35 	0x0111,
36 	0x7FFF, 0x7FFF, 0x7FFF, 0x7FFF, 0x7FFF, 0x7FFF, 0x003F, 0x0000,
37 	0x0000, 0x0000, 0x0000, 0x0000, 0x1000, 0x0000, 0x4000, 0x7FFF,
38 	0x7FFF, 0x0001
42 	0x0111,
43 	0x0000, 0x6000, 0x0000, 0x0000, 0x0000, 0x0000, 0x7FFC, 0x7FFF,
44 	0x7FBF, 0x7FFF, 0x7FBF, 0x7FFF, 0x7FFF, 0x7FFF, 0x77FF, 0x7FFF,
45 	0x4FFF, 0x0000
49 	0x0111,
50 	0x770C, 0x5EEF, 0x29C4, 0x3EC4, 0x6273, 0x0486, 0x4543, 0x3993,
51 	0x3C01, 0x6B56, 0x212E, 0x57EE, 0x4882, 0x204B, 0x7483, 0x3C16,
52 	0x0187, 0x0000
56 	0x0199,
57 	0x7FFF, 0x7FFF, 0x0003, 0x0000, 0x0000, 0x0000, 0x7FC0, 0x7FFF,
58 	0x7EFF, 0x7FFF, 0x7FFF, 0x7FFF, 0x7FFF, 0x7FFF, 0x7FFF, 0x7FFF,
59 	0x7FFF, 0x7FFF, 0x7FFF, 0x7FFF, 0x7FFF, 0x7FFF, 0x7FFF, 0x7FFF,
60 	0x7FFF, 0x01FF
64 	0x0199,
65 	0x1000, 0x0000, 0x0000, 0x7FFF, 0x7FFF, 0x0001, 0x0000, 0x0010,
66 	0x0000, 0x0000, 0x0000, 0x7F00, 0x7FFF, 0x01FF, 0x0000, 0x1000,
67 	0x0000, 0x2000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
68 	0x0000, 0x0000
72 	0x0199,
73 	0x7333, 0x2096, 0x70D1, 0x2310, 0x3020, 0x6197, 0x1464, 0x35BB,
74 	0x70CA, 0x0117, 0x1920, 0x4136, 0x5FC8, 0x5713, 0x4938, 0x7DD2,
75 	0x4DD2, 0x4A71, 0x0220, 0x683E, 0x2C87, 0x4DB1, 0x7BFF, 0x6C09,
76 	0x0452, 0x0084
80 	0x022B,
81 	0x7FFF, 0x7FFF, 0x7FFF, 0x7FFF, 0x7FFF, 0x7FFF, 0x7FFF, 0x7FFF,
82 	0x7FFF, 0x7FFF, 0x7FFF, 0x7FFF, 0x7FFF, 0x7FFF, 0x7FFF, 0x7FFF,
83 	0x7FFF, 0x7FFF, 0x7FFF, 0x7FFF, 0x7FFF, 0x7FFF, 0x7FFF, 0x7FFF,
84 	0x7FFF, 0x7FFF, 0x7FFF, 0x7FFF, 0x7FFF, 0x7FFF, 0x7FFF, 0x7FFF,
85 	0x7FFF, 0x7FFF, 0x07FF
89 	0x022B,
90 	0x0100, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
91 	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
92 	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
93 	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
94 	0x0000, 0x0000, 0x0000
98 	0x022B,
99 	0x7002, 0x6A07, 0x751A, 0x228F, 0x71EF, 0x5869, 0x20F4, 0x1EFC,
100 	0x7357, 0x37E0, 0x4EEC, 0x605E, 0x1652, 0x26F6, 0x31FA, 0x4A8F,
101 	0x6193, 0x3C2A, 0x3C42, 0x48C7, 0x3489, 0x6771, 0x4C57, 0x5CCD,
102 	0x2725, 0x545B, 0x503B, 0x5B42, 0x21A0, 0x2534, 0x687E, 0x70E4,
103 	0x1618, 0x27D7, 0x0465
118 		{ P256_P, P256_B, P256_R2, 0x0001,  65 },  in id_to_curve()
119 		{ P384_P, P384_B, P384_R2, 0x0001,  97 },  in id_to_curve()
120 		{ P521_P, P521_B, P521_R2, 0x0001, 133 }  in id_to_curve()
132  * -- for the point at infinity, z = 0
146  *    MTZ(d)           clear return value if d = 0
152 #define MSET(d, a)      (0x0000 + ((d) << 8) + ((a) << 4))
153 #define MADD(d, a)      (0x1000 + ((d) << 8) + ((a) << 4))
154 #define MSUB(d, a)      (0x2000 + ((d) << 8) + ((a) << 4))
155 #define MMUL(d, a, b)   (0x3000 + ((d) << 8) + ((a) << 4) + (b))
156 #define MINV(d, a, b)   (0x4000 + ((d) << 8) + ((a) << 4) + (b))
157 #define MTZ(d)          (0x5000 + ((d) << 8))
158 #define ENDCODE         0
163 #define P1x    0
173 #define Px     0
205  * If y = 0 (P has order 2) then this yields infinity (z' = 0), as it
209  * If P is infinity (z = 0), then again the formulas yield infinity,
283  * If both P1 and P2 are infinity, then z1 == 0 and z2 == 0, implying that
284  * z3 == 0, so the result is correct.
