 24))) + u128::from(((__v_751.as_canonical_u64() << 0) | (__v_752.as_canonical_u64() << 8) | (__v_749.as_canonical_u64() << 16) | (__v_750.as_canonical_u64() << 24))); + let __v_536: G = G::from_u8(__u32_bytes[0]); + let __v_537: G = G::from_u8(__u32_bytes[1]); + let __v_538: G = G::from_u8(__u32_bytes[2]); + let __v_539: G = G::from_u8(__u32_bytes[3]); + let __v_540: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_536; let __vj = __v_537; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_538; let __vj = __v_539; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_541: G = G::from_u64(1); + let __v_542: G = (__v_540 - __v_541); + let __v_543: G = G::from_u64(2); + let __v_544: G = (__v_540 - __v_543); + let __v_545: G = (__v_542 * __v_544); + let __v_546: G = (__v_540 * __v_545); + let __v_547: G = G::from_u64(0); + if (__v_546 != __v_547) { + return Err(ExecError::AssertEqMismatch { lhs: __v_546.as_canonical_u64(), rhs: __v_547.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); + } + let __v_548: G = if unconstrained { Bytes2::xor(&__v_243, &__v_536) } else { bytes2_xor_value(__v_243, __v_536, record) }; + let __v_549: G = if unconstrained { Bytes2::xor(&__v_244, &__v_537) } else { bytes2_xor_value(__v_244, __v_537, record) }; + let __v_550: G = if unconstrained { Bytes2::xor(&__v_245, &__v_538) } else { bytes2_xor_value(__v_245, __v_538, record) }; + let __v_551: G = if unconstrained { Bytes2::xor(&__v_242, &__v_539) } else { bytes2_xor_value(__v_242, __v_539, record) }; + let __u32_sum: u128 = u128::from(((__v_178.as_canonical_u64() << 0) | (__v_179.as_canonical_u64() << 8) | (__v_180.as_canonical_u64() << 16) | (__v_181.as_canonical_u64() << 24))) + u128::from(((__v_550.as_canonical_u64() << 0) | (__v_551.as_canonical_u64() << 8) | (__v_548.as_canonical_u64() << 16) | (__v_549.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_753: G = G::from_u8(__u32_bytes[0]); - let __v_754: G = G::from_u8(__u32_bytes[1]); - let __v_755: G = G::from_u8(__u32_bytes[2]); - let __v_756: G = G::from_u8(__u32_bytes[3]); - let __v_757: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_753; let __vj = __v_754; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_755; let __vj = __v_756; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_758: G = G::from_u64(((__v_203.as_canonical_u64() << 0) | (__v_204.as_canonical_u64() << 8) | (__v_205.as_canonical_u64() << 16) | (__v_206.as_canonical_u64() << 24))); - let __v_759: G = G::from_u64(((__v_751.as_canonical_u64() << 0) | (__v_752.as_canonical_u64() << 8) | (__v_749.as_canonical_u64() << 16) | (__v_750.as_canonical_u64() << 24))); - let __v_760: G = G::from_u64(((__v_753.as_canonical_u64() << 0) | (__v_754.as_canonical_u64() << 8) | (__v_755.as_canonical_u64() << 16) | (__v_756.as_canonical_u64() << 24))); - let __v_761: G = (__v_757 * __v_757); - if (__v_761 != __v_757) { - return Err(ExecError::AssertEqMismatch { lhs: __v_761.as_canonical_u64(), rhs: __v_757.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); - } - let __v_762: G = (__v_758 + __v_759); - let __v_763: G = G::from_u64(4294967296); - let __v_764: G = (__v_763 * __v_757); - let __v_765: G = (__v_760 + __v_764); - if (__v_762 != __v_765) { - return Err(ExecError::AssertEqMismatch { lhs: __v_762.as_canonical_u64(), rhs: __v_765.as_canonical_u64(), msg: Some("u32_add: witnessed sum does not match its inputs".to_string()) }); - } - let __v_766: G = if unconstrained { Bytes2::xor(&__v_520, &__v_753) } else { bytes2_xor_value(__v_520, __v_753, record) }; - let __v_767: G = if unconstrained { Bytes2::xor(&__v_526, &__v_754) } else { bytes2_xor_value(__v_526, __v_754, record) }; - let __v_768: G = if unconstrained { Bytes2::xor(&__v_523, &__v_755) } else { bytes2_xor_value(__v_523, __v_755, record) }; - let __v_769: G = if unconstrained { Bytes2::xor(&__v_527, &__v_756) } else { bytes2_xor_value(__v_527, __v_756, record) }; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr4(&__v_767, &__v_768) } else { bytes2_chain_rotr4_value(__v_767, __v_768, record) }; - let __v_770: G = __b2_out.0; - let __v_771: G = __b2_out.1; - let __v_772: G = __b2_out.2; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr4(&__v_769, &__v_766) } else { bytes2_chain_rotr4_value(__v_769, __v_766, record) }; - let __v_773: G = __b2_out.0; - let __v_774: G = __b2_out.1; - let __v_775: G = __b2_out.2; - let __v_776: G = (__v_771 + __v_775); - let __v_777: G = (__v_774 + __v_772); - let __u32_sum: u128 = u128::from(((__v_728.as_canonical_u64() << 0) | (__v_729.as_canonical_u64() << 8) | (__v_730.as_canonical_u64() << 16) | (__v_731.as_canonical_u64() << 24))) + u128::from(((__v_770.as_canonical_u64() << 0) | (__v_776.as_canonical_u64() << 8) | (__v_773.as_canonical_u64() << 16) | (__v_777.as_canonical_u64() << 24))) + u128::from(((__v_116.as_canonical_u64() << 0) | (__v_117.as_canonical_u64() << 8) | (__v_118.as_canonical_u64() << 16) | (__v_119.as_canonical_u64() << 24))); + let __v_552: G = G::from_u8(__u32_bytes[0]); + let __v_553: G = G::from_u8(__u32_bytes[1]); + let __v_554: G = G::from_u8(__u32_bytes[2]); + let __v_555: G = G::from_u8(__u32_bytes[3]); + let __v_556: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_552; let __vj = __v_553; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_554; let __vj = __v_555; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_557: G = (__v_556 * __v_556); + if (__v_557 != __v_556) { + return Err(ExecError::AssertEqMismatch { lhs: __v_557.as_canonical_u64(), rhs: __v_556.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); + } + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_396, &__v_552) } else { bytes2_xor_split4_value(__v_396, __v_552, record) }; + let __v_558: G = __b2_out.0; + let __v_559: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_397, &__v_553) } else { bytes2_xor_split4_value(__v_397, __v_553, record) }; + let __v_560: G = __b2_out.0; + let __v_561: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_398, &__v_554) } else { bytes2_xor_split4_value(__v_398, __v_554, record) }; + let __v_562: G = __b2_out.0; + let __v_563: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_399, &__v_555) } else { bytes2_xor_split4_value(__v_399, __v_555, record) }; + let __v_564: G = __b2_out.0; + let __v_565: G = __b2_out.1; + let __v_566: G = (__v_560 + __v_563); + let __v_567: G = (__v_562 + __v_565); + let __v_568: G = (__v_564 + __v_559); + let __v_569: G = (__v_558 + __v_561); + let __u32_sum: u128 = u128::from(((__v_536.as_canonical_u64() << 0) | (__v_537.as_canonical_u64() << 8) | (__v_538.as_canonical_u64() << 16) | (__v_539.as_canonical_u64() << 24))) + u128::from(((__v_566.as_canonical_u64() << 0) | (__v_567.as_canonical_u64() << 8) | (__v_568.as_canonical_u64() << 16) | (__v_569.as_canonical_u64() << 24))) + u128::from(((__v_116.as_canonical_u64() << 0) | (__v_117.as_canonical_u64() << 8) | (__v_118.as_canonical_u64() << 16) | (__v_119.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_778: G = G::from_u8(__u32_bytes[0]); - let __v_779: G = G::from_u8(__u32_bytes[1]); - let __v_780: G = G::from_u8(__u32_bytes[2]); - let __v_781: G = G::from_u8(__u32_bytes[3]); - let __v_782: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_778; let __vj = __v_779; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_780; let __vj = __v_781; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_783: G = G::from_u64(((__v_728.as_canonical_u64() << 0) | (__v_729.as_canonical_u64() << 8) | (__v_730.as_canonical_u64() << 16) | (__v_731.as_canonical_u64() << 24))); - let __v_784: G = G::from_u64(((__v_770.as_canonical_u64() << 0) | (__v_776.as_canonical_u64() << 8) | (__v_773.as_canonical_u64() << 16) | (__v_777.as_canonical_u64() << 24))); - let __v_785: G = G::from_u64(((__v_116.as_canonical_u64() << 0) | (__v_117.as_canonical_u64() << 8) | (__v_118.as_canonical_u64() << 16) | (__v_119.as_canonical_u64() << 24))); - let __v_786: G = G::from_u64(((__v_778.as_canonical_u64() << 0) | (__v_779.as_canonical_u64() << 8) | (__v_780.as_canonical_u64() << 16) | (__v_781.as_canonical_u64() << 24))); - let __v_787: G = G::from_u64(1); - let __v_788: G = (__v_782 - __v_787); - let __v_789: G = G::from_u64(2); - let __v_790: G = (__v_782 - __v_789); - let __v_791: G = (__v_788 * __v_790); - let __v_792: G = (__v_782 * __v_791); - let __v_793: G = G::from_u64(0); - if (__v_792 != __v_793) { - return Err(ExecError::AssertEqMismatch { lhs: __v_792.as_canonical_u64(), rhs: __v_793.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); - } - let __v_794: G = (__v_784 + __v_785); - let __v_795: G = (__v_783 + __v_794); - let __v_796: G = G::from_u64(4294967296); - let __v_797: G = (__v_796 * __v_782); - let __v_798: G = (__v_786 + __v_797); - if (__v_795 != __v_798) { - return Err(ExecError::AssertEqMismatch { lhs: __v_795.as_canonical_u64(), rhs: __v_798.as_canonical_u64(), msg: Some("u32_add3: witnessed sum does not match its inputs".to_string()) }); - } - let __v_799: G = if unconstrained { Bytes2::xor(&__v_751, &__v_778) } else { bytes2_xor_value(__v_751, __v_778, record) }; - let __v_800: G = if unconstrained { Bytes2::xor(&__v_752, &__v_779) } else { bytes2_xor_value(__v_752, __v_779, record) }; - let __v_801: G = if unconstrained { Bytes2::xor(&__v_749, &__v_780) } else { bytes2_xor_value(__v_749, __v_780, record) }; - let __v_802: G = if unconstrained { Bytes2::xor(&__v_750, &__v_781) } else { bytes2_xor_value(__v_750, __v_781, record) }; - let __u32_sum: u128 = u128::from(((__v_753.as_canonical_u64() << 0) | (__v_754.as_canonical_u64() << 8) | (__v_755.as_canonical_u64() << 16) | (__v_756.as_canonical_u64() << 24))) + u128::from(((__v_800.as_canonical_u64() << 0) | (__v_801.as_canonical_u64() << 8) | (__v_802.as_canonical_u64() << 16) | (__v_799.as_canonical_u64() << 24))); + let __v_570: G = G::from_u8(__u32_bytes[0]); + let __v_571: G = G::from_u8(__u32_bytes[1]); + let __v_572: G = G::from_u8(__u32_bytes[2]); + let __v_573: G = G::from_u8(__u32_bytes[3]); + let __v_574: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_570; let __vj = __v_571; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_572; let __vj = __v_573; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_575: G = G::from_u64(1); + let __v_576: G = (__v_574 - __v_575); + let __v_577: G = G::from_u64(2); + let __v_578: G = (__v_574 - __v_577); + let __v_579: G = (__v_576 * __v_578); + let __v_580: G = (__v_574 * __v_579); + let __v_581: G = G::from_u64(0); + if (__v_580 != __v_581) { + return Err(ExecError::AssertEqMismatch { lhs: __v_580.as_canonical_u64(), rhs: __v_581.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); + } + let __v_582: G = if unconstrained { Bytes2::xor(&__v_550, &__v_570) } else { bytes2_xor_value(__v_550, __v_570, record) }; + let __v_583: G = if unconstrained { Bytes2::xor(&__v_551, &__v_571) } else { bytes2_xor_value(__v_551, __v_571, record) }; + let __v_584: G = if unconstrained { Bytes2::xor(&__v_548, &__v_572) } else { bytes2_xor_value(__v_548, __v_572, record) }; + let __v_585: G = if unconstrained { Bytes2::xor(&__v_549, &__v_573) } else { bytes2_xor_value(__v_549, __v_573, record) }; + let __u32_sum: u128 = u128::from(((__v_552.as_canonical_u64() << 0) | (__v_553.as_canonical_u64() << 8) | (__v_554.as_canonical_u64() << 16) | (__v_555.as_canonical_u64() << 24))) + u128::from(((__v_583.as_canonical_u64() << 0) | (__v_584.as_canonical_u64() << 8) | (__v_585.as_canonical_u64() << 16) | (__v_582.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_803: G = G::from_u8(__u32_bytes[0]); - let __v_804: G = G::from_u8(__u32_bytes[1]); - let __v_805: G = G::from_u8(__u32_bytes[2]); - let __v_806: G = G::from_u8(__u32_bytes[3]); - let __v_807: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_803; let __vj = __v_804; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_805; let __vj = __v_806; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_808: G = G::from_u64(((__v_753.as_canonical_u64() << 0) | (__v_754.as_canonical_u64() << 8) | (__v_755.as_canonical_u64() << 16) | (__v_756.as_canonical_u64() << 24))); - let __v_809: G = G::from_u64(((__v_800.as_canonical_u64() << 0) | (__v_801.as_canonical_u64() << 8) | (__v_802.as_canonical_u64() << 16) | (__v_799.as_canonical_u64() << 24))); - let __v_810: G = G::from_u64(((__v_803.as_canonical_u64() << 0) | (__v_804.as_canonical_u64() << 8) | (__v_805.as_canonical_u64() << 16) | (__v_806.as_canonical_u64() << 24))); - let __v_811: G = (__v_807 * __v_807); - if (__v_811 != __v_807) { - return Err(ExecError::AssertEqMismatch { lhs: __v_811.as_canonical_u64(), rhs: __v_807.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); - } - let __v_812: G = (__v_808 + __v_809); - let __v_813: G = G::from_u64(4294967296); - let __v_814: G = (__v_813 * __v_807); - let __v_815: G = (__v_810 + __v_814); - if (__v_812 != __v_815) { - return Err(ExecError::AssertEqMismatch { lhs: __v_812.as_canonical_u64(), rhs: __v_815.as_canonical_u64(), msg: Some("u32_add: witnessed sum does not match its inputs".to_string()) }); - } - let __v_816: G = if unconstrained { Bytes2::xor(&__v_770, &__v_803) } else { bytes2_xor_value(__v_770, __v_803, record) }; - let __v_817: G = if unconstrained { Bytes2::xor(&__v_776, &__v_804) } else { bytes2_xor_value(__v_776, __v_804, record) }; - let __v_818: G = if unconstrained { Bytes2::xor(&__v_773, &__v_805) } else { bytes2_xor_value(__v_773, __v_805, record) }; - let __v_819: G = if unconstrained { Bytes2::xor(&__v_777, &__v_806) } else { bytes2_xor_value(__v_777, __v_806, record) }; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr7(&__v_816, &__v_817) } else { bytes2_chain_rotr7_value(__v_816, __v_817, record) }; - let __v_820: G = __b2_out.0; - let __v_821: G = __b2_out.1; - let __v_822: G = __b2_out.2; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr7(&__v_818, &__v_819) } else { bytes2_chain_rotr7_value(__v_818, __v_819, record) }; - let __v_823: G = __b2_out.0; - let __v_824: G = __b2_out.1; - let __v_825: G = __b2_out.2; - let __v_826: G = (__v_821 + __v_825); - let __v_827: G = (__v_824 + __v_822); - let __u32_sum: u128 = u128::from(((__v_478.as_canonical_u64() << 0) | (__v_479.as_canonical_u64() << 8) | (__v_480.as_canonical_u64() << 16) | (__v_481.as_canonical_u64() << 24))) + u128::from(((__v_220.as_canonical_u64() << 0) | (__v_226.as_canonical_u64() << 8) | (__v_223.as_canonical_u64() << 16) | (__v_227.as_canonical_u64() << 24))) + u128::from(((__v_120.as_canonical_u64() << 0) | (__v_121.as_canonical_u64() << 8) | (__v_122.as_canonical_u64() << 16) | (__v_123.as_canonical_u64() << 24))); + let __v_586: G = G::from_u8(__u32_bytes[0]); + let __v_587: G = G::from_u8(__u32_bytes[1]); + let __v_588: G = G::from_u8(__u32_bytes[2]); + let __v_589: G = G::from_u8(__u32_bytes[3]); + let __v_590: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_586; let __vj = __v_587; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_588; let __vj = __v_589; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_591: G = (__v_590 * __v_590); + if (__v_591 != __v_590) { + return Err(ExecError::AssertEqMismatch { lhs: __v_591.as_canonical_u64(), rhs: __v_590.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); + } + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_566, &__v_586) } else { bytes2_xor_split7_value(__v_566, __v_586, record) }; + let __v_592: G = __b2_out.0; + let __v_593: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_567, &__v_587) } else { bytes2_xor_split7_value(__v_567, __v_587, record) }; + let __v_594: G = __b2_out.0; + let __v_595: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_568, &__v_588) } else { bytes2_xor_split7_value(__v_568, __v_588, record) }; + let __v_596: G = __b2_out.0; + let __v_597: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_569, &__v_589) } else { bytes2_xor_split7_value(__v_569, __v_589, record) }; + let __v_598: G = __b2_out.0; + let __v_599: G = __b2_out.1; + let __v_600: G = (__v_592 + __v_595); + let __v_601: G = (__v_594 + __v_597); + let __v_602: G = (__v_596 + __v_599); + let __v_603: G = (__v_598 + __v_593); + let __u32_sum: u128 = u128::from(((__v_366.as_canonical_u64() << 0) | (__v_367.as_canonical_u64() << 8) | (__v_368.as_canonical_u64() << 16) | (__v_369.as_canonical_u64() << 24))) + u128::from(((__v_192.as_canonical_u64() << 0) | (__v_193.as_canonical_u64() << 8) | (__v_194.as_canonical_u64() << 16) | (__v_195.as_canonical_u64() << 24))) + u128::from(((__v_120.as_canonical_u64() << 0) | (__v_121.as_canonical_u64() << 8) | (__v_122.as_canonical_u64() << 16) | (__v_123.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_828: G = G::from_u8(__u32_bytes[0]); - let __v_829: G = G::from_u8(__u32_bytes[1]); - let __v_830: G = G::from_u8(__u32_bytes[2]); - let __v_831: G = G::from_u8(__u32_bytes[3]); - let __v_832: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_828; let __vj = __v_829; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_830; let __vj = __v_831; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_833: G = G::from_u64(((__v_478.as_canonical_u64() << 0) | (__v_479.as_canonical_u64() << 8) | (__v_480.as_canonical_u64() << 16) | (__v_481.as_canonical_u64() << 24))); - let __v_834: G = G::from_u64(((__v_220.as_canonical_u64() << 0) | (__v_226.as_canonical_u64() << 8) | (__v_223.as_canonical_u64() << 16) | (__v_227.as_canonical_u64() << 24))); - let __v_835: G = G::from_u64(((__v_120.as_canonical_u64() << 0) | (__v_121.as_canonical_u64() << 8) | (__v_122.as_canonical_u64() << 16) | (__v_123.as_canonical_u64() << 24))); - let __v_836: G = G::from_u64(((__v_828.as_canonical_u64() << 0) | (__v_829.as_canonical_u64() << 8) | (__v_830.as_canonical_u64() << 16) | (__v_831.as_canonical_u64() << 24))); - let __v_837: G = G::from_u64(1); - let __v_838: G = (__v_832 - __v_837); - let __v_839: G = G::from_u64(2); - let __v_840: G = (__v_832 - __v_839); - let __v_841: G = (__v_838 * __v_840); - let __v_842: G = (__v_832 * __v_841); - let __v_843: G = G::from_u64(0); - if (__v_842 != __v_843) { - return Err(ExecError::AssertEqMismatch { lhs: __v_842.as_canonical_u64(), rhs: __v_843.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); - } - let __v_844: G = (__v_834 + __v_835); - let __v_845: G = (__v_833 + __v_844); - let __v_846: G = G::from_u64(4294967296); - let __v_847: G = (__v_846 * __v_832); - let __v_848: G = (__v_836 + __v_847); - if (__v_845 != __v_848) { - return Err(ExecError::AssertEqMismatch { lhs: __v_845.as_canonical_u64(), rhs: __v_848.as_canonical_u64(), msg: Some("u32_add3: witnessed sum does not match its inputs".to_string()) }); - } - let __v_849: G = if unconstrained { Bytes2::xor(&__v_400, &__v_828) } else { bytes2_xor_value(__v_400, __v_828, record) }; - let __v_850: G = if unconstrained { Bytes2::xor(&__v_401, &__v_829) } else { bytes2_xor_value(__v_401, __v_829, record) }; - let __v_851: G = if unconstrained { Bytes2::xor(&__v_402, &__v_830) } else { bytes2_xor_value(__v_402, __v_830, record) }; - let __v_852: G = if unconstrained { Bytes2::xor(&__v_399, &__v_831) } else { bytes2_xor_value(__v_399, __v_831, record) }; - let __u32_sum: u128 = u128::from(((__v_303.as_canonical_u64() << 0) | (__v_304.as_canonical_u64() << 8) | (__v_305.as_canonical_u64() << 16) | (__v_306.as_canonical_u64() << 24))) + u128::from(((__v_851.as_canonical_u64() << 0) | (__v_852.as_canonical_u64() << 8) | (__v_849.as_canonical_u64() << 16) | (__v_850.as_canonical_u64() << 24))); + let __v_604: G = G::from_u8(__u32_bytes[0]); + let __v_605: G = G::from_u8(__u32_bytes[1]); + let __v_606: G = G::from_u8(__u32_bytes[2]); + let __v_607: G = G::from_u8(__u32_bytes[3]); + let __v_608: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_604; let __vj = __v_605; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_606; let __vj = __v_607; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_609: G = G::from_u64(1); + let __v_610: G = (__v_608 - __v_609); + let __v_611: G = G::from_u64(2); + let __v_612: G = (__v_608 - __v_611); + let __v_613: G = (__v_610 * __v_612); + let __v_614: G = (__v_608 * __v_613); + let __v_615: G = G::from_u64(0); + if (__v_614 != __v_615) { + return Err(ExecError::AssertEqMismatch { lhs: __v_614.as_canonical_u64(), rhs: __v_615.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); + } + let __v_616: G = if unconstrained { Bytes2::xor(&__v_311, &__v_604) } else { bytes2_xor_value(__v_311, __v_604, record) }; + let __v_617: G = if unconstrained { Bytes2::xor(&__v_312, &__v_605) } else { bytes2_xor_value(__v_312, __v_605, record) }; + let __v_618: G = if unconstrained { Bytes2::xor(&__v_313, &__v_606) } else { bytes2_xor_value(__v_313, __v_606, record) }; + let __v_619: G = if unconstrained { Bytes2::xor(&__v_310, &__v_607) } else { bytes2_xor_value(__v_310, __v_607, record) }; + let __u32_sum: u128 = u128::from(((__v_246.as_canonical_u64() << 0) | (__v_247.as_canonical_u64() << 8) | (__v_248.as_canonical_u64() << 16) | (__v_249.as_canonical_u64() << 24))) + u128::from(((__v_618.as_canonical_u64() << 0) | (__v_619.as_canonical_u64() << 8) | (__v_616.as_canonical_u64() << 16) | (__v_617.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_853: G = G::from_u8(__u32_bytes[0]); - let __v_854: G = G::from_u8(__u32_bytes[1]); - let __v_855: G = G::from_u8(__u32_bytes[2]); - let __v_856: G = G::from_u8(__u32_bytes[3]); - let __v_857: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_853; let __vj = __v_854; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_855; let __vj = __v_856; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_858: G = G::from_u64(((__v_303.as_canonical_u64() << 0) | (__v_304.as_canonical_u64() << 8) | (__v_305.as_canonical_u64() << 16) | (__v_306.as_canonical_u64() << 24))); - let __v_859: G = G::from_u64(((__v_851.as_canonical_u64() << 0) | (__v_852.as_canonical_u64() << 8) | (__v_849.as_canonical_u64() << 16) | (__v_850.as_canonical_u64() << 24))); - let __v_860: G = G::from_u64(((__v_853.as_canonical_u64() << 0) | (__v_854.as_canonical_u64() << 8) | (__v_855.as_canonical_u64() << 16) | (__v_856.as_canonical_u64() << 24))); - let __v_861: G = (__v_857 * __v_857); - if (__v_861 != __v_857) { - return Err(ExecError::AssertEqMismatch { lhs: __v_861.as_canonical_u64(), rhs: __v_857.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); - } - let __v_862: G = (__v_858 + __v_859); - let __v_863: G = G::from_u64(4294967296); - let __v_864: G = (__v_863 * __v_857); - let __v_865: G = (__v_860 + __v_864); - if (__v_862 != __v_865) { - return Err(ExecError::AssertEqMismatch { lhs: __v_862.as_canonical_u64(), rhs: __v_865.as_canonical_u64(), msg: Some("u32_add: witnessed sum does not match its inputs".to_string()) }); - } - let __v_866: G = if unconstrained { Bytes2::xor(&__v_220, &__v_853) } else { bytes2_xor_value(__v_220, __v_853, record) }; - let __v_867: G = if unconstrained { Bytes2::xor(&__v_226, &__v_854) } else { bytes2_xor_value(__v_226, __v_854, record) }; - let __v_868: G = if unconstrained { Bytes2::xor(&__v_223, &__v_855) } else { bytes2_xor_value(__v_223, __v_855, record) }; - let __v_869: G = if unconstrained { Bytes2::xor(&__v_227, &__v_856) } else { bytes2_xor_value(__v_227, __v_856, record) }; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr4(&__v_867, &__v_868) } else { bytes2_chain_rotr4_value(__v_867, __v_868, record) }; - let __v_870: G = __b2_out.0; - let __v_871: G = __b2_out.1; - let __v_872: G = __b2_out.2; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr4(&__v_869, &__v_866) } else { bytes2_chain_rotr4_value(__v_869, __v_866, record) }; - let __v_873: G = __b2_out.0; - let __v_874: G = __b2_out.1; - let __v_875: G = __b2_out.2; - let __v_876: G = (__v_871 + __v_875); - let __v_877: G = (__v_874 + __v_872); - let __u32_sum: u128 = u128::from(((__v_828.as_canonical_u64() << 0) | (__v_829.as_canonical_u64() << 8) | (__v_830.as_canonical_u64() << 16) | (__v_831.as_canonical_u64() << 24))) + u128::from(((__v_870.as_canonical_u64() << 0) | (__v_876.as_canonical_u64() << 8) | (__v_873.as_canonical_u64() << 16) | (__v_877.as_canonical_u64() << 24))) + u128::from(((__v_124.as_canonical_u64() << 0) | (__v_125.as_canonical_u64() << 8) | (__v_126.as_canonical_u64() << 16) | (__v_127.as_canonical_u64() << 24))); + let __v_620: G = G::from_u8(__u32_bytes[0]); + let __v_621: G = G::from_u8(__u32_bytes[1]); + let __v_622: G = G::from_u8(__u32_bytes[2]); + let __v_623: G = G::from_u8(__u32_bytes[3]); + let __v_624: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_620; let __vj = __v_621; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_622; let __vj = __v_623; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_625: G = (__v_624 * __v_624); + if (__v_625 != __v_624) { + return Err(ExecError::AssertEqMismatch { lhs: __v_625.as_canonical_u64(), rhs: __v_624.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); + } + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_192, &__v_620) } else { bytes2_xor_split4_value(__v_192, __v_620, record) }; + let __v_626: G = __b2_out.0; + let __v_627: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_193, &__v_621) } else { bytes2_xor_split4_value(__v_193, __v_621, record) }; + let __v_628: G = __b2_out.0; + let __v_629: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_194, &__v_622) } else { bytes2_xor_split4_value(__v_194, __v_622, record) }; + let __v_630: G = __b2_out.0; + let __v_631: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_195, &__v_623) } else { bytes2_xor_split4_value(__v_195, __v_623, record) }; + let __v_632: G = __b2_out.0; + let __v_633: G = __b2_out.1; + let __v_634: G = (__v_628 + __v_631); + let __v_635: G = (__v_630 + __v_633); + let __v_636: G = (__v_632 + __v_627); + let __v_637: G = (__v_626 + __v_629); + let __u32_sum: u128 = u128::from(((__v_604.as_canonical_u64() << 0) | (__v_605.as_canonical_u64() << 8) | (__v_606.as_canonical_u64() << 16) | (__v_607.as_canonical_u64() << 24))) + u128::from(((__v_634.as_canonical_u64() << 0) | (__v_635.as_canonical_u64() << 8) | (__v_636.as_canonical_u64() << 16) | (__v_637.as_canonical_u64() << 24))) + u128::from(((__v_124.as_canonical_u64() << 0) | (__v_125.as_canonical_u64() << 8) | (__v_126.as_canonical_u64() << 16) | (__v_127.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_878: G = G::from_u8(__u32_bytes[0]); - let __v_879: G = G::from_u8(__u32_bytes[1]); - let __v_880: G = G::from_u8(__u32_bytes[2]); - let __v_881: G = G::from_u8(__u32_bytes[3]); - let __v_882: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_878; let __vj = __v_879; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_880; let __vj = __v_881; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_883: G = G::from_u64(((__v_828.as_canonical_u64() << 0) | (__v_829.as_canonical_u64() << 8) | (__v_830.as_canonical_u64() << 16) | (__v_831.as_canonical_u64() << 24))); - let __v_884: G = G::from_u64(((__v_870.as_canonical_u64() << 0) | (__v_876.as_canonical_u64() << 8) | (__v_873.as_canonical_u64() << 16) | (__v_877.as_canonical_u64() << 24))); - let __v_885: G = G::from_u64(((__v_124.as_canonical_u64() << 0) | (__v_125.as_canonical_u64() << 8) | (__v_126.as_canonical_u64() << 16) | (__v_127.as_canonical_u64() << 24))); - let __v_886: G = G::from_u64(((__v_878.as_canonical_u64() << 0) | (__v_879.as_canonical_u64() << 8) | (__v_880.as_canonical_u64() << 16) | (__v_881.as_canonical_u64() << 24))); - let __v_887: G = G::from_u64(1); - let __v_888: G = (__v_882 - __v_887); - let __v_889: G = G::from_u64(2); - let __v_890: G = (__v_882 - __v_889); - let __v_891: G = (__v_888 * __v_890); - let __v_892: G = (__v_882 * __v_891); - let __v_893: G = G::from_u64(0); - if (__v_892 != __v_893) { - return Err(ExecError::AssertEqMismatch { lhs: __v_892.as_canonical_u64(), rhs: __v_893.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); - } - let __v_894: G = (__v_884 + __v_885); - let __v_895: G = (__v_883 + __v_894); - let __v_896: G = G::from_u64(4294967296); - let __v_897: G = (__v_896 * __v_882); - let __v_898: G = (__v_886 + __v_897); - if (__v_895 != __v_898) { - return Err(ExecError::AssertEqMismatch { lhs: __v_895.as_canonical_u64(), rhs: __v_898.as_canonical_u64(), msg: Some("u32_add3: witnessed sum does not match its inputs".to_string()) }); - } - let __v_899: G = if unconstrained { Bytes2::xor(&__v_851, &__v_878) } else { bytes2_xor_value(__v_851, __v_878, record) }; - let __v_900: G = if unconstrained { Bytes2::xor(&__v_852, &__v_879) } else { bytes2_xor_value(__v_852, __v_879, record) }; - let __v_901: G = if unconstrained { Bytes2::xor(&__v_849, &__v_880) } else { bytes2_xor_value(__v_849, __v_880, record) }; - let __v_902: G = if unconstrained { Bytes2::xor(&__v_850, &__v_881) } else { bytes2_xor_value(__v_850, __v_881, record) }; - let __u32_sum: u128 = u128::from(((__v_853.as_canonical_u64() << 0) | (__v_854.as_canonical_u64() << 8) | (__v_855.as_canonical_u64() << 16) | (__v_856.as_canonical_u64() << 24))) + u128::from(((__v_900.as_canonical_u64() << 0) | (__v_901.as_canonical_u64() << 8) | (__v_902.as_canonical_u64() << 16) | (__v_899.as_canonical_u64() << 24))); + let __v_638: G = G::from_u8(__u32_bytes[0]); + let __v_639: G = G::from_u8(__u32_bytes[1]); + let __v_640: G = G::from_u8(__u32_bytes[2]); + let __v_641: G = G::from_u8(__u32_bytes[3]); + let __v_642: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_638; let __vj = __v_639; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_640; let __vj = __v_641; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_643: G = G::from_u64(1); + let __v_644: G = (__v_642 - __v_643); + let __v_645: G = G::from_u64(2); + let __v_646: G = (__v_642 - __v_645); + let __v_647: G = (__v_644 * __v_646); + let __v_648: G = (__v_642 * __v_647); + let __v_649: G = G::from_u64(0); + if (__v_648 != __v_649) { + return Err(ExecError::AssertEqMismatch { lhs: __v_648.as_canonical_u64(), rhs: __v_649.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); + } + let __v_650: G = if unconstrained { Bytes2::xor(&__v_618, &__v_638) } else { bytes2_xor_value(__v_618, __v_638, record) }; + let __v_651: G = if unconstrained { Bytes2::xor(&__v_619, &__v_639) } else { bytes2_xor_value(__v_619, __v_639, record) }; + let __v_652: G = if unconstrained { Bytes2::xor(&__v_616, &__v_640) } else { bytes2_xor_value(__v_616, __v_640, record) }; + let __v_653: G = if unconstrained { Bytes2::xor(&__v_617, &__v_641) } else { bytes2_xor_value(__v_617, __v_641, record) }; + let __u32_sum: u128 = u128::from(((__v_620.as_canonical_u64() << 0) | (__v_621.as_canonical_u64() << 8) | (__v_622.as_canonical_u64() << 16) | (__v_623.as_canonical_u64() << 24))) + u128::from(((__v_651.as_canonical_u64() << 0) | (__v_652.as_canonical_u64() << 8) | (__v_653.as_canonical_u64() << 16) | (__v_650.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_903: G = G::from_u8(__u32_bytes[0]); - let __v_904: G = G::from_u8(__u32_bytes[1]); - let __v_905: G = G::from_u8(__u32_bytes[2]); - let __v_906: G = G::from_u8(__u32_bytes[3]); - let __v_907: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_903; let __vj = __v_904; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_905; let __vj = __v_906; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_908: G = G::from_u64(((__v_853.as_canonical_u64() << 0) | (__v_854.as_canonical_u64() << 8) | (__v_855.as_canonical_u64() << 16) | (__v_856.as_canonical_u64() << 24))); - let __v_909: G = G::from_u64(((__v_900.as_canonical_u64() << 0) | (__v_901.as_canonical_u64() << 8) | (__v_902.as_canonical_u64() << 16) | (__v_899.as_canonical_u64() << 24))); - let __v_910: G = G::from_u64(((__v_903.as_canonical_u64() << 0) | (__v_904.as_canonical_u64() << 8) | (__v_905.as_canonical_u64() << 16) | (__v_906.as_canonical_u64() << 24))); - let __v_911: G = (__v_907 * __v_907); - if (__v_911 != __v_907) { - return Err(ExecError::AssertEqMismatch { lhs: __v_911.as_canonical_u64(), rhs: __v_907.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); - } - let __v_912: G = (__v_908 + __v_909); - let __v_913: G = G::from_u64(4294967296); - let __v_914: G = (__v_913 * __v_907); - let __v_915: G = (__v_910 + __v_914); - if (__v_912 != __v_915) { - return Err(ExecError::AssertEqMismatch { lhs: __v_912.as_canonical_u64(), rhs: __v_915.as_canonical_u64(), msg: Some("u32_add: witnessed sum does not match its inputs".to_string()) }); - } - let __v_916: G = if unconstrained { Bytes2::xor(&__v_870, &__v_903) } else { bytes2_xor_value(__v_870, __v_903, record) }; - let __v_917: G = if unconstrained { Bytes2::xor(&__v_876, &__v_904) } else { bytes2_xor_value(__v_876, __v_904, record) }; - let __v_918: G = if unconstrained { Bytes2::xor(&__v_873, &__v_905) } else { bytes2_xor_value(__v_873, __v_905, record) }; - let __v_919: G = if unconstrained { Bytes2::xor(&__v_877, &__v_906) } else { bytes2_xor_value(__v_877, __v_906, record) }; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr7(&__v_916, &__v_917) } else { bytes2_chain_rotr7_value(__v_916, __v_917, record) }; - let __v_920: G = __b2_out.0; - let __v_921: G = __b2_out.1; - let __v_922: G = __b2_out.2; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr7(&__v_918, &__v_919) } else { bytes2_chain_rotr7_value(__v_918, __v_919, record) }; - let __v_923: G = __b2_out.0; - let __v_924: G = __b2_out.1; - let __v_925: G = __b2_out.2; - let __v_926: G = (__v_921 + __v_925); - let __v_927: G = (__v_924 + __v_922); - let __ret: [G; OUT_28] = [__v_578, __v_579, __v_580, __v_581, __v_678, __v_679, __v_680, __v_681, __v_778, __v_779, __v_780, __v_781, __v_878, __v_879, __v_880, __v_881, __v_920, __v_926, __v_923, __v_927, __v_620, __v_626, __v_623, __v_627, __v_720, __v_726, __v_723, __v_727, __v_820, __v_826, __v_823, __v_827, __v_803, __v_804, __v_805, __v_806, __v_903, __v_904, __v_905, __v_906, __v_603, __v_604, __v_605, __v_606, __v_703, __v_704, __v_705, __v_706, __v_700, __v_701, __v_702, __v_699, __v_800, __v_801, __v_802, __v_799, __v_900, __v_901, __v_902, __v_899, __v_600, __v_601, __v_602, __v_599, __v_64, __v_65, __v_66, __v_67, __v_68, __v_69, __v_70, __v_71, __v_72, __v_73, __v_74, __v_75, __v_76, __v_77, __v_78, __v_79, __v_80, __v_81, __v_82, __v_83, __v_84, __v_85, __v_86, __v_87, __v_88, __v_89, __v_90, __v_91, __v_92, __v_93, __v_94, __v_95, __v_96, __v_97, __v_98, __v_99, __v_100, __v_101, __v_102, __v_103, __v_104, __v_105, __v_106, __v_107, __v_108, __v_109, __v_110, __v_111, __v_112, __v_113, __v_114, __v_115, __v_116, __v_117, __v_118, __v_119, __v_120, __v_121, __v_122, __v_123, __v_124, __v_125, __v_126, __v_127]; + let __v_654: G = G::from_u8(__u32_bytes[0]); + let __v_655: G = G::from_u8(__u32_bytes[1]); + let __v_656: G = G::from_u8(__u32_bytes[2]); + let __v_657: G = G::from_u8(__u32_bytes[3]); + let __v_658: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_654; let __vj = __v_655; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_656; let __vj = __v_657; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_659: G = (__v_658 * __v_658); + if (__v_659 != __v_658) { + return Err(ExecError::AssertEqMismatch { lhs: __v_659.as_canonical_u64(), rhs: __v_658.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); + } + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_634, &__v_654) } else { bytes2_xor_split7_value(__v_634, __v_654, record) }; + let __v_660: G = __b2_out.0; + let __v_661: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_635, &__v_655) } else { bytes2_xor_split7_value(__v_635, __v_655, record) }; + let __v_662: G = __b2_out.0; + let __v_663: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_636, &__v_656) } else { bytes2_xor_split7_value(__v_636, __v_656, record) }; + let __v_664: G = __b2_out.0; + let __v_665: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_637, &__v_657) } else { bytes2_xor_split7_value(__v_637, __v_657, record) }; + let __v_666: G = __b2_out.0; + let __v_667: G = __b2_out.1; + let __v_668: G = (__v_660 + __v_663); + let __v_669: G = (__v_662 + __v_665); + let __v_670: G = (__v_664 + __v_667); + let __v_671: G = (__v_666 + __v_661); + let __ret: [G; OUT_28] = [__v_434, __v_435, __v_436, __v_437, __v_502, __v_503, __v_504, __v_505, __v_570, __v_571, __v_572, __v_573, __v_638, __v_639, __v_640, __v_641, __v_668, __v_669, __v_670, __v_671, __v_464, __v_465, __v_466, __v_467, __v_532, __v_533, __v_534, __v_535, __v_600, __v_601, __v_602, __v_603, __v_586, __v_587, __v_588, __v_589, __v_654, __v_655, __v_656, __v_657, __v_450, __v_451, __v_452, __v_453, __v_518, __v_519, __v_520, __v_521, __v_515, __v_516, __v_517, __v_514, __v_583, __v_584, __v_585, __v_582, __v_651, __v_652, __v_653, __v_650, __v_447, __v_448, __v_449, __v_446, __v_64, __v_65, __v_66, __v_67, __v_68, __v_69, __v_70, __v_71, __v_72, __v_73, __v_74, __v_75, __v_76, __v_77, __v_78, __v_79, __v_80, __v_81, __v_82, __v_83, __v_84, __v_85, __v_86, __v_87, __v_88, __v_89, __v_90, __v_91, __v_92, __v_93, __v_94, __v_95, __v_96, __v_97, __v_98, __v_99, __v_100, __v_101, __v_102, __v_103, __v_104, __v_105, __v_106, __v_107, __v_108, __v_109, __v_110, __v_111, __v_112, __v_113, __v_114, __v_115, __v_116, __v_117, __v_118, __v_119, __v_120, __v_121, __v_122, __v_123, __v_124, __v_125, __v_126, __v_127]; record.function_queries[28].insert(&inp[..], &__ret[..], G::from_bool(!unconstrained)); return Ok(__ret); }) diff --git a/crates/ixvm-codegen/src/aiur_multi_stark.rs b/crates/ixvm-codegen/src/aiur_multi_stark.rs index 3915d68b..0583b54c 100644 --- a/crates/ixvm-codegen/src/aiur_multi_stark.rs +++ b/crates/ixvm-codegen/src/aiur_multi_stark.rs @@ -14,7 +14,7 @@ use multi_stark::p3_field::{PrimeCharacteristicRing, PrimeField64}; use aiur::G; -use aiur::execute::{ ExecError, IOBuffer, QueryRecord, bytes1_bit_decompose_value, bytes2_xor_value, bytes2_chain_rotr7_value, bytes2_chain_rotr4_value, g_inverse_value, CodegenBytes1 as Bytes1, CodegenBytes2 as Bytes2 }; +use aiur::execute::{ ExecError, IOBuffer, QueryRecord, bytes1_bit_decompose_value, bytes2_xor_value, bytes2_xor_split7_value, bytes2_xor_split4_value, g_inverse_value, CodegenBytes1 as Bytes1, CodegenBytes2 as Bytes2 }; const INPUT_SIZE_0: usize = 3; const IN_0: usize = 3; @@ -189,19 +189,9 @@ fn aiur_fn_2( let __v_12: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); if !unconstrained { let __vi = __v_8; let __vj = __v_9; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; if !unconstrained { let __vi = __v_10; let __vj = __v_11; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_13: G = G::from_u64(((__v_0.as_canonical_u64() << 0) | (__v_1.as_canonical_u64() << 8) | (__v_2.as_canonical_u64() << 16) | (__v_3.as_canonical_u64() << 24))); - let __v_14: G = G::from_u64(((__v_4.as_canonical_u64() << 0) | (__v_5.as_canonical_u64() << 8) | (__v_6.as_canonical_u64() << 16) | (__v_7.as_canonical_u64() << 24))); - let __v_15: G = G::from_u64(((__v_8.as_canonical_u64() << 0) | (__v_9.as_canonical_u64() << 8) | (__v_10.as_canonical_u64() << 16) | (__v_11.as_canonical_u64() << 24))); - let __v_16: G = (__v_12 * __v_12); - if (__v_16 != __v_12) { - return Err(ExecError::AssertEqMismatch { lhs: __v_16.as_canonical_u64(), rhs: __v_12.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); - } - let __v_17: G = (__v_13 + __v_14); - let __v_18: G = G::from_u64(4294967296); - let __v_19: G = (__v_18 * __v_12); - let __v_20: G = (__v_15 + __v_19); - if (__v_17 != __v_20) { - return Err(ExecError::AssertEqMismatch { lhs: __v_17.as_canonical_u64(), rhs: __v_20.as_canonical_u64(), msg: Some("u32_add: witnessed sum does not match its inputs".to_string()) }); + let __v_13: G = (__v_12 * __v_12); + if (__v_13 != __v_12) { + return Err(ExecError::AssertEqMismatch { lhs: __v_13.as_canonical_u64(), rhs: __v_12.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); } let __ret: [G; OUT_2] = [__v_8, __v_9, __v_10, __v_11]; record.function_queries[2].insert(&inp[..], &__ret[..], G::from_bool(!unconstrained)); @@ -240,27 +230,15 @@ fn aiur_fn_3( let __v_16: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); if !unconstrained { let __vi = __v_12; let __vj = __v_13; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; if !unconstrained { let __vi = __v_14; let __vj = __v_15; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_17: G = G::from_u64(((__v_0.as_canonical_u64() << 0) | (__v_1.as_canonical_u64() << 8) | (__v_2.as_canonical_u64() << 16) | (__v_3.as_canonical_u64() << 24))); - let __v_18: G = G::from_u64(((__v_4.as_canonical_u64() << 0) | (__v_5.as_canonical_u64() << 8) | (__v_6.as_canonical_u64() << 16) | (__v_7.as_canonical_u64() << 24))); - let __v_19: G = G::from_u64(((__v_8.as_canonical_u64() << 0) | (__v_9.as_canonical_u64() << 8) | (__v_10.as_canonical_u64() << 16) | (__v_11.as_canonical_u64() << 24))); - let __v_20: G = G::from_u64(((__v_12.as_canonical_u64() << 0) | (__v_13.as_canonical_u64() << 8) | (__v_14.as_canonical_u64() << 16) | (__v_15.as_canonical_u64() << 24))); - let __v_21: G = G::from_u64(1); - let __v_22: G = (__v_16 - __v_21); - let __v_23: G = G::from_u64(2); - let __v_24: G = (__v_16 - __v_23); - let __v_25: G = (__v_22 * __v_24); - let __v_26: G = (__v_16 * __v_25); - let __v_27: G = G::from_u64(0); - if (__v_26 != __v_27) { - return Err(ExecError::AssertEqMismatch { lhs: __v_26.as_canonical_u64(), rhs: __v_27.