1	import Base
2	import ./types.bend as T
3	
4	# Generated by tools/generators/blake3/gen.py; do not edit by hand.
5	
6	def rot16(+x: U32) -> U32:
7	  U32.or(U32.shrn(x,16n),U32.shln(x,16n))
8	
9	def rot12(+x: U32) -> U32:
10	  U32.or(U32.shrn(x,12n),U32.shln(x,20n))
11	
12	def rot8(+x: U32) -> U32:
13	  U32.or(U32.shrn(x,8n),U32.shln(x,24n))
14	
15	def rot7(+x: U32) -> U32:
16	  U32.or(U32.shrn(x,7n),U32.shln(x,25n))
17	
18	# G on the four columns, message words m0..m7.
19	def column(s: T.St, +m0: U32, +m1: U32, +m2: U32, +m3: U32, +m4: U32, +m5: U32, +m6: U32, +m7: U32) -> T.St:
20	  match s:
21	    case T.St{+v0,+v1,+v2,+v3,+v4,+v5,+v6,+v7,+v8,+v9,+v10,+v11,+v12,+v13,+v14,+v15}:
22	      +t0 = U32.add(U32.add(v0,v4),m0)
23	      +t1 = rot16(U32.xor(v12,t0))
24	      +t2 = U32.add(v8,t1)
25	      +t3 = rot12(U32.xor(v4,t2))
26	      +t4 = U32.add(U32.add(t0,t3),m1)
27	      +t5 = rot8(U32.xor(t1,t4))
28	      +t6 = U32.add(t2,t5)
29	      +t7 = rot7(U32.xor(t3,t6))
30	      +t8 = U32.add(U32.add(v1,v5),m2)
31	      +t9 = rot16(U32.xor(v13,t8))
32	      +t10 = U32.add(v9,t9)
33	      +t11 = rot12(U32.xor(v5,t10))
34	      +t12 = U32.add(U32.add(t8,t11),m3)
35	      +t13 = rot8(U32.xor(t9,t12))
36	      +t14 = U32.add(t10,t13)
37	      +t15 = rot7(U32.xor(t11,t14))
38	      +t16 = U32.add(U32.add(v2,v6),m4)
39	      +t17 = rot16(U32.xor(v14,t16))
40	      +t18 = U32.add(v10,t17)
41	      +t19 = rot12(U32.xor(v6,t18))
42	      +t20 = U32.add(U32.add(t16,t19),m5)
43	      +t21 = rot8(U32.xor(t17,t20))
44	      +t22 = U32.add(t18,t21)
45	      +t23 = rot7(U32.xor(t19,t22))
46	      +t24 = U32.add(U32.add(v3,v7),m6)
47	      +t25 = rot16(U32.xor(v15,t24))
48	      +t26 = U32.add(v11,t25)
49	      +t27 = rot12(U32.xor(v7,t26))
50	      +t28 = U32.add(U32.add(t24,t27),m7)
51	      +t29 = rot8(U32.xor(t25,t28))
52	      +t30 = U32.add(t26,t29)
53	      +t31 = rot7(U32.xor(t27,t30))
54	      T.St{t4,t12,t20,t28,t7,t15,t23,t31,t6,t14,t22,t30,t5,t13,t21,t29}
55	
56	# G on the four diagonals, message words m8..m15.