285  * If either of P1 or P2 is infinity, but not both, then z3 == 0, which is
287  * h == 0 only if u1 == u2; this happens in two cases:
292  * -- P1 = 0 and P2 != 0
293  * -- P1 != 0 and P2 = 0
299  * The returned flag is cleared if r == 0. This happens in the following
303  * -- One point is infinity and the other is on line Y = 0.
305  * on line Y = 0 since that would be a point of order 2). If the two
309  * This allows us to detect the "P1 == P2" case, assuming that P1 != 0 and
310  * P2 != 0:
313  * -- Otherwise, if the returned flag is 1, then P1+P2 = 0, and the result
315  * -- Otherwise (result is infinity, flag is 0), then P1 = P2 and we should
344 	 * Report cases where r = 0 through the returned flag.
471 	for (u = 0;; u ++) {  in run_code()
475 		if (op == 0) {  in run_code()
478 		d = (op >> 8) & 0x0F;  in run_code()
479 		a = (op >> 4) & 0x0F;  in run_code()
480 		b = op & 0x0F;  in run_code()
487 		case 0:  in run_code()
492 			ctl |= NOT(br_i15_sub(t[d], cc->p, 0));  in run_code()
502 			plen = (cc->p[0] - (cc->p[0] >> 4) + 7) >> 3;  in run_code()
526 	plen = (p[0] + 31) >> 4;  in set_one()
527 	memset(x, 0, plen * sizeof *x);  in set_one()
528 	x[0] = p[0];  in set_one()
529 	x[1] = 0x0001;  in set_one()
535 	memset(P, 0, sizeof *P);  in point_zero()
536 	P->c[0][0] = P->c[1][0] = P->c[2][0] = cc->p[0];  in point_zero()
579 	while (xlen -- > 0) {  in point_mul()
582 		for (k = 6; k >= 0; k -= 2) {  in point_mul()
591 			bnz = NEQ(bits, 0);  in point_mul()
606  * the point at infinity. If the point is invalid then this returns 0, but
614 	 * -- first byte is 0x04;  in point_decode()
619 	 * has value 0x06 or 0x07, depending on the least significant bit  in point_decode()
636 	plen = (cc->p[0] - (cc->p[0] >> 4) + 7) >> 3;  in point_decode()
638 		return 0;  in point_decode()
640 	r = br_i15_decode_mod(P->c[0], buf + 1, plen, cc->p);  in point_decode()
646 	r &= EQ(buf[0], 0x04);  in point_decode()
648 	r &= EQ(buf[0], 0x04) | (EQ(buf[0] & 0xFE, 0x06)  in point_decode()
649 		& ~(uint32_t)(buf[0] ^ buf[plen << 1]));  in point_decode()
655 	zlen = ((cc->p[0] + 31) >> 4) * sizeof(uint16_t);  in point_decode()
656 	memcpy(Q.c[0], cc->R2, zlen);  in point_decode()
676 	plen = (cc->p[0] - (cc->p[0] >> 4) + 7) >> 3;  in point_encode()
677 	buf[0] = 0x04;  in point_encode()
681 	br_i15_encode(buf + 1, plen, Q.c[0]);  in point_encode()
737 		return 0;  in api_mul()
775 		return 0;  in api_muladd()
793 	 * -- If P+Q = 0 then we must report an error.  in api_muladd()
800 	 * If z is 1 then either P+Q = 0 (t = 1) or P = Q (t = 0). So we  in api_muladd()
803 	 *   z = 0, t = 0   return P (normal addition)  in api_muladd()
804 	 *   z = 0, t = 1   return P (normal addition)  in api_muladd()
805 	 *   z = 1, t = 0   return Q (a 'double' case)  in api_muladd()
806 	 *   z = 1, t = 1   report an error (P+Q = 0)  in api_muladd()
817 	(uint32_t)0x03800000,