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); - } - let __v_28: G = (__v_18 + __v_19); - let __v_29: G = (__v_17 + __v_28); - let __v_30: G = G::from_u64(4294967296); - let __v_31: G = (__v_30 * __v_16); - let __v_32: G = (__v_20 + __v_31); - if (__v_29 != __v_32) { - return Err(ExecError::AssertEqMismatch { lhs: __v_29.as_canonical_u64(), rhs: __v_32.as_canonical_u64(), msg: Some("u32_add3: witnessed sum does not match its inputs".to_string()) }); + let __v_17: G = G::from_u64(1); + let __v_18: G = (__v_16 - __v_17); + let __v_19: G = G::from_u64(2); + let __v_20: G = (__v_16 - __v_19); + let __v_21: G = (__v_18 * __v_20); + let __v_22: G = (__v_16 * __v_21); + let __v_23: G = G::from_u64(0); + if (__v_22 != __v_23) { + return Err(ExecError::AssertEqMismatch { lhs: __v_22.as_canonical_u64(), rhs: __v_23.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); } let __ret: [G; OUT_3] = [__v_12, __v_13, __v_14, __v_15]; record.function_queries[3].insert(&inp[..], &__ret[..], G::from_bool(!unconstrained)); @@ -336,8 +314,8 @@ fn aiur_fn_6( }) } -const INPUT_SIZE_7: usize = 4; -const IN_7: usize = 4; +const INPUT_SIZE_7: usize = 8; +const IN_7: usize = 8; const OUT_7: usize = 4; fn aiur_fn_7( inp: [G; IN_7], @@ -350,24 +328,34 @@ fn aiur_fn_7( let __v_1: G = inp[1]; let __v_2: G = inp[2]; let __v_3: G = inp[3]; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr4(&__v_1, &__v_2) } else { bytes2_chain_rotr4_value(__v_1, __v_2, record) }; - let __v_4: G = __b2_out.0; - let __v_5: G = __b2_out.1; - let __v_6: G = __b2_out.2; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr4(&__v_3, &__v_0) } else { bytes2_chain_rotr4_value(__v_3, __v_0, record) }; - let __v_7: G = __b2_out.0; - let __v_8: G = __b2_out.1; - let __v_9: G = __b2_out.2; - let __v_10: G = (__v_5 + __v_9); - let __v_11: G = (__v_8 + __v_6); - let __ret: [G; OUT_7] = [__v_4, __v_10, __v_7, __v_11]; + let __v_4: G = inp[4]; + let __v_5: G = inp[5]; + let __v_6: G = inp[6]; + let __v_7: G = inp[7]; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_0, &__v_4) } else { bytes2_xor_split7_value(__v_0, __v_4, record) }; + let __v_8: G = __b2_out.0; + let __v_9: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_1, &__v_5) } else { bytes2_xor_split7_value(__v_1, __v_5, record) }; + let __v_10: G = __b2_out.0; + let __v_11: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_2, &__v_6) } else { bytes2_xor_split7_value(__v_2, __v_6, record) }; + let __v_12: G = __b2_out.0; + let __v_13: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_3, &__v_7) } else { bytes2_xor_split7_value(__v_3, __v_7, record) }; + let __v_14: G = __b2_out.0; + let __v_15: G = __b2_out.1; + let __v_16: G = (__v_8 + __v_11); + let __v_17: G = (__v_10 + __v_13); + let __v_18: G = (__v_12 + __v_15); + let __v_19: G = (__v_14 + __v_9); + let __ret: [G; OUT_7] = [__v_16, __v_17, __v_18, __v_19]; record.function_queries[7].insert(&inp[..], &__ret[..], G::from_bool(!unconstrained)); return Ok(__ret); }) } -const INPUT_SIZE_8: usize = 4; -const IN_8: usize = 4; +const INPUT_SIZE_8: usize = 8; +const IN_8: usize = 8; const OUT_8: usize = 4; fn aiur_fn_8( inp: [G; IN_8], @@ -380,17 +368,27 @@ fn aiur_fn_8( let __v_1: G = inp[1]; let __v_2: G = inp[2]; let __v_3: G = inp[3]; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr7(&__v_0, &__v_1) } else { bytes2_chain_rotr7_value(__v_0, __v_1, record) }; - let __v_4: G = __b2_out.0; - let __v_5: G = __b2_out.1; - let __v_6: G = __b2_out.2; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr7(&__v_2, &__v_3) } else { bytes2_chain_rotr7_value(__v_2, __v_3, record) }; - let __v_7: G = __b2_out.0; - let __v_8: G = __b2_out.1; - let __v_9: G = __b2_out.2; - let __v_10: G = (__v_5 + __v_9); - let __v_11: G = (__v_8 + __v_6); - let __ret: [G; OUT_8] = [__v_4, __v_10, __v_7, __v_11]; + let __v_4: G = inp[4]; + let __v_5: G = inp[5]; + let __v_6: G = inp[6]; + let __v_7: G = inp[7]; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_0, &__v_4) } else { bytes2_xor_split4_value(__v_0, __v_4, record) }; + let __v_8: G = __b2_out.0; + let __v_9: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_1, &__v_5) } else { bytes2_xor_split4_value(__v_1, __v_5, record) }; + let __v_10: G = __b2_out.0; + let __v_11: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_2, &__v_6) } else { bytes2_xor_split4_value(__v_2, __v_6, record) }; + let __v_12: G = __b2_out.0; + let __v_13: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_3, &__v_7) } else { bytes2_xor_split4_value(__v_3, __v_7, record) }; + let __v_14: G = __b2_out.0; + let __v_15: G = __b2_out.1; + let __v_16: G = (__v_10 + __v_13); + let __v_17: G = (__v_12 + __v_15); + let __v_18: G = (__v_14 + __v_9); + let __v_19: G = (__v_8 + __v_11); + let __ret: [G; OUT_8] = [__v_16, __v_17, __v_18, __v_19]; record.function_queries[8].insert(&inp[..], &__ret[..], G::from_bool(!unconstrained)); return Ok(__ret); }) @@ -4757,70 +4755,73 @@ fn aiur_fn_68( let __v_28: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); if !unconstrained { let __vi = __v_24; let __vj = __v_25; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; if !unconstrained { let __vi = __v_26; let __vj = __v_27; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_29: G = G::from_u64(((__v_0.as_canonical_u64() << 0) | (__v_1.as_canonical_u64() << 8) | (__v_2.as_canonical_u64() << 16) | (__v_3.as_canonical_u64() << 24))); - let __v_30: G = G::from_u64(((__v_4.as_canonical_u64() << 0) | (__v_5.as_canonical_u64() << 8) | (__v_6.as_canonical_u64() << 16) | (__v_7.as_canonical_u64() << 24))); - let __v_31: G = G::from_u64(((__v_16.as_canonical_u64() << 0) | (__v_17.as_canonical_u64() << 8) | (__v_18.as_canonical_u64() << 16) | (__v_19.as_canonical_u64() << 24))); - let __v_32: G = G::from_u64(((__v_24.as_canonical_u64() << 0) | (__v_25.as_canonical_u64() << 8) | (__v_26.as_canonical_u64() << 16) | (__v_27.as_canonical_u64() << 24))); - let __v_33: G = G::from_u64(1); - let __v_34: G = (__v_28 - __v_33); - let __v_35: G = G::from_u64(2); - let __v_36: G = (__v_28 - __v_35); - let __v_37: G = (__v_34 * __v_36); - let __v_38: G = (__v_28 * __v_37); - let __v_39: G = G::from_u64(0); - if (__v_38 != __v_39) { - return Err(ExecError::AssertEqMismatch { lhs: __v_38.as_canonical_u64(), rhs: __v_39.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); - } - let __v_40: G = (__v_30 + __v_31); - let __v_41: G = (__v_29 + __v_40); - let __v_42: G = G::from_u64(4294967296); - let __v_43: G = (__v_42 * __v_28); - let __v_44: G = (__v_32 + __v_43); - if (__v_41 != __v_44) { - return Err(ExecError::AssertEqMismatch { lhs: __v_41.as_canonical_u64(), rhs: __v_44.as_canonical_u64(), msg: Some("u32_add3: witnessed sum does not match its inputs".to_string()) }); - } - let __v_45: G = if unconstrained { Bytes2::xor(&__v_12, &__v_24) } else { bytes2_xor_value(__v_12, __v_24, record) }; - let __v_46: G = if unconstrained { Bytes2::xor(&__v_13, &__v_25) } else { bytes2_xor_value(__v_13, __v_25, record) }; - let __v_47: G = if unconstrained { Bytes2::xor(&__v_14, &__v_26) } else { bytes2_xor_value(__v_14, __v_26, record) }; - let __v_48: G = if unconstrained { Bytes2::xor(&__v_15, &__v_27) } else { bytes2_xor_value(__v_15, __v_27, record) }; - let __u32_sum: u128 = u128::from(((__v_8.as_canonical_u64() << 0) | (__v_9.as_canonical_u64() << 8) | (__v_10.as_canonical_u64() << 16) | (__v_11.as_canonical_u64() << 24))) + u128::from(((__v_47.as_canonical_u64() << 0) | (__v_48.as_canonical_u64() << 8) | (__v_45.as_canonical_u64() << 16) | (__v_46.as_canonical_u64() << 24))); + let __v_29: G = G::from_u64(1); + let __v_30: G = (__v_28 - __v_29); + let __v_31: G = G::from_u64(2); + let __v_32: G = (__v_28 - __v_31); + let __v_33: G = (__v_30 * __v_32); + let __v_34: G = (__v_28 * __v_33); + let __v_35: G = G::from_u64(0); + if (__v_34 != __v_35) { + return Err(ExecError::AssertEqMismatch { lhs: __v_34.as_canonical_u64(), rhs: __v_35.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); + } + let __v_36: G = if unconstrained { Bytes2::xor(&__v_12, &__v_24) } else { bytes2_xor_value(__v_12, __v_24, record) }; + let __v_37: G = if unconstrained { Bytes2::xor(&__v_13, &__v_25) } else { bytes2_xor_value(__v_13, __v_25, record) }; + let __v_38: G = if unconstrained { Bytes2::xor(&__v_14, &__v_26) } else { bytes2_xor_value(__v_14, __v_26, record) }; + let __v_39: G = if unconstrained { Bytes2::xor(&__v_15, &__v_27) } else { bytes2_xor_value(__v_15, __v_27, record) }; + let __u32_sum: u128 = u128::from(((__v_8.as_canonical_u64() << 0) | (__v_9.as_canonical_u64() << 8) | (__v_10.as_canonical_u64() << 16) | (__v_11.as_canonical_u64() << 24))) + u128::from(((__v_38.as_canonical_u64() << 0) | (__v_39.as_canonical_u64() << 8) | (__v_36.as_canonical_u64() << 16) | (__v_37.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_49: G = G::from_u8(__u32_bytes[0]); - let __v_50: G = G::from_u8(__u32_bytes[1]); - let __v_51: G = G::from_u8(__u32_bytes[2]); - let __v_52: G = G::from_u8(__u32_bytes[3]); - let __v_53: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_49; let __vj = __v_50; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_51; let __vj = __v_52; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_54: G = G::from_u64(((__v_8.as_canonical_u64() << 0) | (__v_9.as_canonical_u64() << 8) | (__v_10.as_canonical_u64() << 16) | (__v_11.as_canonical_u64() << 24))); - let __v_55: G = G::from_u64(((__v_47.as_canonical_u64() << 0) | (__v_48.as_canonical_u64() << 8) | (__v_45.as_canonical_u64() << 16) | (__v_46.as_canonical_u64() << 24))); - let __v_56: G = G::from_u64(((__v_49.as_canonical_u64() << 0) | (__v_50.as_canonical_u64() << 8) | (__v_51.as_canonical_u64() << 16) | (__v_52.as_canonical_u64() << 24))); - let __v_57: G = (__v_53 * __v_53); - if (__v_57 != __v_53) { - return Err(ExecError::AssertEqMismatch { lhs: __v_57.as_canonical_u64(), rhs: __v_53.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); - } - let __v_58: G = (__v_54 + __v_55); - let __v_59: G = G::from_u64(4294967296); - let __v_60: G = (__v_59 * __v_53); - let __v_61: G = (__v_56 + __v_60); - if (__v_58 != __v_61) { - return Err(ExecError::AssertEqMismatch { lhs: __v_58.as_canonical_u64(), rhs: __v_61.as_canonical_u64(), msg: Some("u32_add: witnessed sum does not match its inputs".to_string()) }); - } - let __v_62: G = if unconstrained { Bytes2::xor(&__v_4, &__v_49) } else { bytes2_xor_value(__v_4, __v_49, record) }; - let __v_63: G = if unconstrained { Bytes2::xor(&__v_5, &__v_50) } else { bytes2_xor_value(__v_5, __v_50, record) }; - let __v_64: G = if unconstrained { Bytes2::xor(&__v_6, &__v_51) } else { bytes2_xor_value(__v_6, __v_51, record) }; - let __v_65: G = if unconstrained { Bytes2::xor(&__v_7, &__v_52) } else { bytes2_xor_value(__v_7, __v_52, record) }; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr4(&__v_63, &__v_64) } else { bytes2_chain_rotr4_value(__v_63, __v_64, record) }; - let __v_66: G = __b2_out.0; - let __v_67: G = __b2_out.1; - let __v_68: G = __b2_out.2; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr4(&__v_65, &__v_62) } else { bytes2_chain_rotr4_value(__v_65, __v_62, record) }; - let __v_69: G = __b2_out.0; - let __v_70: G = __b2_out.1; - let __v_71: G = __b2_out.2; - let __v_72: G = (__v_67 + __v_71); - let __v_73: G = (__v_70 + __v_68); - let __u32_sum: u128 = u128::from(((__v_24.as_canonical_u64() << 0) | (__v_25.as_canonical_u64() << 8) | (__v_26.as_canonical_u64() << 16) | (__v_27.as_canonical_u64() << 24))) + u128::from(((__v_66.as_canonical_u64() << 0) | (__v_72.as_canonical_u64() << 8) | (__v_69.as_canonical_u64() << 16) | (__v_73.as_canonical_u64() << 24))) + u128::from(((__v_20.as_canonical_u64() << 0) | (__v_21.as_canonical_u64() << 8) | (__v_22.as_canonical_u64() << 16) | (__v_23.as_canonical_u64() << 24))); + let __v_40: G = G::from_u8(__u32_bytes[0]); + let __v_41: G = G::from_u8(__u32_bytes[1]); + let __v_42: G = G::from_u8(__u32_bytes[2]); + let __v_43: G = G::from_u8(__u32_bytes[3]); + let __v_44: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_40; let __vj = __v_41; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_42; let __vj = __v_43; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_45: G = (__v_44 * __v_44); + if (__v_45 != __v_44) { + return Err(ExecError::AssertEqMismatch { lhs: __v_45.as_canonical_u64(), rhs: __v_44.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); + } + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_4, &__v_40) } else { bytes2_xor_split4_value(__v_4, __v_40, record) }; + let __v_46: G = __b2_out.0; + let __v_47: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_5, &__v_41) } else { bytes2_xor_split4_value(__v_5, __v_41, record) }; + let __v_48: G = __b2_out.0; + let __v_49: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_6, &__v_42) } else { bytes2_xor_split4_value(__v_6, __v_42, record) }; + let __v_50: G = __b2_out.0; + let __v_51: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_7, &__v_43) } else { bytes2_xor_split4_value(__v_7, __v_43, record) }; + let __v_52: G = __b2_out.0; + let __v_53: G = __b2_out.1; + let __v_54: G = (__v_48 + __v_51); + let __v_55: G = (__v_50 + __v_53); + let __v_56: G = (__v_52 + __v_47); + let __v_57: G = (__v_46 + __v_49); + let __u32_sum: u128 = u128::from(((__v_24.as_canonical_u64() << 0) | (__v_25.as_canonical_u64() << 8) | (__v_26.as_canonical_u64() << 16) | (__v_27.as_canonical_u64() << 24))) + u128::from(((__v_54.as_canonical_u64() << 0) | (__v_55.as_canonical_u64() << 8) | (__v_56.as_canonical_u64() << 16) | (__v_57.as_canonical_u64() << 24))) + u128::from(((__v_20.as_canonical_u64() << 0) | (__v_21.as_canonical_u64() << 8) | (__v_22.as_canonical_u64() << 16) | (__v_23.as_canonical_u64() << 24))); + let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); + let __v_58: G = G::from_u8(__u32_bytes[0]); + let __v_59: G = G::from_u8(__u32_bytes[1]); + let __v_60: G = G::from_u8(__u32_bytes[2]); + let __v_61: G = G::from_u8(__u32_bytes[3]); + let __v_62: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_58; let __vj = __v_59; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_60; let __vj = __v_61; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_63: G = G::from_u64(1); + let __v_64: G = (__v_62 - __v_63); + let __v_65: G = G::from_u64(2); + let __v_66: G = (__v_62 - __v_65); + let __v_67: G = (__v_64 * __v_66); + let __v_68: G = (__v_62 * __v_67); + let __v_69: G = G::from_u64(0); + if (__v_68 != __v_69) { + return Err(ExecError::AssertEqMismatch { lhs: __v_68.as_canonical_u64(), rhs: __v_69.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); + } + let __v_70: G = if unconstrained { Bytes2::xor(&__v_38, &__v_58) } else { bytes2_xor_value(__v_38, __v_58, record) }; + let __v_71: G = if unconstrained { Bytes2::xor(&__v_39, &__v_59) } else { bytes2_xor_value(__v_39, __v_59, record) }; + let __v_72: G = if unconstrained { Bytes2::xor(&__v_36, &__v_60) } else { bytes2_xor_value(__v_36, __v_60, record) }; + let __v_73: G = if unconstrained { Bytes2::xor(&__v_37, &__v_61) } else { bytes2_xor_value(__v_37, __v_61, record) }; + let __u32_sum: u128 = u128::from(((__v_40.as_canonical_u64() << 0) | (__v_41.as_canonical_u64() << 8) | (__v_42.as_canonical_u64() << 16) | (__v_43.as_canonical_u64() << 24))) + u128::from(((__v_71.as_canonical_u64() << 0) | (__v_72.as_canonical_u64() << 8) | (__v_73.as_canonical_u64() << 16) | (__v_70.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); let __v_74: G = G::from_u8(__u32_bytes[0]); let __v_75: G = G::from_u8(__u32_bytes[1]); @@ -4829,70 +4830,27 @@ fn aiur_fn_68( let __v_78: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); if !unconstrained { let __vi = __v_74; let __vj = __v_75; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; if !unconstrained { let __vi = __v_76; let __vj = __v_77; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_79: G = G::from_u64(((__v_24.as_canonical_u64() << 0) | (__v_25.as_canonical_u64() << 8) | (__v_26.as_canonical_u64() << 16) | (__v_27.as_canonical_u64() << 24))); - let __v_80: G = G::from_u64(((__v_66.as_canonical_u64() << 0) | (__v_72.as_canonical_u64() << 8) | (__v_69.as_canonical_u64() << 16) | (__v_73.as_canonical_u64() << 24))); - let __v_81: G = G::from_u64(((__v_20.as_canonical_u64() << 0) | (__v_21.as_canonical_u64() << 8) | (__v_22.as_canonical_u64() << 16) | (__v_23.as_canonical_u64() << 24))); - let __v_82: G = G::from_u64(((__v_74.as_canonical_u64() << 0) | (__v_75.as_canonical_u64() << 8) | (__v_76.as_canonical_u64() << 16) | (__v_77.as_canonical_u64() << 24))); - let __v_83: G = G::from_u64(1); - let __v_84: G = (__v_78 - __v_83); - let __v_85: G = G::from_u64(2); - let __v_86: G = (__v_78 - __v_85); - let __v_87: G = (__v_84 * __v_86); - let __v_88: G = (__v_78 * __v_87); - let __v_89: G = G::from_u64(0); - if (__v_88 != __v_89) { - return Err(ExecError::AssertEqMismatch { lhs: __v_88.as_canonical_u64(), rhs: __v_89.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); - } - let __v_90: G = (__v_80 + __v_81); - let __v_91: G = (__v_79 + __v_90); - let __v_92: G = G::from_u64(4294967296); - let __v_93: G = (__v_92 * __v_78); - let __v_94: G = (__v_82 + __v_93); - if (__v_91 != __v_94) { - return Err(ExecError::AssertEqMismatch { lhs: __v_91.as_canonical_u64(), rhs: __v_94.as_canonical_u64(), msg: Some("u32_add3: witnessed sum does not match its inputs".to_string()) }); - } - let __v_95: G = if unconstrained { Bytes2::xor(&__v_47, &__v_74) } else { bytes2_xor_value(__v_47, __v_74, record) }; - let __v_96: G = if unconstrained { Bytes2::xor(&__v_48, &__v_75) } else { bytes2_xor_value(__v_48, __v_75, record) }; - let __v_97: G = if unconstrained { Bytes2::xor(&__v_45, &__v_76) } else { bytes2_xor_value(__v_45, __v_76, record) }; - let __v_98: G = if unconstrained { Bytes2::xor(&__v_46, &__v_77) } else { bytes2_xor_value(__v_46, __v_77, record) }; - let __u32_sum: u128 = u128::from(((__v_49.as_canonical_u64() << 0) | (__v_50.as_canonical_u64() << 8) | (__v_51.as_canonical_u64() << 16) | (__v_52.as_canonical_u64() << 24))) + u128::from(((__v_96.as_canonical_u64() << 0) | (__v_97.as_canonical_u64() << 8) | (__v_98.as_canonical_u64() << 16) | (__v_95.as_canonical_u64() << 24))); - let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_99: G = G::from_u8(__u32_bytes[0]); - let __v_100: G = G::from_u8(__u32_bytes[1]); - let __v_101: G = G::from_u8(__u32_bytes[2]); - let __v_102: G = G::from_u8(__u32_bytes[3]); - let __v_103: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_99; let __vj = __v_100; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_101; let __vj = __v_102; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_104: G = G::from_u64(((__v_49.as_canonical_u64() << 0) | (__v_50.as_canonical_u64() << 8) | (__v_51.as_canonical_u64() << 16) | (__v_52.as_canonical_u64() << 24))); - let __v_105: G = G::from_u64(((__v_96.as_canonical_u64() << 0) | (__v_97.as_canonical_u64() << 8) | (__v_98.as_canonical_u64() << 16) | (__v_95.as_canonical_u64() << 24))); - let __v_106: G = G::from_u64(((__v_99.as_canonical_u64() << 0) | (__v_100.as_canonical_u64() << 8) | (__v_101.as_canonical_u64() << 16) | (__v_102.as_canonical_u64() << 24))); - let __v_107: G = (__v_103 * __v_103); - if (__v_107 != __v_103) { - return Err(ExecError::AssertEqMismatch { lhs: __v_107.as_canonical_u64(), rhs: __v_103.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); - } - let __v_108: G = (__v_104 + __v_105); - let __v_109: G = G::from_u64(4294967296); - let __v_110: G = (__v_109 * __v_103); - let __v_111: G = (__v_106 + __v_110); - if (__v_108 != __v_111) { - return Err(ExecError::AssertEqMismatch { lhs: __v_108.as_canonical_u64(), rhs: __v_111.as_canonical_u64(), msg: Some("u32_add: witnessed sum does not match its inputs".to_string()) }); - } - let __v_112: G = if unconstrained { Bytes2::xor(&__v_66, &__v_99) } else { bytes2_xor_value(__v_66, __v_99, record) }; - let __v_113: G = if unconstrained { Bytes2::xor(&__v_72, &__v_100) } else { bytes2_xor_value(__v_72, __v_100, record) }; - let __v_114: G = if unconstrained { Bytes2::xor(&__v_69, &__v_101) } else { bytes2_xor_value(__v_69, __v_101, record) }; - let __v_115: G = if unconstrained { Bytes2::xor(&__v_73, &__v_102) } else { bytes2_xor_value(__v_73, __v_102, record) }; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr7(&__v_112, &__v_113) } else { bytes2_chain_rotr7_value(__v_112, __v_113, record) }; - let __v_116: G = __b2_out.0; - let __v_117: G = __b2_out.1; - let __v_118: G = __b2_out.2; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr7(&__v_114, &__v_115) } else { bytes2_chain_rotr7_value(__v_114, __v_115, record) }; - let __v_119: G = __b2_out.0; - let __v_120: G = __b2_out.1; - let __v_121: G = __b2_out.2; - let __v_122: G = (__v_117 + __v_121); - let __v_123: G = (__v_120 + __v_118); - let __ret: [G; OUT_68] = [__v_74, __v_75, __v_76, __v_77, __v_116, __v_122, __v_119, __v_123, __v_99, __v_100, __v_101, __v_102, __v_96, __v_97, __v_98, __v_95]; + let __v_79: G = (__v_78 * __v_78); + if (__v_79 != __v_78) { + return Err(ExecError::AssertEqMismatch { lhs: __v_79.as_canonical_u64(), rhs: __v_78.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); + } + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_54, &__v_74) } else { bytes2_xor_split7_value(__v_54, __v_74, record) }; + let __v_80: G = __b2_out.0; + let __v_81: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_55, &__v_75) } else { bytes2_xor_split7_value(__v_55, __v_75, record) }; + let __v_82: G = __b2_out.0; + let __v_83: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_56, &__v_76) } else { bytes2_xor_split7_value(__v_56, __v_76, record) }; + let __v_84: G = __b2_out.0; + let __v_85: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_57, &__v_77) } else { bytes2_xor_split7_value(__v_57, __v_77, record) }; + let __v_86: G = __b2_out.0; + let __v_87: G = __b2_out.1; + let __v_88: G = (__v_80 + __v_83); + let __v_89: G = (__v_82 + __v_85); + let __v_90: G = (__v_84 + __v_87); + let __v_91: G = (__v_86 + __v_81); + let __ret: [G; OUT_68] = [__v_58, __v_59, __v_60, __v_61, __v_88, __v_89, __v_90, __v_91, __v_74, __v_75, __v_76, __v_77, __v_71, __v_72, __v_73, __v_70]; record.function_queries[68].insert(&inp[..], &__ret[..], G::from_bool(!unconstrained)); return Ok(__ret); }) @@ -5045,70 +5003,73 @@ fn aiur_fn_69( let __v_132: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); if !unconstrained { let __vi = __v_128; let __vj = __v_129; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; if !unconstrained { let __vi = __v_130; let __vj = __v_131; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_133: G = G::from_u64(((__v_0.as_canonical_u64() << 0) | (__v_1.as_canonical_u64() << 8) | (__v_2.as_canonical_u64() << 16) | (__v_3.as_canonical_u64() << 24))); - let __v_134: G = G::from_u64(((__v_16.as_canonical_u64() << 0) | (__v_17.as_canonical_u64() << 8) | (__v_18.as_canonical_u64() << 16) | (__v_19.as_canonical_u64() << 24))); - let __v_135: G = G::from_u64(((__v_64.as_canonical_u64() << 0) | (__v_65.as_canonical_u64() << 8) | (__v_66.as_canonical_u64() << 16) | (__v_67.as_canonical_u64() << 24))); - let __v_136: G = G::from_u64(((__v_128.as_canonical_u64() << 0) | (__v_129.as_canonical_u64() << 8) | (__v_130.as_canonical_u64() << 16) | (__v_131.as_canonical_u64() << 24))); - let __v_137: G = G::from_u64(1); - let __v_138: G = (__v_132 - __v_137); - let __v_139: G = G::from_u64(2); - let __v_140: G = (__v_132 - __v_139); - let __v_141: G = (__v_138 * __v_140); - let __v_142: G = (__v_132 * __v_141); - let __v_143: G = G::from_u64(0); - if (__v_142 != __v_143) { - return Err(ExecError::AssertEqMismatch { lhs: __v_142.as_canonical_u64(), rhs: __v_143.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); - } - let __v_144: G = (__v_134 + __v_135); - let __v_145: G = (__v_133 + __v_144); - let __v_146: G = G::from_u64(4294967296); - let __v_147: G = (__v_146 * __v_132); - let __v_148: G = (__v_136 + __v_147); - if (__v_145 != __v_148) { - return Err(ExecError::AssertEqMismatch { lhs: __v_145.as_canonical_u64(), rhs: __v_148.as_canonical_u64(), msg: Some("u32_add3: witnessed sum does not match its inputs".to_string()) }); - } - let __v_149: G = if unconstrained { Bytes2::xor(&__v_48, &__v_128) } else { bytes2_xor_value(__v_48, __v_128, record) }; - let __v_150: G = if unconstrained { Bytes2::xor(&__v_49, &__v_129) } else { bytes2_xor_value(__v_49, __v_129, record) }; - let __v_151: G = if unconstrained { Bytes2::xor(&__v_50, &__v_130) } else { bytes2_xor_value(__v_50, __v_130, record) }; - let __v_152: G = if unconstrained { Bytes2::xor(&__v_51, &__v_131) } else { bytes2_xor_value(__v_51, __v_131, record) }; - let __u32_sum: u128 = u128::from(((__v_32.as_canonical_u64() << 0) | (__v_33.as_canonical_u64() << 8) | (__v_34.as_canonical_u64() << 16) | (__v_35.as_canonical_u64() << 24))) + u128::from(((__v_151.as_canonical_u64() << 0) | (__v_152.as_canonical_u64() << 8) | (__v_149.as_canonical_u64() << 16) | (__v_150.as_canonical_u64() << 24))); + let __v_133: G = G::from_u64(1); + let __v_134: G = (__v_132 - __v_133); + let __v_135: G = G::from_u64(2); + let __v_136: G = (__v_132 - __v_135); + let __v_137: G = (__v_134 * __v_136); + let __v_138: G = (__v_132 * __v_137); + let __v_139: G = G::from_u64(0); + if (__v_138 != __v_139) { + return Err(ExecError::AssertEqMismatch { lhs: __v_138.as_canonical_u64(), rhs: __v_139.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); + } + let __v_140: G = if unconstrained { Bytes2::xor(&__v_48, &__v_128) } else { bytes2_xor_value(__v_48, __v_128, record) }; + let __v_141: G = if unconstrained { Bytes2::xor(&__v_49, &__v_129) } else { bytes2_xor_value(__v_49, __v_129, record) }; + let __v_142: G = if unconstrained { Bytes2::xor(&__v_50, &__v_130) } else { bytes2_xor_value(__v_50, __v_130, record) }; + let __v_143: G = if unconstrained { Bytes2::xor(&__v_51, &__v_131) } else { bytes2_xor_value(__v_51, __v_131, record) }; + let __u32_sum: u128 = u128::from(((__v_32.as_canonical_u64() << 0) | (__v_33.as_canonical_u64() << 8) | (__v_34.as_canonical_u64() << 16) | (__v_35.as_canonical_u64() << 24))) + u128::from(((__v_142.as_canonical_u64() << 0) | (__v_143.as_canonical_u64() << 8) | (__v_140.as_canonical_u64() << 16) | (__v_141.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_153: G = G::from_u8(__u32_bytes[0]); - let __v_154: G = G::from_u8(__u32_bytes[1]); - let __v_155: G = G::from_u8(__u32_bytes[2]); - let __v_156: G = G::from_u8(__u32_bytes[3]); - let __v_157: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_153; let __vj = __v_154; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_155; let __vj = __v_156; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_158: G = G::from_u64(((__v_32.as_canonical_u64() << 0) | (__v_33.as_canonical_u64() << 8) | (__v_34.as_canonical_u64() << 16) | (__v_35.as_canonical_u64() << 24))); - let __v_159: G = G::from_u64(((__v_151.as_canonical_u64() << 0) | (__v_152.as_canonical_u64() << 8) | (__v_149.as_canonical_u64() << 16) | (__v_150.as_canonical_u64() << 24))); - let __v_160: G = G::from_u64(((__v_153.as_canonical_u64() << 0) | (__v_154.as_canonical_u64() << 8) | (__v_155.as_canonical_u64() << 16) | (__v_156.as_canonical_u64() << 24))); - let __v_161: G = (__v_157 * __v_157); - if (__v_161 != __v_157) { - return Err(ExecError::AssertEqMismatch { lhs: __v_161.as_canonical_u64(), rhs: __v_157.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); - } - let __v_162: G = (__v_158 + __v_159); - let __v_163: G = G::from_u64(4294967296); - let __v_164: G = (__v_163 * __v_157); - let __v_165: G = (__v_160 + __v_164); - if (__v_162 != __v_165) { - return Err(ExecError::AssertEqMismatch { lhs: __v_162.as_canonical_u64(), rhs: __v_165.as_canonical_u64(), msg: Some("u32_add: witnessed sum does not match its inputs".to_string()) }); - } - let __v_166: G = if unconstrained { Bytes2::xor(&__v_16, &__v_153) } else { bytes2_xor_value(__v_16, __v_153, record) }; - let __v_167: G = if unconstrained { Bytes2::xor(&__v_17, &__v_154) } else { bytes2_xor_value(__v_17, __v_154, record) }; - let __v_168: G = if unconstrained { Bytes2::xor(&__v_18, &__v_155) } else { bytes2_xor_value(__v_18, __v_155, record) }; - let __v_169: G = if unconstrained { Bytes2::xor(&__v_19, &__v_156) } else { bytes2_xor_value(__v_19, __v_156, record) }; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr4(&__v_167, &__v_168) } else { bytes2_chain_rotr4_value(__v_167, __v_168, record) }; - let __v_170: G = __b2_out.0; - let __v_171: G = __b2_out.1; - let __v_172: G = __b2_out.2; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr4(&__v_169, &__v_166) } else { bytes2_chain_rotr4_value(__v_169, __v_166, record) }; - let __v_173: G = __b2_out.0; - let __v_174: G = __b2_out.1; - let __v_175: G = __b2_out.2; - let __v_176: G = (__v_171 + __v_175); - let __v_177: G = (__v_174 + __v_172); - let __u32_sum: u128 = u128::from(((__v_128.as_canonical_u64() << 0) | (__v_129.as_canonical_u64() << 8) | (__v_130.as_canonical_u64() << 16) | (__v_131.as_canonical_u64() << 24))) + u128::from(((__v_170.as_canonical_u64() << 0) | (__v_176.as_canonical_u64() << 8) | (__v_173.as_canonical_u64() << 16) | (__v_177.as_canonical_u64() << 24))) + u128::from(((__v_68.as_canonical_u64() << 0) | (__v_69.as_canonical_u64() << 8) | (__v_70.as_canonical_u64() << 16) | (__v_71.as_canonical_u64() << 24))); + let __v_144: G = G::from_u8(__u32_bytes[0]); + let __v_145: G = G::from_u8(__u32_bytes[1]); + let __v_146: G = G::from_u8(__u32_bytes[2]); + let __v_147: G = G::from_u8(__u32_bytes[3]); + let __v_148: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_144; let __vj = __v_145; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_146; let __vj = __v_147; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_149: G = (__v_148 * __v_148); + if (__v_149 != __v_148) { + return Err(ExecError::AssertEqMismatch { lhs: __v_149.as_canonical_u64(), rhs: __v_148.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); + } + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_16, &__v_144) } else { bytes2_xor_split4_value(__v_16, __v_144, record) }; + let __v_150: G = __b2_out.0; + let __v_151: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_17, &__v_145) } else { bytes2_xor_split4_value(__v_17, __v_145, record) }; + let __v_152: G = __b2_out.0; + let __v_153: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_18, &__v_146) } else { bytes2_xor_split4_value(__v_18, __v_146, record) }; + let __v_154: G = __b2_out.0; + let __v_155: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_19, &__v_147) } else { bytes2_xor_split4_value(__v_19, __v_147, record) }; + let __v_156: G = __b2_out.0; + let __v_157: G = __b2_out.1; + let __v_158: G = (__v_152 + __v_155); + let __v_159: G = (__v_154 + __v_157); + let __v_160: G = (__v_156 + __v_151); + let __v_161: G = (__v_150 + __v_153); + let __u32_sum: u128 = u128::from(((__v_128.as_canonical_u64() << 0) | (__v_129.as_canonical_u64() << 8) | (__v_130.as_canonical_u64() << 16) | (__v_131.as_canonical_u64() << 24))) + u128::from(((__v_158.as_canonical_u64() << 0) | (__v_159.as_canonical_u64() << 8) | (__v_160.as_canonical_u64() << 16) | (__v_161.as_canonical_u64() << 24))) + u128::from(((__v_68.as_canonical_u64() << 0) | (__v_69.as_canonical_u64() << 8) | (__v_70.as_canonical_u64() << 16) | (__v_71.as_canonical_u64() << 24))); + let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); + let __v_162: G = G::from_u8(__u32_bytes[0]); + let __v_163: G = G::from_u8(__u32_bytes[1]); + let __v_164: G = G::from_u8(__u32_bytes[2]); + let __v_165: G = G::from_u8(__u32_bytes[3]); + let __v_166: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_162; let __vj = __v_163; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_164; let __vj = __v_165; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_167: G = G::from_u64(1); + let __v_168: G = (__v_166 - __v_167); + let __v_169: G = G::from_u64(2); + let __v_170: G = (__v_166 - __v_169); + let __v_171: G = (__v_168 * __v_170); + let __v_172: G = (__v_166 * __v_171); + let __v_173: G = G::from_u64(0); + if (__v_172 != __v_173) { + return Err(ExecError::AssertEqMismatch { lhs: __v_172.as_canonical_u64(), rhs: __v_173.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); + } + let __v_174: G = if unconstrained { Bytes2::xor(&__v_142, &__v_162) } else { bytes2_xor_value(__v_142, __v_162, record) }; + let __v_175: G = if unconstrained { Bytes2::xor(&__v_143, &__v_163) } else { bytes2_xor_value(__v_143, __v_163, record) }; + let __v_176: G = if unconstrained { Bytes2::xor(&__v_140, &__v_164) } else { bytes2_xor_value(__v_140, __v_164, record) }; + let __v_177: G = if unconstrained { Bytes2::xor(&__v_141, &__v_165) } else { bytes2_xor_value(__v_141, __v_165, record) }; + let __u32_sum: u128 = u128::from(((__v_144.as_canonical_u64() << 0) | (__v_145.as_canonical_u64() << 8) | (__v_146.as_canonical_u64() << 16) | (__v_147.as_canonical_u64() << 24))) + u128::from(((__v_175.as_canonical_u64() << 0) | (__v_176.as_canonical_u64() << 8) | (__v_177.as_canonical_u64() << 16) | (__v_174.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); let __v_178: G = G::from_u8(__u32_bytes[0]); let __v_179: G = G::from_u8(__u32_bytes[1]); @@ -5117,1078 +5078,755 @@ fn aiur_fn_69( let __v_182: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); if !unconstrained { let __vi = __v_178; let __vj = __v_179; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; if !unconstrained { let __vi = __v_180; let __vj = __v_181; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_183: G = G::from_u64(((__v_128.as_canonical_u64() << 0) | (__v_129.as_canonical_u64() << 8) | (__v_130.as_canonical_u64() << 16) | (__v_131.as_canonical_u64() << 24))); - let __v_184: G = G::from_u64(((__v_170.as_canonical_u64() << 0) | (__v_176.as_canonical_u64() << 8) | (__v_173.as_canonical_u64() << 16) | (__v_177.as_canonical_u64() << 24))); - let __v_185: G = G::from_u64(((__v_68.as_canonical_u64() << 0) | (__v_69.as_canonical_u64() << 8) | (__v_70.as_canonical_u64() << 16) | (__v_71.as_canonical_u64() << 24))); - let __v_186: G = G::from_u64(((__v_178.as_canonical_u64() << 0) | (__v_179.as_canonical_u64() << 8) | (__v_180.as_canonical_u64() << 16) | (__v_181.as_canonical_u64() << 24))); - let __v_187: G = G::from_u64(1); - let __v_188: G = (__v_182 - __v_187); - let __v_189: G = G::from_u64(2); - let __v_190: G = (__v_182 - __v_189); - let __v_191: G = (__v_188 * __v_190); - let __v_192: G = (__v_182 * __v_191); - let __v_193: G = G::from_u64(0); - if (__v_192 != __v_193) { - return Err(ExecError::AssertEqMismatch { lhs: __v_192.as_canonical_u64(), rhs: __v_193.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); - } - let __v_194: G = (__v_184 + __v_185); - let __v_195: G = (__v_183 + __v_194); - let __v_196: G = G::from_u64(4294967296); - let __v_197: G = (__v_196 * __v_182); - let __v_198: G = (__v_186 + __v_197); - if (__v_195 != __v_198) { - return Err(ExecError::AssertEqMismatch { lhs: __v_195.as_canonical_u64(), rhs: __v_198.as_canonical_u64(), msg: Some("u32_add3: witnessed sum does not match its inputs".to_string()) }); - } - let __v_199: G = if unconstrained { Bytes2::xor(&__v_151, &__v_178) } else { bytes2_xor_value(__v_151, __v_178, record) }; - let __v_200: G = if unconstrained { Bytes2::xor(&__v_152, &__v_179) } else { bytes2_xor_value(__v_152, __v_179, record) }; - let __v_201: G = if unconstrained { Bytes2::xor(&__v_149, &__v_180) } else { bytes2_xor_value(__v_149, __v_180, record) }; - let __v_202: G = if unconstrained { Bytes2::xor(&__v_150, &__v_181) } else { bytes2_xor_value(__v_150, __v_181, record) }; - let __u32_sum: u128 = u128::from(((__v_153.as_canonical_u64() << 0) | (__v_154.as_canonical_u64() << 8) | (__v_155.as_canonical_u64() << 16) | (__v_156.as_canonical_u64() << 24))) + u128::from(((__v_200.as_canonical_u64() << 0) | (__v_201.as_canonical_u64() << 8) | (__v_202.as_canonical_u64() << 16) | (__v_199.as_canonical_u64() << 24))); + let __v_183: G = (__v_182 * __v_182); + if (__v_183 != __v_182) { + return Err(ExecError::AssertEqMismatch { lhs: __v_183.as_canonical_u64(), rhs: __v_182.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); + } + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_158, &__v_178) } else { bytes2_xor_split7_value(__v_158, __v_178, record) }; + let __v_184: G = __b2_out.0; + let __v_185: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_159, &__v_179) } else { bytes2_xor_split7_value(__v_159, __v_179, record) }; + let __v_186: G = __b2_out.0; + let __v_187: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_160, &__v_180) } else { bytes2_xor_split7_value(__v_160, __v_180, record) }; + let __v_188: G = __b2_out.0; + let __v_189: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_161, &__v_181) } else { bytes2_xor_split7_value(__v_161, __v_181, record) }; + let __v_190: G = __b2_out.0; + let __v_191: G = __b2_out.1; + let __v_192: G = (__v_184 + __v_187); + let __v_193: G = (__v_186 + __v_189); + let __v_194: G = (__v_188 + __v_191); + let __v_195: G = (__v_190 + __v_185); + let __u32_sum: u128 = u128::from(((__v_4.as_canonical_u64() << 0) | (__v_5.as_canonical_u64() << 8) | (__v_6.as_canonical_u64() << 16) | (__v_7.as_canonical_u64() << 24))) + u128::from(((__v_20.as_canonical_u64() << 0) | (__v_21.as_canonical_u64() << 8) | (__v_22.as_canonical_u64() << 16) | (__v_23.as_canonical_u64() << 24))) + u128::from(((__v_72.as_canonical_u64() << 0) | (__v_73.as_canonical_u64() << 8) | (__v_74.as_canonical_u64() << 16) | (__v_75.as_canonical_u64() << 24))); + let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); + let __v_196: G = G::from_u8(__u32_bytes[0]); + let __v_197: G = G::from_u8(__u32_bytes[1]); + let __v_198: G = G::from_u8(__u32_bytes[2]); + let __v_199: G = G::from_u8(__u32_bytes[3]); + let __v_200: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_196; let __vj = __v_197; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_198; let __vj = __v_199; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_201: G = G::from_u64(1); + let __v_202: G = (__v_200 - __v_201); + let __v_203: G = G::from_u64(2); + let __v_204: G = (__v_200 - __v_203); + let __v_205: G = (__v_202 * __v_204); + let __v_206: G = (__v_200 * __v_205); + let __v_207: G = G::from_u64(0); + if (__v_206 != __v_207) { + return Err(ExecError::AssertEqMismatch { lhs: __v_206.as_canonical_u64(), rhs: __v_207.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); + } + let __v_208: G = if unconstrained { Bytes2::xor(&__v_52, &__v_196) } else { bytes2_xor_value(__v_52, __v_196, record) }; + let __v_209: G = if unconstrained { Bytes2::xor(&__v_53, &__v_197) } else { bytes2_xor_value(__v_53, __v_197, record) }; + let __v_210: G = if unconstrained { Bytes2::xor(&__v_54, &__v_198) } else { bytes2_xor_value(__v_54, __v_198, record) }; + let __v_211: G = if unconstrained { Bytes2::xor(&__v_55, &__v_199) } else { bytes2_xor_value(__v_55, __v_199, record) }; + let __u32_sum: u128 = u128::from(((__v_36.as_canonical_u64() << 0) | (__v_37.as_canonical_u64() << 8) | (__v_38.as_canonical_u64() << 16) | (__v_39.as_canonical_u64() << 24))) + u128::from(((__v_210.as_canonical_u64() << 0) | (__v_211.as_canonical_u64() << 8) | (__v_208.as_canonical_u64() << 16) | (__v_209.