57	def diagonal(s: T.St, +m8: U32, +m9: U32, +m10: U32, +m11: U32, +m12: U32, +m13: U32, +m14: U32, +m15: U32) -> T.St:
58	  match s:
59	    case T.St{+v0,+v1,+v2,+v3,+v4,+v5,+v6,+v7,+v8,+v9,+v10,+v11,+v12,+v13,+v14,+v15}:
60	      +t0 = U32.add(U32.add(v0,v5),m8)
61	      +t1 = rot16(U32.xor(v15,t0))
62	      +t2 = U32.add(v10,t1)
63	      +t3 = rot12(U32.xor(v5,t2))
64	      +t4 = U32.add(U32.add(t0,t3),m9)
65	      +t5 = rot8(U32.xor(t1,t4))
66	      +t6 = U32.add(t2,t5)
67	      +t7 = rot7(U32.xor(t3,t6))
68	      +t8 = U32.add(U32.add(v1,v6),m10)
69	      +t9 = rot16(U32.xor(v12,t8))
70	      +t10 = U32.add(v11,t9)
71	      +t11 = rot12(U32.xor(v6,t10))
72	      +t12 = U32.add(U32.add(t8,t11),m11)
73	      +t13 = rot8(U32.xor(t9,t12))
74	      +t14 = U32.add(t10,t13)
75	      +t15 = rot7(U32.xor(t11,t14))
76	      +t16 = U32.add(U32.add(v2,v7),m12)
77	      +t17 = rot16(U32.xor(v13,t16))
78	      +t18 = U32.add(v8,t17)
79	      +t19 = rot12(U32.xor(v7,t18))
80	      +t20 = U32.add(U32.add(t16,t19),m13)
81	      +t21 = rot8(U32.xor(t17,t20))
82	      +t22 = U32.add(t18,t21)
83	      +t23 = rot7(U32.xor(t19,t22))
84	      +t24 = U32.add(U32.add(v3,v4),m14)
85	      +t25 = rot16(U32.xor(v14,t24))
86	      +t26 = U32.add(v9,t25)
87	      +t27 = rot12(U32.xor(v4,t26))
88	      +t28 = U32.add(U32.add(t24,t27),m15)
89	      +t29 = rot8(U32.xor(t25,t28))
90	      +t30 = U32.add(t26,t29)
91	      +t31 = rot7(U32.xor(t27,t30))
92	      T.St{t4,t12,t20,t28,t31,t7,t15,t23,t22,t30,t6,t14,t13,t21,t29,t5}
93	
94	# One round: the column step then the diagonal step.
95	def round(s: T.St, +m0: U32, +m1: U32, +m2: U32, +m3: U32, +m4: U32, +m5: U32, +m6: U32, +m7: U32, +m8: U32, +m9: U32, +m10: U32, +m11: U32, +m12: U32, +m13: U32, +m14: U32, +m15: U32) -> T.St:
96	  diagonal(column(s,m0,m1,m2,m3,m4,m5,m6,m7),m8,m9,m10,m11,m12,m13,m14,m15)
97	
98	def fold(s: T.St) -> T.CV:
99	  match s:
100	    case T.St{v0,v1,v2,v3,v4,v5,v6,v7,v8,v9,v10,v11,v12,v13,v14,v15}:
101	      T.CV{U32.xor(v0,v8),U32.xor(v1,v9),U32.xor(v2,v10),U32.xor(v3,v11),U32.xor(v4,v12),U32.xor(v5,v13),U32.xor(v6,v14),U32.xor(v7,v15)}
102	
103	# The initial state: the chaining value, IV[0..3], the counter (low word,
104	# then the high word, 0: an input has fewer than 2^32 chunks), the block
105	# length and the flags.
106	def init(cv: T.CV, +t: U32, +len: U32, +flags: U32) -> T.St:
107	  match cv:
108	    case T.CV{h0,h1,h2,h3,h4,h5,h6,h7}:
109	      T.St{h0,h1,h2,h3,h4,h5,h6,h7,1779033703,3144134277,1013904242,2773480762,t,0,len,flags}
110	
111	# Seven rounds; round r takes the message words in the order of the
112	# permutation applied r times (the fixed BLAKE3 schedule).
113	def rounds7(s: T.St, b: T.Block) -> T.St:
114	  match b:
115	    case T.B{+m0,+m1,+m2,+m3,+m4,+m5,+m6,+m7,+m8,+m9,+m10,+m11,+m12,+m13,+m14,+m15}:
116	      round(round(round(round(round(round(round(s,m0,m1,m2,m3,m4,m5,m6,m7,m8,m9,m10,m11,m12,m13,m14,m15),m2,m6,m3,m10,m7,m0,m4,m13,m1,m11,m12,m5,m9,m14,m15,m8),m3,m4,m10,m12,m13,m2,m7,m14,m6,m5,m9,m0,m11,m15,m8,m1),m10,m7,m12,m9,m14,m3,m13,m15,m4,m0,m11,m2,m5,m8,m1,m6),m12,m13,m9,m11,m15,m10,m14,m8,m7,m2,m5,m3,m0,m1,m6,m4),m9,m14,m11,m5,m8,m12,m15,m1,m13,m3,m0,m10,m2,m6,m4,m7),m11,m15,m5,m0,m1,m9,m8,m6,m14,m10,m2,m12,m3,m4,m7,m13)
117	
118	# The compression function (hash mode, 32-byte output): the new chaining
119	# value is the low half of the final state xor its high half.
120	def compress(cv: T.CV, b: T.Block, +t: U32, +len: U32, +flags: U32) -> T.CV:
121	  fold(rounds7(init(cv,t,len,flags),b))