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_203: G = G::from_u8(__u32_bytes[0]); - let __v_204: G = G::from_u8(__u32_bytes[1]); - let __v_205: G = G::from_u8(__u32_bytes[2]); - let __v_206: G = G::from_u8(__u32_bytes[3]); - let __v_207: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_203; let __vj = __v_204; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_205; let __vj = __v_206; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_208: G = G::from_u64(((__v_153.as_canonical_u64() << 0) | (__v_154.as_canonical_u64() << 8) | (__v_155.as_canonical_u64() << 16) | (__v_156.as_canonical_u64() << 24))); - let __v_209: G = G::from_u64(((__v_200.as_canonical_u64() << 0) | (__v_201.as_canonical_u64() << 8) | (__v_202.as_canonical_u64() << 16) | (__v_199.as_canonical_u64() << 24))); - let __v_210: G = G::from_u64(((__v_203.as_canonical_u64() << 0) | (__v_204.as_canonical_u64() << 8) | (__v_205.as_canonical_u64() << 16) | (__v_206.as_canonical_u64() << 24))); - let __v_211: G = (__v_207 * __v_207); - if (__v_211 != __v_207) { - return Err(ExecError::AssertEqMismatch { lhs: __v_211.as_canonical_u64(), rhs: __v_207.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); - } - let __v_212: G = (__v_208 + __v_209); - let __v_213: G = G::from_u64(4294967296); - let __v_214: G = (__v_213 * __v_207); - let __v_215: G = (__v_210 + __v_214); - if (__v_212 != __v_215) { - return Err(ExecError::AssertEqMismatch { lhs: __v_212.as_canonical_u64(), rhs: __v_215.as_canonical_u64(), msg: Some("u32_add: witnessed sum does not match its inputs".to_string()) }); - } - let __v_216: G = if unconstrained { Bytes2::xor(&__v_170, &__v_203) } else { bytes2_xor_value(__v_170, __v_203, record) }; - let __v_217: G = if unconstrained { Bytes2::xor(&__v_176, &__v_204) } else { bytes2_xor_value(__v_176, __v_204, record) }; - let __v_218: G = if unconstrained { Bytes2::xor(&__v_173, &__v_205) } else { bytes2_xor_value(__v_173, __v_205, record) }; - let __v_219: G = if unconstrained { Bytes2::xor(&__v_177, &__v_206) } else { bytes2_xor_value(__v_177, __v_206, record) }; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr7(&__v_216, &__v_217) } else { bytes2_chain_rotr7_value(__v_216, __v_217, record) }; + let __v_212: G = G::from_u8(__u32_bytes[0]); + let __v_213: G = G::from_u8(__u32_bytes[1]); + let __v_214: G = G::from_u8(__u32_bytes[2]); + let __v_215: G = G::from_u8(__u32_bytes[3]); + let __v_216: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_212; let __vj = __v_213; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_214; let __vj = __v_215; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_217: G = (__v_216 * __v_216); + if (__v_217 != __v_216) { + return Err(ExecError::AssertEqMismatch { lhs: __v_217.as_canonical_u64(), rhs: __v_216.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); + } + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_20, &__v_212) } else { bytes2_xor_split4_value(__v_20, __v_212, record) }; + let __v_218: G = __b2_out.0; + let __v_219: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_21, &__v_213) } else { bytes2_xor_split4_value(__v_21, __v_213, record) }; let __v_220: G = __b2_out.0; let __v_221: G = __b2_out.1; - let __v_222: G = __b2_out.2; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr7(&__v_218, &__v_219) } else { bytes2_chain_rotr7_value(__v_218, __v_219, record) }; - let __v_223: G = __b2_out.0; - let __v_224: G = __b2_out.1; - let __v_225: G = __b2_out.2; - let __v_226: G = (__v_221 + __v_225); - let __v_227: G = (__v_224 + __v_222); - let __u32_sum: u128 = u128::from(((__v_4.as_canonical_u64() << 0) | (__v_5.as_canonical_u64() << 8) | (__v_6.as_canonical_u64() << 16) | (__v_7.as_canonical_u64() << 24))) + u128::from(((__v_20.as_canonical_u64() << 0) | (__v_21.as_canonical_u64() << 8) | (__v_22.as_canonical_u64() << 16) | (__v_23.as_canonical_u64() << 24))) + u128::from(((__v_72.as_canonical_u64() << 0) | (__v_73.as_canonical_u64() << 8) | (__v_74.as_canonical_u64() << 16) | (__v_75.as_canonical_u64() << 24))); + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_22, &__v_214) } else { bytes2_xor_split4_value(__v_22, __v_214, record) }; + let __v_222: G = __b2_out.0; + let __v_223: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_23, &__v_215) } else { bytes2_xor_split4_value(__v_23, __v_215, record) }; + let __v_224: G = __b2_out.0; + let __v_225: G = __b2_out.1; + let __v_226: G = (__v_220 + __v_223); + let __v_227: G = (__v_222 + __v_225); + let __v_228: G = (__v_224 + __v_219); + let __v_229: G = (__v_218 + __v_221); + let __u32_sum: u128 = u128::from(((__v_196.as_canonical_u64() << 0) | (__v_197.as_canonical_u64() << 8) | (__v_198.as_canonical_u64() << 16) | (__v_199.as_canonical_u64() << 24))) + u128::from(((__v_226.as_canonical_u64() << 0) | (__v_227.as_canonical_u64() << 8) | (__v_228.as_canonical_u64() << 16) | (__v_229.as_canonical_u64() << 24))) + u128::from(((__v_76.as_canonical_u64() << 0) | (__v_77.as_canonical_u64() << 8) | (__v_78.as_canonical_u64() << 16) | (__v_79.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_228: G = G::from_u8(__u32_bytes[0]); - let __v_229: G = G::from_u8(__u32_bytes[1]); - let __v_230: G = G::from_u8(__u32_bytes[2]); - let __v_231: G = G::from_u8(__u32_bytes[3]); - let __v_232: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_228; let __vj = __v_229; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_230: G = G::from_u8(__u32_bytes[0]); + let __v_231: G = G::from_u8(__u32_bytes[1]); + let __v_232: G = G::from_u8(__u32_bytes[2]); + let __v_233: G = G::from_u8(__u32_bytes[3]); + let __v_234: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); if !unconstrained { let __vi = __v_230; let __vj = __v_231; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_233: G = G::from_u64(((__v_4.as_canonical_u64() << 0) | (__v_5.as_canonical_u64() << 8) | (__v_6.as_canonical_u64() << 16) | (__v_7.as_canonical_u64() << 24))); - let __v_234: G = G::from_u64(((__v_20.as_canonical_u64() << 0) | (__v_21.as_canonical_u64() << 8) | (__v_22.as_canonical_u64() << 16) | (__v_23.as_canonical_u64() << 24))); - let __v_235: G = G::from_u64(((__v_72.as_canonical_u64() << 0) | (__v_73.as_canonical_u64() << 8) | (__v_74.as_canonical_u64() << 16) | (__v_75.as_canonical_u64() << 24))); - let __v_236: G = G::from_u64(((__v_228.as_canonical_u64() << 0) | (__v_229.as_canonical_u64() << 8) | (__v_230.as_canonical_u64() << 16) | (__v_231.as_canonical_u64() << 24))); - let __v_237: G = G::from_u64(1); - let __v_238: G = (__v_232 - __v_237); - let __v_239: G = G::from_u64(2); - let __v_240: G = (__v_232 - __v_239); - let __v_241: G = (__v_238 * __v_240); - let __v_242: G = (__v_232 * __v_241); - let __v_243: G = G::from_u64(0); - if (__v_242 != __v_243) { - return Err(ExecError::AssertEqMismatch { lhs: __v_242.as_canonical_u64(), rhs: __v_243.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); - } - let __v_244: G = (__v_234 + __v_235); - let __v_245: G = (__v_233 + __v_244); - let __v_246: G = G::from_u64(4294967296); - let __v_247: G = (__v_246 * __v_232); - let __v_248: G = (__v_236 + __v_247); - if (__v_245 != __v_248) { - return Err(ExecError::AssertEqMismatch { lhs: __v_245.as_canonical_u64(), rhs: __v_248.as_canonical_u64(), msg: Some("u32_add3: witnessed sum does not match its inputs".to_string()) }); - } - let __v_249: G = if unconstrained { Bytes2::xor(&__v_52, &__v_228) } else { bytes2_xor_value(__v_52, __v_228, record) }; - let __v_250: G = if unconstrained { Bytes2::xor(&__v_53, &__v_229) } else { bytes2_xor_value(__v_53, __v_229, record) }; - let __v_251: G = if unconstrained { Bytes2::xor(&__v_54, &__v_230) } else { bytes2_xor_value(__v_54, __v_230, record) }; - let __v_252: G = if unconstrained { Bytes2::xor(&__v_55, &__v_231) } else { bytes2_xor_value(__v_55, __v_231, record) }; - let __u32_sum: u128 = u128::from(((__v_36.as_canonical_u64() << 0) | (__v_37.as_canonical_u64() << 8) | (__v_38.as_canonical_u64() << 16) | (__v_39.as_canonical_u64() << 24))) + u128::from(((__v_251.as_canonical_u64() << 0) | (__v_252.as_canonical_u64() << 8) | (__v_249.as_canonical_u64() << 16) | (__v_250.as_canonical_u64() << 24))); + if !unconstrained { let __vi = __v_232; let __vj = __v_233; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_235: G = G::from_u64(1); + let __v_236: G = (__v_234 - __v_235); + let __v_237: G = G::from_u64(2); + let __v_238: G = (__v_234 - __v_237); + let __v_239: G = (__v_236 * __v_238); + let __v_240: G = (__v_234 * __v_239); + let __v_241: G = G::from_u64(0); + if (__v_240 != __v_241) { + return Err(ExecError::AssertEqMismatch { lhs: __v_240.as_canonical_u64(), rhs: __v_241.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); + } + let __v_242: G = if unconstrained { Bytes2::xor(&__v_210, &__v_230) } else { bytes2_xor_value(__v_210, __v_230, record) }; + let __v_243: G = if unconstrained { Bytes2::xor(&__v_211, &__v_231) } else { bytes2_xor_value(__v_211, __v_231, record) }; + let __v_244: G = if unconstrained { Bytes2::xor(&__v_208, &__v_232) } else { bytes2_xor_value(__v_208, __v_232, record) }; + let __v_245: G = if unconstrained { Bytes2::xor(&__v_209, &__v_233) } else { bytes2_xor_value(__v_209, __v_233, record) }; + let __u32_sum: u128 = u128::from(((__v_212.as_canonical_u64() << 0) | (__v_213.as_canonical_u64() << 8) | (__v_214.as_canonical_u64() << 16) | (__v_215.as_canonical_u64() << 24))) + u128::from(((__v_243.as_canonical_u64() << 0) | (__v_244.as_canonical_u64() << 8) | (__v_245.as_canonical_u64() << 16) | (__v_242.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_253: G = G::from_u8(__u32_bytes[0]); - let __v_254: G = G::from_u8(__u32_bytes[1]); - let __v_255: G = G::from_u8(__u32_bytes[2]); - let __v_256: G = G::from_u8(__u32_bytes[3]); - let __v_257: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_253; let __vj = __v_254; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_255; let __vj = __v_256; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_258: G = G::from_u64(((__v_36.as_canonical_u64() << 0) | (__v_37.as_canonical_u64() << 8) | (__v_38.as_canonical_u64() << 16) | (__v_39.as_canonical_u64() << 24))); - let __v_259: G = G::from_u64(((__v_251.as_canonical_u64() << 0) | (__v_252.as_canonical_u64() << 8) | (__v_249.as_canonical_u64() << 16) | (__v_250.as_canonical_u64() << 24))); - let __v_260: G = G::from_u64(((__v_253.as_canonical_u64() << 0) | (__v_254.as_canonical_u64() << 8) | (__v_255.as_canonical_u64() << 16) | (__v_256.as_canonical_u64() << 24))); - let __v_261: G = (__v_257 * __v_257); - if (__v_261 != __v_257) { - return Err(ExecError::AssertEqMismatch { lhs: __v_261.as_canonical_u64(), rhs: __v_257.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); - } - let __v_262: G = (__v_258 + __v_259); - let __v_263: G = G::from_u64(4294967296); - let __v_264: G = (__v_263 * __v_257); - let __v_265: G = (__v_260 + __v_264); - if (__v_262 != __v_265) { - return Err(ExecError::AssertEqMismatch { lhs: __v_262.as_canonical_u64(), rhs: __v_265.as_canonical_u64(), msg: Some("u32_add: witnessed sum does not match its inputs".to_string()) }); - } - let __v_266: G = if unconstrained { Bytes2::xor(&__v_20, &__v_253) } else { bytes2_xor_value(__v_20, __v_253, record) }; - let __v_267: G = if unconstrained { Bytes2::xor(&__v_21, &__v_254) } else { bytes2_xor_value(__v_21, __v_254, record) }; - let __v_268: G = if unconstrained { Bytes2::xor(&__v_22, &__v_255) } else { bytes2_xor_value(__v_22, __v_255, record) }; - let __v_269: G = if unconstrained { Bytes2::xor(&__v_23, &__v_256) } else { bytes2_xor_value(__v_23, __v_256, record) }; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr4(&__v_267, &__v_268) } else { bytes2_chain_rotr4_value(__v_267, __v_268, record) }; - let __v_270: G = __b2_out.0; - let __v_271: G = __b2_out.1; - let __v_272: G = __b2_out.2; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr4(&__v_269, &__v_266) } else { bytes2_chain_rotr4_value(__v_269, __v_266, record) }; - let __v_273: G = __b2_out.0; - let __v_274: G = __b2_out.1; - let __v_275: G = __b2_out.2; - let __v_276: G = (__v_271 + __v_275); - let __v_277: G = (__v_274 + __v_272); - let __u32_sum: u128 = u128::from(((__v_228.as_canonical_u64() << 0) | (__v_229.as_canonical_u64() << 8) | (__v_230.as_canonical_u64() << 16) | (__v_231.as_canonical_u64() << 24))) + u128::from(((__v_270.as_canonical_u64() << 0) | (__v_276.as_canonical_u64() << 8) | (__v_273.as_canonical_u64() << 16) | (__v_277.as_canonical_u64() << 24))) + u128::from(((__v_76.as_canonical_u64() << 0) | (__v_77.as_canonical_u64() << 8) | (__v_78.as_canonical_u64() << 16) | (__v_79.as_canonical_u64() << 24))); + let __v_246: G = G::from_u8(__u32_bytes[0]); + let __v_247: G = G::from_u8(__u32_bytes[1]); + let __v_248: G = G::from_u8(__u32_bytes[2]); + let __v_249: G = G::from_u8(__u32_bytes[3]); + let __v_250: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_246; let __vj = __v_247; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_248; let __vj = __v_249; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_251: G = (__v_250 * __v_250); + if (__v_251 != __v_250) { + return Err(ExecError::AssertEqMismatch { lhs: __v_251.as_canonical_u64(), rhs: __v_250.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); + } + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_226, &__v_246) } else { bytes2_xor_split7_value(__v_226, __v_246, record) }; + let __v_252: G = __b2_out.0; + let __v_253: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_227, &__v_247) } else { bytes2_xor_split7_value(__v_227, __v_247, record) }; + let __v_254: G = __b2_out.0; + let __v_255: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_228, &__v_248) } else { bytes2_xor_split7_value(__v_228, __v_248, record) }; + let __v_256: G = __b2_out.0; + let __v_257: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_229, &__v_249) } else { bytes2_xor_split7_value(__v_229, __v_249, record) }; + let __v_258: G = __b2_out.0; + let __v_259: G = __b2_out.1; + let __v_260: G = (__v_252 + __v_255); + let __v_261: G = (__v_254 + __v_257); + let __v_262: G = (__v_256 + __v_259); + let __v_263: G = (__v_258 + __v_253); + let __u32_sum: u128 = u128::from(((__v_8.as_canonical_u64() << 0) | (__v_9.as_canonical_u64() << 8) | (__v_10.as_canonical_u64() << 16) | (__v_11.as_canonical_u64() << 24))) + u128::from(((__v_24.as_canonical_u64() << 0) | (__v_25.as_canonical_u64() << 8) | (__v_26.as_canonical_u64() << 16) | (__v_27.as_canonical_u64() << 24))) + u128::from(((__v_80.as_canonical_u64() << 0) | (__v_81.as_canonical_u64() << 8) | (__v_82.as_canonical_u64() << 16) | (__v_83.as_canonical_u64() << 24))); + let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); + let __v_264: G = G::from_u8(__u32_bytes[0]); + let __v_265: G = G::from_u8(__u32_bytes[1]); + let __v_266: G = G::from_u8(__u32_bytes[2]); + let __v_267: G = G::from_u8(__u32_bytes[3]); + let __v_268: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_264; let __vj = __v_265; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_266; let __vj = __v_267; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_269: G = G::from_u64(1); + let __v_270: G = (__v_268 - __v_269); + let __v_271: G = G::from_u64(2); + let __v_272: G = (__v_268 - __v_271); + let __v_273: G = (__v_270 * __v_272); + let __v_274: G = (__v_268 * __v_273); + let __v_275: G = G::from_u64(0); + if (__v_274 != __v_275) { + return Err(ExecError::AssertEqMismatch { lhs: __v_274.as_canonical_u64(), rhs: __v_275.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); + } + let __v_276: G = if unconstrained { Bytes2::xor(&__v_56, &__v_264) } else { bytes2_xor_value(__v_56, __v_264, record) }; + let __v_277: G = if unconstrained { Bytes2::xor(&__v_57, &__v_265) } else { bytes2_xor_value(__v_57, __v_265, record) }; + let __v_278: G = if unconstrained { Bytes2::xor(&__v_58, &__v_266) } else { bytes2_xor_value(__v_58, __v_266, record) }; + let __v_279: G = if unconstrained { Bytes2::xor(&__v_59, &__v_267) } else { bytes2_xor_value(__v_59, __v_267, record) }; + let __u32_sum: u128 = u128::from(((__v_40.as_canonical_u64() << 0) | (__v_41.as_canonical_u64() << 8) | (__v_42.as_canonical_u64() << 16) | (__v_43.as_canonical_u64() << 24))) + u128::from(((__v_278.as_canonical_u64() << 0) | (__v_279.as_canonical_u64() << 8) | (__v_276.as_canonical_u64() << 16) | (__v_277.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_278: G = G::from_u8(__u32_bytes[0]); - let __v_279: G = G::from_u8(__u32_bytes[1]); - let __v_280: G = G::from_u8(__u32_bytes[2]); - let __v_281: G = G::from_u8(__u32_bytes[3]); - let __v_282: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_278; let __vj = __v_279; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_280: G = G::from_u8(__u32_bytes[0]); + let __v_281: G = G::from_u8(__u32_bytes[1]); + let __v_282: G = G::from_u8(__u32_bytes[2]); + let __v_283: G = G::from_u8(__u32_bytes[3]); + let __v_284: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); if !unconstrained { let __vi = __v_280; let __vj = __v_281; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_283: G = G::from_u64(((__v_228.as_canonical_u64() << 0) | (__v_229.as_canonical_u64() << 8) | (__v_230.as_canonical_u64() << 16) | (__v_231.as_canonical_u64() << 24))); - let __v_284: G = G::from_u64(((__v_270.as_canonical_u64() << 0) | (__v_276.as_canonical_u64() << 8) | (__v_273.as_canonical_u64() << 16) | (__v_277.as_canonical_u64() << 24))); - let __v_285: G = G::from_u64(((__v_76.as_canonical_u64() << 0) | (__v_77.as_canonical_u64() << 8) | (__v_78.as_canonical_u64() << 16) | (__v_79.as_canonical_u64() << 24))); - let __v_286: G = G::from_u64(((__v_278.as_canonical_u64() << 0) | (__v_279.as_canonical_u64() << 8) | (__v_280.as_canonical_u64() << 16) | (__v_281.as_canonical_u64() << 24))); - let __v_287: G = G::from_u64(1); - let __v_288: G = (__v_282 - __v_287); - let __v_289: G = G::from_u64(2); - let __v_290: G = (__v_282 - __v_289); - let __v_291: G = (__v_288 * __v_290); - let __v_292: G = (__v_282 * __v_291); - let __v_293: G = G::from_u64(0); - if (__v_292 != __v_293) { - return Err(ExecError::AssertEqMismatch { lhs: __v_292.as_canonical_u64(), rhs: __v_293.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); - } - let __v_294: G = (__v_284 + __v_285); - let __v_295: G = (__v_283 + __v_294); - let __v_296: G = G::from_u64(4294967296); - let __v_297: G = (__v_296 * __v_282); - let __v_298: G = (__v_286 + __v_297); - if (__v_295 != __v_298) { - return Err(ExecError::AssertEqMismatch { lhs: __v_295.as_canonical_u64(), rhs: __v_298.as_canonical_u64(), msg: Some("u32_add3: witnessed sum does not match its inputs".to_string()) }); - } - let __v_299: G = if unconstrained { Bytes2::xor(&__v_251, &__v_278) } else { bytes2_xor_value(__v_251, __v_278, record) }; - let __v_300: G = if unconstrained { Bytes2::xor(&__v_252, &__v_279) } else { bytes2_xor_value(__v_252, __v_279, record) }; - let __v_301: G = if unconstrained { Bytes2::xor(&__v_249, &__v_280) } else { bytes2_xor_value(__v_249, __v_280, record) }; - let __v_302: G = if unconstrained { Bytes2::xor(&__v_250, &__v_281) } else { bytes2_xor_value(__v_250, __v_281, record) }; - let __u32_sum: u128 = u128::from(((__v_253.as_canonical_u64() << 0) | (__v_254.as_canonical_u64() << 8) | (__v_255.as_canonical_u64() << 16) | (__v_256.as_canonical_u64() << 24))) + u128::from(((__v_300.as_canonical_u64() << 0) | (__v_301.as_canonical_u64() << 8) | (__v_302.as_canonical_u64() << 16) | (__v_299.as_canonical_u64() << 24))); + if !unconstrained { let __vi = __v_282; let __vj = __v_283; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_285: G = (__v_284 * __v_284); + if (__v_285 != __v_284) { + return Err(ExecError::AssertEqMismatch { lhs: __v_285.as_canonical_u64(), rhs: __v_284.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); + } + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_24, &__v_280) } else { bytes2_xor_split4_value(__v_24, __v_280, record) }; + let __v_286: G = __b2_out.0; + let __v_287: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_25, &__v_281) } else { bytes2_xor_split4_value(__v_25, __v_281, record) }; + let __v_288: G = __b2_out.0; + let __v_289: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_26, &__v_282) } else { bytes2_xor_split4_value(__v_26, __v_282, record) }; + let __v_290: G = __b2_out.0; + let __v_291: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_27, &__v_283) } else { bytes2_xor_split4_value(__v_27, __v_283, record) }; + let __v_292: G = __b2_out.0; + let __v_293: G = __b2_out.1; + let __v_294: G = (__v_288 + __v_291); + let __v_295: G = (__v_290 + __v_293); + let __v_296: G = (__v_292 + __v_287); + let __v_297: G = (__v_286 + __v_289); + let __u32_sum: u128 = u128::from(((__v_264.as_canonical_u64() << 0) | (__v_265.as_canonical_u64() << 8) | (__v_266.as_canonical_u64() << 16) | (__v_267.as_canonical_u64() << 24))) + u128::from(((__v_294.as_canonical_u64() << 0) | (__v_295.as_canonical_u64() << 8) | (__v_296.as_canonical_u64() << 16) | (__v_297.as_canonical_u64() << 24))) + u128::from(((__v_84.as_canonical_u64() << 0) | (__v_85.as_canonical_u64() << 8) | (__v_86.as_canonical_u64() << 16) | (__v_87.as_canonical_u64() << 24))); + let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); + let __v_298: G = G::from_u8(__u32_bytes[0]); + let __v_299: G = G::from_u8(__u32_bytes[1]); + let __v_300: G = G::from_u8(__u32_bytes[2]); + let __v_301: G = G::from_u8(__u32_bytes[3]); + let __v_302: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_298; let __vj = __v_299; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_300; let __vj = __v_301; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_303: G = G::from_u64(1); + let __v_304: G = (__v_302 - __v_303); + let __v_305: G = G::from_u64(2); + let __v_306: G = (__v_302 - __v_305); + let __v_307: G = (__v_304 * __v_306); + let __v_308: G = (__v_302 * __v_307); + let __v_309: G = G::from_u64(0); + if (__v_308 != __v_309) { + return Err(ExecError::AssertEqMismatch { lhs: __v_308.as_canonical_u64(), rhs: __v_309.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); + } + let __v_310: G = if unconstrained { Bytes2::xor(&__v_278, &__v_298) } else { bytes2_xor_value(__v_278, __v_298, record) }; + let __v_311: G = if unconstrained { Bytes2::xor(&__v_279, &__v_299) } else { bytes2_xor_value(__v_279, __v_299, record) }; + let __v_312: G = if unconstrained { Bytes2::xor(&__v_276, &__v_300) } else { bytes2_xor_value(__v_276, __v_300, record) }; + let __v_313: G = if unconstrained { Bytes2::xor(&__v_277, &__v_301) } else { bytes2_xor_value(__v_277, __v_301, record) }; + let __u32_sum: u128 = u128::from(((__v_280.as_canonical_u64() << 0) | (__v_281.as_canonical_u64() << 8) | (__v_282.as_canonical_u64() << 16) | (__v_283.as_canonical_u64() << 24))) + u128::from(((__v_311.as_canonical_u64() << 0) | (__v_312.as_canonical_u64() << 8) | (__v_313.as_canonical_u64() << 16) | (__v_310.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_303: G = G::from_u8(__u32_bytes[0]); - let __v_304: G = G::from_u8(__u32_bytes[1]); - let __v_305: G = G::from_u8(__u32_bytes[2]); - let __v_306: G = G::from_u8(__u32_bytes[3]); - let __v_307: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_303; let __vj = __v_304; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_305; let __vj = __v_306; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_308: G = G::from_u64(((__v_253.as_canonical_u64() << 0) | (__v_254.as_canonical_u64() << 8) | (__v_255.as_canonical_u64() << 16) | (__v_256.as_canonical_u64() << 24))); - let __v_309: G = G::from_u64(((__v_300.as_canonical_u64() << 0) | (__v_301.as_canonical_u64() << 8) | (__v_302.as_canonical_u64() << 16) | (__v_299.as_canonical_u64() << 24))); - let __v_310: G = G::from_u64(((__v_303.as_canonical_u64() << 0) | (__v_304.as_canonical_u64() << 8) | (__v_305.as_canonical_u64() << 16) | (__v_306.as_canonical_u64() << 24))); - let __v_311: G = (__v_307 * __v_307); - if (__v_311 != __v_307) { - return Err(ExecError::AssertEqMismatch { lhs: __v_311.as_canonical_u64(), rhs: __v_307.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); - } - let __v_312: G = (__v_308 + __v_309); - let __v_313: G = G::from_u64(4294967296); - let __v_314: G = (__v_313 * __v_307); - let __v_315: G = (__v_310 + __v_314); - if (__v_312 != __v_315) { - return Err(ExecError::AssertEqMismatch { lhs: __v_312.as_canonical_u64(), rhs: __v_315.as_canonical_u64(), msg: Some("u32_add: witnessed sum does not match its inputs".to_string()) }); - } - let __v_316: G = if unconstrained { Bytes2::xor(&__v_270, &__v_303) } else { bytes2_xor_value(__v_270, __v_303, record) }; - let __v_317: G = if unconstrained { Bytes2::xor(&__v_276, &__v_304) } else { bytes2_xor_value(__v_276, __v_304, record) }; - let __v_318: G = if unconstrained { Bytes2::xor(&__v_273, &__v_305) } else { bytes2_xor_value(__v_273, __v_305, record) }; - let __v_319: G = if unconstrained { Bytes2::xor(&__v_277, &__v_306) } else { bytes2_xor_value(__v_277, __v_306, record) }; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr7(&__v_316, &__v_317) } else { bytes2_chain_rotr7_value(__v_316, __v_317, record) }; + let __v_314: G = G::from_u8(__u32_bytes[0]); + let __v_315: G = G::from_u8(__u32_bytes[1]); + let __v_316: G = G::from_u8(__u32_bytes[2]); + let __v_317: G = G::from_u8(__u32_bytes[3]); + let __v_318: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_314; let __vj = __v_315; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_316; let __vj = __v_317; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_319: G = (__v_318 * __v_318); + if (__v_319 != __v_318) { + return Err(ExecError::AssertEqMismatch { lhs: __v_319.as_canonical_u64(), rhs: __v_318.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); + } + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_294, &__v_314) } else { bytes2_xor_split7_value(__v_294, __v_314, record) }; let __v_320: G = __b2_out.0; let __v_321: G = __b2_out.1; - let __v_322: G = __b2_out.2; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr7(&__v_318, &__v_319) } else { bytes2_chain_rotr7_value(__v_318, __v_319, record) }; - let __v_323: G = __b2_out.0; - let __v_324: G = __b2_out.1; - let __v_325: G = __b2_out.2; - let __v_326: G = (__v_321 + __v_325); - let __v_327: G = (__v_324 + __v_322); - let __u32_sum: u128 = u128::from(((__v_8.as_canonical_u64() << 0) | (__v_9.as_canonical_u64() << 8) | (__v_10.as_canonical_u64() << 16) | (__v_11.as_canonical_u64() << 24))) + u128::from(((__v_24.as_canonical_u64() << 0) | (__v_25.as_canonical_u64() << 8) | (__v_26.as_canonical_u64() << 16) | (__v_27.as_canonical_u64() << 24))) + u128::from(((__v_80.as_canonical_u64() << 0) | (__v_81.as_canonical_u64() << 8) | (__v_82.as_canonical_u64() << 16) | (__v_83.as_canonical_u64() << 24))); + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_295, &__v_315) } else { bytes2_xor_split7_value(__v_295, __v_315, record) }; + let __v_322: G = __b2_out.0; + let __v_323: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_296, &__v_316) } else { bytes2_xor_split7_value(__v_296, __v_316, record) }; + let __v_324: G = __b2_out.0; + let __v_325: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_297, &__v_317) } else { bytes2_xor_split7_value(__v_297, __v_317, record) }; + let __v_326: G = __b2_out.0; + let __v_327: G = __b2_out.1; + let __v_328: G = (__v_320 + __v_323); + let __v_329: G = (__v_322 + __v_325); + let __v_330: G = (__v_324 + __v_327); + let __v_331: G = (__v_326 + __v_321); + let __u32_sum: u128 = u128::from(((__v_12.as_canonical_u64() << 0) | (__v_13.as_canonical_u64() << 8) | (__v_14.as_canonical_u64() << 16) | (__v_15.as_canonical_u64() << 24))) + u128::from(((__v_28.as_canonical_u64() << 0) | (__v_29.as_canonical_u64() << 8) | (__v_30.as_canonical_u64() << 16) | (__v_31.as_canonical_u64() << 24))) + u128::from(((__v_88.as_canonical_u64() << 0) | (__v_89.as_canonical_u64() << 8) | (__v_90.as_canonical_u64() << 16) | (__v_91.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_328: G = G::from_u8(__u32_bytes[0]); - let __v_329: G = G::from_u8(__u32_bytes[1]); - let __v_330: G = G::from_u8(__u32_bytes[2]); - let __v_331: G = G::from_u8(__u32_bytes[3]); - let __v_332: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_328; let __vj = __v_329; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_330; let __vj = __v_331; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_333: G = G::from_u64(((__v_8.as_canonical_u64() << 0) | (__v_9.as_canonical_u64() << 8) | (__v_10.as_canonical_u64() << 16) | (__v_11.as_canonical_u64() << 24))); - let __v_334: G = G::from_u64(((__v_24.as_canonical_u64() << 0) | (__v_25.as_canonical_u64() << 8) | (__v_26.as_canonical_u64() << 16) | (__v_27.as_canonical_u64() << 24))); - let __v_335: G = G::from_u64(((__v_80.as_canonical_u64() << 0) | (__v_81.as_canonical_u64() << 8) | (__v_82.as_canonical_u64() << 16) | (__v_83.as_canonical_u64() << 24))); - let __v_336: G = G::from_u64(((__v_328.as_canonical_u64() << 0) | (__v_329.as_canonical_u64() << 8) | (__v_330.as_canonical_u64() << 16) | (__v_331.as_canonical_u64() << 24))); + let __v_332: G = G::from_u8(__u32_bytes[0]); + let __v_333: G = G::from_u8(__u32_bytes[1]); + let __v_334: G = G::from_u8(__u32_bytes[2]); + let __v_335: G = G::from_u8(__u32_bytes[3]); + let __v_336: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_332; let __vj = __v_333; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_334; let __vj = __v_335; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; let __v_337: G = G::from_u64(1); - let __v_338: G = (__v_332 - __v_337); + let __v_338: G = (__v_336 - __v_337); let __v_339: G = G::from_u64(2); - let __v_340: G = (__v_332 - __v_339); + let __v_340: G = (__v_336 - __v_339); let __v_341: G = (__v_338 * __v_340); - let __v_342: G = (__v_332 * __v_341); + let __v_342: G = (__v_336 * __v_341); let __v_343: G = G::from_u64(0); if (__v_342 != __v_343) { return Err(ExecError::AssertEqMismatch { lhs: __v_342.as_canonical_u64(), rhs: __v_343.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); } - let __v_344: G = (__v_334 + __v_335); - let __v_345: G = (__v_333 + __v_344); - let __v_346: G = G::from_u64(4294967296); - let __v_347: G = (__v_346 * __v_332); - let __v_348: G = (__v_336 + __v_347); - if (__v_345 != __v_348) { - return Err(ExecError::AssertEqMismatch { lhs: __v_345.as_canonical_u64(), rhs: __v_348.as_canonical_u64(), msg: Some("u32_add3: witnessed sum does not match its inputs".to_string()) }); - } - let __v_349: G = if unconstrained { Bytes2::xor(&__v_56, &__v_328) } else { bytes2_xor_value(__v_56, __v_328, record) }; - let __v_350: G = if unconstrained { Bytes2::xor(&__v_57, &__v_329) } else { bytes2_xor_value(__v_57, __v_329, record) }; - let __v_351: G = if unconstrained { Bytes2::xor(&__v_58, &__v_330) } else { bytes2_xor_value(__v_58, __v_330, record) }; - let __v_352: G = if unconstrained { Bytes2::xor(&__v_59, &__v_331) } else { bytes2_xor_value(__v_59, __v_331, record) }; - let __u32_sum: u128 = u128::from(((__v_40.as_canonical_u64() << 0) | (__v_41.as_canonical_u64() << 8) | (__v_42.as_canonical_u64() << 16) | (__v_43.as_canonical_u64() << 24))) + u128::from(((__v_351.as_canonical_u64() << 0) | (__v_352.as_canonical_u64() << 8) | (__v_349.as_canonical_u64() << 16) | (__v_350.as_canonical_u64() << 24))); - let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_353: G = G::from_u8(__u32_bytes[0]); - let __v_354: G = G::from_u8(__u32_bytes[1]); - let __v_355: G = G::from_u8(__u32_bytes[2]); - let __v_356: G = G::from_u8(__u32_bytes[3]); - let __v_357: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_353; let __vj = __v_354; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_355; let __vj = __v_356; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_358: G = G::from_u64(((__v_40.as_canonical_u64() << 0) | (__v_41.as_canonical_u64() << 8) | (__v_42.as_canonical_u64() << 16) | (__v_43.as_canonical_u64() << 24))); - let __v_359: G = G::from_u64(((__v_351.as_canonical_u64() << 0) | (__v_352.as_canonical_u64() << 8) | (__v_349.as_canonical_u64() << 16) | (__v_350.as_canonical_u64() << 24))); - let __v_360: G = G::from_u64(((__v_353.as_canonical_u64() << 0) | (__v_354.as_canonical_u64() << 8) | (__v_355.as_canonical_u64() << 16) | (__v_356.as_canonical_u64() << 24))); - let __v_361: G = (__v_357 * __v_357); - if (__v_361 != __v_357) { - return Err(ExecError::AssertEqMismatch { lhs: __v_361.as_canonical_u64(), rhs: __v_357.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); - } - let __v_362: G = (__v_358 + __v_359); - let __v_363: G = G::from_u64(4294967296); - let __v_364: G = (__v_363 * __v_357); - let __v_365: G = (__v_360 + __v_364); - if (__v_362 != __v_365) { - return Err(ExecError::AssertEqMismatch { lhs: __v_362.as_canonical_u64(), rhs: __v_365.as_canonical_u64(), msg: Some("u32_add: witnessed sum does not match its inputs".to_string()) }); - } - let __v_366: G = if unconstrained { Bytes2::xor(&__v_24, &__v_353) } else { bytes2_xor_value(__v_24, __v_353, record) }; - let __v_367: G = if unconstrained { Bytes2::xor(&__v_25, &__v_354) } else { bytes2_xor_value(__v_25, __v_354, record) }; - let __v_368: G = if unconstrained { Bytes2::xor(&__v_26, &__v_355) } else { bytes2_xor_value(__v_26, __v_355, record) }; - let __v_369: G = if unconstrained { Bytes2::xor(&__v_27, &__v_356) } else { bytes2_xor_value(__v_27, __v_356, record) }; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr4(&__v_367, &__v_368) } else { bytes2_chain_rotr4_value(__v_367, __v_368, record) }; - let __v_370: G = __b2_out.0; - let __v_371: G = __b2_out.1; - let __v_372: G = __b2_out.2; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr4(&__v_369, &__v_366) } else { bytes2_chain_rotr4_value(__v_369, __v_366, record) }; - let __v_373: G = __b2_out.0; - let __v_374: G = __b2_out.1; - let __v_375: G = __b2_out.2; - let __v_376: G = (__v_371 + __v_375); - let __v_377: G = (__v_374 + __v_372); - let __u32_sum: u128 = u128::from(((__v_328.as_canonical_u64() << 0) | (__v_329.as_canonical_u64() << 8) | (__v_330.as_canonical_u64() << 16) | (__v_331.as_canonical_u64() << 24))) + u128::from(((__v_370.as_canonical_u64() << 0) | (__v_376.as_canonical_u64() << 8) | (__v_373.as_canonical_u64() << 16) | (__v_377.as_canonical_u64() << 24))) + u128::from(((__v_84.as_canonical_u64() << 0) | (__v_85.as_canonical_u64() << 8) | (__v_86.as_canonical_u64() << 16) | (__v_87.as_canonical_u64() << 24))); - let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_378: G = G::from_u8(__u32_bytes[0]); - let __v_379: G = G::from_u8(__u32_bytes[1]); - let __v_380: G = G::from_u8(__u32_bytes[2]); - let __v_381: G = G::from_u8(__u32_bytes[3]); - let __v_382: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_378; let __vj = __v_379; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_380; let __vj = __v_381; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_383: G = G::from_u64(((__v_328.as_canonical_u64() << 0) | (__v_329.as_canonical_u64() << 8) | (__v_330.as_canonical_u64() << 16) | (__v_331.as_canonical_u64() << 24))); - let __v_384: G = G::from_u64(((__v_370.as_canonical_u64() << 0) | (__v_376.as_canonical_u64() << 8) | (__v_373.as_canonical_u64() << 16) | (__v_377.as_canonical_u64() << 24))); - let __v_385: G = G::from_u64(((__v_84.as_canonical_u64() << 0) | (__v_85.as_canonical_u64() << 8) | (__v_86.as_canonical_u64() << 16) | (__v_87.as_canonical_u64() << 24))); - let __v_386: G = G::from_u64(((__v_378.as_canonical_u64() << 0) | (__v_379.as_canonical_u64() << 8) | (__v_380.as_canonical_u64() << 16) | (__v_381.as_canonical_u64() << 24))); - let __v_387: G = G::from_u64(1); - let __v_388: G = (__v_382 - __v_387); - let __v_389: G = G::from_u64(2); - let __v_390: G = (__v_382 - __v_389); - let __v_391: G = (__v_388 * __v_390); - let __v_392: G = (__v_382 * __v_391); - let __v_393: G = G::from_u64(0); - if (__v_392 != __v_393) { - return Err(ExecError::AssertEqMismatch { lhs: __v_392.as_canonical_u64(), rhs: __v_393.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); - } - let __v_394: G = (__v_384 + __v_385); - let __v_395: G = (__v_383 + __v_394); - let __v_396: G = G::from_u64(4294967296); - let __v_397: G = (__v_396 * __v_382); - let __v_398: G = (__v_386 + __v_397); - if (__v_395 != __v_398) { - return Err(ExecError::AssertEqMismatch { lhs: __v_395.as_canonical_u64(), rhs: __v_398.as_canonical_u64(), msg: Some("u32_add3: witnessed sum does not match its inputs".to_string()) }); - } - let __v_399: G = if unconstrained { Bytes2::xor(&__v_351, &__v_378) } else { bytes2_xor_value(__v_351, __v_378, record) }; - let __v_400: G = if unconstrained { Bytes2::xor(&__v_352, &__v_379) } else { bytes2_xor_value(__v_352, __v_379, record) }; - let __v_401: G = if unconstrained { Bytes2::xor(&__v_349, &__v_380) } else { bytes2_xor_value(__v_349, __v_380, record) }; - let __v_402: G = if unconstrained { Bytes2::xor(&__v_350, &__v_381) } else { bytes2_xor_value(__v_350, __v_381, record) }; - let __u32_sum: u128 = u128::from(((__v_353.as_canonical_u64() << 0) | (__v_354.as_canonical_u64() << 8) | (__v_355.as_canonical_u64() << 16) | (__v_356.as_canonical_u64() << 24))) + u128::from(((__v_400.as_canonical_u64() << 0) | (__v_401.as_canonical_u64() << 8) | (__v_402.as_canonical_u64() << 16) | (__v_399.as_canonical_u64() << 24))); - let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_403: G = G::from_u8(__u32_bytes[0]); - let __v_404: G = G::from_u8(__u32_bytes[1]); - let __v_405: G = G::from_u8(__u32_bytes[2]); - let __v_406: G = G::from_u8(__u32_bytes[3]); - let __v_407: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_403; let __vj = __v_404; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_405; let __vj = __v_406; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_408: G = G::from_u64(((__v_353.as_canonical_u64() << 0) | (__v_354.as_canonical_u64() << 8) | (__v_355.as_canonical_u64() << 16) | (__v_356.as_canonical_u64() << 24))); - let __v_409: G = G::from_u64(((__v_400.as_canonical_u64() << 0) | (__v_401.as_canonical_u64() << 8) | (__v_402.as_canonical_u64() << 16) | (__v_399.as_canonical_u64() << 24))); - let __v_410: G = G::from_u64(((__v_403.as_canonical_u64() << 0) | (__v_404.as_canonical_u64() << 8) | (__v_405.as_canonical_u64() << 16) | (__v_406.as_canonical_u64() << 24))); - let __v_411: G = (__v_407 * __v_407); - if (__v_411 != __v_407) { - return Err(ExecError::AssertEqMismatch { lhs: __v_411.as_canonical_u64(), rhs: __v_407.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); - } - let __v_412: G = (__v_408 + __v_409); - let __v_413: G = G::from_u64(4294967296); - let __v_414: G = (__v_413 * __v_407); - let __v_415: G = (__v_410 + __v_414); - if (__v_412 != __v_415) { - return Err(ExecError::AssertEqMismatch { lhs: __v_412.as_canonical_u64(), rhs: __v_415.as_canonical_u64(), msg: Some("u32_add: witnessed sum does not match its inputs".to_string()) }); - } - let __v_416: G = if unconstrained { Bytes2::xor(&__v_370, &__v_403) } else { bytes2_xor_value(__v_370, __v_403, record) }; - let __v_417: G = if unconstrained { Bytes2::xor(&__v_376, &__v_404) } else { bytes2_xor_value(__v_376, __v_404, record) }; - let __v_418: G = if unconstrained { Bytes2::xor(&__v_373, &__v_405) } else { bytes2_xor_value(__v_373, __v_405, record) }; - let __v_419: G = if unconstrained { Bytes2::xor(&__v_377, &__v_406) } else { bytes2_xor_value(__v_377, __v_406, record) }; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr7(&__v_416, &__v_417) } else { bytes2_chain_rotr7_value(__v_416, __v_417, record) }; - let __v_420: G = __b2_out.0; - let __v_421: G = __b2_out.1; - let __v_422: G = __b2_out.2; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr7(&__v_418, &__v_419) } else { bytes2_chain_rotr7_value(__v_418, __v_419, record) }; - let __v_423: G = __b2_out.0; - let __v_424: G = __b2_out.1; - let __v_425: G = __b2_out.2; - let __v_426: G = (__v_421 + __v_425); - let __v_427: G = (__v_424 + __v_422); - let __u32_sum: u128 = u128::from(((__v_12.as_canonical_u64() << 0) | (__v_13.as_canonical_u64() << 8) | (__v_14.as_canonical_u64() << 16) | (__v_15.as_canonical_u64() << 24))) + u128::from(((__v_28.as_canonical_u64() << 0) | (__v_29.as_canonical_u64() << 8) | (__v_30.as_canonical_u64() << 16) | (__v_31.as_canonical_u64() << 24))) + u128::from(((__v_88.as_canonical_u64() << 0) | (__v_89.as_canonical_u64() << 8) | (__v_90.as_canonical_u64() << 16) | (__v_91.as_canonical_u64() << 24))); - let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_428: G = G::from_u8(__u32_bytes[0]); - let __v_429: G = G::from_u8(__u32_bytes[1]); - let __v_430: G = G::from_u8(__u32_bytes[2]); - let __v_431: G = G::from_u8(__u32_bytes[3]); - let __v_432: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_428; let __vj = __v_429; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_430; let __vj = __v_431; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_433: G = G::from_u64(((__v_12.as_canonical_u64() << 0) | (__v_13.as_canonical_u64() << 8) | (__v_14.as_canonical_u64() << 16) | (__v_15.as_canonical_u64() << 24))); - let __v_434: G = G::from_u64(((__v_28.as_canonical_u64() << 0) | (__v_29.as_canonical_u64() << 8) | (__v_30.as_canonical_u64() << 16) | (__v_31.as_canonical_u64() << 24))); - let __v_435: G = G::from_u64(((__v_88.as_canonical_u64() << 0) | (__v_89.as_canonical_u64() << 8) | (__v_90.as_canonical_u64() << 16) | (__v_91.as_canonical_u64() << 24))); - let __v_436: G = G::from_u64(((__v_428.as_canonical_u64() << 0) | (__v_429.as_canonical_u64() << 8) | (__v_430.as_canonical_u64() << 16) | (__v_431.as_canonical_u64() << 24))); - let __v_437: G = G::from_u64(1); - let __v_438: G = (__v_432 - __v_437); - let __v_439: G = G::from_u64(2); - let __v_440: G = (__v_432 - __v_439); - let __v_441: G = (__v_438 * __v_440); - let __v_442: G = (__v_432 * __v_441); - let __v_443: G = G::from_u64(0); - if (__v_442 != __v_443) { - return Err(ExecError::AssertEqMismatch { lhs: __v_442.as_canonical_u64(), rhs: __v_443.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); - } - let __v_444: G = (__v_434 + __v_435); - let __v_445: G = (__v_433 + __v_444); - let __v_446: G = G::from_u64(4294967296); - let __v_447: G = (__v_446 * __v_432); - let __v_448: G = (__v_436 + __v_447); - if (__v_445 != __v_448) { - return Err(ExecError::AssertEqMismatch { lhs: __v_445.as_canonical_u64(), rhs: __v_448.as_canonical_u64(), msg: Some("u32_add3: witnessed sum does not match its inputs".to_string()) }); - } - let __v_449: G = if unconstrained { Bytes2::xor(&__v_60, &__v_428) } else { bytes2_xor_value(__v_60, __v_428, record) }; - let __v_450: G = if unconstrained { Bytes2::xor(&__v_61, &__v_429) } else { bytes2_xor_value(__v_61, __v_429, record) }; - let __v_451: G = if unconstrained { Bytes2::xor(&__v_62, &__v_430) } else { bytes2_xor_value(__v_62, __v_430, record) }; - let __v_452: G = if unconstrained { Bytes2::xor(&__v_63, &__v_431) } else { bytes2_xor_value(__v_63, __v_431, record) }; - let __u32_sum: u128 = u128::from(((__v_44.as_canonical_u64() << 0) | (__v_45.as_canonical_u64() << 8) | (__v_46.as_canonical_u64() << 16) | (__v_47.as_canonical_u64() << 24))) + u128::from(((__v_451.as_canonical_u64() << 0) | (__v_452.as_canonical_u64() << 8) | (__v_449.as_canonical_u64() << 16) | (__v_450.as_canonical_u64() << 24))); + let __v_344: G = if unconstrained { Bytes2::xor(&__v_60, &__v_332) } else { bytes2_xor_value(__v_60, __v_332, record) }; + let __v_345: G = if unconstrained { Bytes2::xor(&__v_61, &__v_333) } else { bytes2_xor_value(__v_61, __v_333, record) }; + let __v_346: G = if unconstrained { Bytes2::xor(&__v_62, &__v_334) } else { bytes2_xor_value(__v_62, __v_334, record) }; + let __v_347: G = if unconstrained { Bytes2::xor(&__v_63, &__v_335) } else { bytes2_xor_value(__v_63, __v_335, record) }; + let __u32_sum: u128 = u128::from(((__v_44.as_canonical_u64() << 0) | (__v_45.as_canonical_u64() << 8) | (__v_46.as_canonical_u64() << 16) | (__v_47.as_canonical_u64() << 24))) + u128::from(((__v_346.as_canonical_u64() << 0) | (__v_347.as_canonical_u64() << 8) | (__v_344.as_canonical_u64() << 16) | (__v_345.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_453: G = G::from_u8(__u32_bytes[0]); - let __v_454: G = G::from_u8(__u32_bytes[1]); - let __v_455: G = G::from_u8(__u32_bytes[2]); - let __v_456: G = G::from_u8(__u32_bytes[3]); - let __v_457: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_453; let __vj = __v_454; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_455; let __vj = __v_456; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_458: G = G::from_u64(((__v_44.as_canonical_u64() << 0) | (__v_45.as_canonical_u64() << 8) | (__v_46.as_canonical_u64() << 16) | (__v_47.as_canonical_u64() << 24))); - let __v_459: G = G::from_u64(((__v_451.as_canonical_u64() << 0) | (__v_452.as_canonical_u64() << 8) | (__v_449.as_canonical_u64() << 16) | (__v_450.as_canonical_u64() << 24))); - let __v_460: G = G::from_u64(((__v_453.as_canonical_u64() << 0) | (__v_454.as_canonical_u64() << 8) | (__v_455.as_canonical_u64() << 16) | (__v_456.as_canonical_u64() << 24))); - let __v_461: G = (__v_457 * __v_457); - if (__v_461 != __v_457) { - return Err(ExecError::AssertEqMismatch { lhs: __v_461.as_canonical_u64(), rhs: __v_457.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); - } - let __v_462: G = (__v_458 + __v_459); - let __v_463: G = G::from_u64(4294967296); - let __v_464: G = (__v_463 * __v_457); - let __v_465: G = (__v_460 + __v_464); - if (__v_462 != __v_465) { - return Err(ExecError::AssertEqMismatch { lhs: __v_462.as_canonical_u64(), rhs: __v_465.as_canonical_u64(), msg: Some("u32_add: witnessed sum does not match its inputs".to_string()) }); - } - let __v_466: G = if unconstrained { Bytes2::xor(&__v_28, &__v_453) } else { bytes2_xor_value(__v_28, __v_453, record) }; - let __v_467: G = if unconstrained { Bytes2::xor(&__v_29, &__v_454) } else { bytes2_xor_value(__v_29, __v_454, record) }; - let __v_468: G = if unconstrained { Bytes2::xor(&__v_30, &__v_455) } else { bytes2_xor_value(__v_30, __v_455, record) }; - let __v_469: G = if unconstrained { Bytes2::xor(&__v_31, &__v_456) } else { bytes2_xor_value(__v_31, __v_456, record) }; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr4(&__v_467, &__v_468) } else { bytes2_chain_rotr4_value(__v_467, __v_468, record) }; - let __v_470: G = __b2_out.0; - let __v_471: G = __b2_out.1; - let __v_472: G = __b2_out.2; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr4(&__v_469, &__v_466) } else { bytes2_chain_rotr4_value(__v_469, __v_466, record) }; - let __v_473: G = __b2_out.0; - let __v_474: G = __b2_out.1; - let __v_475: G = __b2_out.2; - let __v_476: G = (__v_471 + __v_475); - let __v_477: G = (__v_474 + __v_472); - let __u32_sum: u128 = u128::from(((__v_428.as_canonical_u64() << 0) | (__v_429.as_canonical_u64() << 8) | (__v_430.as_canonical_u64() << 16) | (__v_431.as_canonical_u64() << 24))) + u128::from(((__v_470.as_canonical_u64() << 0) | (__v_476.as_canonical_u64() << 8) | (__v_473.as_canonical_u64() << 16) | (__v_477.as_canonical_u64() << 24))) + u128::from(((__v_92.as_canonical_u64() << 0) | (__v_93.as_canonical_u64() << 8) | (__v_94.as_canonical_u64() << 16) | (__v_95.as_canonical_u64() << 24))); + let __v_348: G = G::from_u8(__u32_bytes[0]); + let __v_349: G = G::from_u8(__u32_bytes[1]); + let __v_350: G = G::from_u8(__u32_bytes[2]); + let __v_351: G = G::from_u8(__u32_bytes[3]); + let __v_352: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_348; let __vj = __v_349; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_350; let __vj = __v_351; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_353: G = (__v_352 * __v_352); + if (__v_353 != __v_352) { + return Err(ExecError::AssertEqMismatch { lhs: __v_353.as_canonical_u64(), rhs: __v_352.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); + } + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_28, &__v_348) } else { bytes2_xor_split4_value(__v_28, __v_348, record) }; + let __v_354: G = __b2_out.0; + let __v_355: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_29, &__v_349) } else { bytes2_xor_split4_value(__v_29, __v_349, record) }; + let __v_356: G = __b2_out.0; + let __v_357: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_30, &__v_350) } else { bytes2_xor_split4_value(__v_30, __v_350, record) }; + let __v_358: G = __b2_out.0; + let __v_359: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_31, &__v_351) } else { bytes2_xor_split4_value(__v_31, __v_351, record) }; + let __v_360: G = __b2_out.0; + let __v_361: G = __b2_out.1; + let __v_362: G = (__v_356 + __v_359); + let __v_363: G = (__v_358 + __v_361); + let __v_364: G = (__v_360 + __v_355); + let __v_365: G = (__v_354 + __v_357); + let __u32_sum: u128 = u128::from(((__v_332.as_canonical_u64() << 0) | (__v_333.as_canonical_u64() << 8) | (__v_334.as_canonical_u64() << 16) | (__v_335.as_canonical_u64() << 24))) + u128::from(((__v_362.as_canonical_u64() << 0) | (__v_363.as_canonical_u64() << 8) | (__v_364.as_canonical_u64() << 16) | (__v_365.as_canonical_u64() << 24))) + u128::from(((__v_92.as_canonical_u64() << 0) | (__v_93.as_canonical_u64() << 8) | (__v_94.as_canonical_u64() << 16) | (__v_95.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_478: G = G::from_u8(__u32_bytes[0]); - let __v_479: G = G::from_u8(__u32_bytes[1]); - let __v_480: G = G::from_u8(__u32_bytes[2]); - let __v_481: G = G::from_u8(__u32_bytes[3]); - let __v_482: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_478; let __vj = __v_479; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_480; let __vj = __v_481; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_483: G = G::from_u64(((__v_428.as_canonical_u64() << 0) | (__v_429.as_canonical_u64() << 8) | (__v_430.as_canonical_u64() << 16) | (__v_431.as_canonical_u64() << 24))); - let __v_484: G = G::from_u64(((__v_470.as_canonical_u64() << 0) | (__v_476.as_canonical_u64() << 8) | (__v_473.as_canonical_u64() << 16) | (__v_477.as_canonical_u64() << 24))); - let __v_485: G = G::from_u64(((__v_92.as_canonical_u64() << 0) | (__v_93.as_canonical_u64() << 8) | (__v_94.as_canonical_u64() << 16) | (__v_95.as_canonical_u64() << 24))); - let __v_486: G = G::from_u64(((__v_478.as_canonical_u64() << 0) | (__v_479.as_canonical_u64() << 8) | (__v_480.as_canonical_u64() << 16) | (__v_481.as_canonical_u64() << 24))); - let __v_487: G = G::from_u64(1); - let __v_488: G = (__v_482 - __v_487); - let __v_489: G = G::from_u64(2); - let __v_490: G = (__v_482 - __v_489); - let __v_491: G = (__v_488 * __v_490); - let __v_492: G = (__v_482 * __v_491); - let __v_493: G = G::from_u64(0); - if (__v_492 != __v_493) { - return Err(ExecError::AssertEqMismatch { lhs: __v_492.as_canonical_u64(), rhs: __v_493.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); - } - let __v_494: G = (__v_484 + __v_485); - let __v_495: G = (__v_483 + __v_494); - let __v_496: G = G::from_u64(4294967296); - let __v_497: G = (__v_496 * __v_482); - let __v_498: G = (__v_486 + __v_497); - if (__v_495 != __v_498) { - return Err(ExecError::AssertEqMismatch { lhs: __v_495.as_canonical_u64(), rhs: __v_498.as_canonical_u64(), msg: Some("u32_add3: witnessed sum does not match its inputs".to_string()) }); - } - let __v_499: G = if unconstrained { Bytes2::xor(&__v_451, &__v_478) } else { bytes2_xor_value(__v_451, __v_478, record) }; - let __v_500: G = if unconstrained { Bytes2::xor(&__v_452, &__v_479) } else { bytes2_xor_value(__v_452, __v_479, record) }; - let __v_501: G = if unconstrained { Bytes2::xor(&__v_449, &__v_480) } else { bytes2_xor_value(__v_449, __v_480, record) }; - let __v_502: G = if unconstrained { Bytes2::xor(&__v_450, &__v_481) } else { bytes2_xor_value(__v_450, __v_481, record) }; - let __u32_sum: u128 = u128::from(((__v_453.as_canonical_u64() << 0) | (__v_454.as_canonical_u64() << 8) | (__v_455.as_canonical_u64() << 16) | (__v_456.as_canonical_u64() << 24))) + u128::from(((__v_500.as_canonical_u64() << 0) | (__v_501.as_canonical_u64() << 8) | (__v_502.as_canonical_u64() << 16) | (__v_499.as_canonical_u64() << 24))); + let __v_366: G = G::from_u8(__u32_bytes[0]); + let __v_367: G = G::from_u8(__u32_bytes[1]); + let __v_368: G = G::from_u8(__u32_bytes[2]); + let __v_369: G = G::from_u8(__u32_bytes[3]); + let __v_370: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_366; let __vj = __v_367; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_368; let __vj = __v_369; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_371: G = G::from_u64(1); + let __v_372: G = (__v_370 - __v_371); + let __v_373: G = G::from_u64(2); + let __v_374: G = (__v_370 - __v_373); + let __v_375: G = (__v_372 * __v_374); + let __v_376: G = (__v_370 * __v_375); + let __v_377: G = G::from_u64(0); + if (__v_376 != __v_377) { + return Err(ExecError::AssertEqMismatch { lhs: __v_376.as_canonical_u64(), rhs: __v_377.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); + } + let __v_378: G = if unconstrained { Bytes2::xor(&__v_346, &__v_366) } else { bytes2_xor_value(__v_346, __v_366, record) }; + let __v_379: G = if unconstrained { Bytes2::xor(&__v_347, &__v_367) } else { bytes2_xor_value(__v_347, __v_367, record) }; + let __v_380: G = if unconstrained { Bytes2::xor(&__v_344, &__v_368) } else { bytes2_xor_value(__v_344, __v_368, record) }; + let __v_381: G = if unconstrained { Bytes2::xor(&__v_345, &__v_369) } else { bytes2_xor_value(__v_345, __v_369, record) }; + let __u32_sum: u128 = u128::from(((__v_348.as_canonical_u64() << 0) | (__v_349.as_canonical_u64() << 8) | (__v_350.as_canonical_u64() << 16) | (__v_351.as_canonical_u64() << 24))) + u128::from(((__v_379.as_canonical_u64() << 0) | (__v_380.as_canonical_u64() << 8) | (__v_381.as_canonical_u64() << 16) | (__v_378.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_503: G = G::from_u8(__u32_bytes[0]); - let __v_504: G = G::from_u8(__u32_bytes[1]); - let __v_505: G = G::from_u8(__u32_bytes[2]); - let __v_506: G = G::from_u8(__u32_bytes[3]); - let __v_507: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_503; let __vj = __v_504; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_505; let __vj = __v_506; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_508: G = G::from_u64(((__v_453.as_canonical_u64() << 0) | (__v_454.as_canonical_u64() << 8) | (__v_455.as_canonical_u64() << 16) | (__v_456.as_canonical_u64() << 24))); - let __v_509: G = G::from_u64(((__v_500.as_canonical_u64() << 0) | (__v_501.as_canonical_u64() << 8) | (__v_502.as_canonical_u64() << 16) | (__v_499.as_canonical_u64() << 24))); - let __v_510: G = G::from_u64(((__v_503.as_canonical_u64() << 0) | (__v_504.as_canonical_u64() << 8) | (__v_505.as_canonical_u64() << 16) | (__v_506.as_canonical_u64() << 24))); - let __v_511: G = (__v_507 * __v_507); - if (__v_511 != __v_507) { - return Err(ExecError::AssertEqMismatch { lhs: __v_511.as_canonical_u64(), rhs: __v_507.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); - } - let __v_512: G = (__v_508 + __v_509); - let __v_513: G = G::from_u64(4294967296); - let __v_514: G = (__v_513 * __v_507); - let __v_515: G = (__v_510 + __v_514); - if (__v_512 != __v_515) { - return Err(ExecError::AssertEqMismatch { lhs: __v_512.as_canonical_u64(), rhs: __v_515.as_canonical_u64(), msg: Some("u32_add: witnessed sum does not match its inputs".to_string()) }); - } - let __v_516: G = if unconstrained { Bytes2::xor(&__v_470, &__v_503) } else { bytes2_xor_value(__v_470, __v_503, record) }; - let __v_517: G = if unconstrained { Bytes2::xor(&__v_476, &__v_504) } else { bytes2_xor_value(__v_476, __v_504, record) }; - let __v_518: G = if unconstrained { Bytes2::xor(&__v_473, &__v_505) } else { bytes2_xor_value(__v_473, __v_505, record) }; - let __v_519: G = if unconstrained { Bytes2::xor(&__v_477, &__v_506) } else { bytes2_xor_value(__v_477, __v_506, record) }; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr7(&__v_516, &__v_517) } else { bytes2_chain_rotr7_value(__v_516, __v_517, record) }; - let __v_520: G = __b2_out.0; - let __v_521: G = __b2_out.1; - let __v_522: G = __b2_out.2; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr7(&__v_518, &__v_519) } else { bytes2_chain_rotr7_value(__v_518, __v_519, record) }; - let __v_523: G = __b2_out.0; - let __v_524: G = __b2_out.1; - let __v_525: G = __b2_out.2; - let __v_526: G = (__v_521 + __v_525); - let __v_527: G = (__v_524 + __v_522); - let __u32_sum: u128 = u128::from(((__v_178.as_canonical_u64() << 0) | (__v_179.as_canonical_u64() << 8) | (__v_180.as_canonical_u64() << 16) | (__v_181.as_canonical_u64() << 24))) + u128::from(((__v_320.as_canonical_u64() << 0) | (__v_326.as_canonical_u64() << 8) | (__v_323.as_canonical_u64() << 16) | (__v_327.as_canonical_u64() << 24))) + u128::from(((__v_96.as_canonical_u64() << 0) | (__v_97.as_canonical_u64() << 8) | (__v_98.as_canonical_u64() << 16) | (__v_99.as_canonical_u64() << 24))); + let __v_382: G = G::from_u8(__u32_bytes[0]); + let __v_383: G = G::from_u8(__u32_bytes[1]); + let __v_384: G = G::from_u8(__u32_bytes[2]); + let __v_385: G = G::from_u8(__u32_bytes[3]); + let __v_386: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_382; let __vj = __v_383; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_384; let __vj = __v_385; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_387: G = (__v_386 * __v_386); + if (__v_387 != __v_386) { + return Err(ExecError::AssertEqMismatch { lhs: __v_387.as_canonical_u64(), rhs: __v_386.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); + } + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_362, &__v_382) } else { bytes2_xor_split7_value(__v_362, __v_382, record) }; + let __v_388: G = __b2_out.0; + let __v_389: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_363, &__v_383) } else { bytes2_xor_split7_value(__v_363, __v_383, record) }; + let __v_390: G = __b2_out.0; + let __v_391: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_364, &__v_384) } else { bytes2_xor_split7_value(__v_364, __v_384, record) }; + let __v_392: G = __b2_out.0; + let __v_393: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_365, &__v_385) } else { bytes2_xor_split7_value(__v_365, __v_385, record) }; + let __v_394: G = __b2_out.0; + let __v_395: G = __b2_out.1; + let __v_396: G = (__v_388 + __v_391); + let __v_397: G = (__v_390 + __v_393); + let __v_398: G = (__v_392 + __v_395); + let __v_399: G = (__v_394 + __v_389); + let __u32_sum: u128 = u128::from(((__v_162.as_canonical_u64() << 0) | (__v_163.as_canonical_u64() << 8) | (__v_164.as_canonical_u64() << 16) | (__v_165.as_canonical_u64() << 24))) + u128::from(((__v_260.as_canonical_u64() << 0) | (__v_261.as_canonical_u64() << 8) | (__v_262.as_canonical_u64() << 16) | (__v_263.as_canonical_u64() << 24))) + u128::from(((__v_96.as_canonical_u64() << 0) | (__v_97.as_canonical_u64() << 8) | (__v_98.as_canonical_u64() << 16) | (__v_99.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_528: G = G::from_u8(__u32_bytes[0]); - let __v_529: G = G::from_u8(__u32_bytes[1]); - let __v_530: G = G::from_u8(__u32_bytes[2]); - let __v_531: G = G::from_u8(__u32_bytes[3]); - let __v_532: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_528; let __vj = __v_529; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_530; let __vj = __v_531; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_533: G = G::from_u64(((__v_178.as_canonical_u64() << 0) | (__v_179.as_canonical_u64() << 8) | (__v_180.as_canonical_u64() << 16) | (__v_181.as_canonical_u64() << 24))); - let __v_534: G = G::from_u64(((__v_320.as_canonical_u64() << 0) | (__v_326.as_canonical_u64() << 8) | (__v_323.as_canonical_u64() << 16) | (__v_327.as_canonical_u64() << 24))); - let __v_535: G = G::from_u64(((__v_96.as_canonical_u64() << 0) | (__v_97.as_canonical_u64() << 8) | (__v_98.as_canonical_u64() << 16) | (__v_99.as_canonical_u64() << 24))); - let __v_536: G = G::from_u64(((__v_528.as_canonical_u64() << 0) | (__v_529.as_canonical_u64() << 8) | (__v_530.as_canonical_u64() << 16) | (__v_531.as_canonical_u64() << 24))); - let __v_537: G = G::from_u64(1); - let __v_538: G = (__v_532 - __v_537); - let __v_539: G = G::from_u64(2); - let __v_540: G = (__v_532 - __v_539); - let __v_541: G = (__v_538 * __v_540); - let __v_542: G = (__v_532 * __v_541); - let __v_543: G = G::from_u64(0); - if (__v_542 != __v_543) { - return Err(ExecError::AssertEqMismatch { lhs: __v_542.as_canonical_u64(), rhs: __v_543.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); - } - let __v_544: G = (__v_534 + __v_535); - let __v_545: G = (__v_533 + __v_544); - let __v_546: G = G::from_u64(4294967296); - let __v_547: G = (__v_546 * __v_532); - let __v_548: G = (__v_536 + __v_547); - if (__v_545 != __v_548) { - return Err(ExecError::AssertEqMismatch { lhs: __v_545.as_canonical_u64(), rhs: __v_548.as_canonical_u64(), msg: Some("u32_add3: witnessed sum does not match its inputs".to_string()) }); - } - let __v_549: G = if unconstrained { Bytes2::xor(&__v_500, &__v_528) } else { bytes2_xor_value(__v_500, __v_528, record) }; - let __v_550: G = if unconstrained { Bytes2::xor(&__v_501, &__v_529) } else { bytes2_xor_value(__v_501, __v_529, record) }; - let __v_551: G = if unconstrained { Bytes2::xor(&__v_502, &__v_530) } else { bytes2_xor_value(__v_502, __v_530, record) }; - let __v_552: G = if unconstrained { Bytes2::xor(&__v_499, &__v_531) } else { bytes2_xor_value(__v_499, __v_531, record) }; - let __u32_sum: u128 = u128::from(((__v_403.as_canonical_u64() << 0) | (__v_404.as_canonical_u64() << 8) | (__v_405.as_canonical_u64() << 16) | (__v_406.as_canonical_u64() << 24))) + u128::from(((__v_551.as_canonical_u64() << 0) | (__v_552.as_canonical_u64() << 8) | (__v_549.as_canonical_u64() << 16) | (__v_550.as_canonical_u64() << 24))); + let __v_400: G = G::from_u8(__u32_bytes[0]); + let __v_401: G = G::from_u8(__u32_bytes[1]); + let __v_402: G = G::from_u8(__u32_bytes[2]); + let __v_403: G = G::from_u8(__u32_bytes[3]); + let __v_404: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_400; let __vj = __v_401; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_402; let __vj = __v_403; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_405: G = G::from_u64(1); + let __v_406: G = (__v_404 - __v_405); + let __v_407: G = G::from_u64(2); + let __v_408: G = (__v_404 - __v_407); + let __v_409: G = (__v_406 * __v_408); + let __v_410: G = (__v_404 * __v_409); + let __v_411: G = G::from_u64(0); + if (__v_410 != __v_411) { + return Err(ExecError::AssertEqMismatch { lhs: __v_410.as_canonical_u64(), rhs: __v_411.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); + } + let __v_412: G = if unconstrained { Bytes2::xor(&__v_379, &__v_400) } else { bytes2_xor_value(__v_379, __v_400, record) }; + let __v_413: G = if unconstrained { Bytes2::xor(&__v_380, &__v_401) } else { bytes2_xor_value(__v_380, __v_401, record) }; + let __v_414: G = if unconstrained { Bytes2::xor(&__v_381, &__v_402) } else { bytes2_xor_value(__v_381, __v_402, record) }; + let __v_415: G = if unconstrained { Bytes2::xor(&__v_378, &__v_403) } else { bytes2_xor_value(__v_378, __v_403, record) }; + let __u32_sum: u128 = u128::from(((__v_314.as_canonical_u64() << 0) | (__v_315.as_canonical_u64() << 8) | (__v_316.as_canonical_u64() << 16) | (__v_317.as_canonical_u64() << 24))) + u128::from(((__v_414.as_canonical_u64() << 0) | (__v_415.as_canonical_u64() << 8) | (__v_412.as_canonical_u64() << 16) | (__v_413.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_553: G = G::from_u8(__u32_bytes[0]); - let __v_554: G = G::from_u8(__u32_bytes[1]); - let __v_555: G = G::from_u8(__u32_bytes[2]); - let __v_556: G = G::from_u8(__u32_bytes[3]); - let __v_557: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_553; let __vj = __v_554; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_555; let __vj = __v_556; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_558: G = G::from_u64(((__v_403.as_canonical_u64() << 0) | (__v_404.as_canonical_u64() << 8) | (__v_405.as_canonical_u64() << 16) | (__v_406.as_canonical_u64() << 24))); - let __v_559: G = G::from_u64(((__v_551.as_canonical_u64() << 0) | (__v_552.as_canonical_u64() << 8) | (__v_549.as_canonical_u64() << 16) | (__v_550.as_canonical_u64() << 24))); - let __v_560: G = G::from_u64(((__v_553.as_canonical_u64() << 0) | (__v_554.as_canonical_u64() << 8) | (__v_555.as_canonical_u64() << 16) | (__v_556.as_canonical_u64() << 24))); - let __v_561: G = (__v_557 * __v_557); - if (__v_561 != __v_557) { - return Err(ExecError::AssertEqMismatch { lhs: __v_561.as_canonical_u64(), rhs: __v_557.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); - } - let __v_562: G = (__v_558 + __v_559); - let __v_563: G = G::from_u64(4294967296); - let __v_564: G = (__v_563 * __v_557); - let __v_565: G = (__v_560 + __v_564); - if (__v_562 != __v_565) { - return Err(ExecError::AssertEqMismatch { lhs: __v_562.as_canonical_u64(), rhs: __v_565.as_canonical_u64(), msg: Some("u32_add: witnessed sum does not match its inputs".to_string()) }); - } - let __v_566: G = if unconstrained { Bytes2::xor(&__v_320, &__v_553) } else { bytes2_xor_value(__v_320, __v_553, record) }; - let __v_567: G = if unconstrained { Bytes2::xor(&__v_326, &__v_554) } else { bytes2_xor_value(__v_326, __v_554, record) }; - let __v_568: G = if unconstrained { Bytes2::xor(&__v_323, &__v_555) } else { bytes2_xor_value(__v_323, __v_555, record) }; - let __v_569: G = if unconstrained { Bytes2::xor(&__v_327, &__v_556) } else { bytes2_xor_value(__v_327, __v_556, record) }; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr4(&__v_567, &__v_568) } else { bytes2_chain_rotr4_value(__v_567, __v_568, record) }; - let __v_570: G = __b2_out.0; - let __v_571: G = __b2_out.1; - let __v_572: G = __b2_out.2; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr4(&__v_569, &__v_566) } else { bytes2_chain_rotr4_value(__v_569, __v_566, record) }; - let __v_573: G = __b2_out.0; - let __v_574: G = __b2_out.1; - let __v_575: G = __b2_out.2; - let __v_576: G = (__v_571 + __v_575); - let __v_577: G = (__v_574 + __v_572); - let __u32_sum: u128 = u128::from(((__v_528.as_canonical_u64() << 0) | (__v_529.as_canonical_u64() << 8) | (__v_530.as_canonical_u64() << 16) | (__v_531.as_canonical_u64() << 24))) + u128::from(((__v_570.as_canonical_u64() << 0) | (__v_576.as_canonical_u64() << 8) | (__v_573.as_canonical_u64() << 16) | (__v_577.as_canonical_u64() << 24))) + u128::from(((__v_100.as_canonical_u64() << 0) | (__v_101.as_canonical_u64() << 8) | (__v_102.as_canonical_u64() << 16) | (__v_103.as_canonical_u64() << 24))); + let __v_416: G = G::from_u8(__u32_bytes[0]); + let __v_417: G = G::from_u8(__u32_bytes[1]); + let __v_418: G = G::from_u8(__u32_bytes[2]); + let __v_419: G = G::from_u8(__u32_bytes[3]); + let __v_420: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_416; let __vj = __v_417; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_418; let __vj = __v_419; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_421: G = (__v_420 * __v_420); + if (__v_421 != __v_420) { + return Err(ExecError::AssertEqMismatch { lhs: __v_421.as_canonical_u64(), rhs: __v_420.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); + } + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_260, &__v_416) } else { bytes2_xor_split4_value(__v_260, __v_416, record) }; + let __v_422: G = __b2_out.0; + let __v_423: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_261, &__v_417) } else { bytes2_xor_split4_value(__v_261, __v_417, record) }; + let __v_424: G = __b2_out.0; + let __v_425: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_262, &__v_418) } else { bytes2_xor_split4_value(__v_262, __v_418, record) }; + let __v_426: G = __b2_out.0; + let __v_427: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_263, &__v_419) } else { bytes2_xor_split4_value(__v_263, __v_419, record) }; + let __v_428: G = __b2_out.0; + let __v_429: G = __b2_out.1; + let __v_430: G = (__v_424 + __v_427); + let __v_431: G = (__v_426 + __v_429); + let __v_432: G = (__v_428 + __v_423); + let __v_433: G = (__v_422 + __v_425); + let __u32_sum: u128 = u128::from(((__v_400.as_canonical_u64() << 0) | (__v_401.as_canonical_u64() << 8) | (__v_402.as_canonical_u64() << 16) | (__v_403.as_canonical_u64() << 24))) + u128::from(((__v_430.as_canonical_u64() << 0) | (__v_431.as_canonical_u64() << 8) | (__v_432.as_canonical_u64() << 16) | (__v_433.as_canonical_u64() << 24))) + u128::from(((__v_100.as_canonical_u64() << 0) | (__v_101.as_canonical_u64() << 8) | (__v_102.as_canonical_u64() << 16) | (__v_103.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_578: G = G::from_u8(__u32_bytes[0]); - let __v_579: G = G::from_u8(__u32_bytes[1]); - let __v_580: G = G::from_u8(__u32_bytes[2]); - let __v_581: G = G::from_u8(__u32_bytes[3]); - let __v_582: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_578; let __vj = __v_579; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_580; let __vj = __v_581; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_583: G = G::from_u64(((__v_528.as_canonical_u64() << 0) | (__v_529.as_canonical_u64() << 8) | (__v_530.as_canonical_u64() << 16) | (__v_531.as_canonical_u64() << 24))); - let __v_584: G = G::from_u64(((__v_570.as_canonical_u64() << 0) | (__v_576.as_canonical_u64() << 8) | (__v_573.as_canonical_u64() << 16) | (__v_577.as_canonical_u64() << 24))); - let __v_585: G = G::from_u64(((__v_100.as_canonical_u64() << 0) | (__v_101.as_canonical_u64() << 8) | (__v_102.as_canonical_u64() << 16) | (__v_103.as_canonical_u64() << 24))); - let __v_586: G = G::from_u64(((__v_578.as_canonical_u64() << 0) | (__v_579.as_canonical_u64() << 8) | (__v_580.as_canonical_u64() << 16) | (__v_581.as_canonical_u64() << 24))); - let __v_587: G = G::from_u64(1); - let __v_588: G = (__v_582 - __v_587); - let __v_589: G = G::from_u64(2); - let __v_590: G = (__v_582 - __v_589); - let __v_591: G = (__v_588 * __v_590); - let __v_592: G = (__v_582 * __v_591); - let __v_593: G = G::from_u64(0); - if (__v_592 != __v_593) { - return Err(ExecError::AssertEqMismatch { lhs: __v_592.as_canonical_u64(), rhs: __v_593.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); - } - let __v_594: G = (__v_584 + __v_585); - let __v_595: G = (__v_583 + __v_594); - let __v_596: G = G::from_u64(4294967296); - let __v_597: G = (__v_596 * __v_582); - let __v_598: G = (__v_586 + __v_597); - if (__v_595 != __v_598) { - return Err(ExecError::AssertEqMismatch { lhs: __v_595.as_canonical_u64(), rhs: __v_598.as_canonical_u64(), msg: Some("u32_add3: witnessed sum does not match its inputs".to_string()) }); - } - let __v_599: G = if unconstrained { Bytes2::xor(&__v_551, &__v_578) } else { bytes2_xor_value(__v_551, __v_578, record) }; - let __v_600: G = if unconstrained { Bytes2::xor(&__v_552, &__v_579) } else { bytes2_xor_value(__v_552, __v_579, record) }; - let __v_601: G = if unconstrained { Bytes2::xor(&__v_549, &__v_580) } else { bytes2_xor_value(__v_549, __v_580, record) }; - let __v_602: G = if unconstrained { Bytes2::xor(&__v_550, &__v_581) } else { bytes2_xor_value(__v_550, __v_581, record) }; - let __u32_sum: u128 = u128::from(((__v_553.as_canonical_u64() << 0) | (__v_554.as_canonical_u64() << 8) | (__v_555.as_canonical_u64() << 16) | (__v_556.as_canonical_u64() << 24))) + u128::from(((__v_600.as_canonical_u64() << 0) | (__v_601.as_canonical_u64() << 8) | (__v_602.as_canonical_u64() << 16) | (__v_599.as_canonical_u64() << 24))); + let __v_434: G = G::from_u8(__u32_bytes[0]); + let __v_435: G = G::from_u8(__u32_bytes[1]); + let __v_436: G = G::from_u8(__u32_bytes[2]); + let __v_437: G = G::from_u8(__u32_bytes[3]); + let __v_438: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_434; let __vj = __v_435; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_436; let __vj = __v_437; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_439: G = G::from_u64(1); + let __v_440: G = (__v_438 - __v_439); + let __v_441: G = G::from_u64(2); + let __v_442: G = (__v_438 - __v_441); + let __v_443: G = (__v_440 * __v_442); + let __v_444: G = (__v_438 * __v_443); + let __v_445: G = G::from_u64(0); + if (__v_444 != __v_445) { + return Err(ExecError::AssertEqMismatch { lhs: __v_444.as_canonical_u64(), rhs: __v_445.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); + } + let __v_446: G = if unconstrained { Bytes2::xor(&__v_414, &__v_434) } else { bytes2_xor_value(__v_414, __v_434, record) }; + let __v_447: G = if unconstrained { Bytes2::xor(&__v_415, &__v_435) } else { bytes2_xor_value(__v_415, __v_435, record) }; + let __v_448: G = if unconstrained { Bytes2::xor(&__v_412, &__v_436) } else { bytes2_xor_value(__v_412, __v_436, record) }; + let __v_449: G = if unconstrained { Bytes2::xor(&__v_413, &__v_437) } else { bytes2_xor_value(__v_413, __v_437, record) }; + let __u32_sum: u128 = u128::from(((__v_416.as_canonical_u64() << 0) | (__v_417.as_canonical_u64() << 8) | (__v_418.as_canonical_u64() << 16) | (__v_419.as_canonical_u64() << 24))) + u128::from(((__v_447.as_canonical_u64() << 0) | (__v_448.as_canonical_u64() << 8) | (__v_449.as_canonical_u64() << 16) | (__v_446.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_603: G = G::from_u8(__u32_bytes[0]); - let __v_604: G = G::from_u8(__u32_bytes[1]); - let __v_605: G = G::from_u8(__u32_bytes[2]); - let __v_606: G = G::from_u8(__u32_bytes[3]); - let __v_607: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_603; let __vj = __v_604; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_605; let __vj = __v_606; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_608: G = G::from_u64(((__v_553.as_canonical_u64() << 0) | (__v_554.as_canonical_u64() << 8) | (__v_555.as_canonical_u64() << 16) | (__v_556.as_canonical_u64() << 24))); - let __v_609: G = G::from_u64(((__v_600.as_canonical_u64() << 0) | (__v_601.as_canonical_u64() << 8) | (__v_602.as_canonical_u64() << 16) | (__v_599.as_canonical_u64() << 24))); - let __v_610: G = G::from_u64(((__v_603.as_canonical_u64() << 0) | (__v_604.as_canonical_u64() << 8) | (__v_605.as_canonical_u64() << 16) | (__v_606.as_canonical_u64() << 24))); - let __v_611: G = (__v_607 * __v_607); - if (__v_611 != __v_607) { - return Err(ExecError::AssertEqMismatch { lhs: __v_611.as_canonical_u64(), rhs: __v_607.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); - } - let __v_612: G = (__v_608 + __v_609); - let __v_613: G = G::from_u64(4294967296); - let __v_614: G = (__v_613 * __v_607); - let __v_615: G = (__v_610 + __v_614); - if (__v_612 != __v_615) { - return Err(ExecError::AssertEqMismatch { lhs: __v_612.as_canonical_u64(), rhs: __v_615.as_canonical_u64(), msg: Some("u32_add: witnessed sum does not match its inputs".to_string()) }); - } - let __v_616: G = if unconstrained { Bytes2::xor(&__v_570, &__v_603) } else { bytes2_xor_value(__v_570, __v_603, record) }; - let __v_617: G = if unconstrained { Bytes2::xor(&__v_576, &__v_604) } else { bytes2_xor_value(__v_576, __v_604, record) }; - let __v_618: G = if unconstrained { Bytes2::xor(&__v_573, &__v_605) } else { bytes2_xor_value(__v_573, __v_605, record) }; - let __v_619: G = if unconstrained { Bytes2::xor(&__v_577, &__v_606) } else { bytes2_xor_value(__v_577, __v_606, record) }; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr7(&__v_616, &__v_617) } else { bytes2_chain_rotr7_value(__v_616, __v_617, record) }; - let __v_620: G = __b2_out.0; - let __v_621: G = __b2_out.1; - let __v_622: G = __b2_out.2; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr7(&__v_618, &__v_619) } else { bytes2_chain_rotr7_value(__v_618, __v_619, record) }; - let __v_623: G = __b2_out.0; - let __v_624: G = __b2_out.1; - let __v_625: G = __b2_out.2; - let __v_626: G = (__v_621 + __v_625); - let __v_627: G = (__v_624 + __v_622); - let __u32_sum: u128 = u128::from(((__v_278.as_canonical_u64() << 0) | (__v_279.as_canonical_u64() << 8) | (__v_280.as_canonical_u64() << 16) | (__v_281.as_canonical_u64() << 24))) + u128::from(((__v_420.as_canonical_u64() << 0) | (__v_426.as_canonical_u64() << 8) | (__v_423.as_canonical_u64() << 16) | (__v_427.as_canonical_u64() << 24))) + u128::from(((__v_104.as_canonical_u64() << 0) | (__v_105.as_canonical_u64() << 8) | (__v_106.as_canonical_u64() << 16) | (__v_107.as_canonical_u64() << 24))); + let __v_450: G = G::from_u8(__u32_bytes[0]); + let __v_451: G = G::from_u8(__u32_bytes[1]); + let __v_452: G = G::from_u8(__u32_bytes[2]); + let __v_453: G = G::from_u8(__u32_bytes[3]); + let __v_454: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_450; let __vj = __v_451; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_452; let __vj = __v_453; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_455: G = (__v_454 * __v_454); + if (__v_455 != __v_454) { + return Err(ExecError::AssertEqMismatch { lhs: __v_455.as_canonical_u64(), rhs: __v_454.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); + } + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_430, &__v_450) } else { bytes2_xor_split7_value(__v_430, __v_450, record) }; + let __v_456: G = __b2_out.0; + let __v_457: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_431, &__v_451) } else { bytes2_xor_split7_value(__v_431, __v_451, record) }; + let __v_458: G = __b2_out.0; + let __v_459: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_432, &__v_452) } else { bytes2_xor_split7_value(__v_432, __v_452, record) }; + let __v_460: G = __b2_out.0; + let __v_461: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_433, &__v_453) } else { bytes2_xor_split7_value(__v_433, __v_453, record) }; + let __v_462: G = __b2_out.0; + let __v_463: G = __b2_out.1; + let __v_464: G = (__v_456 + __v_459); + let __v_465: G = (__v_458 + __v_461); + let __v_466: G = (__v_460 + __v_463); + let __v_467: G = (__v_462 + __v_457); + let __u32_sum: u128 = u128::from(((__v_230.as_canonical_u64() << 0) | (__v_231.as_canonical_u64() << 8) | (__v_232.as_canonical_u64() << 16) | (__v_233.as_canonical_u64() << 24))) + u128::from(((__v_328.as_canonical_u64() << 0) | (__v_329.as_canonical_u64() << 8) | (__v_330.as_canonical_u64() << 16) | (__v_331.as_canonical_u64() << 24))) + u128::from(((__v_104.as_canonical_u64() << 0) | (__v_105.as_canonical_u64() << 8) | (__v_106.as_canonical_u64() << 16) | (__v_107.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_628: G = G::from_u8(__u32_bytes[0]); - let __v_629: G = G::from_u8(__u32_bytes[1]); - let __v_630: G = G::from_u8(__u32_bytes[2]); - let __v_631: G = G::from_u8(__u32_bytes[3]); - let __v_632: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_628; let __vj = __v_629; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_630; let __vj = __v_631; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_633: G = G::from_u64(((__v_278.as_canonical_u64() << 0) | (__v_279.as_canonical_u64() << 8) | (__v_280.as_canonical_u64() << 16) | (__v_281.as_canonical_u64() << 24))); - let __v_634: G = G::from_u64(((__v_420.as_canonical_u64() << 0) | (__v_426.as_canonical_u64() << 8) | (__v_423.as_canonical_u64() << 16) | (__v_427.as_canonical_u64() << 24))); - let __v_635: G = G::from_u64(((__v_104.as_canonical_u64() << 0) | (__v_105.as_canonical_u64() << 8) | (__v_106.as_canonical_u64() << 16) | (__v_107.as_canonical_u64() << 24))); - let __v_636: G = G::from_u64(((__v_628.as_canonical_u64() << 0) | (__v_629.as_canonical_u64() << 8) | (__v_630.as_canonical_u64() << 16) | (__v_631.as_canonical_u64() << 24))); - let __v_637: G = G::from_u64(1); - let __v_638: G = (__v_632 - __v_637); - let __v_639: G = G::from_u64(2); - let __v_640: G = (__v_632 - __v_639); - let __v_641: G = (__v_638 * __v_640); - let __v_642: G = (__v_632 * __v_641); - let __v_643: G = G::from_u64(0); - if (__v_642 != __v_643) { - return Err(ExecError::AssertEqMismatch { lhs: __v_642.as_canonical_u64(), rhs: __v_643.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); - } - let __v_644: G = (__v_634 + __v_635); - let __v_645: G = (__v_633 + __v_644); - let __v_646: G = G::from_u64(4294967296); - let __v_647: G = (__v_646 * __v_632); - let __v_648: G = (__v_636 + __v_647); - if (__v_645 != __v_648) { - return Err(ExecError::AssertEqMismatch { lhs: __v_645.as_canonical_u64(), rhs: __v_648.as_canonical_u64(), msg: Some("u32_add3: witnessed sum does not match its inputs".to_string()) }); - } - let __v_649: G = if unconstrained { Bytes2::xor(&__v_200, &__v_628) } else { bytes2_xor_value(__v_200, __v_628, record) }; - let __v_650: G = if unconstrained { Bytes2::xor(&__v_201, &__v_629) } else { bytes2_xor_value(__v_201, __v_629, record) }; - let __v_651: G = if unconstrained { Bytes2::xor(&__v_202, &__v_630) } else { bytes2_xor_value(__v_202, __v_630, record) }; - let __v_652: G = if unconstrained { Bytes2::xor(&__v_199, &__v_631) } else { bytes2_xor_value(__v_199, __v_631, record) }; - let __u32_sum: u128 = u128::from(((__v_503.as_canonical_u64() << 0) | (__v_504.as_canonical_u64() << 8) | (__v_505.as_canonical_u64() << 16) | (__v_506.as_canonical_u64() << 24))) + u128::from(((__v_651.as_canonical_u64() << 0) | (__v_652.as_canonical_u64() << 8) | (__v_649.as_canonical_u64() << 16) | (__v_650.as_canonical_u64() << 24))); + let __v_468: G = G::from_u8(__u32_bytes[0]); + let __v_469: G = G::from_u8(__u32_bytes[1]); + let __v_470: G = G::from_u8(__u32_bytes[2]); + let __v_471: G = G::from_u8(__u32_bytes[3]); + let __v_472: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_468; let __vj = __v_469; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_470; let __vj = __v_471; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_473: G = G::from_u64(1); + let __v_474: G = (__v_472 - __v_473); + let __v_475: G = G::from_u64(2); + let __v_476: G = (__v_472 - __v_475); + let __v_477: G = (__v_474 * __v_476); + let __v_478: G = (__v_472 * __v_477); + let __v_479: G = G::from_u64(0); + if (__v_478 != __v_479) { + return Err(ExecError::AssertEqMismatch { lhs: __v_478.as_canonical_u64(), rhs: __v_479.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); + } + let __v_480: G = if unconstrained { Bytes2::xor(&__v_175, &__v_468) } else { bytes2_xor_value(__v_175, __v_468, record) }; + let __v_481: G = if unconstrained { Bytes2::xor(&__v_176, &__v_469) } else { bytes2_xor_value(__v_176, __v_469, record) }; + let __v_482: G = if unconstrained { Bytes2::xor(&__v_177, &__v_470) } else { bytes2_xor_value(__v_177, __v_470, record) }; + let __v_483: G = if unconstrained { Bytes2::xor(&__v_174, &__v_471) } else { bytes2_xor_value(__v_174, __v_471, record) }; + let __u32_sum: u128 = u128::from(((__v_382.as_canonical_u64() << 0) | (__v_383.as_canonical_u64() << 8) | (__v_384.as_canonical_u64() << 16) | (__v_385.as_canonical_u64() << 24))) + u128::from(((__v_482.as_canonical_u64() << 0) | (__v_483.as_canonical_u64() << 8) | (__v_480.as_canonical_u64() << 16) | (__v_481.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_653: G = G::from_u8(__u32_bytes[0]); - let __v_654: G = G::from_u8(__u32_bytes[1]); - let __v_655: G = G::from_u8(__u32_bytes[2]); - let __v_656: G = G::from_u8(__u32_bytes[3]); - let __v_657: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_653; let __vj = __v_654; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_655; let __vj = __v_656; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_658: G = G::from_u64(((__v_503.as_canonical_u64() << 0) | (__v_504.as_canonical_u64() << 8) | (__v_505.as_canonical_u64() << 16) | (__v_506.as_canonical_u64() << 24))); - let __v_659: G = G::from_u64(((__v_651.as_canonical_u64() << 0) | (__v_652.as_canonical_u64() << 8) | (__v_649.as_canonical_u64() << 16) | (__v_650.as_canonical_u64() << 24))); - let __v_660: G = G::from_u64(((__v_653.as_canonical_u64() << 0) | (__v_654.as_canonical_u64() << 8) | (__v_655.as_canonical_u64() << 16) | (__v_656.as_canonical_u64() << 24))); - let __v_661: G = (__v_657 * __v_657); - if (__v_661 != __v_657) { - return Err(ExecError::AssertEqMismatch { lhs: __v_661.as_canonical_u64(), rhs: __v_657.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); - } - let __v_662: G = (__v_658 + __v_659); - let __v_663: G = G::from_u64(4294967296); - let __v_664: G = (__v_663 * __v_657); - let __v_665: G = (__v_660 + __v_664); - if (__v_662 != __v_665) { - return Err(ExecError::AssertEqMismatch { lhs: __v_662.as_canonical_u64(), rhs: __v_665.as_canonical_u64(), msg: Some("u32_add: witnessed sum does not match its inputs".to_string()) }); - } - let __v_666: G = if unconstrained { Bytes2::xor(&__v_420, &__v_653) } else { bytes2_xor_value(__v_420, __v_653, record) }; - let __v_667: G = if unconstrained { Bytes2::xor(&__v_426, &__v_654) } else { bytes2_xor_value(__v_426, __v_654, record) }; - let __v_668: G = if unconstrained { Bytes2::xor(&__v_423, &__v_655) } else { bytes2_xor_value(__v_423, __v_655, record) }; - let __v_669: G = if unconstrained { Bytes2::xor(&__v_427, &__v_656) } else { bytes2_xor_value(__v_427, __v_656, record) }; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr4(&__v_667, &__v_668) } else { bytes2_chain_rotr4_value(__v_667, __v_668, record) }; - let __v_670: G = __b2_out.0; - let __v_671: G = __b2_out.1; - let __v_672: G = __b2_out.2; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr4(&__v_669, &__v_666) } else { bytes2_chain_rotr4_value(__v_669, __v_666, record) }; - let __v_673: G = __b2_out.0; - let __v_674: G = __b2_out.1; - let __v_675: G = __b2_out.2; - let __v_676: G = (__v_671 + __v_675); - let __v_677: G = (__v_674 + __v_672); - let __u32_sum: u128 = u128::from(((__v_628.as_canonical_u64() << 0) | (__v_629.as_canonical_u64() << 8) | (__v_630.as_canonical_u64() << 16) | (__v_631.as_canonical_u64() << 24))) + u128::from(((__v_670.as_canonical_u64() << 0) | (__v_676.as_canonical_u64() << 8) | (__v_673.as_canonical_u64() << 16) | (__v_677.as_canonical_u64() << 24))) + u128::from(((__v_108.as_canonical_u64() << 0) | (__v_109.as_canonical_u64() << 8) | (__v_110.as_canonical_u64() << 16) | (__v_111.as_canonical_u64() << 24))); + let __v_484: G = G::from_u8(__u32_bytes[0]); + let __v_485: G = G::from_u8(__u32_bytes[1]); + let __v_486: G = G::from_u8(__u32_bytes[2]); + let __v_487: G = G::from_u8(__u32_bytes[3]); + let __v_488: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_484; let __vj = __v_485; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_486; let __vj = __v_487; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_489: G = (__v_488 * __v_488); + if (__v_489 != __v_488) { + return Err(ExecError::AssertEqMismatch { lhs: __v_489.as_canonical_u64(), rhs: __v_488.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); + } + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_328, &__v_484) } else { bytes2_xor_split4_value(__v_328, __v_484, record) }; + let __v_490: G = __b2_out.0; + let __v_491: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_329, &__v_485) } else { bytes2_xor_split4_value(__v_329, __v_485, record) }; + let __v_492: G = __b2_out.0; + let __v_493: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_330, &__v_486) } else { bytes2_xor_split4_value(__v_330, __v_486, record) }; + let __v_494: G = __b2_out.0; + let __v_495: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_331, &__v_487) } else { bytes2_xor_split4_value(__v_331, __v_487, record) }; + let __v_496: G = __b2_out.0; + let __v_497: G = __b2_out.1; + let __v_498: G = (__v_492 + __v_495); + let __v_499: G = (__v_494 + __v_497); + let __v_500: G = (__v_496 + __v_491); + let __v_501: G = (__v_490 + __v_493); + let __u32_sum: u128 = u128::from(((__v_468.as_canonical_u64() << 0) | (__v_469.as_canonical_u64() << 8) | (__v_470.as_canonical_u64() << 16) | (__v_471.as_canonical_u64() << 24))) + u128::from(((__v_498.as_canonical_u64() << 0) | (__v_499.as_canonical_u64() << 8) | (__v_500.as_canonical_u64() << 16) | (__v_501.as_canonical_u64() << 24))) + u128::from(((__v_108.as_canonical_u64() << 0) | (__v_109.as_canonical_u64() << 8) | (__v_110.as_canonical_u64() << 16) | (__v_111.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_678: G = G::from_u8(__u32_bytes[0]); - let __v_679: G = G::from_u8(__u32_bytes[1]); - let __v_680: G = G::from_u8(__u32_bytes[2]); - let __v_681: G = G::from_u8(__u32_bytes[3]); - let __v_682: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_678; let __vj = __v_679; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_680; let __vj = __v_681; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_683: G = G::from_u64(((__v_628.as_canonical_u64() << 0) | (__v_629.as_canonical_u64() << 8) | (__v_630.as_canonical_u64() << 16) | (__v_631.as_canonical_u64() << 24))); - let __v_684: G = G::from_u64(((__v_670.as_canonical_u64() << 0) | (__v_676.as_canonical_u64() << 8) | (__v_673.as_canonical_u64() << 16) | (__v_677.as_canonical_u64() << 24))); - let __v_685: G = G::from_u64(((__v_108.as_canonical_u64() << 0) | (__v_109.as_canonical_u64() << 8) | (__v_110.as_canonical_u64() << 16) | (__v_111.as_canonical_u64() << 24))); - let __v_686: G = G::from_u64(((__v_678.as_canonical_u64() << 0) | (__v_679.as_canonical_u64() << 8) | (__v_680.as_canonical_u64() << 16) | (__v_681.as_canonical_u64() << 24))); - let __v_687: G = G::from_u64(1); - let __v_688: G = (__v_682 - __v_687); - let __v_689: G = G::from_u64(2); - let __v_690: G = (__v_682 - __v_689); - let __v_691: G = (__v_688 * __v_690); - let __v_692: G = (__v_682 * __v_691); - let __v_693: G = G::from_u64(0); - if (__v_692 != __v_693) { - return Err(ExecError::AssertEqMismatch { lhs: __v_692.as_canonical_u64(), rhs: __v_693.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); - } - let __v_694: G = (__v_684 + __v_685); - let __v_695: G = (__v_683 + __v_694); - let __v_696: G = G::from_u64(4294967296); - let __v_697: G = (__v_696 * __v_682); - let __v_698: G = (__v_686 + __v_697); - if (__v_695 != __v_698) { - return Err(ExecError::AssertEqMismatch { lhs: __v_695.as_canonical_u64(), rhs: __v_698.as_canonical_u64(), msg: Some("u32_add3: witnessed sum does not match its inputs".to_string()) }); - } - let __v_699: G = if unconstrained { Bytes2::xor(&__v_651, &__v_678) } else { bytes2_xor_value(__v_651, __v_678, record) }; - let __v_700: G = if unconstrained { Bytes2::xor(&__v_652, &__v_679) } else { bytes2_xor_value(__v_652, __v_679, record) }; - let __v_701: G = if unconstrained { Bytes2::xor(&__v_649, &__v_680) } else { bytes2_xor_value(__v_649, __v_680, record) }; - let __v_702: G = if unconstrained { Bytes2::xor(&__v_650, &__v_681) } else { bytes2_xor_value(__v_650, __v_681, record) }; - let __u32_sum: u128 = u128::from(((__v_653.as_canonical_u64() << 0) | (__v_654.as_canonical_u64() << 8) | (__v_655.as_canonical_u64() << 16) | (__v_656.as_canonical_u64() << 24))) + u128::from(((__v_700.as_canonical_u64() << 0) | (__v_701.as_canonical_u64() << 8) | (__v_702.as_canonical_u64() << 16) | (__v_699.as_canonical_u64() << 24))); + let __v_502: G = G::from_u8(__u32_bytes[0]); + let __v_503: G = G::from_u8(__u32_bytes[1]); + let __v_504: G = G::from_u8(__u32_bytes[2]); + let __v_505: G = G::from_u8(__u32_bytes[3]); + let __v_506: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_502; let __vj = __v_503; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_504; let __vj = __v_505; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_507: G = G::from_u64(1); + let __v_508: G = (__v_506 - __v_507); + let __v_509: G = G::from_u64(2); + let __v_510: G = (__v_506 - __v_509); + let __v_511: G = (__v_508 * __v_510); + let __v_512: G = (__v_506 * __v_511); + let __v_513: G = G::from_u64(0); + if (__v_512 != __v_513) { + return Err(ExecError::AssertEqMismatch { lhs: __v_512.as_canonical_u64(), rhs: __v_513.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); + } + let __v_514: G = if unconstrained { Bytes2::xor(&__v_482, &__v_502) } else { bytes2_xor_value(__v_482, __v_502, record) }; + let __v_515: G = if unconstrained { Bytes2::xor(&__v_483, &__v_503) } else { bytes2_xor_value(__v_483, __v_503, record) }; + let __v_516: G = if unconstrained { Bytes2::xor(&__v_480, &__v_504) } else { bytes2_xor_value(__v_480, __v_504, record) }; + let __v_517: G = if unconstrained { Bytes2::xor(&__v_481, &__v_505) } else { bytes2_xor_value(__v_481, __v_505, record) }; + let __u32_sum: u128 = u128::from(((__v_484.as_canonical_u64() << 0) | (__v_485.as_canonical_u64() << 8) | (__v_486.as_canonical_u64() << 16) | (__v_487.as_canonical_u64() << 24))) + u128::from(((__v_515.as_canonical_u64() << 0) | (__v_516.as_canonical_u64() << 8) | (__v_517.as_canonical_u64() << 16) | (__v_514.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_703: G = G::from_u8(__u32_bytes[0]); - let __v_704: G = G::from_u8(__u32_bytes[1]); - let __v_705: G = G::from_u8(__u32_bytes[2]); - let __v_706: G = G::from_u8(__u32_bytes[3]); - let __v_707: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_703; let __vj = __v_704; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_705; let __vj = __v_706; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_708: G = G::from_u64(((__v_653.as_canonical_u64() << 0) | (__v_654.as_canonical_u64() << 8) | (__v_655.as_canonical_u64() << 16) | (__v_656.as_canonical_u64() << 24))); - let __v_709: G = G::from_u64(((__v_700.as_canonical_u64() << 0) | (__v_701.as_canonical_u64() << 8) | (__v_702.as_canonical_u64() << 16) | (__v_699.as_canonical_u64() << 24))); - let __v_710: G = G::from_u64(((__v_703.as_canonical_u64() << 0) | (__v_704.as_canonical_u64() << 8) | (__v_705.as_canonical_u64() << 16) | (__v_706.as_canonical_u64() << 24))); - let __v_711: G = (__v_707 * __v_707); - if (__v_711 != __v_707) { - return Err(ExecError::AssertEqMismatch { lhs: __v_711.as_canonical_u64(), rhs: __v_707.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); - } - let __v_712: G = (__v_708 + __v_709); - let __v_713: G = G::from_u64(4294967296); - let __v_714: G = (__v_713 * __v_707); - let __v_715: G = (__v_710 + __v_714); - if (__v_712 != __v_715) { - return Err(ExecError::AssertEqMismatch { lhs: __v_712.as_canonical_u64(), rhs: __v_715.as_canonical_u64(), msg: Some("u32_add: witnessed sum does not match its inputs".to_string()) }); - } - let __v_716: G = if unconstrained { Bytes2::xor(&__v_670, &__v_703) } else { bytes2_xor_value(__v_670, __v_703, record) }; - let __v_717: G = if unconstrained { Bytes2::xor(&__v_676, &__v_704) } else { bytes2_xor_value(__v_676, __v_704, record) }; - let __v_718: G = if unconstrained { Bytes2::xor(&__v_673, &__v_705) } else { bytes2_xor_value(__v_673, __v_705, record) }; - let __v_719: G = if unconstrained { Bytes2::xor(&__v_677, &__v_706) } else { bytes2_xor_value(__v_677, __v_706, record) }; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr7(&__v_716, &__v_717) } else { bytes2_chain_rotr7_value(__v_716, __v_717, record) }; - let __v_720: G = __b2_out.0; - let __v_721: G = __b2_out.1; - let __v_722: G = __b2_out.2; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr7(&__v_718, &__v_719) } else { bytes2_chain_rotr7_value(__v_718, __v_719, record) }; - let __v_723: G = __b2_out.0; - let __v_724: G = __b2_out.1; - let __v_725: G = __b2_out.2; - let __v_726: G = (__v_721 + __v_725); - let __v_727: G = (__v_724 + __v_722); - let __u32_sum: u128 = u128::from(((__v_378.as_canonical_u64() << 0) | (__v_379.as_canonical_u64() << 8) | (__v_380.as_canonical_u64() << 16) | (__v_381.as_canonical_u64() << 24))) + u128::from(((__v_520.as_canonical_u64() << 0) | (__v_526.as_canonical_u64() << 8) | (__v_523.as_canonical_u64() << 16) | (__v_527.as_canonical_u64() << 24))) + u128::from(((__v_112.as_canonical_u64() << 0) | (__v_113.as_canonical_u64() << 8) | (__v_114.as_canonical_u64() << 16) | (__v_115.as_canonical_u64() << 24))); + let __v_518: G = G::from_u8(__u32_bytes[0]); + let __v_519: G = G::from_u8(__u32_bytes[1]); + let __v_520: G = G::from_u8(__u32_bytes[2]); + let __v_521: G = G::from_u8(__u32_bytes[3]); + let __v_522: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_518; let __vj = __v_519; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_520; let __vj = __v_521; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_523: G = (__v_522 * __v_522); + if (__v_523 != __v_522) { + return Err(ExecError::AssertEqMismatch { lhs: __v_523.as_canonical_u64(), rhs: __v_522.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); + } + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_498, &__v_518) } else { bytes2_xor_split7_value(__v_498, __v_518, record) }; + let __v_524: G = __b2_out.0; + let __v_525: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_499, &__v_519) } else { bytes2_xor_split7_value(__v_499, __v_519, record) }; + let __v_526: G = __b2_out.0; + let __v_527: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_500, &__v_520) } else { bytes2_xor_split7_value(__v_500, __v_520, record) }; + let __v_528: G = __b2_out.0; + let __v_529: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_501, &__v_521) } else { bytes2_xor_split7_value(__v_501, __v_521, record) }; + let __v_530: G = __b2_out.0; + let __v_531: G = __b2_out.1; + let __v_532: G = (__v_524 + __v_527); + let __v_533: G = (__v_526 + __v_529); + let __v_534: G = (__v_528 + __v_531); + let __v_535: G = (__v_530 + __v_525); + let __u32_sum: u128 = u128::from(((__v_298.as_canonical_u64() << 0) | (__v_299.as_canonical_u64() << 8) | (__v_300.as_canonical_u64() << 16) | (__v_301.as_canonical_u64() << 24))) + u128::from(((__v_396.as_canonical_u64() << 0) | (__v_397.as_canonical_u64() << 8) | (__v_398.as_canonical_u64() << 16) | (__v_399.as_canonical_u64() << 24))) + u128::from(((__v_112.as_canonical_u64() << 0) | (__v_113.as_canonical_u64() << 8) | (__v_114.as_canonical_u64() << 16) | (__v_115.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_728: G = G::from_u8(__u32_bytes[0]); - let __v_729: G = G::from_u8(__u32_bytes[1]); - let __v_730: G = G::from_u8(__u32_bytes[2]); - let __v_731: G = G::from_u8(__u32_bytes[3]); - let __v_732: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_728; let __vj = __v_729; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_730; let __vj = __v_731; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_733: G = G::from_u64(((__v_378.as_canonical_u64() << 0) | (__v_379.as_canonical_u64() << 8) | (__v_380.as_canonical_u64() << 16) | (__v_381.as_canonical_u64() << 24))); - let __v_734: G = G::from_u64(((__v_520.as_canonical_u64() << 0) | (__v_526.as_canonical_u64() << 8) | (__v_523.as_canonical_u64() << 16) | (__v_527.as_canonical_u64() << 24))); - let __v_735: G = G::from_u64(((__v_112.as_canonical_u64() << 0) | (__v_113.as_canonical_u64() << 8) | (__v_114.as_canonical_u64() << 16) | (__v_115.as_canonical_u64() << 24))); - let __v_736: G = G::from_u64(((__v_728.as_canonical_u64() << 0) | (__v_729.as_canonical_u64() << 8) | (__v_730.as_canonical_u64() << 16) | (__v_731.as_canonical_u64() << 24))); - let __v_737: G = G::from_u64(1); - let __v_738: G = (__v_732 - __v_737); - let __v_739: G = G::from_u64(2); - let __v_740: G = (__v_732 - __v_739); - let __v_741: G = (__v_738 * __v_740); - let __v_742: G = (__v_732 * __v_741); - let __v_743: G = G::from_u64(0); - if (__v_742 != __v_743) { - return Err(ExecError::AssertEqMismatch { lhs: __v_742.as_canonical_u64(), rhs: __v_743.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); - } - let __v_744: G = (__v_734 + __v_735); - let __v_745: G = (__v_733 + __v_744); - let __v_746: G = G::from_u64(4294967296); - let __v_747: G = (__v_746 * __v_732); - let __v_748: G = (__v_736 + __v_747); - if (__v_745 != __v_748) { - return Err(ExecError::AssertEqMismatch { lhs: __v_745.as_canonical_u64(), rhs: __v_748.as_canonical_u64(), msg: Some("u32_add3: witnessed sum does not match its inputs".to_string()) }); - } - let __v_749: G = if unconstrained { Bytes2::xor(&__v_300, &__v_728) } else { bytes2_xor_value(__v_300, __v_728, record) }; - let __v_750: G = if unconstrained { Bytes2::xor(&__v_301, &__v_729) } else { bytes2_xor_value(__v_301, __v_729, record) }; - let __v_751: G = if unconstrained { Bytes2::xor(&__v_302, &__v_730) } else { bytes2_xor_value(__v_302, __v_730, record) }; - let __v_752: G = if unconstrained { Bytes2::xor(&__v_299, &__v_731) } else { bytes2_xor_value(__v_299, __v_731, record) }; - let __u32_sum: u128 = u128::from(((__v_203.as_canonical_u64() << 0) | (__v_204.as_canonical_u64() << 8) | (__v_205.as_canonical_u64() << 16) | (__v_206.as_canonical_u64() << 24))) + u128::from(((__v_751.as_canonical_u64() << 0) | (__v_752.as_canonical_u64() << 8) | (__v_749.as_canonical_u64() << 16) | (__v_750.as_canonical_u64() << 24))); + let __v_536: G = G::from_u8(__u32_bytes[0]); + let __v_537: G = G::from_u8(__u32_bytes[1]); + let __v_538: G = G::from_u8(__u32_bytes[2]); + let __v_539: G = G::from_u8(__u32_bytes[3]); + let __v_540: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_536; let __vj = __v_537; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_538; let __vj = __v_539; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_541: G = G::from_u64(1); + let __v_542: G = (__v_540 - __v_541); + let __v_543: G = G::from_u64(2); + let __v_544: G = (__v_540 - __v_543); + let __v_545: G = (__v_542 * __v_544); + let __v_546: G = (__v_540 * __v_545); + let __v_547: G = G::from_u64(0); + if (__v_546 != __v_547) { + return Err(ExecError::AssertEqMismatch { lhs: __v_546.as_canonical_u64(), rhs: __v_547.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); + } + let __v_548: G = if unconstrained { Bytes2::xor(&__v_243, &__v_536) } else { bytes2_xor_value(__v_243, __v_536, record) }; + let __v_549: G = if unconstrained { Bytes2::xor(&__v_244, &__v_537) } else { bytes2_xor_value(__v_244, __v_537, record) }; + let __v_550: G = if unconstrained { Bytes2::xor(&__v_245, &__v_538) } else { bytes2_xor_value(__v_245, __v_538, record) }; + let __v_551: G = if unconstrained { Bytes2::xor(&__v_242, &__v_539) } else { bytes2_xor_value(__v_242, __v_539, record) }; + let __u32_sum: u128 = u128::from(((__v_178.as_canonical_u64() << 0) | (__v_179.as_canonical_u64() << 8) | (__v_180.as_canonical_u64() << 16) | (__v_181.as_canonical_u64() << 24))) + u128::from(((__v_550.as_canonical_u64() << 0) | (__v_551.as_canonical_u64() << 8) | (__v_548.as_canonical_u64() << 16) | (__v_549.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_753: G = G::from_u8(__u32_bytes[0]); - let __v_754: G = G::from_u8(__u32_bytes[1]); - let __v_755: G = G::from_u8(__u32_bytes[2]); - let __v_756: G = G::from_u8(__u32_bytes[3]); - let __v_757: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_753; let __vj = __v_754; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_755; let __vj = __v_756; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_758: G = G::from_u64(((__v_203.as_canonical_u64() << 0) | (__v_204.as_canonical_u64() << 8) | (__v_205.as_canonical_u64() << 16) | (__v_206.as_canonical_u64() << 24))); - let __v_759: G = G::from_u64(((__v_751.as_canonical_u64() << 0) | (__v_752.as_canonical_u64() << 8) | (__v_749.as_canonical_u64() << 16) | (__v_750.as_canonical_u64() << 24))); - let __v_760: G = G::from_u64(((__v_753.as_canonical_u64() << 0) | (__v_754.as_canonical_u64() << 8) | (__v_755.as_canonical_u64() << 16) | (__v_756.as_canonical_u64() << 24))); - let __v_761: G = (__v_757 * __v_757); - if (__v_761 != __v_757) { - return Err(ExecError::AssertEqMismatch { lhs: __v_761.as_canonical_u64(), rhs: __v_757.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); - } - let __v_762: G = (__v_758 + __v_759); - let __v_763: G = G::from_u64(4294967296); - let __v_764: G = (__v_763 * __v_757); - let __v_765: G = (__v_760 + __v_764); - if (__v_762 != __v_765) { - return Err(ExecError::AssertEqMismatch { lhs: __v_762.as_canonical_u64(), rhs: __v_765.as_canonical_u64(), msg: Some("u32_add: witnessed sum does not match its inputs".to_string()) }); - } - let __v_766: G = if unconstrained { Bytes2::xor(&__v_520, &__v_753) } else { bytes2_xor_value(__v_520, __v_753, record) }; - let __v_767: G = if unconstrained { Bytes2::xor(&__v_526, &__v_754) } else { bytes2_xor_value(__v_526, __v_754, record) }; - let __v_768: G = if unconstrained { Bytes2::xor(&__v_523, &__v_755) } else { bytes2_xor_value(__v_523, __v_755, record) }; - let __v_769: G = if unconstrained { Bytes2::xor(&__v_527, &__v_756) } else { bytes2_xor_value(__v_527, __v_756, record) }; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr4(&__v_767, &__v_768) } else { bytes2_chain_rotr4_value(__v_767, __v_768, record) }; - let __v_770: G = __b2_out.0; - let __v_771: G = __b2_out.1; - let __v_772: G = __b2_out.2; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr4(&__v_769, &__v_766) } else { bytes2_chain_rotr4_value(__v_769, __v_766, record) }; - let __v_773: G = __b2_out.0; - let __v_774: G = __b2_out.1; - let __v_775: G = __b2_out.2; - let __v_776: G = (__v_771 + __v_775); - let __v_777: G = (__v_774 + __v_772); - let __u32_sum: u128 = u128::from(((__v_728.as_canonical_u64() << 0) | (__v_729.as_canonical_u64() << 8) | (__v_730.as_canonical_u64() << 16) | (__v_731.as_canonical_u64() << 24))) + u128::from(((__v_770.as_canonical_u64() << 0) | (__v_776.as_canonical_u64() << 8) | (__v_773.as_canonical_u64() << 16) | (__v_777.as_canonical_u64() << 24))) + u128::from(((__v_116.as_canonical_u64() << 0) | (__v_117.as_canonical_u64() << 8) | (__v_118.as_canonical_u64() << 16) | (__v_119.as_canonical_u64() << 24))); + let __v_552: G = G::from_u8(__u32_bytes[0]); + let __v_553: G = G::from_u8(__u32_bytes[1]); + let __v_554: G = G::from_u8(__u32_bytes[2]); + let __v_555: G = G::from_u8(__u32_bytes[3]); + let __v_556: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_552; let __vj = __v_553; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_554; let __vj = __v_555; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_557: G = (__v_556 * __v_556); + if (__v_557 != __v_556) { + return Err(ExecError::AssertEqMismatch { lhs: __v_557.as_canonical_u64(), rhs: __v_556.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); + } + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_396, &__v_552) } else { bytes2_xor_split4_value(__v_396, __v_552, record) }; + let __v_558: G = __b2_out.0; + let __v_559: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_397, &__v_553) } else { bytes2_xor_split4_value(__v_397, __v_553, record) }; + let __v_560: G = __b2_out.0; + let __v_561: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_398, &__v_554) } else { bytes2_xor_split4_value(__v_398, __v_554, record) }; + let __v_562: G = __b2_out.0; + let __v_563: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_399, &__v_555) } else { bytes2_xor_split4_value(__v_399, __v_555, record) }; + let __v_564: G = __b2_out.0; + let __v_565: G = __b2_out.1; + let __v_566: G = (__v_560 + __v_563); + let __v_567: G = (__v_562 + __v_565); + let __v_568: G = (__v_564 + __v_559); + let __v_569: G = (__v_558 + __v_561); + let __u32_sum: u128 = u128::from(((__v_536.as_canonical_u64() << 0) | (__v_537.as_canonical_u64() << 8) | (__v_538.as_canonical_u64() << 16) | (__v_539.as_canonical_u64() << 24))) + u128::from(((__v_566.as_canonical_u64() << 0) | (__v_567.as_canonical_u64() << 8) | (__v_568.as_canonical_u64() << 16) | (__v_569.as_canonical_u64() << 24))) + u128::from(((__v_116.as_canonical_u64() << 0) | (__v_117.as_canonical_u64() << 8) | (__v_118.as_canonical_u64() << 16) | (__v_119.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_778: G = G::from_u8(__u32_bytes[0]); - let __v_779: G = G::from_u8(__u32_bytes[1]); - let __v_780: G = G::from_u8(__u32_bytes[2]); - let __v_781: G = G::from_u8(__u32_bytes[3]); - let __v_782: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_778; let __vj = __v_779; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_780; let __vj = __v_781; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_783: G = G::from_u64(((__v_728.as_canonical_u64() << 0) | (__v_729.as_canonical_u64() << 8) | (__v_730.as_canonical_u64() << 16) | (__v_731.as_canonical_u64() << 24))); - let __v_784: G = G::from_u64(((__v_770.as_canonical_u64() << 0) | (__v_776.as_canonical_u64() << 8) | (__v_773.as_canonical_u64() << 16) | (__v_777.as_canonical_u64() << 24))); - let __v_785: G = G::from_u64(((__v_116.as_canonical_u64() << 0) | (__v_117.as_canonical_u64() << 8) | (__v_118.as_canonical_u64() << 16) | (__v_119.as_canonical_u64() << 24))); - let __v_786: G = G::from_u64(((__v_778.as_canonical_u64() << 0) | (__v_779.as_canonical_u64() << 8) | (__v_780.as_canonical_u64() << 16) | (__v_781.as_canonical_u64() << 24))); - let __v_787: G = G::from_u64(1); - let __v_788: G = (__v_782 - __v_787); - let __v_789: G = G::from_u64(2); - let __v_790: G = (__v_782 - __v_789); - let __v_791: G = (__v_788 * __v_790); - let __v_792: G = (__v_782 * __v_791); - let __v_793: G = G::from_u64(0); - if (__v_792 != __v_793) { - return Err(ExecError::AssertEqMismatch { lhs: __v_792.as_canonical_u64(), rhs: __v_793.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); - } - let __v_794: G = (__v_784 + __v_785); - let __v_795: G = (__v_783 + __v_794); - let __v_796: G = G::from_u64(4294967296); - let __v_797: G = (__v_796 * __v_782); - let __v_798: G = (__v_786 + __v_797); - if (__v_795 != __v_798) { - return Err(ExecError::AssertEqMismatch { lhs: __v_795.as_canonical_u64(), rhs: __v_798.as_canonical_u64(), msg: Some("u32_add3: witnessed sum does not match its inputs".to_string()) }); - } - let __v_799: G = if unconstrained { Bytes2::xor(&__v_751, &__v_778) } else { bytes2_xor_value(__v_751, __v_778, record) }; - let __v_800: G = if unconstrained { Bytes2::xor(&__v_752, &__v_779) } else { bytes2_xor_value(__v_752, __v_779, record) }; - let __v_801: G = if unconstrained { Bytes2::xor(&__v_749, &__v_780) } else { bytes2_xor_value(__v_749, __v_780, record) }; - let __v_802: G = if unconstrained { Bytes2::xor(&__v_750, &__v_781) } else { bytes2_xor_value(__v_750, __v_781, record) }; - let __u32_sum: u128 = u128::from(((__v_753.as_canonical_u64() << 0) | (__v_754.as_canonical_u64() << 8) | (__v_755.as_canonical_u64() << 16) | (__v_756.as_canonical_u64() << 24))) + u128::from(((__v_800.as_canonical_u64() << 0) | (__v_801.as_canonical_u64() << 8) | (__v_802.as_canonical_u64() << 16) | (__v_799.as_canonical_u64() << 24))); + let __v_570: G = G::from_u8(__u32_bytes[0]); + let __v_571: G = G::from_u8(__u32_bytes[1]); + let __v_572: G = G::from_u8(__u32_bytes[2]); + let __v_573: G = G::from_u8(__u32_bytes[3]); + let __v_574: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_570; let __vj = __v_571; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_572; let __vj = __v_573; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_575: G = G::from_u64(1); + let __v_576: G = (__v_574 - __v_575); + let __v_577: G = G::from_u64(2); + let __v_578: G = (__v_574 - __v_577); + let __v_579: G = (__v_576 * __v_578); + let __v_580: G = (__v_574 * __v_579); + let __v_581: G = G::from_u64(0); + if (__v_580 != __v_581) { + return Err(ExecError::AssertEqMismatch { lhs: __v_580.as_canonical_u64(), rhs: __v_581.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); + } + let __v_582: G = if unconstrained { Bytes2::xor(&__v_550, &__v_570) } else { bytes2_xor_value(__v_550, __v_570, record) }; + let __v_583: G = if unconstrained { Bytes2::xor(&__v_551, &__v_571) } else { bytes2_xor_value(__v_551, __v_571, record) }; + let __v_584: G = if unconstrained { Bytes2::xor(&__v_548, &__v_572) } else { bytes2_xor_value(__v_548, __v_572, record) }; + let __v_585: G = if unconstrained { Bytes2::xor(&__v_549, &__v_573) } else { bytes2_xor_value(__v_549, __v_573, record) }; + let __u32_sum: u128 = u128::from(((__v_552.as_canonical_u64() << 0) | (__v_553.as_canonical_u64() << 8) | (__v_554.as_canonical_u64() << 16) | (__v_555.as_canonical_u64() << 24))) + u128::from(((__v_583.as_canonical_u64() << 0) | (__v_584.as_canonical_u64() << 8) | (__v_585.as_canonical_u64() << 16) | (__v_582.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_803: G = G::from_u8(__u32_bytes[0]); - let __v_804: G = G::from_u8(__u32_bytes[1]); - let __v_805: G = G::from_u8(__u32_bytes[2]); - let __v_806: G = G::from_u8(__u32_bytes[3]); - let __v_807: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_803; let __vj = __v_804; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_805; let __vj = __v_806; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_808: G = G::from_u64(((__v_753.as_canonical_u64() << 0) | (__v_754.as_canonical_u64() << 8) | (__v_755.as_canonical_u64() << 16) | (__v_756.as_canonical_u64() << 24))); - let __v_809: G = G::from_u64(((__v_800.as_canonical_u64() << 0) | (__v_801.as_canonical_u64() << 8) | (__v_802.as_canonical_u64() << 16) | (__v_799.as_canonical_u64() << 24))); - let __v_810: G = G::from_u64(((__v_803.as_canonical_u64() << 0) | (__v_804.as_canonical_u64() << 8) | (__v_805.as_canonical_u64() << 16) | (__v_806.as_canonical_u64() << 24))); - let __v_811: G = (__v_807 * __v_807); - if (__v_811 != __v_807) { - return Err(ExecError::AssertEqMismatch { lhs: __v_811.as_canonical_u64(), rhs: __v_807.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); - } - let __v_812: G = (__v_808 + __v_809); - let __v_813: G = G::from_u64(4294967296); - let __v_814: G = (__v_813 * __v_807); - let __v_815: G = (__v_810 + __v_814); - if (__v_812 != __v_815) { - return Err(ExecError::AssertEqMismatch { lhs: __v_812.as_canonical_u64(), rhs: __v_815.as_canonical_u64(), msg: Some("u32_add: witnessed sum does not match its inputs".to_string()) }); - } - let __v_816: G = if unconstrained { Bytes2::xor(&__v_770, &__v_803) } else { bytes2_xor_value(__v_770, __v_803, record) }; - let __v_817: G = if unconstrained { Bytes2::xor(&__v_776, &__v_804) } else { bytes2_xor_value(__v_776, __v_804, record) }; - let __v_818: G = if unconstrained { Bytes2::xor(&__v_773, &__v_805) } else { bytes2_xor_value(__v_773, __v_805, record) }; - let __v_819: G = if unconstrained { Bytes2::xor(&__v_777, &__v_806) } else { bytes2_xor_value(__v_777, __v_806, record) }; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr7(&__v_816, &__v_817) } else { bytes2_chain_rotr7_value(__v_816, __v_817, record) }; - let __v_820: G = __b2_out.0; - let __v_821: G = __b2_out.1; - let __v_822: G = __b2_out.2; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr7(&__v_818, &__v_819) } else { bytes2_chain_rotr7_value(__v_818, __v_819, record) }; - let __v_823: G = __b2_out.0; - let __v_824: G = __b2_out.1; - let __v_825: G = __b2_out.2; - let __v_826: G = (__v_821 + __v_825); - let __v_827: G = (__v_824 + __v_822); - let __u32_sum: u128 = u128::from(((__v_478.as_canonical_u64() << 0) | (__v_479.as_canonical_u64() << 8) | (__v_480.as_canonical_u64() << 16) | (__v_481.as_canonical_u64() << 24))) + u128::from(((__v_220.as_canonical_u64() << 0) | (__v_226.as_canonical_u64() << 8) | (__v_223.as_canonical_u64() << 16) | (__v_227.as_canonical_u64() << 24))) + u128::from(((__v_120.as_canonical_u64() << 0) | (__v_121.as_canonical_u64() << 8) | (__v_122.as_canonical_u64() << 16) | (__v_123.as_canonical_u64() << 24))); + let __v_586: G = G::from_u8(__u32_bytes[0]); + let __v_587: G = G::from_u8(__u32_bytes[1]); + let __v_588: G = G::from_u8(__u32_bytes[2]); + let __v_589: G = G::from_u8(__u32_bytes[3]); + let __v_590: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_586; let __vj = __v_587; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_588; let __vj = __v_589; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_591: G = (__v_590 * __v_590); + if (__v_591 != __v_590) { + return Err(ExecError::AssertEqMismatch { lhs: __v_591.as_canonical_u64(), rhs: __v_590.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); + } + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_566, &__v_586) } else { bytes2_xor_split7_value(__v_566, __v_586, record) }; + let __v_592: G = __b2_out.0; + let __v_593: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_567, &__v_587) } else { bytes2_xor_split7_value(__v_567, __v_587, record) }; + let __v_594: G = __b2_out.0; + let __v_595: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_568, &__v_588) } else { bytes2_xor_split7_value(__v_568, __v_588, record) }; + let __v_596: G = __b2_out.0; + let __v_597: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_569, &__v_589) } else { bytes2_xor_split7_value(__v_569, __v_589, record) }; + let __v_598: G = __b2_out.0; + let __v_599: G = __b2_out.1; + let __v_600: G = (__v_592 + __v_595); + let __v_601: G = (__v_594 + __v_597); + let __v_602: G = (__v_596 + __v_599); + let __v_603: G = (__v_598 + __v_593); + let __u32_sum: u128 = u128::from(((__v_366.as_canonical_u64() << 0) | (__v_367.as_canonical_u64() << 8) | (__v_368.as_canonical_u64() << 16) | (__v_369.as_canonical_u64() << 24))) + u128::from(((__v_192.as_canonical_u64() << 0) | (__v_193.as_canonical_u64() << 8) | (__v_194.as_canonical_u64() << 16) | (__v_195.as_canonical_u64() << 24))) + u128::from(((__v_120.as_canonical_u64() << 0) | (__v_121.as_canonical_u64() << 8) | (__v_122.as_canonical_u64() << 16) | (__v_123.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_828: G = G::from_u8(__u32_bytes[0]); - let __v_829: G = G::from_u8(__u32_bytes[1]); - let __v_830: G = G::from_u8(__u32_bytes[2]); - let __v_831: G = G::from_u8(__u32_bytes[3]); - let __v_832: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_828; let __vj = __v_829; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_830; let __vj = __v_831; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_833: G = G::from_u64(((__v_478.as_canonical_u64() << 0) | (__v_479.as_canonical_u64() << 8) | (__v_480.as_canonical_u64() << 16) | (__v_481.as_canonical_u64() << 24))); - let __v_834: G = G::from_u64(((__v_220.as_canonical_u64() << 0) | (__v_226.as_canonical_u64() << 8) | (__v_223.as_canonical_u64() << 16) | (__v_227.as_canonical_u64() << 24))); - let __v_835: G = G::from_u64(((__v_120.as_canonical_u64() << 0) | (__v_121.as_canonical_u64() << 8) | (__v_122.as_canonical_u64() << 16) | (__v_123.as_canonical_u64() << 24))); - let __v_836: G = G::from_u64(((__v_828.as_canonical_u64() << 0) | (__v_829.as_canonical_u64() << 8) | (__v_830.as_canonical_u64() << 16) | (__v_831.as_canonical_u64() << 24))); - let __v_837: G = G::from_u64(1); - let __v_838: G = (__v_832 - __v_837); - let __v_839: G = G::from_u64(2); - let __v_840: G = (__v_832 - __v_839); - let __v_841: G = (__v_838 * __v_840); - let __v_842: G = (__v_832 * __v_841); - let __v_843: G = G::from_u64(0); - if (__v_842 != __v_843) { - return Err(ExecError::AssertEqMismatch { lhs: __v_842.as_canonical_u64(), rhs: __v_843.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); - } - let __v_844: G = (__v_834 + __v_835); - let __v_845: G = (__v_833 + __v_844); - let __v_846: G = G::from_u64(4294967296); - let __v_847: G = (__v_846 * __v_832); - let __v_848: G = (__v_836 + __v_847); - if (__v_845 != __v_848) { - return Err(ExecError::AssertEqMismatch { lhs: __v_845.as_canonical_u64(), rhs: __v_848.as_canonical_u64(), msg: Some("u32_add3: witnessed sum does not match its inputs".to_string()) }); - } - let __v_849: G = if unconstrained { Bytes2::xor(&__v_400, &__v_828) } else { bytes2_xor_value(__v_400, __v_828, record) }; - let __v_850: G = if unconstrained { Bytes2::xor(&__v_401, &__v_829) } else { bytes2_xor_value(__v_401, __v_829, record) }; - let __v_851: G = if unconstrained { Bytes2::xor(&__v_402, &__v_830) } else { bytes2_xor_value(__v_402, __v_830, record) }; - let __v_852: G = if unconstrained { Bytes2::xor(&__v_399, &__v_831) } else { bytes2_xor_value(__v_399, __v_831, record) }; - let __u32_sum: u128 = u128::from(((__v_303.as_canonical_u64() << 0) | (__v_304.as_canonical_u64() << 8) | (__v_305.as_canonical_u64() << 16) | (__v_306.as_canonical_u64() << 24))) + u128::from(((__v_851.as_canonical_u64() << 0) | (__v_852.as_canonical_u64() << 8) | (__v_849.as_canonical_u64() << 16) | (__v_850.as_canonical_u64() << 24))); + let __v_604: G = G::from_u8(__u32_bytes[0]); + let __v_605: G = G::from_u8(__u32_bytes[1]); + let __v_606: G = G::from_u8(__u32_bytes[2]); + let __v_607: G = G::from_u8(__u32_bytes[3]); + let __v_608: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_604; let __vj = __v_605; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_606; let __vj = __v_607; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_609: G = G::from_u64(1); + let __v_610: G = (__v_608 - __v_609); + let __v_611: G = G::from_u64(2); + let __v_612: G = (__v_608 - __v_611); + let __v_613: G = (__v_610 * __v_612); + let __v_614: G = (__v_608 * __v_613); + let __v_615: G = G::from_u64(0); + if (__v_614 != __v_615) { + return Err(ExecError::AssertEqMismatch { lhs: __v_614.as_canonical_u64(), rhs: __v_615.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); + } + let __v_616: G = if unconstrained { Bytes2::xor(&__v_311, &__v_604) } else { bytes2_xor_value(__v_311, __v_604, record) }; + let __v_617: G = if unconstrained { Bytes2::xor(&__v_312, &__v_605) } else { bytes2_xor_value(__v_312, __v_605, record) }; + let __v_618: G = if unconstrained { Bytes2::xor(&__v_313, &__v_606) } else { bytes2_xor_value(__v_313, __v_606, record) }; + let __v_619: G = if unconstrained { Bytes2::xor(&__v_310, &__v_607) } else { bytes2_xor_value(__v_310, __v_607, record) }; + let __u32_sum: u128 = u128::from(((__v_246.as_canonical_u64() << 0) | (__v_247.as_canonical_u64() << 8) | (__v_248.as_canonical_u64() << 16) | (__v_249.as_canonical_u64() << 24))) + u128::from(((__v_618.as_canonical_u64() << 0) | (__v_619.as_canonical_u64() << 8) | (__v_616.as_canonical_u64() << 16) | (__v_617.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_853: G = G::from_u8(__u32_bytes[0]); - let __v_854: G = G::from_u8(__u32_bytes[1]); - let __v_855: G = G::from_u8(__u32_bytes[2]); - let __v_856: G = G::from_u8(__u32_bytes[3]); - let __v_857: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_853; let __vj = __v_854; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_855; let __vj = __v_856; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_858: G = G::from_u64(((__v_303.as_canonical_u64() << 0) | (__v_304.as_canonical_u64() << 8) | (__v_305.as_canonical_u64() << 16) | (__v_306.as_canonical_u64() << 24))); - let __v_859: G = G::from_u64(((__v_851.as_canonical_u64() << 0) | (__v_852.as_canonical_u64() << 8) | (__v_849.as_canonical_u64() << 16) | (__v_850.as_canonical_u64() << 24))); - let __v_860: G = G::from_u64(((__v_853.as_canonical_u64() << 0) | (__v_854.as_canonical_u64() << 8) | (__v_855.as_canonical_u64() << 16) | (__v_856.as_canonical_u64() << 24))); - let __v_861: G = (__v_857 * __v_857); - if (__v_861 != __v_857) { - return Err(ExecError::AssertEqMismatch { lhs: __v_861.as_canonical_u64(), rhs: __v_857.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); - } - let __v_862: G = (__v_858 + __v_859); - let __v_863: G = G::from_u64(4294967296); - let __v_864: G = (__v_863 * __v_857); - let __v_865: G = (__v_860 + __v_864); - if (__v_862 != __v_865) { - return Err(ExecError::AssertEqMismatch { lhs: __v_862.as_canonical_u64(), rhs: __v_865.as_canonical_u64(), msg: Some("u32_add: witnessed sum does not match its inputs".to_string()) }); - } - let __v_866: G = if unconstrained { Bytes2::xor(&__v_220, &__v_853) } else { bytes2_xor_value(__v_220, __v_853, record) }; - let __v_867: G = if unconstrained { Bytes2::xor(&__v_226, &__v_854) } else { bytes2_xor_value(__v_226, __v_854, record) }; - let __v_868: G = if unconstrained { Bytes2::xor(&__v_223, &__v_855) } else { bytes2_xor_value(__v_223, __v_855, record) }; - let __v_869: G = if unconstrained { Bytes2::xor(&__v_227, &__v_856) } else { bytes2_xor_value(__v_227, __v_856, record) }; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr4(&__v_867, &__v_868) } else { bytes2_chain_rotr4_value(__v_867, __v_868, record) }; - let __v_870: G = __b2_out.0; - let __v_871: G = __b2_out.1; - let __v_872: G = __b2_out.2; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr4(&__v_869, &__v_866) } else { bytes2_chain_rotr4_value(__v_869, __v_866, record) }; - let __v_873: G = __b2_out.0; - let __v_874: G = __b2_out.1; - let __v_875: G = __b2_out.2; - let __v_876: G = (__v_871 + __v_875); - let __v_877: G = (__v_874 + __v_872); - let __u32_sum: u128 = u128::from(((__v_828.as_canonical_u64() << 0) | (__v_829.as_canonical_u64() << 8) | (__v_830.as_canonical_u64() << 16) | (__v_831.as_canonical_u64() << 24))) + u128::from(((__v_870.as_canonical_u64() << 0) | (__v_876.as_canonical_u64() << 8) | (__v_873.as_canonical_u64() << 16) | (__v_877.as_canonical_u64() << 24))) + u128::from(((__v_124.as_canonical_u64() << 0) | (__v_125.as_canonical_u64() << 8) | (__v_126.as_canonical_u64() << 16) | (__v_127.as_canonical_u64() << 24))); + let __v_620: G = G::from_u8(__u32_bytes[0]); + let __v_621: G = G::from_u8(__u32_bytes[1]); + let __v_622: G = G::from_u8(__u32_bytes[2]); + let __v_623: G = G::from_u8(__u32_bytes[3]); + let __v_624: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_620; let __vj = __v_621; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_622; let __vj = __v_623; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_625: G = (__v_624 * __v_624); + if (__v_625 != __v_624) { + return Err(ExecError::AssertEqMismatch { lhs: __v_625.as_canonical_u64(), rhs: __v_624.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); + } + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_192, &__v_620) } else { bytes2_xor_split4_value(__v_192, __v_620, record) }; + let __v_626: G = __b2_out.0; + let __v_627: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_193, &__v_621) } else { bytes2_xor_split4_value(__v_193, __v_621, record) }; + let __v_628: G = __b2_out.0; + let __v_629: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_194, &__v_622) } else { bytes2_xor_split4_value(__v_194, __v_622, record) }; + let __v_630: G = __b2_out.0; + let __v_631: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split4(&__v_195, &__v_623) } else { bytes2_xor_split4_value(__v_195, __v_623, record) }; + let __v_632: G = __b2_out.0; + let __v_633: G = __b2_out.1; + let __v_634: G = (__v_628 + __v_631); + let __v_635: G = (__v_630 + __v_633); + let __v_636: G = (__v_632 + __v_627); + let __v_637: G = (__v_626 + __v_629); + let __u32_sum: u128 = u128::from(((__v_604.as_canonical_u64() << 0) | (__v_605.as_canonical_u64() << 8) | (__v_606.as_canonical_u64() << 16) | (__v_607.as_canonical_u64() << 24))) + u128::from(((__v_634.as_canonical_u64() << 0) | (__v_635.as_canonical_u64() << 8) | (__v_636.as_canonical_u64() << 16) | (__v_637.as_canonical_u64() << 24))) + u128::from(((__v_124.as_canonical_u64() << 0) | (__v_125.as_canonical_u64() << 8) | (__v_126.as_canonical_u64() << 16) | (__v_127.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_878: G = G::from_u8(__u32_bytes[0]); - let __v_879: G = G::from_u8(__u32_bytes[1]); - let __v_880: G = G::from_u8(__u32_bytes[2]); - let __v_881: G = G::from_u8(__u32_bytes[3]); - let __v_882: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_878; let __vj = __v_879; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_880; let __vj = __v_881; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_883: G = G::from_u64(((__v_828.as_canonical_u64() << 0) | (__v_829.as_canonical_u64() << 8) | (__v_830.as_canonical_u64() << 16) | (__v_831.as_canonical_u64() << 24))); - let __v_884: G = G::from_u64(((__v_870.as_canonical_u64() << 0) | (__v_876.as_canonical_u64() << 8) | (__v_873.as_canonical_u64() << 16) | (__v_877.as_canonical_u64() << 24))); - let __v_885: G = G::from_u64(((__v_124.as_canonical_u64() << 0) | (__v_125.as_canonical_u64() << 8) | (__v_126.as_canonical_u64() << 16) | (__v_127.as_canonical_u64() << 24))); - let __v_886: G = G::from_u64(((__v_878.as_canonical_u64() << 0) | (__v_879.as_canonical_u64() << 8) | (__v_880.as_canonical_u64() << 16) | (__v_881.as_canonical_u64() << 24))); - let __v_887: G = G::from_u64(1); - let __v_888: G = (__v_882 - __v_887); - let __v_889: G = G::from_u64(2); - let __v_890: G = (__v_882 - __v_889); - let __v_891: G = (__v_888 * __v_890); - let __v_892: G = (__v_882 * __v_891); - let __v_893: G = G::from_u64(0); - if (__v_892 != __v_893) { - return Err(ExecError::AssertEqMismatch { lhs: __v_892.as_canonical_u64(), rhs: __v_893.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); - } - let __v_894: G = (__v_884 + __v_885); - let __v_895: G = (__v_883 + __v_894); - let __v_896: G = G::from_u64(4294967296); - let __v_897: G = (__v_896 * __v_882); - let __v_898: G = (__v_886 + __v_897); - if (__v_895 != __v_898) { - return Err(ExecError::AssertEqMismatch { lhs: __v_895.as_canonical_u64(), rhs: __v_898.as_canonical_u64(), msg: Some("u32_add3: witnessed sum does not match its inputs".to_string()) }); - } - let __v_899: G = if unconstrained { Bytes2::xor(&__v_851, &__v_878) } else { bytes2_xor_value(__v_851, __v_878, record) }; - let __v_900: G = if unconstrained { Bytes2::xor(&__v_852, &__v_879) } else { bytes2_xor_value(__v_852, __v_879, record) }; - let __v_901: G = if unconstrained { Bytes2::xor(&__v_849, &__v_880) } else { bytes2_xor_value(__v_849, __v_880, record) }; - let __v_902: G = if unconstrained { Bytes2::xor(&__v_850, &__v_881) } else { bytes2_xor_value(__v_850, __v_881, record) }; - let __u32_sum: u128 = u128::from(((__v_853.as_canonical_u64() << 0) | (__v_854.as_canonical_u64() << 8) | (__v_855.as_canonical_u64() << 16) | (__v_856.as_canonical_u64() << 24))) + u128::from(((__v_900.as_canonical_u64() << 0) | (__v_901.as_canonical_u64() << 8) | (__v_902.as_canonical_u64() << 16) | (__v_899.as_canonical_u64() << 24))); + let __v_638: G = G::from_u8(__u32_bytes[0]); + let __v_639: G = G::from_u8(__u32_bytes[1]); + let __v_640: G = G::from_u8(__u32_bytes[2]); + let __v_641: G = G::from_u8(__u32_bytes[3]); + let __v_642: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_638; let __vj = __v_639; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_640; let __vj = __v_641; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_643: G = G::from_u64(1); + let __v_644: G = (__v_642 - __v_643); + let __v_645: G = G::from_u64(2); + let __v_646: G = (__v_642 - __v_645); + let __v_647: G = (__v_644 * __v_646); + let __v_648: G = (__v_642 * __v_647); + let __v_649: G = G::from_u64(0); + if (__v_648 != __v_649) { + return Err(ExecError::AssertEqMismatch { lhs: __v_648.as_canonical_u64(), rhs: __v_649.as_canonical_u64(), msg: Some("u32_add3: carry is not in {0, 1, 2}".to_string()) }); + } + let __v_650: G = if unconstrained { Bytes2::xor(&__v_618, &__v_638) } else { bytes2_xor_value(__v_618, __v_638, record) }; + let __v_651: G = if unconstrained { Bytes2::xor(&__v_619, &__v_639) } else { bytes2_xor_value(__v_619, __v_639, record) }; + let __v_652: G = if unconstrained { Bytes2::xor(&__v_616, &__v_640) } else { bytes2_xor_value(__v_616, __v_640, record) }; + let __v_653: G = if unconstrained { Bytes2::xor(&__v_617, &__v_641) } else { bytes2_xor_value(__v_617, __v_641, record) }; + let __u32_sum: u128 = u128::from(((__v_620.as_canonical_u64() << 0) | (__v_621.as_canonical_u64() << 8) | (__v_622.as_canonical_u64() << 16) | (__v_623.as_canonical_u64() << 24))) + u128::from(((__v_651.as_canonical_u64() << 0) | (__v_652.as_canonical_u64() << 8) | (__v_653.as_canonical_u64() << 16) | (__v_650.as_canonical_u64() << 24))); let __u32_bytes = u32::try_from(__u32_sum & 0xFFFF_FFFF).expect("masked").to_le_bytes(); - let __v_903: G = G::from_u8(__u32_bytes[0]); - let __v_904: G = G::from_u8(__u32_bytes[1]); - let __v_905: G = G::from_u8(__u32_bytes[2]); - let __v_906: G = G::from_u8(__u32_bytes[3]); - let __v_907: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); - if !unconstrained { let __vi = __v_903; let __vj = __v_904; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - if !unconstrained { let __vi = __v_905; let __vj = __v_906; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; - let __v_908: G = G::from_u64(((__v_853.as_canonical_u64() << 0) | (__v_854.as_canonical_u64() << 8) | (__v_855.as_canonical_u64() << 16) | (__v_856.as_canonical_u64() << 24))); - let __v_909: G = G::from_u64(((__v_900.as_canonical_u64() << 0) | (__v_901.as_canonical_u64() << 8) | (__v_902.as_canonical_u64() << 16) | (__v_899.as_canonical_u64() << 24))); - let __v_910: G = G::from_u64(((__v_903.as_canonical_u64() << 0) | (__v_904.as_canonical_u64() << 8) | (__v_905.as_canonical_u64() << 16) | (__v_906.as_canonical_u64() << 24))); - let __v_911: G = (__v_907 * __v_907); - if (__v_911 != __v_907) { - return Err(ExecError::AssertEqMismatch { lhs: __v_911.as_canonical_u64(), rhs: __v_907.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); - } - let __v_912: G = (__v_908 + __v_909); - let __v_913: G = G::from_u64(4294967296); - let __v_914: G = (__v_913 * __v_907); - let __v_915: G = (__v_910 + __v_914); - if (__v_912 != __v_915) { - return Err(ExecError::AssertEqMismatch { lhs: __v_912.as_canonical_u64(), rhs: __v_915.as_canonical_u64(), msg: Some("u32_add: witnessed sum does not match its inputs".to_string()) }); - } - let __v_916: G = if unconstrained { Bytes2::xor(&__v_870, &__v_903) } else { bytes2_xor_value(__v_870, __v_903, record) }; - let __v_917: G = if unconstrained { Bytes2::xor(&__v_876, &__v_904) } else { bytes2_xor_value(__v_876, __v_904, record) }; - let __v_918: G = if unconstrained { Bytes2::xor(&__v_873, &__v_905) } else { bytes2_xor_value(__v_873, __v_905, record) }; - let __v_919: G = if unconstrained { Bytes2::xor(&__v_877, &__v_906) } else { bytes2_xor_value(__v_877, __v_906, record) }; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr7(&__v_916, &__v_917) } else { bytes2_chain_rotr7_value(__v_916, __v_917, record) }; - let __v_920: G = __b2_out.0; - let __v_921: G = __b2_out.1; - let __v_922: G = __b2_out.2; - let __b2_out: (G, G, G) = if unconstrained { Bytes2::chain_rotr7(&__v_918, &__v_919) } else { bytes2_chain_rotr7_value(__v_918, __v_919, record) }; - let __v_923: G = __b2_out.0; - let __v_924: G = __b2_out.1; - let __v_925: G = __b2_out.2; - let __v_926: G = (__v_921 + __v_925); - let __v_927: G = (__v_924 + __v_922); - let __ret: [G; OUT_69] = [__v_578, __v_579, __v_580, __v_581, __v_678, __v_679, __v_680, __v_681, __v_778, __v_779, __v_780, __v_781, __v_878, __v_879, __v_880, __v_881, __v_920, __v_926, __v_923, __v_927, __v_620, __v_626, __v_623, __v_627, __v_720, __v_726, __v_723, __v_727, __v_820, __v_826, __v_823, __v_827, __v_803, __v_804, __v_805, __v_806, __v_903, __v_904, __v_905, __v_906, __v_603, __v_604, __v_605, __v_606, __v_703, __v_704, __v_705, __v_706, __v_700, __v_701, __v_702, __v_699, __v_800, __v_801, __v_802, __v_799, __v_900, __v_901, __v_902, __v_899, __v_600, __v_601, __v_602, __v_599, __v_64, __v_65, __v_66, __v_67, __v_68, __v_69, __v_70, __v_71, __v_72, __v_73, __v_74, __v_75, __v_76, __v_77, __v_78, __v_79, __v_80, __v_81, __v_82, __v_83, __v_84, __v_85, __v_86, __v_87, __v_88, __v_89, __v_90, __v_91, __v_92, __v_93, __v_94, __v_95, __v_96, __v_97, __v_98, __v_99, __v_100, __v_101, __v_102, __v_103, __v_104, __v_105, __v_106, __v_107, __v_108, __v_109, __v_110, __v_111, __v_112, __v_113, __v_114, __v_115, __v_116, __v_117, __v_118, __v_119, __v_120, __v_121, __v_122, __v_123, __v_124, __v_125, __v_126, __v_127]; + let __v_654: G = G::from_u8(__u32_bytes[0]); + let __v_655: G = G::from_u8(__u32_bytes[1]); + let __v_656: G = G::from_u8(__u32_bytes[2]); + let __v_657: G = G::from_u8(__u32_bytes[3]); + let __v_658: G = G::from_u64(u64::try_from(__u32_sum >> 32).expect("u32 sum overflow fits u64")); + if !unconstrained { let __vi = __v_654; let __vj = __v_655; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + if !unconstrained { let __vi = __v_656; let __vj = __v_657; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); }; + let __v_659: G = (__v_658 * __v_658); + if (__v_659 != __v_658) { + return Err(ExecError::AssertEqMismatch { lhs: __v_659.as_canonical_u64(), rhs: __v_658.as_canonical_u64(), msg: Some("u32_add: carry is not boolean".to_string()) }); + } + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_634, &__v_654) } else { bytes2_xor_split7_value(__v_634, __v_654, record) }; + let __v_660: G = __b2_out.0; + let __v_661: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_635, &__v_655) } else { bytes2_xor_split7_value(__v_635, __v_655, record) }; + let __v_662: G = __b2_out.0; + let __v_663: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_636, &__v_656) } else { bytes2_xor_split7_value(__v_636, __v_656, record) }; + let __v_664: G = __b2_out.0; + let __v_665: G = __b2_out.1; + let __b2_out: (G, G) = if unconstrained { Bytes2::xor_split7(&__v_637, &__v_657) } else { bytes2_xor_split7_value(__v_637, __v_657, record) }; + let __v_666: G = __b2_out.0; + let __v_667: G = __b2_out.1; + let __v_668: G = (__v_660 + __v_663); + let __v_669: G = (__v_662 + __v_665); + let __v_670: G = (__v_664 + __v_667); + let __v_671: G = (__v_666 + __v_661); + let __ret: [G; OUT_69] = [__v_434, __v_435, __v_436, __v_437, __v_502, __v_503, __v_504, __v_505, __v_570, __v_571, __v_572, __v_573, __v_638, __v_639, __v_640, __v_641, __v_668, __v_669, __v_670, __v_671, __v_464, __v_465, __v_466, __v_467, __v_532, __v_533, __v_534, __v_535, __v_600, __v_601, __v_602, __v_603, __v_586, __v_587, __v_588, __v_589, __v_654, __v_655, __v_656, __v_657, __v_450, __v_451, __v_452, __v_453, __v_518, __v_519, __v_520, __v_521, __v_515, __v_516, __v_517, __v_514, __v_583, __v_584, __v_585, __v_582, __v_651, __v_652, __v_653, __v_650, __v_447, __v_448, __v_449, __v_446, __v_64, __v_65, __v_66, __v_67, __v_68, __v_69, __v_70, __v_71, __v_72, __v_73, __v_74, __v_75, __v_76, __v_77, __v_78, __v_79, __v_80, __v_81, __v_82, __v_83, __v_84, __v_85, __v_86, __v_87, __v_88, __v_89, __v_90, __v_91, __v_92, __v_93, __v_94, __v_95, __v_96, __v_97, __v_98, __v_99, __v_100, __v_101, __v_102, __v_103, __v_104, __v_105, __v_106, __v_107, __v_108, __v_109, __v_110, __v_111, __v_112, __v_113, __v_114, __v_115, __v_116, __v_117, __v_118, __v_119, __v_120, __v_121, __v_122, __v_123, __v_124, __v_125, __v_126, __v_127]; record.function_queries[69].insert(&inp[..], &__ret[..], G::from_bool(!unconstrained)); return Ok(__ret); }) From 42e7a5a2ed0d91342ca0ed1ef989f5363756ff35 Mon Sep 17 00:00:00 2001 From: Gabriel Barreto Date: Fri, 14 Aug 2026 08:31:42 -0300 Subject: [PATCH 5/7] permutation refactor for readability --- Ix/IxVM/Blake3.lean | 147 +++++++++----------------------------------- 1 file changed, 28 insertions(+), 119 deletions(-) diff --git a/Ix/IxVM/Blake3.lean b/Ix/IxVM/Blake3.lean index ce81150f..d255bb99 100644 --- a/Ix/IxVM/Blake3.lean +++ b/Ix/IxVM/Blake3.lean @@ -385,7 +385,25 @@ def blake3 := ⟦ let state = set(state, 9, c); let state = set(state, 14, d); - state + -- Apply the message schedule permutation for the next round. The final + -- round also executes this permutation, but only state[0..15] is consumed + -- afterward, so that last permutation is unobservable. + let new_state = set(state, 16, state[18]); + let new_state = set(new_state, 17, state[22]); + let new_state = set(new_state, 18, state[19]); + let new_state = set(new_state, 19, state[26]); + let new_state = set(new_state, 20, state[23]); + let new_state = set(new_state, 21, state[16]); + let new_state = set(new_state, 22, state[20]); + let new_state = set(new_state, 23, state[29]); + let new_state = set(new_state, 24, state[17]); + let new_state = set(new_state, 25, state[27]); + let new_state = set(new_state, 26, state[28]); + let new_state = set(new_state, 27, state[21]); + let new_state = set(new_state, 28, state[25]); + let new_state = set(new_state, 29, state[30]); + let new_state = set(new_state, 30, state[31]); + set(new_state, 31, state[24]) } -- TODO: @@ -421,137 +439,28 @@ def blake3 := ⟦ -- Round 0 let state = blake3_compress_inner_j(state); - let new_state = set(state, 16, state[18]); - let new_state = set(new_state, 17, state[22]); - let new_state = set(new_state, 18, state[19]); - let new_state = set(new_state, 19, state[26]); - let new_state = set(new_state, 20, state[23]); - let new_state = set(new_state, 21, state[16]); - let new_state = set(new_state, 22, state[20]); - let new_state = set(new_state, 23, state[29]); - let new_state = set(new_state, 24, state[17]); - let new_state = set(new_state, 25, state[27]); - let new_state = set(new_state, 26, state[28]); - let new_state = set(new_state, 27, state[21]); - let new_state = set(new_state, 28, state[25]); - let new_state = set(new_state, 29, state[30]); - let new_state = set(new_state, 30, state[31]); - let new_state = set(new_state, 31, state[24]); - let state = new_state; - -- Round 1 let state = blake3_compress_inner_j(state); - let new_state = set(state, 16, state[18]); - let new_state = set(new_state, 17, state[22]); - let new_state = set(new_state, 18, state[19]); - let new_state = set(new_state, 19, state[26]); - let new_state = set(new_state, 20, state[23]); - let new_state = set(new_state, 21, state[16]); - let new_state = set(new_state, 22, state[20]); - let new_state = set(new_state, 23, state[29]); - let new_state = set(new_state, 24, state[17]); - let new_state = set(new_state, 25, state[27]); - let new_state = set(new_state, 26, state[28]); - let new_state = set(new_state, 27, state[21]); - let new_state = set(new_state, 28, state[25]); - let new_state = set(new_state, 29, state[30]); - let new_state = set(new_state, 30, state[31]); - let new_state = set(new_state, 31, state[24]); - let state = new_state; - -- Round 2 let state = blake3_compress_inner_j(state); - let new_state = set(state, 16, state[18]); - let new_state = set(new_state, 17, state[22]); - let new_state = set(new_state, 18, state[19]); - let new_state = set(new_state, 19, state[26]); - let new_state = set(new_state, 20, state[23]); - let new_state = set(new_state, 21, state[16]); - let new_state = set(new_state, 22, state[20]); - let new_state = set(new_state, 23, state[29]); - let new_state = set(new_state, 24, state[17]); - let new_state = set(new_state, 25, state[27]); - let new_state = set(new_state, 26, state[28]); - let new_state = set(new_state, 27, state[21]); - let new_state = set(new_state, 28, state[25]); - let new_state = set(new_state, 29, state[30]); - let new_state = set(new_state, 30, state[31]); - let new_state = set(new_state, 31, state[24]); - let state = new_state; - -- Round 3 let state = blake3_compress_inner_j(state); - let new_state = set(state, 16, state[18]); - let new_state = set(new_state, 17, state[22]); - let new_state = set(new_state, 18, state[19]); - let new_state = set(new_state, 19, state[26]); - let new_state = set(new_state, 20, state[23]); - let new_state = set(new_state, 21, state[16]); - let new_state = set(new_state, 22, state[20]); - let new_state = set(new_state, 23, state[29]); - let new_state = set(new_state, 24, state[17]); - let new_state = set(new_state, 25, state[27]); - let new_state = set(new_state, 26, state[28]); - let new_state = set(new_state, 27, state[21]); - let new_state = set(new_state, 28, state[25]); - let new_state = set(new_state, 29, state[30]); - let new_state = set(new_state, 30, state[31]); - let new_state = set(new_state, 31, state[24]); - let state = new_state; - -- Round 4 let state = blake3_compress_inner_j(state); - let new_state = set(state, 16, state[18]); - let new_state = set(new_state, 17, state[22]); - let new_state = set(new_state, 18, state[19]); - let new_state = set(new_state, 19, state[26]); - let new_state = set(new_state, 20, state[23]); - let new_state = set(new_state, 21, state[16]); - let new_state = set(new_state, 22, state[20]); - let new_state = set(new_state, 23, state[29]); - let new_state = set(new_state, 24, state[17]); - let new_state = set(new_state, 25, state[27]); - let new_state = set(new_state, 26, state[28]); - let new_state = set(new_state, 27, state[21]); - let new_state = set(new_state, 28, state[25]); - let new_state = set(new_state, 29, state[30]); - let new_state = set(new_state, 30, state[31]); - let new_state = set(new_state, 31, state[24]); - let state = new_state; - -- Round 5 let state = blake3_compress_inner_j(state); - let new_state = set(state, 16, state[18]); - let new_state = set(new_state, 17, state[22]); - let new_state = set(new_state, 18, state[19]); - let new_state = set(new_state, 19, state[26]); - let new_state = set(new_state, 20, state[23]); - let new_state = set(new_state, 21, state[16]); - let new_state = set(new_state, 22, state[20]); - let new_state = set(new_state, 23, state[29]); - let new_state = set(new_state, 24, state[17]); - let new_state = set(new_state, 25, state[27]); - let new_state = set(new_state, 26, state[28]); - let new_state = set(new_state, 27, state[21]); - let new_state = set(new_state, 28, state[25]); - let new_state = set(new_state, 29, state[30]); - let new_state = set(new_state, 30, state[31]); - let new_state = set(new_state, 31, state[24]); - let state = new_state; - -- Round 6 let state = blake3_compress_inner_j(state); - [ - [u8_xor(state[0][0], state[8][0]), u8_xor(state[0][1], state[8][1]), u8_xor(state[0][2], state[8][2]), u8_xor(state[0][3], state[8][3])], - [u8_xor(state[1][0], state[9][0]), u8_xor(state[1][1], state[9][1]), u8_xor(state[1][2], state[9][2]), u8_xor(state[1][3], state[9][3])], - [u8_xor(state[2][0], state[10][0]), u8_xor(state[2][1], state[10][1]), u8_xor(state[2][2], state[10][2]), u8_xor(state[2][3], state[10][3])], - [u8_xor(state[3][0], state[11][0]), u8_xor(state[3][1], state[11][1]), u8_xor(state[3][2], state[11][2]), u8_xor(state[3][3], state[11][3])], - [u8_xor(state[4][0], state[12][0]), u8_xor(state[4][1], state[12][1]), u8_xor(state[4][2], state[12][2]), u8_xor(state[4][3], state[12][3])], - [u8_xor(state[5][0], state[13][0]), u8_xor(state[5][1], state[13][1]), u8_xor(state[5][2], state[13][2]), u8_xor(state[5][3], state[13][3])], - [u8_xor(state[6][0], state[14][0]), u8_xor(state[6][1], state[14][1]), u8_xor(state[6][2], state[14][2]), u8_xor(state[6][3], state[14][3])], - [u8_xor(state[7][0], state[15][0]), u8_xor(state[7][1], state[15][1]), u8_xor(state[7][2], state[15][2]), u8_xor(state[7][3], state[15][3])] - ] + let output0 = @u32_xor(state[0], state[8]); + let output1 = @u32_xor(state[1], state[9]); + let output2 = @u32_xor(state[2], state[10]); + let output3 = @u32_xor(state[3], state[11]); + let output4 = @u32_xor(state[4], state[12]); + let output5 = @u32_xor(state[5], state[13]); + let output6 = @u32_xor(state[6], state[14]); + let output7 = @u32_xor(state[7], state[15]); + [output0, output1, output2, output3, output4, output5, output6, output7] } ⟧ From ac1cc6dd8ae054aa95c16b97d2d51797e6658e56 Mon Sep 17 00:00:00 2001 From: Gabriel Barreto Date: Fri, 14 Aug 2026 08:31:53 -0300 Subject: [PATCH 6/7] codegen --- crates/ixvm-codegen/src/aiur_ixvm.rs | 14 +++++++------- crates/ixvm-codegen/src/aiur_multi_stark.rs | 14 +++++++------- 2 files changed, 14 insertions(+), 14 deletions(-) diff --git a/crates/ixvm-codegen/src/aiur_ixvm.rs b/crates/ixvm-codegen/src/aiur_ixvm.rs index daaa0263..afb13352 100644 --- a/crates/ixvm-codegen/src/aiur_ixvm.rs +++ b/crates/ixvm-codegen/src/aiur_ixvm.rs @@ -6388,7 +6388,7 @@ fn aiur_fn_28( let __v_669: G = (__v_662 + __v_665); let __v_670: G = (__v_664 + __v_667); let __v_671: G = (__v_666 + __v_661); - let __ret: [G; OUT_28] = [__v_434, __v_435, __v_436, __v_437, __v_502, __v_503, __v_504, __v_505, __v_570, __v_571, __v_572, __v_573, __v_638, __v_639, __v_640, __v_641, __v_668, __v_669, __v_670, __v_671, __v_464, __v_465, __v_466, __v_467, __v_532, __v_533, __v_534, __v_535, __v_600, __v_601, __v_602, __v_603, __v_586, __v_587, __v_588, __v_589, __v_654, __v_655, __v_656, __v_657, __v_450, __v_451, __v_452, __v_453, __v_518, __v_519, __v_520, __v_521, __v_515, __v_516, __v_517, __v_514, __v_583, __v_584, __v_585, __v_582, __v_651, __v_652, __v_653, __v_650, __v_447, __v_448, __v_449, __v_446, __v_64, __v_65, __v_66, __v_67, __v_68, __v_69, __v_70, __v_71, __v_72, __v_73, __v_74, __v_75, __v_76, __v_77, __v_78, __v_79, __v_80, __v_81, __v_82, __v_83, __v_84, __v_85, __v_86, __v_87, __v_88, __v_89, __v_90, __v_91, __v_92, __v_93, __v_94, __v_95, __v_96, __v_97, __v_98, __v_99, __v_100, __v_101, __v_102, __v_103, __v_104, __v_105, __v_106, __v_107, __v_108, __v_109, __v_110, __v_111, __v_112, __v_113, __v_114, __v_115, __v_116, __v_117, __v_118, __v_119, __v_120, __v_121, __v_122, __v_123, __v_124, __v_125, __v_126, __v_127]; + let __ret: [G; OUT_28] = [__v_434, __v_435, __v_436, __v_437, __v_502, __v_503, __v_504, __v_505, __v_570, __v_571, __v_572, __v_573, __v_638, __v_639, __v_640, __v_641, __v_668, __v_669, __v_670, __v_671, __v_464, __v_465, __v_466, __v_467, __v_532, __v_533, __v_534, __v_535, __v_600, __v_601, __v_602, __v_603, __v_586, __v_587, __v_588, __v_589, __v_654, __v_655, __v_656, __v_657, __v_450, __v_451, __v_452, __v_453, __v_518, __v_519, __v_520, __v_521, __v_515, __v_516, __v_517, __v_514, __v_583, __v_584, __v_585, __v_582, __v_651, __v_652, __v_653, __v_650, __v_447, __v_448, __v_449, __v_446, __v_72, __v_73, __v_74, __v_75, __v_88, __v_89, __v_90, __v_91, __v_76, __v_77, __v_78, __v_79, __v_104, __v_105, __v_106, __v_107, __v_92, __v_93, __v_94, __v_95, __v_64, __v_65, __v_66, __v_67, __v_80, __v_81, __v_82, __v_83, __v_116, __v_117, __v_118, __v_119, __v_68, __v_69, __v_70, __v_71, __v_108, __v_109, __v_110, __v_111, __v_112, __v_113, __v_114, __v_115, __v_84, __v_85, __v_86, __v_87, __v_100, __v_101, __v_102, __v_103, __v_120, __v_121, __v_122, __v_123, __v_124, __v_125, __v_126, __v_127, __v_96, __v_97, __v_98, __v_99]; record.function_queries[28].insert(&inp[..], &__ret[..], G::from_bool(!unconstrained)); return Ok(__ret); }) @@ -6661,7 +6661,7 @@ fn aiur_fn_29( let __v_253: G = __r_arr[125]; let __v_254: G = __r_arr[126]; let __v_255: G = __r_arr[127]; - let __r_arr: [G; OUT_28] = { let __args: [G; IN_28] = [__v_128, __v_129, __v_130, __v_131, __v_132, __v_133, __v_134, __v_135, __v_136, __v_137, __v_138, __v_139, __v_140, __v_141, __v_142, __v_143, __v_144, __v_145, __v_146, __v_147, __v_148, __v_149, __v_150, __v_151, __v_152, __v_153, __v_154, __v_155, __v_156, __v_157, __v_158, __v_159, __v_160, __v_161, __v_162, __v_163, __v_164, __v_165, __v_166, __v_167, __v_168, __v_169, __v_170, __v_171, __v_172, __v_173, __v_174, __v_175, __v_176, __v_177, __v_178, __v_179, __v_180, __v_181, __v_182, __v_183, __v_184, __v_185, __v_186, __v_187, __v_188, __v_189, __v_190, __v_191, __v_200, __v_201, __v_202, __v_203, __v_216, __v_217, __v_218, __v_219, __v_204, __v_205, __v_206, __v_207, __v_232, __v_233, __v_234, __v_235, __v_220, __v_221, __v_222, __v_223, __v_192, __v_193, __v_194, __v_195, __v_208, __v_209, __v_210, __v_211, __v_244, __v_245, __v_246, __v_247, __v_196, __v_197, __v_198, __v_199, __v_236, __v_237, __v_238, __v_239, __v_240, __v_241, __v_242, __v_243, __v_212, __v_213, __v_214, __v_215, __v_228, __v_229, __v_230, __v_231, __v_248, __v_249, __v_250, __v_251, __v_252, __v_253, __v_254, __v_255, __v_224, __v_225, __v_226, __v_227]; let __cu = unconstrained; if let Some(result) = record.function_queries[28].get_mut(&__args[..]) { if !unconstrained { *result.multiplicity += G::ONE; } let __ret: [G; OUT_28] = unsafe { *(result.output.as_ptr() as *const [G; OUT_28]) }; __ret } else { aiur_fn_28(__args, record, io_buffer, __cu)? } }; + let __r_arr: [G; OUT_28] = { let __args: [G; IN_28] = [__v_128, __v_129, __v_130, __v_131, __v_132, __v_133, __v_134, __v_135, __v_136, __v_137, __v_138, __v_139, __v_140, __v_141, __v_142, __v_143, __v_144, __v_145, __v_146, __v_147, __v_148, __v_149, __v_150, __v_151, __v_152, __v_153, __v_154, __v_155, __v_156, __v_157, __v_158, __v_159, __v_160, __v_161, __v_162, __v_163, __v_164, __v_165, __v_166, __v_167, __v_168, __v_169, __v_170, __v_171, __v_172, __v_173, __v_174, __v_175, __v_176, __v_177, __v_178, __v_179, __v_180, __v_181, __v_182, __v_183, __v_184, __v_185, __v_186, __v_187, __v_188, __v_189, __v_190, __v_191, __v_192, __v_193, __v_194, __v_195, __v_196, __v_197, __v_198, __v_199, __v_200, __v_201, __v_202, __v_203, __v_204, __v_205, __v_206, __v_207, __v_208, __v_209, __v_210, __v_211, __v_212, __v_213, __v_214, __v_215, __v_216, __v_217, __v_218, __v_219, __v_220, __v_221, __v_222, __v_223, __v_224, __v_225, __v_226, __v_227, __v_228, __v_229, __v_230, __v_231, __v_232, __v_233, __v_234, __v_235, __v_236, __v_237, __v_238, __v_239, __v_240, __v_241, __v_242, __v_243, __v_244, __v_245, __v_246, __v_247, __v_248, __v_249, __v_250, __v_251, __v_252, __v_253, __v_254, __v_255]; let __cu = unconstrained; if let Some(result) = record.function_queries[28].get_mut(&__args[..]) { if !unconstrained { *result.multiplicity += G::ONE; } let __ret: [G; OUT_28] = unsafe { *(result.output.as_ptr() as *const [G; OUT_28]) }; __ret } else { aiur_fn_28(__args, record, io_buffer, __cu)? } }; let __v_256: G = __r_arr[0]; let __v_257: G = __r_arr[1]; let __v_258: G = __r_arr[2]; @@ -6790,7 +6790,7 @@ fn aiur_fn_29( let __v_381: G = __r_arr[125]; let __v_382: G = __r_arr[126]; let __v_383: G = __r_arr[127]; - let __r_arr: [G; OUT_28] = { let __args: [G; IN_28] = [__v_256, __v_257, __v_258, __v_259, __v_260, __v_261, __v_262, __v_263, __v_264, __v_265, __v_266, __v_267, __v_268, __v_269, __v_270, __v_271, __v_272, __v_273, __v_274, __v_275, __v_276, __v_277, __v_278, __v_279, __v_280, __v_281, __v_282, __v_283, __v_284, __v_285, __v_286, __v_287, __v_288, __v_289, __v_290, __v_291, __v_292, __v_293, __v_294, __v_295, __v_296, __v_297, __v_298, __v_299, __v_300, __v_301, __v_302, __v_303, __v_304, __v_305, __v_306, __v_307, __v_308, __v_309, __v_310, __v_311, __v_312, __v_313, __v_314, __v_315, __v_316, __v_317, __v_318, __v_319, __v_328, __v_329, __v_330, __v_331, __v_344, __v_345, __v_346, __v_347, __v_332, __v_333, __v_334, __v_335, __v_360, __v_361, __v_362, __v_363, __v_348, __v_349, __v_350, __v_351, __v_320, __v_321, __v_322, __v_323, __v_336, __v_337, __v_338, __v_339, __v_372, __v_373, __v_374, __v_375, __v_324, __v_325, __v_326, __v_327, __v_364, __v_365, __v_366, __v_367, __v_368, __v_369, __v_370, __v_371, __v_340, __v_341, __v_342, __v_343, __v_356, __v_357, __v_358, __v_359, __v_376, __v_377, __v_378, __v_379, __v_380, __v_381, __v_382, __v_383, __v_352, __v_353, __v_354, __v_355]; let __cu = unconstrained; if let Some(result) = record.function_queries[28].get_mut(&__args[..]) { if !unconstrained { *result.multiplicity += G::ONE; } let __ret: [G; OUT_28] = unsafe { *(result.output.as_ptr() as *const [G; OUT_28]) }; __ret } else { aiur_fn_28(__args, record, io_buffer, __cu)? } }; + let __r_arr: [G; OUT_28] = { let __args: [G; IN_28] = [__v_256, __v_257, __v_258, __v_259, __v_260, __v_261, __v_262, __v_263, __v_264, __v_265, __v_266, __v_267, __v_268, __v_269, __v_270, __v_271, __v_272, __v_273, __v_274, __v_275, __v_276, __v_277, __v_278, __v_279, __v_280, __v_281, __v_282, __v_283, __v_284, __v_285, __v_286, __v_287, __v_288, __v_289, __v_290, __v_291, __v_292, __v_293, __v_294, __v_295, __v_296, __v_297, __v_298, __v_299, __v_300, __v_301, __v_302, __v_303, __v_304, __v_305, __v_306, __v_307, __v_308, __v_309, __v_310, __v_311, __v_312, __v_313, __v_314, __v_315, __v_316, __v_317, __v_318, __v_319, __v_320, __v_321, __v_322, __v_323, __v_324, __v_325, __v_326, __v_327, __v_328, __v_329, __v_330, __v_331, __v_332, __v_333, __v_334, __v_335, __v_336, __v_337, __v_338, __v_339, __v_340, __v_341, __v_342, __v_343, __v_344, __v_345, __v_346, __v_347, __v_348, __v_349, __v_350, __v_351, __v_352, __v_353, __v_354, __v_355, __v_356, __v_357, __v_358, __v_359, __v_360, __v_361, __v_362, __v_363, __v_364, __v_365, __v_366, __v_367, __v_368, __v_369, __v_370, __v_371, __v_372, __v_373, __v_374, __v_375, __v_376, __v_377, __v_378, __v_379, __v_380, __v_381, __v_382, __v_383]; let __cu = unconstrained; if let Some(result) = record.function_queries[28].get_mut(&__args[..]) { if !unconstrained { *result.multiplicity += G::ONE; } let __ret: [G; OUT_28] = unsafe { *(result.output.as_ptr() as *const [G; OUT_28]) }; __ret } else { aiur_fn_28(__args, record, io_buffer, __cu)? } }; let __v_384: G = __r_arr[0]; let __v_385: G = __r_arr[1]; let __v_386: G = __r_arr[2]; @@ -6919,7 +6919,7 @@ fn aiur_fn_29( let __v_509: G = __r_arr[125]; let __v_510: G = __r_arr[126]; let __v_511: G = __r_arr[127]; - let __r_arr: [G; OUT_28] = { let __args: [G; IN_28] = [__v_384, __v_385, __v_386, __v_387, __v_388, __v_389, __v_390, __v_391, __v_392, __v_393, __v_394, __v_395, __v_396, __v_397, __v_398, __v_399, __v_400, __v_401, __v_402, __v_403, __v_404, __v_405, __v_406, __v_407, __v_408, __v_409, __v_410, __v_411, __v_412, __v_413, __v_414, __v_415, __v_416, __v_417, __v_418, __v_419, __v_420, __v_421, __v_422, __v_423, __v_424, __v_425, __v_426, __v_427, __v_428, __v_429, __v_430, __v_431, __v_432, __v_433, __v_434, __v_435, __v_436, __v_437, __v_438, __v_439, __v_440, __v_441, __v_442, __v_443, __v_444, __v_445, __v_446, __v_447, __v_456, __v_457, __v_458, __v_459, __v_472, __v_473, __v_474, __v_475, __v_460, __v_461, __v_462, __v_463, __v_488, __v_489, __v_490, __v_491, __v_476, __v_477, __v_478, __v_479, __v_448, __v_449, __v_450, __v_451, __v_464, __v_465, __v_466, __v_467, __v_500, __v_501, __v_502, __v_503, __v_452, __v_453, __v_454, __v_455, __v_492, __v_493, __v_494, __v_495, __v_496, __v_497, __v_498, __v_499, __v_468, __v_469, __v_470, __v_471, __v_484, __v_485, __v_486, __v_487, __v_504, __v_505, __v_506, __v_507, __v_508, __v_509, __v_510, __v_511, __v_480, __v_481, __v_482, __v_483]; let __cu = unconstrained; if let Some(result) = record.function_queries[28].get_mut(&__args[..]) { if !unconstrained { *result.multiplicity += G::ONE; } let __ret: [G; OUT_28] = unsafe { *(result.output.as_ptr() as *const [G; OUT_28]) }; __ret } else { aiur_fn_28(__args, record, io_buffer, __cu)? } }; + let __r_arr: [G; OUT_28] = { let __args: [G; IN_28] = [__v_384, __v_385, __v_386, __v_387, __v_388, __v_389, __v_390, __v_391, __v_392, __v_393, __v_394, __v_395, __v_396, __v_397, __v_398, __v_399, __v_400, __v_401, __v_402, __v_403, __v_404, __v_405, __v_406, __v_407, __v_408, __v_409, __v_410, __v_411, __v_412, __v_413, __v_414, __v_415, __v_416, __v_417, __v_418, __v_419, __v_420, __v_421, __v_422, __v_423, __v_424, __v_425, __v_426, __v_427, __v_428, __v_429, __v_430, __v_431, __v_432, __v_433, __v_434, __v_435, __v_436, __v_437, __v_438, __v_439, __v_440, __v_441, __v_442, __v_443, __v_444, __v_445, __v_446, __v_447, __v_448, __v_449, __v_450, __v_451, __v_452, __v_453, __v_454, __v_455, __v_456, __v_457, __v_458, __v_459, __v_460, __v_461, __v_462, __v_463, __v_464, __v_465, __v_466, __v_467, __v_468, __v_469, __v_470, __v_471, __v_472, __v_473, __v_474, __v_475, __v_476, __v_477, __v_478, __v_479, __v_480, __v_481, __v_482, __v_483, __v_484, __v_485, __v_486, __v_487, __v_488, __v_489, __v_490, __v_491, __v_492, __v_493, __v_494, __v_495, __v_496, __v_497, __v_498, __v_499, __v_500, __v_501, __v_502, __v_503, __v_504, __v_505, __v_506, __v_507, __v_508, __v_509, __v_510, __v_511]; let __cu = unconstrained; if let Some(result) = record.function_queries[28].get_mut(&__args[..]) { if !unconstrained { *result.multiplicity += G::ONE; } let __ret: [G; OUT_28] = unsafe { *(result.output.as_ptr() as *const [G; OUT_28]) }; __ret } else { aiur_fn_28(__args, record, io_buffer, __cu)? } }; let __v_512: G = __r_arr[0]; let __v_513: G = __r_arr[1]; let __v_514: G = __r_arr[2]; @@ -7048,7 +7048,7 @@ fn aiur_fn_29( let __v_637: G = __r_arr[125]; let __v_638: G = __r_arr[126]; let __v_639: G = __r_arr[127]; - let __r_arr: [G; OUT_28] = { let __args: [G; IN_28] = [__v_512, __v_513, __v_514, __v_515, __v_516, __v_517, __v_518, __v_519, __v_520, __v_521, __v_522, __v_523, __v_524, __v_525, __v_526, __v_527, __v_528, __v_529, __v_530, __v_531, __v_532, __v_533, __v_534, __v_535, __v_536, __v_537, __v_538, __v_539, __v_540, __v_541, __v_542, __v_543, __v_544, __v_545, __v_546, __v_547, __v_548, __v_549, __v_550, __v_551, __v_552, __v_553, __v_554, __v_555, __v_556, __v_557, __v_558, __v_559, __v_560, __v_561, __v_562, __v_563, __v_564, __v_565, __v_566, __v_567, __v_568, __v_569, __v_570, __v_571, __v_572, __v_573, __v_574, __v_575, __v_584, __v_585, __v_586, __v_587, __v_600, __v_601, __v_602, __v_603, __v_588, __v_589, __v_590, __v_591, __v_616, __v_617, __v_618, __v_619, __v_604, __v_605, __v_606, __v_607, __v_576, __v_577, __v_578, __v_579, __v_592, __v_593, __v_594, __v_595, __v_628, __v_629, __v_630, __v_631, __v_580, __v_581, __v_582, __v_583, __v_620, __v_621, __v_622, __v_623, __v_624, __v_625, __v_626, __v_627, __v_596, __v_597, __v_598, __v_599, __v_612, __v_613, __v_614, __v_615, __v_632, __v_633, __v_634, __v_635, __v_636, __v_637, __v_638, __v_639, __v_608, __v_609, __v_610, __v_611]; let __cu = unconstrained; if let Some(result) = record.function_queries[28].get_mut(&__args[..]) { if !unconstrained { *result.multiplicity += G::ONE; } let __ret: [G; OUT_28] = unsafe { *(result.output.as_ptr() as *const [G; OUT_28]) }; __ret } else { aiur_fn_28(__args, record, io_buffer, __cu)? } }; + let __r_arr: [G; OUT_28] = { let __args: [G; IN_28] = [__v_512, __v_513, __v_514, __v_515, __v_516, __v_517, __v_518, __v_519, __v_520, __v_521, __v_522, __v_523, __v_524, __v_525, __v_526, __v_527, __v_528, __v_529, __v_530, __v_531, __v_532, __v_533, __v_534, __v_535, __v_536, __v_537, __v_538, __v_539, __v_540, __v_541, __v_542, __v_543, __v_544, __v_545, __v_546, __v_547, __v_548, __v_549, __v_550, __v_551, __v_552, __v_553, __v_554, __v_555, __v_556, __v_557, __v_558, __v_559, __v_560, __v_561, __v_562, __v_563, __v_564, __v_565, __v_566, __v_567, __v_568, __v_569, __v_570, __v_571, __v_572, __v_573, __v_574, __v_575, __v_576, __v_577, __v_578, __v_579, __v_580, __v_581, __v_582, __v_583, __v_584, __v_585, __v_586, __v_587, __v_588, __v_589, __v_590, __v_591, __v_592, __v_593, __v_594, __v_595, __v_596, __v_597, __v_598, __v_599, __v_600, __v_601, __v_602, __v_603, __v_604, __v_605, __v_606, __v_607, __v_608, __v_609, __v_610, __v_611, __v_612, __v_613, __v_614, __v_615, __v_616, __v_617, __v_618, __v_619, __v_620, __v_621, __v_622, __v_623, __v_624, __v_625, __v_626, __v_627, __v_628, __v_629, __v_630, __v_631, __v_632, __v_633, __v_634, __v_635, __v_636, __v_637, __v_638, __v_639]; let __cu = unconstrained; if let Some(result) = record.function_queries[28].get_mut(&__args[..]) { if !unconstrained { *result.multiplicity += G::ONE; } let __ret: [G; OUT_28] = unsafe { *(result.output.as_ptr() as *const [G; OUT_28]) }; __ret } else { aiur_fn_28(__args, record, io_buffer, __cu)? } }; let __v_640: G = __r_arr[0]; let __v_641: G = __r_arr[1]; let __v_642: G = __r_arr[2]; @@ -7177,7 +7177,7 @@ fn aiur_fn_29( let __v_765: G = __r_arr[125]; let __v_766: G = __r_arr[126]; let __v_767: G = __r_arr[127]; - let __r_arr: [G; OUT_28] = { let __args: [G; IN_28] = [__v_640, __v_641, __v_642, __v_643, __v_644, __v_645, __v_646, __v_647, __v_648, __v_649, __v_650, __v_651, __v_652, __v_653, __v_654, __v_655, __v_656, __v_657, __v_658, __v_659, __v_660, __v_661, __v_662, __v_663, __v_664, __v_665, __v_666, __v_667, __v_668, __v_669, __v_670, __v_671, __v_672, __v_673, __v_674, __v_675, __v_676, __v_677, __v_678, __v_679, __v_680, __v_681, __v_682, __v_683, __v_684, __v_685, __v_686, __v_687, __v_688, __v_689, __v_690, __v_691, __v_692, __v_693, __v_694, __v_695, __v_696, __v_697, __v_698, __v_699, __v_700, __v_701, __v_702, __v_703, __v_712, __v_713, __v_714, __v_715, __v_728, __v_729, __v_730, __v_731, __v_716, __v_717, __v_718, __v_719, __v_744, __v_745, __v_746, __v_747, __v_732, __v_733, __v_734, __v_735, __v_704, __v_705, __v_706, __v_707, __v_720, __v_721, __v_722, __v_723, __v_756, __v_757, __v_758, __v_759, __v_708, __v_709, __v_710, __v_711, __v_748, __v_749, __v_750, __v_751, __v_752, __v_753, __v_754, __v_755, __v_724, __v_725, __v_726, __v_727, __v_740, __v_741, __v_742, __v_743, __v_760, __v_761, __v_762, __v_763, __v_764, __v_765, __v_766, __v_767, __v_736, __v_737, __v_738, __v_739]; let __cu = unconstrained; if let Some(result) = record.function_queries[28].get_mut(&__args[..]) { if !unconstrained { *result.multiplicity += G::ONE; } let __ret: [G; OUT_28] = unsafe { *(result.output.as_ptr() as *const [G; OUT_28]) }; __ret } else { aiur_fn_28(__args, record, io_buffer, __cu)? } }; + let __r_arr: [G; OUT_28] = { let __args: [G; IN_28] = [__v_640, __v_641, __v_642, __v_643, __v_644, __v_645, __v_646, __v_647, __v_648, __v_649, __v_650, __v_651, __v_652, __v_653, __v_654, __v_655, __v_656, __v_657, __v_658, __v_659, __v_660, __v_661, __v_662, __v_663, __v_664, __v_665, __v_666, __v_667, __v_668, __v_669, __v_670, __v_671, __v_672, __v_673, __v_674, __v_675, __v_676, __v_677, __v_678, __v_679, __v_680, __v_681, __v_682, __v_683, __v_684, __v_685, __v_686, __v_687, __v_688, __v_689, __v_690, __v_691, __v_692, __v_693, __v_694, __v_695, __v_696, __v_697, __v_698, __v_699, __v_700, __v_701, __v_702, __v_703, __v_704, __v_705, __v_706, __v_707, __v_708, __v_709, __v_710, __v_711, __v_712, __v_713, __v_714, __v_715, __v_716, __v_717, __v_718, __v_719, __v_720, __v_721, __v_722, __v_723, __v_724, __v_725, __v_726, __v_727, __v_728, __v_729, __v_730, __v_731, __v_732, __v_733, __v_734, __v_735, __v_736, __v_737, __v_738, __v_739, __v_740, __v_741, __v_742, __v_743, __v_744, __v_745, __v_746, __v_747, __v_748, __v_749, __v_750, __v_751, __v_752, __v_753, __v_754, __v_755, __v_756, __v_757, __v_758, __v_759, __v_760, __v_761, __v_762, __v_763, __v_764, __v_765, __v_766, __v_767]; let __cu = unconstrained; if let Some(result) = record.function_queries[28].get_mut(&__args[..]) { if !unconstrained { *result.multiplicity += G::ONE; } let __ret: [G; OUT_28] = unsafe { *(result.output.as_ptr() as *const [G; OUT_28]) }; __ret } else { aiur_fn_28(__args, record, io_buffer, __cu)? } }; let __v_768: G = __r_arr[0]; let __v_769: G = __r_arr[1]; let __v_770: G = __r_arr[2]; @@ -7306,7 +7306,7 @@ fn aiur_fn_29( let __v_893: G = __r_arr[125]; let __v_894: G = __r_arr[126]; let __v_895: G = __r_arr[127]; - let __r_arr: [G; OUT_28] = { let __args: [G; IN_28] = [__v_768, __v_769, __v_770, __v_771, __v_772, __v_773, __v_774, __v_775, __v_776, __v_777, __v_778, __v_779, __v_780, __v_781, __v_782, __v_783, __v_784, __v_785, __v_786, __v_787, __v_788, __v_789, __v_790, __v_791, __v_792, __v_793, __v_794, __v_795, __v_796, __v_797, __v_798, __v_799, __v_800, __v_801, __v_802, __v_803, __v_804, __v_805, __v_806, __v_807, __v_808, __v_809, __v_810, __v_811, __v_812, __v_813, __v_814, __v_815, __v_816, __v_817, __v_818, __v_819, __v_820, __v_821, __v_822, __v_823, __v_824, __v_825, __v_826, __v_827, __v_828, __v_829, __v_830, __v_831, __v_840, __v_841, __v_842, __v_843, __v_856, __v_857, __v_858, __v_859, __v_844, __v_845, __v_846, __v_847, __v_872, __v_873, __v_874, __v_875, __v_860, __v_861, __v_862, __v_863, __v_832, __v_833, __v_834, __v_835, __v_848, __v_849, __v_850, __v_851, __v_884, __v_885, __v_886, __v_887, __v_836, __v_837, __v_838, __v_839, __v_876, __v_877, __v_878, __v_879, __v_880, __v_881, __v_882, __v_883, __v_852, __v_853, __v_854, __v_855, __v_868, __v_869, __v_870, __v_871, __v_888, __v_889, __v_890, __v_891, __v_892, __v_893, __v_894, __v_895, __v_864, __v_865, __v_866, __v_867]; let __cu = unconstrained; if let Some(result) = record.function_queries[28].get_mut(&__args[..]) { if !unconstrained { *result.multiplicity += G::ONE; } let __ret: [G; OUT_28] = unsafe { *(result.output.as_ptr() as *const [G; OUT_28]) }; __ret } else { aiur_fn_28(__args, record, io_buffer, __cu)? } }; + let __r_arr: [G; OUT_28] = { let __args: [G; IN_28] = [__v_768, __v_769, __v_770, __v_771, __v_772, __v_773, __v_774, __v_775, __v_776, __v_777, __v_778, __v_779, __v_780, __v_781, __v_782, __v_783, __v_784, __v_785, __v_786, __v_787, __v_788, __v_789, __v_790, __v_791, __v_792, __v_793, __v_794, __v_795, __v_796, __v_797, __v_798, __v_799, __v_800, __v_801, __v_802, __v_803, __v_804, __v_805, __v_806, __v_807, __v_808, __v_809, __v_810, __v_811, __v_812, __v_813, __v_814, __v_815, __v_816, __v_817, __v_818, __v_819, __v_820, __v_821, __v_822, __v_823, __v_824, __v_825, __v_826, __v_827, __v_828, __v_829, __v_830, __v_831, __v_832, __v_833, __v_834, __v_835, __v_836, __v_837, __v_838, __v_839, __v_840, __v_841, __v_842, __v_843, __v_844, __v_845, __v_846, __v_847, __v_848, __v_849, __v_850, __v_851, __v_852, __v_853, __v_854, __v_855, __v_856, __v_857, __v_858, __v_859, __v_860, __v_861, __v_862, __v_863, __v_864, __v_865, __v_866, __v_867, __v_868, __v_869, __v_870, __v_871, __v_872, __v_873, __v_874, __v_875, __v_876, __v_877, __v_878, __v_879, __v_880, __v_881, __v_882, __v_883, __v_884, __v_885, __v_886, __v_887, __v_888, __v_889, __v_890, __v_891, __v_892, __v_893, __v_894, __v_895]; let __cu = unconstrained; if let Some(result) = record.function_queries[28].get_mut(&__args[..]) { if !unconstrained { *result.multiplicity += G::ONE; } let __ret: [G; OUT_28] = unsafe { *(result.output.as_ptr() as *const [G; OUT_28]) }; __ret } else { aiur_fn_28(__args, record, io_buffer, __cu)? } }; let __v_896: G = __r_arr[0]; let __v_897: G = __r_arr[1]; let __v_898: G = __r_arr[2]; diff --git a/crates/ixvm-codegen/src/aiur_multi_stark.rs b/crates/ixvm-codegen/src/aiur_multi_stark.rs index 0583b54c..a5177383 100644 --- a/crates/ixvm-codegen/src/aiur_multi_stark.rs +++ b/crates/ixvm-codegen/src/aiur_multi_stark.rs @@ -5826,7 +5826,7 @@ fn aiur_fn_69( let __v_669: G = (__v_662 + __v_665); let __v_670: G = (__v_664 + __v_667); let __v_671: G = (__v_666 + __v_661); - let __ret: [G; OUT_69] = [__v_434, __v_435, __v_436, __v_437, __v_502, __v_503, __v_504, __v_505, __v_570, __v_571, __v_572, __v_573, __v_638, __v_639, __v_640, __v_641, __v_668, __v_669, __v_670, __v_671, __v_464, __v_465, __v_466, __v_467, __v_532, __v_533, __v_534, __v_535, __v_600, __v_601, __v_602, __v_603, __v_586, __v_587, __v_588, __v_589, __v_654, __v_655, __v_656, __v_657, __v_450, __v_451, __v_452, __v_453, __v_518, __v_519, __v_520, __v_521, __v_515, __v_516, __v_517, __v_514, __v_583, __v_584, __v_585, __v_582, __v_651, __v_652, __v_653, __v_650, __v_447, __v_448, __v_449, __v_446, __v_64, __v_65, __v_66, __v_67, __v_68, __v_69, __v_70, __v_71, __v_72, __v_73, __v_74, __v_75, __v_76, __v_77, __v_78, __v_79, __v_80, __v_81, __v_82, __v_83, __v_84, __v_85, __v_86, __v_87, __v_88, __v_89, __v_90, __v_91, __v_92, __v_93, __v_94, __v_95, __v_96, __v_97, __v_98, __v_99, __v_100, __v_101, __v_102, __v_103, __v_104, __v_105, __v_106, __v_107, __v_108, __v_109, __v_110, __v_111, __v_112, __v_113, __v_114, __v_115, __v_116, __v_117, __v_118, __v_119, __v_120, __v_121, __v_122, __v_123, __v_124, __v_125, __v_126, __v_127]; + let __ret: [G; OUT_69] = [__v_434, __v_435, __v_436, __v_437, __v_502, __v_503, __v_504, __v_505, __v_570, __v_571, __v_572, __v_573, __v_638, __v_639, __v_640, __v_641, __v_668, __v_669, __v_670, __v_671, __v_464, __v_465, __v_466, __v_467, __v_532, __v_533, __v_534, __v_535, __v_600, __v_601, __v_602, __v_603, __v_586, __v_587, __v_588, __v_589, __v_654, __v_655, __v_656, __v_657, __v_450, __v_451, __v_452, __v_453, __v_518, __v_519, __v_520, __v_521, __v_515, __v_516, __v_517, __v_514, __v_583, __v_584, __v_585, __v_582, __v_651, __v_652, __v_653, __v_650, __v_447, __v_448, __v_449, __v_446, __v_72, __v_73, __v_74, __v_75, __v_88, __v_89, __v_90, __v_91, __v_76, __v_77, __v_78, __v_79, __v_104, __v_105, __v_106, __v_107, __v_92, __v_93, __v_94, __v_95, __v_64, __v_65, __v_66, __v_67, __v_80, __v_81, __v_82, __v_83, __v_116, __v_117, __v_118, __v_119, __v_68, __v_69, __v_70, __v_71, __v_108, __v_109, __v_110, __v_111, __v_112, __v_113, __v_114, __v_115, __v_84, __v_85, __v_86, __v_87, __v_100, __v_101, __v_102, __v_103, __v_120, __v_121, __v_122, __v_123, __v_124, __v_125, __v_126, __v_127, __v_96, __v_97, __v_98, __v_99]; record.function_queries[69].insert(&inp[..], &__ret[..], G::from_bool(!unconstrained)); return Ok(__ret); }) @@ -6099,7 +6099,7 @@ fn aiur_fn_70( let __v_253: G = __r_arr[125]; let __v_254: G = __r_arr[126]; let __v_255: G = __r_arr[127]; - let __r_arr: [G; OUT_69] = { let __args: [G; IN_69] = [__v_128, __v_129, __v_130, __v_131, __v_132, __v_133, __v_134, __v_135, __v_136, __v_137, __v_138, __v_139, __v_140, __v_141, __v_142, __v_143, __v_144, __v_145, __v_146, __v_147, __v_148, __v_149, __v_150, __v_151, __v_152, __v_153, __v_154, __v_155, __v_156, __v_157, __v_158, __v_159, __v_160, __v_161, __v_162, __v_163, __v_164, __v_165, __v_166, __v_167, __v_168, __v_169, __v_170, __v_171, __v_172, __v_173, __v_174, __v_175, __v_176, __v_177, __v_178, __v_179, __v_180, __v_181, __v_182, __v_183, __v_184, __v_185, __v_186, __v_187, __v_188, __v_189, __v_190, __v_191, __v_200, __v_201, __v_202, __v_203, __v_216, __v_217, __v_218, __v_219, __v_204, __v_205, __v_206, __v_207, __v_232, __v_233, __v_234, __v_235, __v_220, __v_221, __v_222, __v_223, __v_192, __v_193, __v_194, __v_195, __v_208, __v_209, __v_210, __v_211, __v_244, __v_245, __v_246, __v_247, __v_196, __v_197, __v_198, __v_199, __v_236, __v_237, __v_238, __v_239, __v_240, __v_241, __v_242, __v_243, __v_212, __v_213, __v_214, __v_215, __v_228, __v_229, __v_230, __v_231, __v_248, __v_249, __v_250, __v_251, __v_252, __v_253, __v_254, __v_255, __v_224, __v_225, __v_226, __v_227]; let __cu = unconstrained; if let Some(result) = record.function_queries[69].get_mut(&__args[..]) { if !unconstrained { *result.multiplicity += G::ONE; } let __ret: [G; OUT_69] = unsafe { *(result.output.as_ptr() as *const [G; OUT_69]) }; __ret } else { aiur_fn_69(__args, record, io_buffer, __cu)? } }; + let __r_arr: [G; OUT_69] = { let __args: [G; IN_69] = [__v_128, __v_129, __v_130, __v_131, __v_132, __v_133, __v_134, __v_135, __v_136, __v_137, __v_138, __v_139, __v_140, __v_141, __v_142, __v_143, __v_144, __v_145, __v_146, __v_147, __v_148, __v_149, __v_150, __v_151, __v_152, __v_153, __v_154, __v_155, __v_156, __v_157, __v_158, __v_159, __v_160, __v_161, __v_162, __v_163, __v_164, __v_165, __v_166, __v_167, __v_168, __v_169, __v_170, __v_171, __v_172, __v_173, __v_174, __v_175, __v_176, __v_177, __v_178, __v_179, __v_180, __v_181, __v_182, __v_183, __v_184, __v_185, __v_186, __v_187, __v_188, __v_189, __v_190, __v_191, __v_192, __v_193, __v_194, __v_195, __v_196, __v_197, __v_198, __v_199, __v_200, __v_201, __v_202, __v_203, __v_204, __v_205, __v_206, __v_207, __v_208, __v_209, __v_210, __v_211, __v_212, __v_213, __v_214, __v_215, __v_216, __v_217, __v_218, __v_219, __v_220, __v_221, __v_222, __v_223, __v_224, __v_225, __v_226, __v_227, __v_228, __v_229, __v_230, __v_231, __v_232, __v_233, __v_234, __v_235, __v_236, __v_237, __v_238, __v_239, __v_240, __v_241, __v_242, __v_243, __v_244, __v_245, __v_246, __v_247, __v_248, __v_249, __v_250, __v_251, __v_252, __v_253, __v_254, __v_255]; let __cu = unconstrained; if let Some(result) = record.function_queries[69].get_mut(&__args[..]) { if !unconstrained { *result.multiplicity += G::ONE; } let __ret: [G; OUT_69] = unsafe { *(result.output.as_ptr() as *const [G; OUT_69]) }; __ret } else { aiur_fn_69(__args, record, io_buffer, __cu)? } }; let __v_256: G = __r_arr[0]; let __v_257: G = __r_arr[1]; let __v_258: G = __r_arr[2]; @@ -6228,7 +6228,7 @@ fn aiur_fn_70( let __v_381: G = __r_arr[125]; let __v_382: G = __r_arr[126]; let __v_383: G = __r_arr[127]; - let __r_arr: [G; OUT_69] = { let __args: [G; IN_69] = [__v_256, __v_257, __v_258, __v_259, __v_260, __v_261, __v_262, __v_263, __v_264, __v_265, __v_266, __v_267, __v_268, __v_269, __v_270, __v_271, __v_272, __v_273, __v_274, __v_275, __v_276, __v_277, __v_278, __v_279, __v_280, __v_281, __v_282, __v_283, __v_284, __v_285, __v_286, __v_287, __v_288, __v_289, __v_290, __v_291, __v_292, __v_293, __v_294, __v_295, __v_296, __v_297, __v_298, __v_299, __v_300, __v_301, __v_302, __v_303, __v_304, __v_305, __v_306, __v_307, __v_308, __v_309, __v_310, __v_311, __v_312, __v_313, __v_314, __v_315, __v_316, __v_317, __v_318, __v_319, __v_328, __v_329, __v_330, __v_331, __v_344, __v_345, __v_346, __v_347, __v_332, __v_333, __v_334, __v_335, __v_360, __v_361, __v_362, __v_363, __v_348, __v_349, __v_350, __v_351, __v_320, __v_321, __v_322, __v_323, __v_336, __v_337, __v_338, __v_339, __v_372, __v_373, __v_374, __v_375, __v_324, __v_325, __v_326, __v_327, __v_364, __v_365, __v_366, __v_367, __v_368, __v_369, __v_370, __v_371, __v_340, __v_341, __v_342, __v_343, __v_356, __v_357, __v_358, __v_359, __v_376, __v_377, __v_378, __v_379, __v_380, __v_381, __v_382, __v_383, __v_352, __v_353, __v_354, __v_355]; let __cu = unconstrained; if let Some(result) = record.function_queries[69].get_mut(&__args[..]) { if !unconstrained { *result.multiplicity += G::ONE; } let __ret: [G; OUT_69] = unsafe { *(result.output.as_ptr() as *const [G; OUT_69]) }; __ret } else { aiur_fn_69(__args, record, io_buffer, __cu)? } }; + let __r_arr: [G; OUT_69] = { let __args: [G; IN_69] = [__v_256, __v_257, __v_258, __v_259, __v_260, __v_261, __v_262, __v_263, __v_264, __v_265, __v_266, __v_267, __v_268, __v_269, __v_270, __v_271, __v_272, __v_273, __v_274, __v_275, __v_276, __v_277, __v_278, __v_279, __v_280, __v_281, __v_282, __v_283, __v_284, __v_285, __v_286, __v_287, __v_288, __v_289, __v_290, __v_291, __v_292, __v_293, __v_294, __v_295, __v_296, __v_297, __v_298, __v_299, __v_300, __v_301, __v_302, __v_303, __v_304, __v_305, __v_306, __v_307, __v_308, __v_309, __v_310, __v_311, __v_312, __v_313, __v_314, __v_315, __v_316, __v_317, __v_318, __v_319, __v_320, __v_321, __v_322, __v_323, __v_324, __v_325, __v_326, __v_327, __v_328, __v_329, __v_330, __v_331, __v_332, __v_333, __v_334, __v_335, __v_336, __v_337, __v_338, __v_339, __v_340, __v_341, __v_342, __v_343, __v_344, __v_345, __v_346, __v_347, __v_348, __v_349, __v_350, __v_351, __v_352, __v_353, __v_354, __v_355, __v_356, __v_357, __v_358, __v_359, __v_360, __v_361, __v_362, __v_363, __v_364, __v_365, __v_366, __v_367, __v_368, __v_369, __v_370, __v_371, __v_372, __v_373, __v_374, __v_375, __v_376, __v_377, __v_378, __v_379, __v_380, __v_381, __v_382, __v_383]; let __cu = unconstrained; if let Some(result) = record.function_queries[69].get_mut(&__args[..]) { if !unconstrained { *result.multiplicity += G::ONE; } let __ret: [G; OUT_69] = unsafe { *(result.output.as_ptr() as *const [G; OUT_69]) }; __ret } else { aiur_fn_69(__args, record, io_buffer, __cu)? } }; let __v_384: G = __r_arr[0]; let __v_385: G = __r_arr[1]; let __v_386: G = __r_arr[2]; @@ -6357,7 +6357,7 @@ fn aiur_fn_70( let __v_509: G = __r_arr[125]; let __v_510: G = __r_arr[126]; let __v_511: G = __r_arr[127]; - let __r_arr: [G; OUT_69] = { let __args: [G; IN_69] = [__v_384, __v_385, __v_386, __v_387, __v_388, __v_389, __v_390, __v_391, __v_392, __v_393, __v_394, __v_395, __v_396, __v_397, __v_398, __v_399, __v_400, __v_401, __v_402, __v_403, __v_404, __v_405, __v_406, __v_407, __v_408, __v_409, __v_410, __v_411, __v_412, __v_413, __v_414, __v_415, __v_416, __v_417, __v_418, __v_419, __v_420, __v_421, __v_422, __v_423, __v_424, __v_425, __v_426, __v_427, __v_428, __v_429, __v_430, __v_431, __v_432, __v_433, __v_434, __v_435, __v_436, __v_437, __v_438, __v_439, __v_440, __v_441, __v_442, __v_443, __v_444, __v_445, __v_446, __v_447, __v_456, __v_457, __v_458, __v_459, __v_472, __v_473, __v_474, __v_475, __v_460, __v_461, __v_462, __v_463, __v_488, __v_489, __v_490, __v_491, __v_476, __v_477, __v_478, __v_479, __v_448, __v_449, __v_450, __v_451, __v_464, __v_465, __v_466, __v_467, __v_500, __v_501, __v_502, __v_503, __v_452, __v_453, __v_454, __v_455, __v_492, __v_493, __v_494, __v_495, __v_496, __v_497, __v_498, __v_499, __v_468, __v_469, __v_470, __v_471, __v_484, __v_485, __v_486, __v_487, __v_504, __v_505, __v_506, __v_507, __v_508, __v_509, __v_510, __v_511, __v_480, __v_481, __v_482, __v_483]; let __cu = unconstrained; if let Some(result) = record.function_queries[69].get_mut(&__args[..]) { if !unconstrained { *result.multiplicity += G::ONE; } let __ret: [G; OUT_69] = unsafe { *(result.output.as_ptr() as *const [G; OUT_69]) }; __ret } else { aiur_fn_69(__args, record, io_buffer, __cu)? } }; + let __r_arr: [G; OUT_69] = { let __args: [G; IN_69] = [__v_384, __v_385, __v_386, __v_387, __v_388, __v_389, __v_390, __v_391, __v_392, __v_393, __v_394, __v_395, __v_396, __v_397, __v_398, __v_399, __v_400, __v_401, __v_402, __v_403, __v_404, __v_405, __v_406, __v_407, __v_408, __v_409, __v_410, __v_411, __v_412, __v_413, __v_414, __v_415, __v_416, __v_417, __v_418, __v_419, __v_420, __v_421, __v_422, __v_423, __v_424, __v_425, __v_426, __v_427, __v_428, __v_429, __v_430, __v_431, __v_432, __v_433, __v_434, __v_435, __v_436, __v_437, __v_438, __v_439, __v_440, __v_441, __v_442, __v_443, __v_444, __v_445, __v_446, __v_447, __v_448, __v_449, __v_450, __v_451, __v_452, __v_453, __v_454, __v_455, __v_456, __v_457, __v_458, __v_459, __v_460, __v_461, __v_462, __v_463, __v_464, __v_465, __v_466, __v_467, __v_468, __v_469, __v_470, __v_471, __v_472, __v_473, __v_474, __v_475, __v_476, __v_477, __v_478, __v_479, __v_480, __v_481, __v_482, __v_483, __v_484, __v_485, __v_486, __v_487, __v_488, __v_489, __v_490, __v_491, __v_492, __v_493, __v_494, __v_495, __v_496, __v_497, __v_498, __v_499, __v_500, __v_501, __v_502, __v_503, __v_504, __v_505, __v_506, __v_507, __v_508, __v_509, __v_510, __v_511]; let __cu = unconstrained; if let Some(result) = record.function_queries[69].get_mut(&__args[..]) { if !unconstrained { *result.multiplicity += G::ONE; } let __ret: [G; OUT_69] = unsafe { *(result.output.as_ptr() as *const [G; OUT_69]) }; __ret } else { aiur_fn_69(__args, record, io_buffer, __cu)? } }; let __v_512: G = __r_arr[0]; let __v_513: G = __r_arr[1]; let __v_514: G = __r_arr[2]; @@ -6486,7 +6486,7 @@ fn aiur_fn_70( let __v_637: G = __r_arr[125]; let __v_638: G = __r_arr[126]; let __v_639: G = __r_arr[127]; - let __r_arr: [G; OUT_69] = { let __args: [G; IN_69] = [__v_512, __v_513, __v_514, __v_515, __v_516, __v_517, __v_518, __v_519, __v_520, __v_521, __v_522, __v_523, __v_524, __v_525, __v_526, __v_527, __v_528, __v_529, __v_530, __v_531, __v_532, __v_533, __v_534, __v_535, __v_536, __v_537, __v_538, __v_539, __v_540, __v_541, __v_542, __v_543, __v_544, __v_545, __v_546, __v_547, __v_548, __v_549, __v_550, __v_551, __v_552, __v_553, __v_554, __v_555, __v_556, __v_557, __v_558, __v_559, __v_560, __v_561, __v_562, __v_563, __v_564, __v_565, __v_566, __v_567, __v_568, __v_569, __v_570, __v_571, __v_572, __v_573, __v_574, __v_575, __v_584, __v_585, __v_586, __v_587, __v_600, __v_601, __v_602, __v_603, __v_588, __v_589, __v_590, __v_591, __v_616, __v_617, __v_618, __v_619, __v_604, __v_605, __v_606, __v_607, __v_576, __v_577, __v_578, __v_579, __v_592, __v_593, __v_594, __v_595, __v_628, __v_629, __v_630, __v_631, __v_580, __v_581, __v_582, __v_583, __v_620, __v_621, __v_622, __v_623, __v_624, __v_625, __v_626, __v_627, __v_596, __v_597, __v_598, __v_599, __v_612, __v_613, __v_614, __v_615, __v_632, __v_633, __v_634, __v_635, __v_636, __v_637, __v_638, __v_639, __v_608, __v_609, __v_610, __v_611]; let __cu = unconstrained; if let Some(result) = record.function_queries[69].get_mut(&__args[..]) { if !unconstrained { *result.multiplicity += G::ONE; } let __ret: [G; OUT_69] = unsafe { *(result.output.as_ptr() as *const [G; OUT_69]) }; __ret } else { aiur_fn_69(__args, record, io_buffer, __cu)? } }; + let __r_arr: [G; OUT_69] = { let __args: [G; IN_69] = [__v_512, __v_513, __v_514, __v_515, __v_516, __v_517, __v_518, __v_519, __v_520, __v_521, __v_522, __v_523, __v_524, __v_525, __v_526, __v_527, __v_528, __v_529, __v_530, __v_531, __v_532, __v_533, __v_534, __v_535, __v_536, __v_537, __v_538, __v_539, __v_540, __v_541, __v_542, __v_543, __v_544, __v_545, __v_546, __v_547, __v_548, __v_549, __v_550, __v_551, __v_552, __v_553, __v_554, __v_555, __v_556, __v_557, __v_558, __v_559, __v_560, __v_561, __v_562, __v_563, __v_564, __v_565, __v_566, __v_567, __v_568, __v_569, __v_570, __v_571, __v_572, __v_573, __v_574, __v_575, __v_576, __v_577, __v_578, __v_579, __v_580, __v_581, __v_582, __v_583, __v_584, __v_585, __v_586, __v_587, __v_588, __v_589, __v_590, __v_591, __v_592, __v_593, __v_594, __v_595, __v_596, __v_597, __v_598, __v_599, __v_600, __v_601, __v_602, __v_603, __v_604, __v_605, __v_606, __v_607, __v_608, __v_609, __v_610, __v_611, __v_612, __v_613, __v_614, __v_615, __v_616, __v_617, __v_618, __v_619, __v_620, __v_621, __v_622, __v_623, __v_624, __v_625, __v_626, __v_627, __v_628, __v_629, __v_630, __v_631, __v_632, __v_633, __v_634, __v_635, __v_636, __v_637, __v_638, __v_639]; let __cu = unconstrained; if let Some(result) = record.function_queries[69].get_mut(&__args[..]) { if !unconstrained { *result.multiplicity += G::ONE; } let __ret: [G; OUT_69] = unsafe { *(result.output.as_ptr() as *const [G; OUT_69]) }; __ret } else { aiur_fn_69(__args, record, io_buffer, __cu)? } }; let __v_640: G = __r_arr[0]; let __v_641: G = __r_arr[1]; let __v_642: G = __r_arr[2]; @@ -6615,7 +6615,7 @@ fn aiur_fn_70( let __v_765: G = __r_arr[125]; let __v_766: G = __r_arr[126]; let __v_767: G = __r_arr[127]; - let __r_arr: [G; OUT_69] = { let __args: [G; IN_69] = [__v_640, __v_641, __v_642, __v_643, __v_644, __v_645, __v_646, __v_647, __v_648, __v_649, __v_650, __v_651, __v_652, __v_653, __v_654, __v_655, __v_656, __v_657, __v_658, __v_659, __v_660, __v_661, __v_662, __v_663, __v_664, __v_665, __v_666, __v_667, __v_668, __v_669, __v_670, __v_671, __v_672, __v_673, __v_674, __v_675, __v_676, __v_677, __v_678, __v_679, __v_680, __v_681, __v_682, __v_683, __v_684, __v_685, __v_686, __v_687, __v_688, __v_689, __v_690, __v_691, __v_692, __v_693, __v_694, __v_695, __v_696, __v_697, __v_698, __v_699, __v_700, __v_701, __v_702, __v_703, __v_712, __v_713, __v_714, __v_715, __v_728, __v_729, __v_730, __v_731, __v_716, __v_717, __v_718, __v_719, __v_744, __v_745, __v_746, __v_747, __v_732, __v_733, __v_734, __v_735, __v_704, __v_705, __v_706, __v_707, __v_720, __v_721, __v_722, __v_723, __v_756, __v_757, __v_758, __v_759, __v_708, __v_709, __v_710, __v_711, __v_748, __v_749, __v_750, __v_751, __v_752, __v_753, __v_754, __v_755, __v_724, __v_725, __v_726, __v_727, __v_740, __v_741, __v_742, __v_743, __v_760, __v_761, __v_762, __v_763, __v_764, __v_765, __v_766, __v_767, __v_736, __v_737, __v_738, __v_739]; let __cu = unconstrained; if let Some(result) = record.function_queries[69].get_mut(&__args[..]) { if !unconstrained { *result.multiplicity += G::ONE; } let __ret: [G; OUT_69] = unsafe { *(result.output.as_ptr() as *const [G; OUT_69]) }; __ret } else { aiur_fn_69(__args, record, io_buffer, __cu)? } }; + let __r_arr: [G; OUT_69] = { let __args: [G; IN_69] = [__v_640, __v_641, __v_642, __v_643, __v_644, __v_645, __v_646, __v_647, __v_648, __v_649, __v_650, __v_651, __v_652, __v_653, __v_654, __v_655, __v_656, __v_657, __v_658, __v_659, __v_660, __v_661, __v_662, __v_663, __v_664, __v_665, __v_666, __v_667, __v_668, __v_669, __v_670, __v_671, __v_672, __v_673, __v_674, __v_675, __v_676, __v_677, __v_678, __v_679, __v_680, __v_681, __v_682, __v_683, __v_684, __v_685, __v_686, __v_687, __v_688, __v_689, __v_690, __v_691, __v_692, __v_693, __v_694, __v_695, __v_696, __v_697, __v_698, __v_699, __v_700, __v_701, __v_702, __v_703, __v_704, __v_705, __v_706, __v_707, __v_708, __v_709, __v_710, __v_711, __v_712, __v_713, __v_714, __v_715, __v_716, __v_717, __v_718, __v_719, __v_720, __v_721, __v_722, __v_723, __v_724, __v_725, __v_726, __v_727, __v_728, __v_729, __v_730, __v_731, __v_732, __v_733, __v_734, __v_735, __v_736, __v_737, __v_738, __v_739, __v_740, __v_741, __v_742, __v_743, __v_744, __v_745, __v_746, __v_747, __v_748, __v_749, __v_750, __v_751, __v_752, __v_753, __v_754, __v_755, __v_756, __v_757, __v_758, __v_759, __v_760, __v_761, __v_762, __v_763, __v_764, __v_765, __v_766, __v_767]; let __cu = unconstrained; if let Some(result) = record.function_queries[69].get_mut(&__args[..]) { if !unconstrained { *result.multiplicity += G::ONE; } let __ret: [G; OUT_69] = unsafe { *(result.output.as_ptr() as *const [G; OUT_69]) }; __ret } else { aiur_fn_69(__args, record, io_buffer, __cu)? } }; let __v_768: G = __r_arr[0]; let __v_769: G = __r_arr[1]; let __v_770: G = __r_arr[2]; @@ -6744,7 +6744,7 @@ fn aiur_fn_70( let __v_893: G = __r_arr[125]; let __v_894: G = __r_arr[126]; let __v_895: G = __r_arr[127]; - let __r_arr: [G; OUT_69] = { let __args: [G; IN_69] = [__v_768, __v_769, __v_770, __v_771, __v_772, __v_773, __v_774, __v_775, __v_776, __v_777, __v_778, __v_779, __v_780, __v_781, __v_782, __v_783, __v_784, __v_785, __v_786, __v_787, __v_788, __v_789, __v_790, __v_791, __v_792, __v_793, __v_794, __v_795, __v_796, __v_797, __v_798, __v_799, __v_800, __v_801, __v_802, __v_803, __v_804, __v_805, __v_806, __v_807, __v_808, __v_809, __v_810, __v_811, __v_812, __v_813, __v_814, __v_815, __v_816, __v_817, __v_818, __v_819, __v_820, __v_821, __v_822, __v_823, __v_824, __v_825, __v_826, __v_827, __v_828, __v_829, __v_830, __v_831, __v_840, __v_841, __v_842, __v_843, __v_856, __v_857, __v_858, __v_859, __v_844, __v_845, __v_846, __v_847, __v_872, __v_873, __v_874, __v_875, __v_860, __v_861, __v_862, __v_863, __v_832, __v_833, __v_834, __v_835, __v_848, __v_849, __v_850, __v_851, __v_884, __v_885, __v_886, __v_887, __v_836, __v_837, __v_838, __v_839, __v_876, __v_877, __v_878, __v_879, __v_880, __v_881, __v_882, __v_883, __v_852, __v_853, __v_854, __v_855, __v_868, __v_869, __v_870, __v_871, __v_888, __v_889, __v_890, __v_891, __v_892, __v_893, __v_894, __v_895, __v_864, __v_865, __v_866, __v_867]; let __cu = unconstrained; if let Some(result) = record.function_queries[69].get_mut(&__args[..]) { if !unconstrained { *result.multiplicity += G::ONE; } let __ret: [G; OUT_69] = unsafe { *(result.output.as_ptr() as *const [G; OUT_69]) }; __ret } else { aiur_fn_69(__args, record, io_buffer, __cu)? } }; + let __r_arr: [G; OUT_69] = { let __args: [G; IN_69] = [__v_768, __v_769, __v_770, __v_771, __v_772, __v_773, __v_774, __v_775, __v_776, __v_777, __v_778, __v_779, __v_780, __v_781, __v_782, __v_783, __v_784, __v_785, __v_786, __v_787, __v_788, __v_789, __v_790, __v_791, __v_792, __v_793, __v_794, __v_795, __v_796, __v_797, __v_798, __v_799, __v_800, __v_801, __v_802, __v_803, __v_804, __v_805, __v_806, __v_807, __v_808, __v_809, __v_810, __v_811, __v_812, __v_813, __v_814, __v_815, __v_816, __v_817, __v_818, __v_819, __v_820, __v_821, __v_822, __v_823, __v_824, __v_825, __v_826, __v_827, __v_828, __v_829, __v_830, __v_831, __v_832, __v_833, __v_834, __v_835, __v_836, __v_837, __v_838, __v_839, __v_840, __v_841, __v_842, __v_843, __v_844, __v_845, __v_846, __v_847, __v_848, __v_849, __v_850, __v_851, __v_852, __v_853, __v_854, __v_855, __v_856, __v_857, __v_858, __v_859, __v_860, __v_861, __v_862, __v_863, __v_864, __v_865, __v_866, __v_867, __v_868, __v_869, __v_870, __v_871, __v_872, __v_873, __v_874, __v_875, __v_876, __v_877, __v_878, __v_879, __v_880, __v_881, __v_882, __v_883, __v_884, __v_885, __v_886, __v_887, __v_888, __v_889, __v_890, __v_891, __v_892, __v_893, __v_894, __v_895]; let __cu = unconstrained; if let Some(result) = record.function_queries[69].get_mut(&__args[..]) { if !unconstrained { *result.multiplicity += G::ONE; } let __ret: [G; OUT_69] = unsafe { *(result.output.as_ptr() as *const [G; OUT_69]) }; __ret } else { aiur_fn_69(__args, record, io_buffer, __cu)? } }; let __v_896: G = __r_arr[0]; let __v_897: G = __r_arr[1]; let __v_898: G = __r_arr[2]; From c82f94d74df2bda874c4e66bcb362feeb3de120e Mon Sep 17 00:00:00 2001 From: Gabriel Barreto Date: Fri, 14 Aug 2026 10:22:19 -0300 Subject: [PATCH 7/7] aiur: make xor_split a drop-in substitution for chain_rotr The add-then-remove sequence had left u8XorSplit7/4 in different slots than u8ChainRotr7/4 occupied, scrambling the diff and the FFI tag order. Now the new ops sit exactly where the old ones were: same Bytecode.Op constructor tags (24/25, with the FFI decoder renumbered to match), same lookup channels (13/14), and the same positions in every enum, match, and gadget table. The u32-add ops stay appended at the end (tags 31-33). Codegen regenerated; all FFT pins unchanged. --- Ix/Aiur/Compiler/Check.lean | 18 ++++---- Ix/Aiur/Compiler/Concretize.lean | 28 +++++++----- Ix/Aiur/Compiler/Lower.lean | 8 +++- Ix/Aiur/Compiler/Match.lean | 4 +- Ix/Aiur/Goldilocks.lean | 3 -- Ix/Aiur/Interpret.lean | 20 +++++---- Ix/Aiur/Meta.lean | 26 ++++++----- Ix/Aiur/Semantics/BytecodeEval.lean | 12 ++--- Ix/Aiur/Semantics/SourceEval.lean | 20 ++++++--- Ix/Aiur/Stages/Bytecode.lean | 4 +- Ix/Aiur/Stages/Codegen.lean | 6 +-- Ix/Aiur/Stages/Concrete.lean | 12 ++--- Ix/Aiur/Stages/Simple.lean | 12 ++--- Ix/Aiur/Stages/Source.lean | 28 ++++++------ Ix/Aiur/Stages/Typed.lean | 12 ++--- crates/aiur/src/bytecode.rs | 4 +- crates/aiur/src/constraints.rs | 32 ++++++------- crates/aiur/src/execute.rs | 30 +++++++------ crates/aiur/src/gadgets/bytes2.rs | 70 ++++++++++++++++++----------- crates/aiur/src/lib.rs | 5 ++- crates/aiur/src/trace.rs | 52 ++++++++++----------- crates/ffi/src/aiur/toplevel.rs | 30 ++++++------- 22 files changed, 240 insertions(+), 196 deletions(-) diff --git a/Ix/Aiur/Compiler/Check.lean b/Ix/Aiur/Compiler/Check.lean index 4e1387c2..ca0739f8 100644 --- a/Ix/Aiur/Compiler/Check.lean +++ b/Ix/Aiur/Compiler/Check.lean @@ -761,12 +761,6 @@ def inferTerm (t : Term) : CheckM Typed.Term := match t with let a' ← checkNoEscape a .u8 let b' ← checkNoEscape b .u8 pure (Typed.Term.u8Xor .u8 false a' b') - | .u8XorSplit7 a b => do - let a' ← checkNoEscape a .u8; let b' ← checkNoEscape b .u8 - pure (Typed.Term.u8XorSplit7 (.tuple #[.u8, .u8]) false a' b') - | .u8XorSplit4 a b => do - let a' ← checkNoEscape a .u8; let b' ← checkNoEscape b .u8 - pure (Typed.Term.u8XorSplit4 (.tuple #[.u8, .u8]) false a' b') | .u8And a b => do let a' ← checkNoEscape a .u8 let b' ← checkNoEscape b .u8 @@ -786,6 +780,14 @@ def inferTerm (t : Term) : CheckM Typed.Term := match t with let a' ← checkNoEscape a .u8 let b' ← checkNoEscape b .u8 pure (Typed.Term.u8Mul (.tuple #[.u8, .u8]) false a' b') + | .u8XorSplit7 a b => do + let a' ← checkNoEscape a .u8 + let b' ← checkNoEscape b .u8 + pure (Typed.Term.u8XorSplit7 (.tuple #[.u8, .u8]) false a' b') + | .u8XorSplit4 a b => do + let a' ← checkNoEscape a .u8 + let b' ← checkNoEscape b .u8 + pure (Typed.Term.u8XorSplit4 (.tuple #[.u8, .u8]) false a' b') | .u8Sub a b => do -- Low byte and the 0/1 borrow are both `u8` (same range argument as add). let a' ← checkNoEscape a .u8 @@ -1003,10 +1005,10 @@ def zonkTypedTerm (t : Typed.Term) : CheckM Typed.Term := match t with | .u8ShiftLeft τ e a => do pure (.u8ShiftLeft (← zonkTyp τ) e (← zonkTypedTerm a)) | .u8ShiftRight τ e a => do pure (.u8ShiftRight (← zonkTyp τ) e (← zonkTypedTerm a)) | .u8Xor τ e a b => do pure (.u8Xor (← zonkTyp τ) e (← zonkTypedTerm a) (← zonkTypedTerm b)) - | .u8XorSplit7 τ e a b => do pure (.u8XorSplit7 (← zonkTyp τ) e (← zonkTypedTerm a) (← zonkTypedTerm b)) - | .u8XorSplit4 τ e a b => do pure (.u8XorSplit4 (← zonkTyp τ) e (← zonkTypedTerm a) (← zonkTypedTerm b)) | .u8Add τ e a b => do pure (.u8Add (← zonkTyp τ) e (← zonkTypedTerm a) (← zonkTypedTerm b)) | .u8Mul τ e a b => do pure (.u8Mul (← zonkTyp τ) e (← zonkTypedTerm a) (← zonkTypedTerm b)) + | .u8XorSplit7 τ e a b => do pure (.u8XorSplit7 (← zonkTyp τ) e (← zonkTypedTerm a) (← zonkTypedTerm b)) + | .u8XorSplit4 τ e a b => do pure (.u8XorSplit4 (← zonkTyp τ) e (← zonkTypedTerm a) (← zonkTypedTerm b)) | .u8Sub τ e a b => do pure (.u8Sub (← zonkTyp τ) e (← zonkTypedTerm a) (← zonkTypedTerm b)) | .u8And τ e a b => do pure (.u8And (← zonkTyp τ) e (← zonkTypedTerm a) (← zonkTypedTerm b)) | .u8Or τ e a b => do pure (.u8Or (← zonkTyp τ) e (← zonkTypedTerm a) (← zonkTypedTerm b)) diff --git a/Ix/Aiur/Compiler/Concretize.lean b/Ix/Aiur/Compiler/Concretize.lean index e49519ca..9ff782f1 100644 --- a/Ix/Aiur/Compiler/Concretize.lean +++ b/Ix/Aiur/Compiler/Concretize.lean @@ -334,14 +334,18 @@ def termToConcrete | .u8Xor τ e a b => do pure (.u8Xor (← typToConcrete mono τ) e (← termToConcrete mono a) (← termToConcrete mono b)) - | .u8XorSplit7 τ e a b => do pure (.u8XorSplit7 (← typToConcrete mono τ) e (← termToConcrete mono a) (← termToConcrete mono b)) - | .u8XorSplit4 τ e a b => do pure (.u8XorSplit4 (← typToConcrete mono τ) e (← termToConcrete mono a) (← termToConcrete mono b)) | .u8Add τ e a b => do pure (.u8Add (← typToConcrete mono τ) e (← termToConcrete mono a) (← termToConcrete mono b)) | .u8Mul τ e a b => do pure (.u8Mul (← typToConcrete mono τ) e (← termToConcrete mono a) (← termToConcrete mono b)) + | .u8XorSplit7 τ e a b => do + pure (.u8XorSplit7 (← typToConcrete mono τ) e + (← termToConcrete mono a) (← termToConcrete mono b)) + | .u8XorSplit4 τ e a b => do + pure (.u8XorSplit4 (← typToConcrete mono τ) e + (← termToConcrete mono a) (← termToConcrete mono b)) | .u8Sub τ e a b => do pure (.u8Sub (← typToConcrete mono τ) e (← termToConcrete mono a) (← termToConcrete mono b)) @@ -562,12 +566,14 @@ def rewriteTypedTerm (decls : Typed.Decls) .u8ShiftRight (rewriteTyp subst mono τ) e (rewriteTypedTerm decls subst mono a) | .u8Xor τ e a b => .u8Xor (rewriteTyp subst mono τ) e (rewriteTypedTerm decls subst mono a) (rewriteTypedTerm decls subst mono b) - | .u8XorSplit7 τ e a b => .u8XorSplit7 (rewriteTyp subst mono τ) e (rewriteTypedTerm decls subst mono a) (rewriteTypedTerm decls subst mono b) - | .u8XorSplit4 τ e a b => .u8XorSplit4 (rewriteTyp subst mono τ) e (rewriteTypedTerm decls subst mono a) (rewriteTypedTerm decls subst mono b) | .u8Add τ e a b => .u8Add (rewriteTyp subst mono τ) e (rewriteTypedTerm decls subst mono a) (rewriteTypedTerm decls subst mono b) | .u8Mul τ e a b => .u8Mul (rewriteTyp subst mono τ) e (rewriteTypedTerm decls subst mono a) (rewriteTypedTerm decls subst mono b) + | .u8XorSplit7 τ e a b => .u8XorSplit7 (rewriteTyp subst mono τ) e + (rewriteTypedTerm decls subst mono a) (rewriteTypedTerm decls subst mono b) + | .u8XorSplit4 τ e a b => .u8XorSplit4 (rewriteTyp subst mono τ) e + (rewriteTypedTerm decls subst mono a) (rewriteTypedTerm decls subst mono b) | .u8Sub τ e a b => .u8Sub (rewriteTyp subst mono τ) e (rewriteTypedTerm decls subst mono a) (rewriteTypedTerm decls subst mono b) | .u8And τ e a b => .u8And (rewriteTyp subst mono τ) e @@ -663,8 +669,8 @@ def collectInTypedTerm (seen : Std.HashSet (Global × Array Typ)) : let seen := tArgs.foldl collectInTyp seen args.attach.foldl (fun s ⟨a, _⟩ => collectInTypedTerm s a) seen | .add τ _ a b | .sub τ _ a b | .mul τ _ a b - | .u8Xor τ _ a b | .u8XorSplit7 τ _ a b | .u8XorSplit4 τ _ a b | .u8Add τ _ a b | .u8Mul τ _ a b | .u8Sub τ _ a b - | .u8RangeCheck τ _ a b + | .u8Xor τ _ a b | .u8Add τ _ a b | .u8Mul τ _ a b | .u8Sub τ _ a b + | .u8XorSplit7 τ _ a b | .u8XorSplit4 τ _ a b | .u8RangeCheck τ _ a b | .unconstrainedBigUintDivMod τ _ a b | .u8And τ _ a b | .u8Or τ _ a b | .u8LessThan τ _ a b | .u32LessThan τ _ a b | .unconstrainedU32Add τ _ a b => @@ -738,8 +744,8 @@ def collectCalls (decls : Typed.Decls) let seen := collectCalls decls seen scrut bs.attach.foldl (fun s ⟨(_, b), _⟩ => collectCalls decls s b) seen | .add _ _ a b | .sub _ _ a b | .mul _ _ a b - | .u8Xor _ _ a b | .u8XorSplit7 _ _ a b | .u8XorSplit4 _ _ a b | .u8Add _ _ a b | .u8Mul _ _ a b | .u8Sub _ _ a b - | .u8RangeCheck _ _ a b + | .u8Xor _ _ a b | .u8Add _ _ a b | .u8Mul _ _ a b | .u8Sub _ _ a b + | .u8XorSplit7 _ _ a b | .u8XorSplit4 _ _ a b | .u8RangeCheck _ _ a b | .unconstrainedBigUintDivMod _ _ a b | .u8And _ _ a b | .u8Or _ _ a b | .u8LessThan _ _ a b | .u32LessThan _ _ a b | .unconstrainedU32Add _ _ a b => @@ -843,12 +849,14 @@ def substInTypedTerm (subst : Global → Option Typ) : Typed.Term → Typed.Term .u8ShiftRight (Typ.instantiate subst τ) e (substInTypedTerm subst a) | .u8Xor τ e a b => .u8Xor (Typ.instantiate subst τ) e (substInTypedTerm subst a) (substInTypedTerm subst b) - | .u8XorSplit7 τ e a b => .u8XorSplit7 (Typ.instantiate subst τ) e (substInTypedTerm subst a) (substInTypedTerm subst b) - | .u8XorSplit4 τ e a b => .u8XorSplit4 (Typ.instantiate subst τ) e (substInTypedTerm subst a) (substInTypedTerm subst b) | .u8Add τ e a b => .u8Add (Typ.instantiate subst τ) e (substInTypedTerm subst a) (substInTypedTerm subst b) | .u8Mul τ e a b => .u8Mul (Typ.instantiate subst τ) e (substInTypedTerm subst a) (substInTypedTerm subst b) + | .u8XorSplit7 τ e a b => .u8XorSplit7 (Typ.instantiate subst τ) e + (substInTypedTerm subst a) (substInTypedTerm subst b) + | .u8XorSplit4 τ e a b => .u8XorSplit4 (Typ.instantiate subst τ) e + (substInTypedTerm subst a) (substInTypedTerm subst b) | .u8Sub τ e a b => .u8Sub (Typ.instantiate subst τ) e (substInTypedTerm subst a) (substInTypedTerm subst b) | .u8And τ e a b => .u8And (Typ.instantiate subst τ) e diff --git a/Ix/Aiur/Compiler/Lower.lean b/Ix/Aiur/Compiler/Lower.lean index 0a500298..4cc3dc33 100644 --- a/Ix/Aiur/Compiler/Lower.lean +++ b/Ix/Aiur/Compiler/Lower.lean @@ -300,14 +300,18 @@ def toIndex | .u8Xor _ _ i j => do let i ← expectIdx layoutMap bindings i; let j ← expectIdx layoutMap bindings j pushOp (.u8Xor i j) - | .u8XorSplit7 _ _ i j => do let i ← expectIdx layoutMap bindings i; let j ← expectIdx layoutMap bindings j; pushOp (.u8XorSplit7 i j) 2 - | .u8XorSplit4 _ _ i j => do let i ← expectIdx layoutMap bindings i; let j ← expectIdx layoutMap bindings j; pushOp (.u8XorSplit4 i j) 2 | .u8Add _ _ i j => do let i ← expectIdx layoutMap bindings i; let j ← expectIdx layoutMap bindings j pushOp (.u8Add i j) 2 | .u8Mul _ _ i j => do let i ← expectIdx layoutMap bindings i; let j ← expectIdx layoutMap bindings j pushOp (.u8Mul i j) 2 + | .u8XorSplit7 _ _ i j => do + let i ← expectIdx layoutMap bindings i; let j ← expectIdx layoutMap bindings j + pushOp (.u8XorSplit7 i j) 2 + | .u8XorSplit4 _ _ i j => do + let i ← expectIdx layoutMap bindings i; let j ← expectIdx layoutMap bindings j + pushOp (.u8XorSplit4 i j) 2 | .u8Sub _ _ i j => do let i ← expectIdx layoutMap bindings i; let j ← expectIdx layoutMap bindings j pushOp (.u8Sub i j) 2 diff --git a/Ix/Aiur/Compiler/Match.lean b/Ix/Aiur/Compiler/Match.lean index 16850246..548468d1 100644 --- a/Ix/Aiur/Compiler/Match.lean +++ b/Ix/Aiur/Compiler/Match.lean @@ -381,10 +381,10 @@ def typedToSimple : Term → Simple.Term | .u8ShiftLeft τ e a => .u8ShiftLeft τ e (typedToSimple a) | .u8ShiftRight τ e a => .u8ShiftRight τ e (typedToSimple a) | .u8Xor τ e a b => .u8Xor τ e (typedToSimple a) (typedToSimple b) - | .u8XorSplit7 τ e a b => .u8XorSplit7 τ e (typedToSimple a) (typedToSimple b) - | .u8XorSplit4 τ e a b => .u8XorSplit4 τ e (typedToSimple a) (typedToSimple b) | .u8Add τ e a b => .u8Add τ e (typedToSimple a) (typedToSimple b) | .u8Mul τ e a b => .u8Mul τ e (typedToSimple a) (typedToSimple b) + | .u8XorSplit7 τ e a b => .u8XorSplit7 τ e (typedToSimple a) (typedToSimple b) + | .u8XorSplit4 τ e a b => .u8XorSplit4 τ e (typedToSimple a) (typedToSimple b) | .u8Sub τ e a b => .u8Sub τ e (typedToSimple a) (typedToSimple b) | .u8And τ e a b => .u8And τ e (typedToSimple a) (typedToSimple b) | .u8Or τ e a b => .u8Or τ e (typedToSimple a) (typedToSimple b) diff --git a/Ix/Aiur/Goldilocks.lean b/Ix/Aiur/Goldilocks.lean index 1237453b..35c40b4b 100644 --- a/Ix/Aiur/Goldilocks.lean +++ b/Ix/Aiur/Goldilocks.lean @@ -72,9 +72,6 @@ def G.u8Mul (a b : G) : G × G := def G.u8Sub (a b : G) : G × G := (G.ofNat ((a.n + 256 - b.n) % 256), if a.n < b.n then 1 else 0) -/-- Chainable partial for a right-rotation by 7 bits over little-endian bytes. -Returns `(a>>7 + b<<1, b>>7, a<<1)` (shifts mod 256). -/ - def G.u8ShiftLeft (a : G) : G := G.ofNat ((a.n * 2) % 256) def G.u8ShiftRight (a : G) : G := G.ofNat (a.n / 2) diff --git a/Ix/Aiur/Interpret.lean b/Ix/Aiur/Interpret.lean index bff87e8e..efac94a8 100644 --- a/Ix/Aiur/Interpret.lean +++ b/Ix/Aiur/Interpret.lean @@ -411,14 +411,6 @@ partial def interp (decls : Decls) (bindings : Bindings) : Term → InterpM Valu match (← interp decls bindings t1), (← interp decls bindings t2) with | .field a, .field b => return .field (G.ofUInt8 (a.val.toUInt8 ^^^ b.val.toUInt8)) | _, _ => throwErr "u8Xor: expected field values" - | .u8XorSplit7 t1 t2 => do - match (← interp decls bindings t1), (← interp decls bindings t2) with - | .field a, .field b => let x := a.val.toUInt8 ^^^ b.val.toUInt8; return .tuple #[.field (G.ofUInt8 (x >>> 7)), .field (G.ofUInt8 (x <<< 1))] - | _, _ => throwErr "u8XorSplit7: expected field values" - | .u8XorSplit4 t1 t2 => do - match (← interp decls bindings t1), (← interp decls bindings t2) with - | .field a, .field b => let x := a.val.toUInt8 ^^^ b.val.toUInt8; return .tuple #[.field (G.ofUInt8 (x >>> 4)), .field (G.ofUInt8 (x <<< 4))] - | _, _ => throwErr "u8XorSplit4: expected field values" | .u8Add t1 t2 => do match (← interp decls bindings t1), (← interp decls bindings t2) with | .field a, .field b => @@ -435,6 +427,18 @@ partial def interp (decls : Decls) (bindings : Bindings) : Term → InterpM Valu let hi : Value := .field (G.ofUInt8 (x / 256).toUInt8) return .tuple #[lo, hi] | _, _ => throwErr "u8Mul: expected field values" + | .u8XorSplit7 t1 t2 => do + match (← interp decls bindings t1), (← interp decls bindings t2) with + | .field a, .field b => + let x := a.val.toUInt8 ^^^ b.val.toUInt8 + return .tuple #[.field (G.ofUInt8 (x >>> 7)), .field (G.ofUInt8 (x <<< 1))] + | _, _ => throwErr "u8XorSplit7: expected field values" + | .u8XorSplit4 t1 t2 => do + match (← interp decls bindings t1), (← interp decls bindings t2) with + | .field a, .field b => + let x := a.val.toUInt8 ^^^ b.val.toUInt8 + return .tuple #[.field (G.ofUInt8 (x >>> 4)), .field (G.ofUInt8 (x <<< 4))] + | _, _ => throwErr "u8XorSplit4: expected field values" | .u8Sub t1 t2 => do match (← interp decls bindings t1), (← interp decls bindings t2) with | .field a, .field b => diff --git a/Ix/Aiur/Meta.lean b/Ix/Aiur/Meta.lean index 3114305a..5f8c13d3 100644 --- a/Ix/Aiur/Meta.lean +++ b/Ix/Aiur/Meta.lean @@ -194,10 +194,10 @@ syntax "u8_bit_decomposition" "(" aiur_trm ")" : a syntax "u8_shift_left" "(" aiur_trm ")" : aiur_trm syntax "u8_shift_right" "(" aiur_trm ")" : aiur_trm syntax "u8_xor" "(" aiur_trm ", " aiur_trm ")" : aiur_trm -syntax "u8_xor_split7" "(" aiur_trm ", " aiur_trm ")" : aiur_trm -syntax "u8_xor_split4" "(" aiur_trm ", " aiur_trm ")" : aiur_trm syntax "u8_add" "(" aiur_trm ", " aiur_trm ")" : aiur_trm syntax "u8_mul" "(" aiur_trm ", " aiur_trm ")" : aiur_trm +syntax "u8_xor_split7" "(" aiur_trm ", " aiur_trm ")" : aiur_trm +syntax "u8_xor_split4" "(" aiur_trm ", " aiur_trm ")" : aiur_trm syntax "u8_sub" "(" aiur_trm ", " aiur_trm ")" : aiur_trm syntax "u8_and" "(" aiur_trm ", " aiur_trm ")" : aiur_trm syntax "u8_or" "(" aiur_trm ", " aiur_trm ")" : aiur_trm @@ -337,14 +337,14 @@ partial def elabTrm : ElabStxCat `aiur_trm mkAppM ``Source.Term.u8ShiftRight #[← elabTrm byte] | `(aiur_trm| u8_xor($i:aiur_trm, $j:aiur_trm)) => do mkAppM ``Source.Term.u8Xor #[← elabTrm i, ← elabTrm j] - | `(aiur_trm| u8_xor_split7($i:aiur_trm, $j:aiur_trm)) => do - mkAppM ``Source.Term.u8XorSplit7 #[← elabTrm i, ← elabTrm j] - | `(aiur_trm| u8_xor_split4($i:aiur_trm, $j:aiur_trm)) => do - mkAppM ``Source.Term.u8XorSplit4 #[← elabTrm i, ← elabTrm j] | `(aiur_trm| u8_add($i:aiur_trm, $j:aiur_trm)) => do mkAppM ``Source.Term.u8Add #[← elabTrm i, ← elabTrm j] | `(aiur_trm| u8_mul($i:aiur_trm, $j:aiur_trm)) => do mkAppM ``Source.Term.u8Mul #[← elabTrm i, ← elabTrm j] + | `(aiur_trm| u8_xor_split7($i:aiur_trm, $j:aiur_trm)) => do + mkAppM ``Source.Term.u8XorSplit7 #[← elabTrm i, ← elabTrm j] + | `(aiur_trm| u8_xor_split4($i:aiur_trm, $j:aiur_trm)) => do + mkAppM ``Source.Term.u8XorSplit4 #[← elabTrm i, ← elabTrm j] | `(aiur_trm| u8_sub($i:aiur_trm, $j:aiur_trm)) => do mkAppM ``Source.Term.u8Sub #[← elabTrm i, ← elabTrm j] | `(aiur_trm| u8_and($i:aiur_trm, $j:aiur_trm)) => do @@ -553,12 +553,6 @@ where let i ← replaceToken old new i let j ← replaceToken old new j `(aiur_trm| u8_xor($i, $j)) - | `(aiur_trm| u8_xor_split7($i:aiur_trm, $j:aiur_trm)) => do - let i ← replaceToken old new i; let j ← replaceToken old new j - `(aiur_trm| u8_xor_split7($i, $j)) - | `(aiur_trm| u8_xor_split4($i:aiur_trm, $j:aiur_trm)) => do - let i ← replaceToken old new i; let j ← replaceToken old new j - `(aiur_trm| u8_xor_split4($i, $j)) | `(aiur_trm| u8_add($i:aiur_trm, $j:aiur_trm)) => do let i ← replaceToken old new i let j ← replaceToken old new j @@ -567,6 +561,14 @@ where let i ← replaceToken old new i let j ← replaceToken old new j `(aiur_trm| u8_mul($i, $j)) + | `(aiur_trm| u8_xor_split7($i:aiur_trm, $j:aiur_trm)) => do + let i ← replaceToken old new i + let j ← replaceToken old new j + `(aiur_trm| u8_xor_split7($i, $j)) + | `(aiur_trm| u8_xor_split4($i:aiur_trm, $j:aiur_trm)) => do + let i ← replaceToken old new i + let j ← replaceToken old new j + `(aiur_trm| u8_xor_split4($i, $j)) | `(aiur_trm| u8_sub($i:aiur_trm, $j:aiur_trm)) => do let i ← replaceToken old new i let j ← replaceToken old new j diff --git a/Ix/Aiur/Semantics/BytecodeEval.lean b/Ix/Aiur/Semantics/BytecodeEval.lean index 6655a4d1..7656bcec 100644 --- a/Ix/Aiur/Semantics/BytecodeEval.lean +++ b/Ix/Aiur/Semantics/BytecodeEval.lean @@ -303,12 +303,6 @@ def evalOp (t : Bytecode.Toplevel) (fuel : Nat) (op : Op) (st : EvalState) : | .u8Xor a b => do let x ← readIdx st a; let y ← readIdx st b pure (pushMap st (G.ofUInt8 (x.val.toUInt8 ^^^ y.val.toUInt8))) - | .u8XorSplit7 a b => do - let x ← readIdx st a; let y ← readIdx st b; let z := x.val.toUInt8 ^^^ y.val.toUInt8 - pure (pushMap (pushMap st (G.ofUInt8 (z >>> 7))) (G.ofUInt8 (z <<< 1))) - | .u8XorSplit4 a b => do - let x ← readIdx st a; let y ← readIdx st b; let z := x.val.toUInt8 ^^^ y.val.toUInt8 - pure (pushMap (pushMap st (G.ofUInt8 (z >>> 4))) (G.ofUInt8 (z <<< 4))) | .u8Add a b => do let x ← readIdx st a; let y ← readIdx st b let sum := x.val.toUInt8.toNat + y.val.toUInt8.toNat @@ -319,6 +313,12 @@ def evalOp (t : Bytecode.Toplevel) (fuel : Nat) (op : Op) (st : EvalState) : let prod := x.val.toUInt8.toNat * y.val.toUInt8.toNat let st1 := pushMap st (G.ofUInt8 prod.toUInt8) pure (pushMap st1 (G.ofUInt8 (prod / 256).toUInt8)) + | .u8XorSplit7 a b => do + let x ← readIdx st a; let y ← readIdx st b; let z := x.val.toUInt8 ^^^ y.val.toUInt8 + pure (pushMap (pushMap st (G.ofUInt8 (z >>> 7))) (G.ofUInt8 (z <<< 1))) + | .u8XorSplit4 a b => do + let x ← readIdx st a; let y ← readIdx st b; let z := x.val.toUInt8 ^^^ y.val.toUInt8 + pure (pushMap (pushMap st (G.ofUInt8 (z >>> 4))) (G.ofUInt8 (z <<< 4))) | .u8Sub a b => do let x ← readIdx st a; let y ← readIdx st b let i := x.val.toUInt8; let j := y.val.toUInt8 diff --git a/Ix/Aiur/Semantics/SourceEval.lean b/Ix/Aiur/Semantics/SourceEval.lean index 206dcf50..c0ce18fc 100644 --- a/Ix/Aiur/Semantics/SourceEval.lean +++ b/Ix/Aiur/Semantics/SourceEval.lean @@ -510,6 +510,20 @@ def interp (decls : Decls) (fuel : Nat) (bindings : Bindings) .field (G.ofUInt8 (x / 256).toUInt8)]) (interp decls fuel bindings t1 st) (fun st1 => interp decls fuel bindings t2 st1) + | .u8XorSplit7 t1 t2 => + combineFieldsResult + (fun a b => + let x := a.val.toUInt8 ^^^ b.val.toUInt8 + .tuple #[.field (G.ofUInt8 (x >>> 7)), .field (G.ofUInt8 (x <<< 1))]) + (interp decls fuel bindings t1 st) + (fun st1 => interp decls fuel bindings t2 st1) + | .u8XorSplit4 t1 t2 => + combineFieldsResult + (fun a b => + let x := a.val.toUInt8 ^^^ b.val.toUInt8 + .tuple #[.field (G.ofUInt8 (x >>> 4)), .field (G.ofUInt8 (x <<< 4))]) + (interp decls fuel bindings t1 st) + (fun st1 => interp decls fuel bindings t2 st1) | .u8Sub t1 t2 => combineFieldsResult (fun a b => @@ -517,12 +531,6 @@ def interp (decls : Decls) (fuel : Nat) (bindings : Bindings) .tuple #[.field (G.ofUInt8 (i - j)), .field (if j > i then 1 else 0)]) (interp decls fuel bindings t1 st) (fun st1 => interp decls fuel bindings t2 st1) - | .u8XorSplit7 t1 t2 => - combineFieldsResult (fun a b => let x := a.val.toUInt8 ^^^ b.val.toUInt8; .tuple #[.field (G.ofUInt8 (x >>> 7)), .field (G.ofUInt8 (x <<< 1))]) - (interp decls fuel bindings t1 st) (fun st1 => interp decls fuel bindings t2 st1) - | .u8XorSplit4 t1 t2 => - combineFieldsResult (fun a b => let x := a.val.toUInt8 ^^^ b.val.toUInt8; .tuple #[.field (G.ofUInt8 (x >>> 4)), .field (G.ofUInt8 (x <<< 4))]) - (interp decls fuel bindings t1 st) (fun st1 => interp decls fuel bindings t2 st1) | .u8And t1 t2 => combineFieldsResult (fun a b => .field (G.ofUInt8 (a.val.toUInt8 &&& b.val.toUInt8))) (interp decls fuel bindings t1 st) diff --git a/Ix/Aiur/Stages/Bytecode.lean b/Ix/Aiur/Stages/Bytecode.lean index 7d65d27f..acd8e257 100644 --- a/Ix/Aiur/Stages/Bytecode.lean +++ b/Ix/Aiur/Stages/Bytecode.lean @@ -43,6 +43,8 @@ inductive Op | u8Or : ValIdx → ValIdx → Op | u8LessThan : ValIdx → ValIdx → Op | u32LessThan : ValIdx → ValIdx → Op + | u8XorSplit7 : ValIdx → ValIdx → Op + | u8XorSplit4 : ValIdx → ValIdx → Op | debug : String → Option (Array ValIdx) → Op /-- Range-check the two values into `[0, 256)` via the byte chip. Produces no new values: it is a pure side-effect (lookup), and its `u8` results alias the @@ -70,8 +72,6 @@ inductive Op | unconstrainedU32Add3 : Array ValIdx → Array ValIdx → Array ValIdx → Op /-- Virtual LE-byte packing expression; allocates no auxiliary column. -/ | u32ToField : Array ValIdx → Op - | u8XorSplit7 : ValIdx → ValIdx → Op - | u8XorSplit4 : ValIdx → ValIdx → Op deriving Repr, BEq, Hashable mutual diff --git a/Ix/Aiur/Stages/Codegen.lean b/Ix/Aiur/Stages/Codegen.lean index 904807bb..3bc25cc1 100644 --- a/Ix/Aiur/Stages/Codegen.lean +++ b/Ix/Aiur/Stages/Codegen.lean @@ -347,8 +347,8 @@ def Op.outputCount : Op → Nat | .u8ShiftLeft _ | .u8ShiftRight _ => 1 | .u8Xor _ _ | .u8And _ _ | .u8Or _ _ | .u8LessThan _ _ => 1 | .u8Mul _ _ => 2 - | .u8XorSplit7 _ _ | .u8XorSplit4 _ _ => 2 | .u8Add _ _ | .u8Sub _ _ => 2 + | .u8XorSplit7 _ _ | .u8XorSplit4 _ _ => 2 | .u32LessThan _ _ => 1 | .u8RangeCheck _ _ => 0 | .unconstrainedBigUintDivMod _ _ => 2 @@ -719,12 +719,12 @@ def emitOp (out : Nat) (op : Op) : Array RustStmt := | .u8ShiftLeft b => emitU8Bytes1 out "bytes1_shift_left_value" "Bytes1::shift_left" b 1 | .u8ShiftRight b => emitU8Bytes1 out "bytes1_shift_right_value" "Bytes1::shift_right" b 1 | .u8Xor i j => emitU8Bytes2 out "bytes2_xor_value" "xor" i j 1 - | .u8XorSplit7 i j => emitU8Bytes2 out "bytes2_xor_split7_value" "xor_split7" i j 2 - | .u8XorSplit4 i j => emitU8Bytes2 out "bytes2_xor_split4_value" "xor_split4" i j 2 | .u8Mul i j => emitU8Bytes2 out "bytes2_mul_value" "mul" i j 2 | .u8And i j => emitU8Bytes2 out "bytes2_and_value" "and" i j 1 | .u8Or i j => emitU8Bytes2 out "bytes2_or_value" "or" i j 1 | .u8LessThan i j => emitU8Bytes2 out "bytes2_less_than_value" "less_than" i j 1 + | .u8XorSplit7 i j => emitU8Bytes2 out "bytes2_xor_split7_value" "xor_split7" i j 2 + | .u8XorSplit4 i j => emitU8Bytes2 out "bytes2_xor_split4_value" "xor_split4" i j 2 | .u8Add i j => emitU8Add out i j | .u8Sub i j => emitU8Sub out i j | .u32LessThan a b => emitU32LessThan out a b diff --git a/Ix/Aiur/Stages/Concrete.lean b/Ix/Aiur/Stages/Concrete.lean index dca29735..f563ecb5 100644 --- a/Ix/Aiur/Stages/Concrete.lean +++ b/Ix/Aiur/Stages/Concrete.lean @@ -78,8 +78,6 @@ inductive Term : Type where | u8ShiftLeft (typ : Typ) (escapes : Bool) (a : Term) : Term | u8ShiftRight (typ : Typ) (escapes : Bool) (a : Term) : Term | u8Xor (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term - | u8XorSplit7 (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term - | u8XorSplit4 (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term | u8Add (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term | u8Mul (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term | u8Sub (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term @@ -87,6 +85,8 @@ inductive Term : Type where | u8Or (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term | u8LessThan (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term | u32LessThan (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term + | u8XorSplit7 (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term + | u8XorSplit4 (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term | unconstrainedU32Add (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term | unconstrainedU32Add3 (typ : Typ) (escapes : Bool) (a : Term) (b : Term) (c : Term) : Term | u32ToField (typ : Typ) (escapes : Bool) (a : Term) : Term @@ -109,10 +109,10 @@ def Term.typ : Term → Typ | .assertEq t _ _ _ _ _ | .ioGetInfo t _ _ _ | .ioSetInfo t _ _ _ _ _ _ | .ioRead t _ _ _ _ | .ioWrite t _ _ _ _ | .u8BitDecomposition t _ _ | .u8ShiftLeft t _ _ | .u8ShiftRight t _ _ - | .u8Xor t _ _ _ | .u8XorSplit7 t _ _ _ | .u8XorSplit4 t _ _ _ | .u8Add t _ _ _ | .u8Mul t _ _ _ | .u8Sub t _ _ _ + | .u8Xor t _ _ _ | .u8Add t _ _ _ | .u8Mul t _ _ _ | .u8Sub t _ _ _ | .u8And t _ _ _ | .u8Or t _ _ _ | .u8LessThan t _ _ _ | .u32LessThan t _ _ _ + | .u8XorSplit7 t _ _ _ | .u8XorSplit4 t _ _ _ | .u8RangeCheck t _ _ _ | .unconstrainedU32Add t _ _ _ | .unconstrainedU32Add3 t _ _ _ _ | .u32ToField t _ _ - | .u8RangeCheck t _ _ _ | .unconstrainedBigUintDivMod t _ _ _ | .unconstrainedGToBytes t _ _ | .unconstrainedGInverse t _ _ | .debug t _ _ _ _ => t @@ -129,10 +129,10 @@ def Term.escapes : Term → Bool | .assertEq _ e _ _ _ _ | .ioGetInfo _ e _ _ | .ioSetInfo _ e _ _ _ _ _ | .ioRead _ e _ _ _ | .ioWrite _ e _ _ _ | .u8BitDecomposition _ e _ | .u8ShiftLeft _ e _ | .u8ShiftRight _ e _ - | .u8Xor _ e _ _ | .u8XorSplit7 _ e _ _ | .u8XorSplit4 _ e _ _ | .u8Add _ e _ _ | .u8Mul _ e _ _ | .u8Sub _ e _ _ + | .u8Xor _ e _ _ | .u8Add _ e _ _ | .u8Mul _ e _ _ | .u8Sub _ e _ _ | .u8And _ e _ _ | .u8Or _ e _ _ | .u8LessThan _ e _ _ | .u32LessThan _ e _ _ + | .u8XorSplit7 _ e _ _ | .u8XorSplit4 _ e _ _ | .u8RangeCheck _ e _ _ | .unconstrainedU32Add _ e _ _ | .unconstrainedU32Add3 _ e _ _ _ | .u32ToField _ e _ - | .u8RangeCheck _ e _ _ | .unconstrainedBigUintDivMod _ e _ _ | .unconstrainedGToBytes _ e _ | .unconstrainedGInverse _ e _ | .debug _ e _ _ _ => e diff --git a/Ix/Aiur/Stages/Simple.lean b/Ix/Aiur/Stages/Simple.lean index 545390b3..4e35c18e 100644 --- a/Ix/Aiur/Stages/Simple.lean +++ b/Ix/Aiur/Stages/Simple.lean @@ -74,8 +74,6 @@ inductive Term : Type where | u8ShiftLeft (typ : Typ) (escapes : Bool) (a : Term) : Term | u8ShiftRight (typ : Typ) (escapes : Bool) (a : Term) : Term | u8Xor (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term - | u8XorSplit7 (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term - | u8XorSplit4 (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term | u8Add (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term | u8Mul (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term | u8Sub (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term @@ -83,6 +81,8 @@ inductive Term : Type where | u8Or (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term | u8LessThan (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term | u32LessThan (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term + | u8XorSplit7 (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term + | u8XorSplit4 (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term | unconstrainedU32Add (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term | unconstrainedU32Add3 (typ : Typ) (escapes : Bool) (a : Term) (b : Term) (c : Term) : Term | u32ToField (typ : Typ) (escapes : Bool) (a : Term) : Term @@ -106,10 +106,10 @@ def Term.typ : Term → Typ | .assertEq t _ _ _ _ _ | .ioGetInfo t _ _ _ | .ioSetInfo t _ _ _ _ _ _ | .ioRead t _ _ _ _ | .ioWrite t _ _ _ _ | .u8BitDecomposition t _ _ | .u8ShiftLeft t _ _ | .u8ShiftRight t _ _ - | .u8Xor t _ _ _ | .u8XorSplit7 t _ _ _ | .u8XorSplit4 t _ _ _ | .u8Add t _ _ _ | .u8Mul t _ _ _ | .u8Sub t _ _ _ + | .u8Xor t _ _ _ | .u8Add t _ _ _ | .u8Mul t _ _ _ | .u8Sub t _ _ _ | .u8And t _ _ _ | .u8Or t _ _ _ | .u8LessThan t _ _ _ | .u32LessThan t _ _ _ + | .u8XorSplit7 t _ _ _ | .u8XorSplit4 t _ _ _ | .u8RangeCheck t _ _ _ | .unconstrainedU32Add t _ _ _ | .unconstrainedU32Add3 t _ _ _ _ | .u32ToField t _ _ - | .u8RangeCheck t _ _ _ | .unconstrainedBigUintDivMod t _ _ _ | .unconstrainedGToBytes t _ _ | .unconstrainedGInverse t _ _ | .toField t _ _ | .u8FromFieldUnsafe t _ _ @@ -126,10 +126,10 @@ def Term.escapes : Term → Bool | .assertEq _ e _ _ _ _ | .ioGetInfo _ e _ _ | .ioSetInfo _ e _ _ _ _ _ | .ioRead _ e _ _ _ | .ioWrite _ e _ _ _ | .u8BitDecomposition _ e _ | .u8ShiftLeft _ e _ | .u8ShiftRight _ e _ - | .u8Xor _ e _ _ | .u8XorSplit7 _ e _ _ | .u8XorSplit4 _ e _ _ | .u8Add _ e _ _ | .u8Mul _ e _ _ | .u8Sub _ e _ _ + | .u8Xor _ e _ _ | .u8Add _ e _ _ | .u8Mul _ e _ _ | .u8Sub _ e _ _ | .u8And _ e _ _ | .u8Or _ e _ _ | .u8LessThan _ e _ _ | .u32LessThan _ e _ _ + | .u8XorSplit7 _ e _ _ | .u8XorSplit4 _ e _ _ | .u8RangeCheck _ e _ _ | .unconstrainedU32Add _ e _ _ | .unconstrainedU32Add3 _ e _ _ _ | .u32ToField _ e _ - | .u8RangeCheck _ e _ _ | .unconstrainedBigUintDivMod _ e _ _ | .unconstrainedGToBytes _ e _ | .unconstrainedGInverse _ e _ | .toField _ e _ | .u8FromFieldUnsafe _ e _ diff --git a/Ix/Aiur/Stages/Source.lean b/Ix/Aiur/Stages/Source.lean index 79964453..d4441383 100644 --- a/Ix/Aiur/Stages/Source.lean +++ b/Ix/Aiur/Stages/Source.lean @@ -423,8 +423,6 @@ inductive Term | u8ShiftLeft : Term → Term | u8ShiftRight : Term → Term | u8Xor : Term → Term → Term - | u8XorSplit7 : Term → Term → Term - | u8XorSplit4 : Term → Term → Term | u8Add : Term → Term → Term | u8Mul : Term → Term → Term | u8Sub : Term → Term → Term @@ -432,6 +430,8 @@ inductive Term | u8Or : Term → Term → Term | u8LessThan : Term → Term → Term | u32LessThan : Term → Term → Term + | u8XorSplit7 : Term → Term → Term + | u8XorSplit4 : Term → Term → Term /-- Native unconstrained u32 addition hint. The four result bytes are fresh advice; the carry is a virtual value derived from the packed operands. -/ | unconstrainedU32Add : Term → Term → Term @@ -684,8 +684,6 @@ def Term.freshen (cnt : Nat) (subst : Std.HashMap Local Local) : | .u8ShiftLeft a => let (cnt, a') := Term.freshen cnt subst a; (cnt, .u8ShiftLeft a') | .u8ShiftRight a => let (cnt, a') := Term.freshen cnt subst a; (cnt, .u8ShiftRight a') | .u8Xor a b => let (cnt, a') := Term.freshen cnt subst a; let (cnt, b') := Term.freshen cnt subst b; (cnt, .u8Xor a' b') - | .u8XorSplit7 a b => let (cnt, a') := Term.freshen cnt subst a; let (cnt, b') := Term.freshen cnt subst b; (cnt, .u8XorSplit7 a' b') - | .u8XorSplit4 a b => let (cnt, a') := Term.freshen cnt subst a; let (cnt, b') := Term.freshen cnt subst b; (cnt, .u8XorSplit4 a' b') | .u8Add a b => let (cnt, a') := Term.freshen cnt subst a; let (cnt, b') := Term.freshen cnt subst b; (cnt, .u8Add a' b') | .u8Mul a b => let (cnt, a') := Term.freshen cnt subst a; let (cnt, b') := Term.freshen cnt subst b; (cnt, .u8Mul a' b') | .u8Sub a b => let (cnt, a') := Term.freshen cnt subst a; let (cnt, b') := Term.freshen cnt subst b; (cnt, .u8Sub a' b') @@ -693,6 +691,8 @@ def Term.freshen (cnt : Nat) (subst : Std.HashMap Local Local) : | .u8Or a b => let (cnt, a') := Term.freshen cnt subst a; let (cnt, b') := Term.freshen cnt subst b; (cnt, .u8Or a' b') | .u8LessThan a b => let (cnt, a') := Term.freshen cnt subst a; let (cnt, b') := Term.freshen cnt subst b; (cnt, .u8LessThan a' b') | .u32LessThan a b => let (cnt, a') := Term.freshen cnt subst a; let (cnt, b') := Term.freshen cnt subst b; (cnt, .u32LessThan a' b') + | .u8XorSplit7 a b => let (cnt, a') := Term.freshen cnt subst a; let (cnt, b') := Term.freshen cnt subst b; (cnt, .u8XorSplit7 a' b') + | .u8XorSplit4 a b => let (cnt, a') := Term.freshen cnt subst a; let (cnt, b') := Term.freshen cnt subst b; (cnt, .u8XorSplit4 a' b') | .unconstrainedU32Add a b => let (cnt, a') := Term.freshen cnt subst a; let (cnt, b') := Term.freshen cnt subst b; (cnt, .unconstrainedU32Add a' b') | .unconstrainedU32Add3 a b c => let (cnt, a') := Term.freshen cnt subst a; let (cnt, b') := Term.freshen cnt subst b; let (cnt, c') := Term.freshen cnt subst c; (cnt, .unconstrainedU32Add3 a' b' c') | .u32ToField a => let (cnt, a') := Term.freshen cnt subst a; (cnt, .u32ToField a') @@ -742,8 +742,8 @@ def Term.inlineCallSites : Term → List (Global × Nat) arms.attach.foldl (fun acc ⟨(_, a), _⟩ => acc ++ a.inlineCallSites) s.inlineCallSites | .let _ v b => v.inlineCallSites ++ b.inlineCallSites | .add a b | .sub a b | .mul a b | .set a _ b - | .u8Xor a b | .u8XorSplit7 a b | .u8XorSplit4 a b | .u8Add a b | .u8Mul a b | .u8Sub a b | .u8And a b | .u8Or a b - | .u8LessThan a b | .u32LessThan a b | .unconstrainedU32Add a b + | .u8Xor a b | .u8Add a b | .u8Mul a b | .u8Sub a b | .u8And a b | .u8Or a b + | .u8LessThan a b | .u32LessThan a b | .u8XorSplit7 a b | .u8XorSplit4 a b | .unconstrainedU32Add a b | .unconstrainedBigUintDivMod a b | .u8RangeCheck a b | .ioGetInfo a b => a.inlineCallSites ++ b.inlineCallSites | .assertEq a b _ c => a.inlineCallSites ++ b.inlineCallSites ++ c.inlineCallSites @@ -858,8 +858,6 @@ def Term.expandOnce (done : Std.HashMap Global (List Local × Term)) (cnt : Nat) | .u8ShiftLeft a => let (cnt, a') := Term.expandOnce done cnt a; (cnt, .u8ShiftLeft a') | .u8ShiftRight a => let (cnt, a') := Term.expandOnce done cnt a; (cnt, .u8ShiftRight a') | .u8Xor a b => let (cnt, a') := Term.expandOnce done cnt a; let (cnt, b') := Term.expandOnce done cnt b; (cnt, .u8Xor a' b') - | .u8XorSplit7 a b => let (cnt, a') := Term.expandOnce done cnt a; let (cnt, b') := Term.expandOnce done cnt b; (cnt, .u8XorSplit7 a' b') - | .u8XorSplit4 a b => let (cnt, a') := Term.expandOnce done cnt a; let (cnt, b') := Term.expandOnce done cnt b; (cnt, .u8XorSplit4 a' b') | .u8Add a b => let (cnt, a') := Term.expandOnce done cnt a; let (cnt, b') := Term.expandOnce done cnt b; (cnt, .u8Add a' b') | .u8Mul a b => let (cnt, a') := Term.expandOnce done cnt a; let (cnt, b') := Term.expandOnce done cnt b; (cnt, .u8Mul a' b') | .u8Sub a b => let (cnt, a') := Term.expandOnce done cnt a; let (cnt, b') := Term.expandOnce done cnt b; (cnt, .u8Sub a' b') @@ -867,6 +865,8 @@ def Term.expandOnce (done : Std.HashMap Global (List Local × Term)) (cnt : Nat) | .u8Or a b => let (cnt, a') := Term.expandOnce done cnt a; let (cnt, b') := Term.expandOnce done cnt b; (cnt, .u8Or a' b') | .u8LessThan a b => let (cnt, a') := Term.expandOnce done cnt a; let (cnt, b') := Term.expandOnce done cnt b; (cnt, .u8LessThan a' b') | .u32LessThan a b => let (cnt, a') := Term.expandOnce done cnt a; let (cnt, b') := Term.expandOnce done cnt b; (cnt, .u32LessThan a' b') + | .u8XorSplit7 a b => let (cnt, a') := Term.expandOnce done cnt a; let (cnt, b') := Term.expandOnce done cnt b; (cnt, .u8XorSplit7 a' b') + | .u8XorSplit4 a b => let (cnt, a') := Term.expandOnce done cnt a; let (cnt, b') := Term.expandOnce done cnt b; (cnt, .u8XorSplit4 a' b') | .unconstrainedU32Add a b => let (cnt, a') := Term.expandOnce done cnt a; let (cnt, b') := Term.expandOnce done cnt b; (cnt, .unconstrainedU32Add a' b') | .unconstrainedU32Add3 a b c => let (cnt, a') := Term.expandOnce done cnt a; let (cnt, b') := Term.expandOnce done cnt b; let (cnt, c') := Term.expandOnce done cnt c; (cnt, .unconstrainedU32Add3 a' b' c') | .u32ToField a => let (cnt, a') := Term.expandOnce done cnt a; (cnt, .u32ToField a') @@ -978,10 +978,6 @@ def Term.hoistLets : Term → Term := | .unconstrainedGInverse a => let (fs, c) := Term.peelLets (Term.hoistLets a); Term.wrapLets fs (.unconstrainedGInverse c) | .u8Xor a b => let (fs, cs) := Term.peelListLets [Term.hoistLets a, Term.hoistLets b] match cs with | [a, b] => Term.wrapLets fs (.u8Xor a b) | _ => t - | .u8XorSplit7 a b => let (fs, cs) := Term.peelListLets [Term.hoistLets a, Term.hoistLets b] - match cs with | [a, b] => Term.wrapLets fs (.u8XorSplit7 a b) | _ => t - | .u8XorSplit4 a b => let (fs, cs) := Term.peelListLets [Term.hoistLets a, Term.hoistLets b] - match cs with | [a, b] => Term.wrapLets fs (.u8XorSplit4 a b) | _ => t | .u8Add a b => let (fs, cs) := Term.peelListLets [Term.hoistLets a, Term.hoistLets b] match cs with | [a, b] => Term.wrapLets fs (.u8Add a b) | _ => t | .u8Mul a b => let (fs, cs) := Term.peelListLets [Term.hoistLets a, Term.hoistLets b] @@ -996,6 +992,10 @@ def Term.hoistLets : Term → Term := match cs with | [a, b] => Term.wrapLets fs (.u8LessThan a b) | _ => t | .u32LessThan a b => let (fs, cs) := Term.peelListLets [Term.hoistLets a, Term.hoistLets b] match cs with | [a, b] => Term.wrapLets fs (.u32LessThan a b) | _ => t + | .u8XorSplit7 a b => let (fs, cs) := Term.peelListLets [Term.hoistLets a, Term.hoistLets b] + match cs with | [a, b] => Term.wrapLets fs (.u8XorSplit7 a b) | _ => t + | .u8XorSplit4 a b => let (fs, cs) := Term.peelListLets [Term.hoistLets a, Term.hoistLets b] + match cs with | [a, b] => Term.wrapLets fs (.u8XorSplit4 a b) | _ => t | .unconstrainedU32Add a b => let (fs, cs) := Term.peelListLets [Term.hoistLets a, Term.hoistLets b] match cs with | [a, b] => Term.wrapLets fs (.unconstrainedU32Add a b) | _ => t | .unconstrainedU32Add3 a b c => let (fs, cs) := Term.peelListLets [Term.hoistLets a, Term.hoistLets b, Term.hoistLets c] @@ -1096,9 +1096,9 @@ partial def Term.collectGlobals (acc : Std.HashSet Global) : Term → Std.HashSe bs.foldl (fun a (p, b) => b.collectGlobals (patternGlobals a p)) (s.collectGlobals acc) | .app g args _ => args.foldl (fun a t => t.collectGlobals a) (acc.insert g) - | .add a b | .sub a b | .mul a b | .u8Xor a b | .u8XorSplit7 a b | .u8XorSplit4 a b | .u8Add a b + | .add a b | .sub a b | .mul a b | .u8Xor a b | .u8Add a b | .u8Mul a b | .u8Sub a b | .u8And a b | .u8Or a b | .u8LessThan a b - | .u32LessThan a b | .unconstrainedU32Add a b + | .u32LessThan a b | .u8XorSplit7 a b | .u8XorSplit4 a b | .unconstrainedU32Add a b | .u8RangeCheck a b | .unconstrainedBigUintDivMod a b | .ioGetInfo a b => b.collectGlobals (a.collectGlobals acc) | .unconstrainedU32Add3 a b c => c.collectGlobals (b.collectGlobals (a.collectGlobals acc)) diff --git a/Ix/Aiur/Stages/Typed.lean b/Ix/Aiur/Stages/Typed.lean index 40ec6313..55bc14c4 100644 --- a/Ix/Aiur/Stages/Typed.lean +++ b/Ix/Aiur/Stages/Typed.lean @@ -50,8 +50,6 @@ inductive Term : Type where | u8ShiftLeft (typ : Typ) (escapes : Bool) (a : Term) : Term | u8ShiftRight (typ : Typ) (escapes : Bool) (a : Term) : Term | u8Xor (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term - | u8XorSplit7 (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term - | u8XorSplit4 (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term | u8Add (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term | u8Mul (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term | u8Sub (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term @@ -59,6 +57,8 @@ inductive Term : Type where | u8Or (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term | u8LessThan (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term | u32LessThan (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term + | u8XorSplit7 (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term + | u8XorSplit4 (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term | unconstrainedU32Add (typ : Typ) (escapes : Bool) (a : Term) (b : Term) : Term | unconstrainedU32Add3 (typ : Typ) (escapes : Bool) (a : Term) (b : Term) (c : Term) : Term | u32ToField (typ : Typ) (escapes : Bool) (a : Term) : Term @@ -82,10 +82,10 @@ def Term.typ : Term → Typ | .assertEq t _ _ _ _ _ | .ioGetInfo t _ _ _ | .ioSetInfo t _ _ _ _ _ _ | .ioRead t _ _ _ _ | .ioWrite t _ _ _ _ | .u8BitDecomposition t _ _ | .u8ShiftLeft t _ _ | .u8ShiftRight t _ _ - | .u8Xor t _ _ _ | .u8XorSplit7 t _ _ _ | .u8XorSplit4 t _ _ _ | .u8Add t _ _ _ | .u8Mul t _ _ _ | .u8Sub t _ _ _ + | .u8Xor t _ _ _ | .u8Add t _ _ _ | .u8Mul t _ _ _ | .u8Sub t _ _ _ | .u8And t _ _ _ | .u8Or t _ _ _ | .u8LessThan t _ _ _ | .u32LessThan t _ _ _ + | .u8XorSplit7 t _ _ _ | .u8XorSplit4 t _ _ _ | .u8RangeCheck t _ _ _ | .unconstrainedU32Add t _ _ _ | .unconstrainedU32Add3 t _ _ _ _ | .u32ToField t _ _ - | .u8RangeCheck t _ _ _ | .unconstrainedBigUintDivMod t _ _ _ | .unconstrainedGToBytes t _ _ | .unconstrainedGInverse t _ _ | .toField t _ _ | .u8FromFieldUnsafe t _ _ @@ -102,10 +102,10 @@ def Term.escapes : Term → Bool | .assertEq _ e _ _ _ _ | .ioGetInfo _ e _ _ | .ioSetInfo _ e _ _ _ _ _ | .ioRead _ e _ _ _ | .ioWrite _ e _ _ _ | .u8BitDecomposition _ e _ | .u8ShiftLeft _ e _ | .u8ShiftRight _ e _ - | .u8Xor _ e _ _ | .u8XorSplit7 _ e _ _ | .u8XorSplit4 _ e _ _ | .u8Add _ e _ _ | .u8Mul _ e _ _ | .u8Sub _ e _ _ + | .u8Xor _ e _ _ | .u8Add _ e _ _ | .u8Mul _ e _ _ | .u8Sub _ e _ _ | .u8And _ e _ _ | .u8Or _ e _ _ | .u8LessThan _ e _ _ | .u32LessThan _ e _ _ + | .u8XorSplit7 _ e _ _ | .u8XorSplit4 _ e _ _ | .u8RangeCheck _ e _ _ | .unconstrainedU32Add _ e _ _ | .unconstrainedU32Add3 _ e _ _ _ | .u32ToField _ e _ - | .u8RangeCheck _ e _ _ | .unconstrainedBigUintDivMod _ e _ _ | .unconstrainedGToBytes _ e _ | .unconstrainedGInverse _ e _ | .toField _ e _ | .u8FromFieldUnsafe _ e _ diff --git a/crates/aiur/src/bytecode.rs b/crates/aiur/src/bytecode.rs index da521d83..57e426e8 100644 --- a/crates/aiur/src/bytecode.rs +++ b/crates/aiur/src/bytecode.rs @@ -51,8 +51,6 @@ pub enum Op { U8ShiftLeft(ValIdx), U8ShiftRight(ValIdx), U8Xor(ValIdx, ValIdx), - U8XorSplit7(ValIdx, ValIdx), - U8XorSplit4(ValIdx, ValIdx), U8Add(ValIdx, ValIdx), U8Mul(ValIdx, ValIdx), U8Sub(ValIdx, ValIdx), @@ -60,6 +58,8 @@ pub enum Op { U8Or(ValIdx, ValIdx), U8LessThan(ValIdx, ValIdx), U32LessThan(ValIdx, ValIdx), + U8XorSplit7(ValIdx, ValIdx), + U8XorSplit4(ValIdx, ValIdx), Debug(String, Option>), /// Range-check two values into `[0, 256)` via the byte chip. Produces no new /// values: its `u8` results alias the two inputs (cf. `AssertEq`). diff --git a/crates/aiur/src/constraints.rs b/crates/aiur/src/constraints.rs index 2ecd46fd..26488ce5 100644 --- a/crates/aiur/src/constraints.rs +++ b/crates/aiur/src/constraints.rs @@ -529,22 +529,6 @@ impl Op { sel.clone(), state, ), - Op::U8XorSplit7(i, j) => bytes2_constraints( - *i, - *j, - &Bytes2Op::XorSplit7, - u8_xor_split7_channel(), - sel.clone(), - state, - ), - Op::U8XorSplit4(i, j) => bytes2_constraints( - *i, - *j, - &Bytes2Op::XorSplit4, - u8_xor_split4_channel(), - sel.clone(), - state, - ), Op::U8Add(i, j) => { // The add lookup pins only the low byte `z = (x + y) mod 256`. The // carry is then `c = (x + y - z) / 256`, a compound expression that @@ -656,6 +640,22 @@ impl Op { sel.clone(), state, ), + Op::U8XorSplit7(i, j) => bytes2_constraints( + *i, + *j, + &Bytes2Op::XorSplit7, + u8_xor_split7_channel(), + sel.clone(), + state, + ), + Op::U8XorSplit4(i, j) => bytes2_constraints( + *i, + *j, + &Bytes2Op::XorSplit4, + u8_xor_split4_channel(), + sel.clone(), + state, + ), Op::U8RangeCheck(i, j) => { // Pure range-check lookup: no output columns (the `u8` results alias // the inputs), just require `(i, j)` from the byte chip. diff --git a/crates/aiur/src/execute.rs b/crates/aiur/src/execute.rs index 61235c49..f0799e17 100644 --- a/crates/aiur/src/execute.rs +++ b/crates/aiur/src/execute.rs @@ -468,20 +468,6 @@ impl Function { bytes2_execute(*i, *j, &Bytes2Op::Xor, &mut map, record); } }, - ExecEntry::Op(Op::U8XorSplit7(i, j)) => { - let (a, b) = Bytes2::xor_split7(&map[*i], &map[*j]); - if !unconstrained { - record.bytes2_queries.bump_xor_split7(&map[*i], &map[*j]); - } - map.extend([a, b]); - }, - ExecEntry::Op(Op::U8XorSplit4(i, j)) => { - let (a, b) = Bytes2::xor_split4(&map[*i], &map[*j]); - if !unconstrained { - record.bytes2_queries.bump_xor_split4(&map[*i], &map[*j]); - } - map.extend([a, b]); - }, ExecEntry::Op(Op::U8Add(i, j)) => { // The add gadget yields only the low byte; the carry is derived // and pushed separately so the op still produces `(low, carry)`. @@ -580,6 +566,20 @@ impl Function { } } }, + ExecEntry::Op(Op::U8XorSplit7(i, j)) => { + let (a, b) = Bytes2::xor_split7(&map[*i], &map[*j]); + if !unconstrained { + record.bytes2_queries.bump_xor_split7(&map[*i], &map[*j]); + } + map.extend([a, b]); + }, + ExecEntry::Op(Op::U8XorSplit4(i, j)) => { + let (a, b) = Bytes2::xor_split4(&map[*i], &map[*j]); + if !unconstrained { + record.bytes2_queries.bump_xor_split4(&map[*i], &map[*j]); + } + map.extend([a, b]); + }, ExecEntry::Op(Op::U8RangeCheck(i, j)) => { // No `map.push`: the two `u8` outputs alias the inputs `i`, `j`. // Records a range-check query so the byte-chip lookup is satisfied. @@ -837,6 +837,8 @@ pub fn bytes2_xor_split7_value(a: G, b: G, record: &mut QueryRecord) -> (G, G) { record.bytes2_queries.bump_xor_split7(&a, &b); Bytes2::xor_split7(&a, &b) } + +#[inline] pub fn bytes2_xor_split4_value(a: G, b: G, record: &mut QueryRecord) -> (G, G) { record.bytes2_queries.bump_xor_split4(&a, &b); Bytes2::xor_split4(&a, &b) diff --git a/crates/aiur/src/gadgets/bytes2.rs b/crates/aiur/src/gadgets/bytes2.rs index 1fffd666..8a2e16ef 100644 --- a/crates/aiur/src/gadgets/bytes2.rs +++ b/crates/aiur/src/gadgets/bytes2.rs @@ -364,17 +364,20 @@ impl AiurGadget for Bytes2 { less_than, &[less_than_channel, i, j, Self::less_than(&i, &j)], ); - let (hi, lo) = Self::xor_split7(&i, &j); - row_lookups.pull(8, xor_split7, &[xor_split7_channel, i, j, hi, lo]); - let (hi, lo) = Self::xor_split4(&i, &j); - row_lookups.pull(9, xor_split4, &[xor_split4_channel, i, j, hi, lo]); - // Pull range_check. row_lookups.pull(6, range_check, &[range_check_channel, i, j]); // Pull mul. let (lo, hi) = Self::mul(&i, &j); row_lookups.pull(7, mul, &[mul_channel, i, j, lo, hi]); + + // Pull xor_split7. + let (hi, lo) = Self::xor_split7(&i, &j); + row_lookups.pull(8, xor_split7, &[xor_split7_channel, i, j, hi, lo]); + + // Pull xor_split4. + let (hi, lo) = Self::xor_split4(&i, &j); + row_lookups.pull(9, xor_split4, &[xor_split4_channel, i, j, hi, lo]); }, ); drop(row_writers); @@ -426,6 +429,7 @@ impl Bytes2Queries { pub(crate) fn bump_xor_split7(&mut self, i: &G, j: &G) { self.bump_multiplicity_for(i, j, 8) } + pub(crate) fn bump_xor_split4(&mut self, i: &G, j: &G) { self.bump_multiplicity_for(i, j, 9) } @@ -439,28 +443,6 @@ impl Bytes2Queries { } impl Bytes2 { - pub fn xor_split7_u8(i: u8, j: u8) -> (u8, u8) { - let x = i ^ j; - (x >> 7, x << 1) - } - pub fn xor_split4_u8(i: u8, j: u8) -> (u8, u8) { - let x = i ^ j; - (x >> 4, x << 4) - } - pub fn xor_split7(i: &G, j: &G) -> (G, G) { - let (a, b) = Self::xor_split7_u8( - u8::try_from(i.as_canonical_u64()).expect("byte-table input"), - u8::try_from(j.as_canonical_u64()).expect("byte-table input"), - ); - (G::from_u8(a), G::from_u8(b)) - } - pub fn xor_split4(i: &G, j: &G) -> (G, G) { - let (a, b) = Self::xor_split4_u8( - u8::try_from(i.as_canonical_u64()).expect("byte-table input"), - u8::try_from(j.as_canonical_u64()).expect("byte-table input"), - ); - (G::from_u8(a), G::from_u8(b)) - } #[inline] pub fn xor(i: &G, j: &G) -> G { let i: u8 = i.as_canonical_u64().try_into().unwrap(); @@ -513,4 +495,38 @@ impl Bytes2 { let p = u16::from(i) * u16::from(j); (G::from_u8((p & 0xff) as u8), G::from_u8((p >> 8) as u8)) } + + /// Building block for a right-rotation by 7 bits over little-endian bytes: + /// the xor `x = i ^ j` split as `(x >> 7, x << 1)` (shift mod 256). + #[inline] + pub fn xor_split7_u8(i: u8, j: u8) -> (u8, u8) { + let x = i ^ j; + (x >> 7, x << 1) + } + + /// Building block for a right-rotation by 4 bits over little-endian bytes: + /// the xor `x = i ^ j` split as `(x >> 4, x << 4)` (shifts mod 256). + #[inline] + pub fn xor_split4_u8(i: u8, j: u8) -> (u8, u8) { + let x = i ^ j; + (x >> 4, x << 4) + } + + #[inline] + pub fn xor_split7(i: &G, j: &G) -> (G, G) { + let (hi, lo) = Self::xor_split7_u8( + u8::try_from(i.as_canonical_u64()).expect("byte-table input"), + u8::try_from(j.as_canonical_u64()).expect("byte-table input"), + ); + (G::from_u8(hi), G::from_u8(lo)) + } + + #[inline] + pub fn xor_split4(i: &G, j: &G) -> (G, G) { + let (hi, lo) = Self::xor_split4_u8( + u8::try_from(i.as_canonical_u64()).expect("byte-table input"), + u8::try_from(j.as_canonical_u64()).expect("byte-table input"), + ); + (G::from_u8(hi), G::from_u8(lo)) + } } diff --git a/crates/aiur/src/lib.rs b/crates/aiur/src/lib.rs index 8f34e8e0..3acf6666 100644 --- a/crates/aiur/src/lib.rs +++ b/crates/aiur/src/lib.rs @@ -82,9 +82,10 @@ pub fn u8_mul_channel() -> G { #[inline] pub fn u8_xor_split7_channel() -> G { - G::from_u8(15) + G::from_u8(13) } + #[inline] pub fn u8_xor_split4_channel() -> G { - G::from_u8(16) + G::from_u8(14) } diff --git a/crates/aiur/src/trace.rs b/crates/aiur/src/trace.rs index e1cd9c1e..e87dfe15 100644 --- a/crates/aiur/src/trace.rs +++ b/crates/aiur/src/trace.rs @@ -454,32 +454,6 @@ impl Op { slice.push_auxiliary(index, xor); slice.push_lookup(index, G::ONE, &[u8_xor_channel(), i, j, xor]); }, - Op::U8XorSplit7(i, j) => { - let (i, _) = map[*i]; - let (j, _) = map[*j]; - let (hi, lo) = Bytes2::xor_split7(&i, &j); - map.extend([(hi, 1), (lo, 1)]); - slice.push_auxiliary(index, hi); - slice.push_auxiliary(index, lo); - slice.push_lookup( - index, - G::ONE, - &[u8_xor_split7_channel(), i, j, hi, lo], - ); - }, - Op::U8XorSplit4(i, j) => { - let (i, _) = map[*i]; - let (j, _) = map[*j]; - let (hi, lo) = Bytes2::xor_split4(&i, &j); - map.extend([(hi, 1), (lo, 1)]); - slice.push_auxiliary(index, hi); - slice.push_auxiliary(index, lo); - slice.push_lookup( - index, - G::ONE, - &[u8_xor_split4_channel(), i, j, hi, lo], - ); - }, Op::U8Add(i, j) => { let (i, _) = map[*i]; let (j, _) = map[*j]; @@ -564,6 +538,32 @@ impl Op { &[u8_less_than_channel(), i, j, less_than], ); }, + Op::U8XorSplit7(i, j) => { + let (i, _) = map[*i]; + let (j, _) = map[*j]; + let (hi, lo) = Bytes2::xor_split7(&i, &j); + map.extend([(hi, 1), (lo, 1)]); + slice.push_auxiliary(index, hi); + slice.push_auxiliary(index, lo); + slice.push_lookup( + index, + G::ONE, + &[u8_xor_split7_channel(), i, j, hi, lo], + ); + }, + Op::U8XorSplit4(i, j) => { + let (i, _) = map[*i]; + let (j, _) = map[*j]; + let (hi, lo) = Bytes2::xor_split4(&i, &j); + map.extend([(hi, 1), (lo, 1)]); + slice.push_auxiliary(index, hi); + slice.push_auxiliary(index, lo); + slice.push_lookup( + index, + G::ONE, + &[u8_xor_split4_channel(), i, j, hi, lo], + ); + }, Op::U32LessThan(x_idx, y_idx) => { let (a, _) = map[*x_idx]; let (b, _) = map[*y_idx]; diff --git a/crates/ffi/src/aiur/toplevel.rs b/crates/ffi/src/aiur/toplevel.rs index 8e3ebfba..4b88cdac 100644 --- a/crates/ffi/src/aiur/toplevel.rs +++ b/crates/ffi/src/aiur/toplevel.rs @@ -139,6 +139,14 @@ fn decode_op(ctor: LeanCtor>) -> Op { Op::U32LessThan(i, j) }, 24 => { + let [i, j] = ctor.objs::<2>().map(|x| lean_unbox_nat_as_usize(&x)); + Op::U8XorSplit7(i, j) + }, + 25 => { + let [i, j] = ctor.objs::<2>().map(|x| lean_unbox_nat_as_usize(&x)); + Op::U8XorSplit4(i, j) + }, + 26 => { let [label_obj, idxs_obj] = ctor.objs::<2>(); let label = label_obj.as_string().to_string(); let idxs = if idxs_obj.is_scalar() { @@ -149,27 +157,27 @@ fn decode_op(ctor: LeanCtor>) -> Op { }; Op::Debug(label, idxs) }, - 25 => { + 27 => { let [i, j] = ctor.objs::<2>().map(|x| lean_unbox_nat_as_usize(&x)); Op::U8RangeCheck(i, j) }, - 26 => { + 28 => { let [i, j] = ctor.objs::<2>().map(|x| lean_unbox_nat_as_usize(&x)); Op::UnconstrainedBigUintDivMod(i, j) }, - 27 => { + 29 => { let [a] = ctor.objs::<1>().map(|x| lean_unbox_nat_as_usize(&x)); Op::UnconstrainedGToBytes(a) }, - 28 => { + 30 => { let [a] = ctor.objs::<1>().map(|x| lean_unbox_nat_as_usize(&x)); Op::UnconstrainedGInverse(a) }, - 29 => { + 31 => { let [a, b] = ctor.objs::<2>(); Op::UnconstrainedU32Add(decode_vec_val_idx(a), decode_vec_val_idx(b)) }, - 30 => { + 32 => { let [a, b, c] = ctor.objs::<3>(); Op::UnconstrainedU32Add3( decode_vec_val_idx(a), @@ -177,18 +185,10 @@ fn decode_op(ctor: LeanCtor>) -> Op { decode_vec_val_idx(c), ) }, - 31 => { + 33 => { let [a] = ctor.objs::<1>(); Op::U32ToField(decode_vec_val_idx(a)) }, - 32 => { - let [i, j] = ctor.objs::<2>().map(|x| lean_unbox_nat_as_usize(&x)); - Op::U8XorSplit7(i, j) - }, - 33 => { - let [i, j] = ctor.objs::<2>().map(|x| lean_unbox_nat_as_usize(&x)); - Op::U8XorSplit4(i, j) - }, _ => unreachable!(), } }