34 	0x00000108,
35 	0x7FFFFFFF, 0x7FFFFFFF, 0x7FFFFFFF, 0x00000007,
36 	0x00000000, 0x00000000, 0x00000040, 0x7FFFFF80,
37 	0x000000FF
41 	0x00000108,
42 	0x00014000, 0x00018000, 0x00000000, 0x7FF40000,
43 	0x7FEFFFFF, 0x7FF7FFFF, 0x7FAFFFFF, 0x005FFFFF,
44 	0x00000000
48 	0x00000108,
49 	0x6FEE1803, 0x6229C4BD, 0x21B139BE, 0x327150AA,
50 	0x3567802E, 0x3F7212ED, 0x012E4355, 0x782DD38D,
51 	0x0000000E
55 	0x0000018C,
56 	0x7FFFFFFF, 0x00000001, 0x00000000, 0x7FFFFFF8,
57 	0x7FFFFFEF, 0x7FFFFFFF, 0x7FFFFFFF, 0x7FFFFFFF,
58 	0x7FFFFFFF, 0x7FFFFFFF, 0x7FFFFFFF, 0x7FFFFFFF,
59 	0x00000FFF
63 	0x0000018C,
64 	0x00000000, 0x00000080, 0x7FFFFE00, 0x000001FF,
65 	0x00000800, 0x00000000, 0x7FFFE000, 0x00001FFF,
66 	0x00008000, 0x00008000, 0x00000000, 0x00000000,
67 	0x00000000
71 	0x0000018C,
72 	0x6E666840, 0x070D0392, 0x5D810231, 0x7651D50C,
73 	0x17E218D6, 0x1B192002, 0x44EFE441, 0x3A524E2B,
74 	0x2719BA5F, 0x41F02209, 0x36C5643E, 0x5813EFFE,
75 	0x000008A5
79 	0x00000219,
80 	0x7FFFFFFF, 0x7FFFFFFF, 0x7FFFFFFF, 0x7FFFFFFF,
81 	0x7FFFFFFF, 0x7FFFFFFF, 0x7FFFFFFF, 0x7FFFFFFF,
82 	0x7FFFFFFF, 0x7FFFFFFF, 0x7FFFFFFF, 0x7FFFFFFF,
83 	0x7FFFFFFF, 0x7FFFFFFF, 0x7FFFFFFF, 0x7FFFFFFF,
84 	0x01FFFFFF
88 	0x00000219,
89 	0x00001000, 0x00000000, 0x00000000, 0x00000000,
90 	0x00000000, 0x00000000, 0x00000000, 0x00000000,
91 	0x00000000, 0x00000000, 0x00000000, 0x00000000,
92 	0x00000000, 0x00000000, 0x00000000, 0x00000000,
93 	0x00000000
97 	0x00000219,
98 	0x540FC00A, 0x228FEA35, 0x2C34F1EF, 0x67BF107A,
99 	0x46FC1CD5, 0x1605E9DD, 0x6937B165, 0x272A3D8F,
100 	0x42785586, 0x44C8C778, 0x15F3B8B4, 0x64B73366,
101 	0x03BA8B69, 0x0D05B42A, 0x21F929A2, 0x2C31C393,
102 	0x00654FAE
117 		{ P256_P, P256_B, P256_R2, 0x00000001,  65 },  in id_to_curve()
118 		{ P384_P, P384_B, P384_R2, 0x00000001,  97 },  in id_to_curve()
119 		{ P521_P, P521_B, P521_R2, 0x00000001, 133 }  in id_to_curve()
131  * -- for the point at infinity, z = 0
145  *    MTZ(d)           clear return value if d = 0
151 #define MSET(d, a)      (0x0000 + ((d) << 8) + ((a) << 4))
152 #define MADD(d, a)      (0x1000 + ((d) << 8) + ((a) << 4))
153 #define MSUB(d, a)      (0x2000 + ((d) << 8) + ((a) << 4))
154 #define MMUL(d, a, b)   (0x3000 + ((d) << 8) + ((a) << 4) + (b))
155 #define MINV(d, a, b)   (0x4000 + ((d) << 8) + ((a) << 4) + (b))
156 #define MTZ(d)          (0x5000 + ((d) << 8))
157 #define ENDCODE         0
162 #define P1x    0
172 #define Px     0
204  * If y = 0 (P has order 2) then this yields infinity (z' = 0), as it
208  * If P is infinity (z = 0), then again the formulas yield infinity,
282  * If both P1 and P2 are infinity, then z1 == 0 and z2 == 0, implying that
283  * z3 == 0, so the result is correct.
284  * If either of P1 or P2 is infinity, but not both, then z3 == 0, which is
286  * h == 0 only if u1 == u2; this happens in two cases:
291  * -- P1 = 0 and P2 != 0
292  * -- P1 != 0 and P2 = 0
298  * The returned flag is cleared if r == 0. This happens in the following
302  * -- One point is infinity and the other is on line Y = 0.
304  * on line Y = 0 since that would be a point of order 2). If the two
308  * This allows us to detect the "P1 == P2" case, assuming that P1 != 0 and
309  * P2 != 0:
312  * -- Otherwise, if the returned flag is 1, then P1+P2 = 0, and the result
314  * -- Otherwise (result is infinity, flag is 0), then P1 = P2 and we should
343 	 * Report cases where r = 0 through the returned flag.
470 	for (u = 0;; u ++) {  in run_code()
474 		if (op == 0) {  in run_code()
477 		d = (op >> 8) & 0x0F;  in run_code()
478 		a = (op >> 4) & 0x0F;  in run_code()
479 		b = op & 0x0F;  in run_code()
486 		case 0:  in run_code()
491 			ctl |= NOT(br_i31_sub(t[d], cc->p, 0));  in run_code()
501 			plen = (cc->p[0] - (cc->p[0] >> 5) + 7) >> 3;  in run_code()
525 	plen = (p[0] + 63) >> 5;  in set_one()
526 	memset(x, 0, plen * sizeof *x);  in set_one()
527 	x[0] = p[0];  in set_one()
528 	x[1] = 0x00000001;  in set_one()
534 	memset(P, 0, sizeof *P);  in point_zero()
535 	P->c[0][0] = P->c[1][0] = P->c[2][0] = cc->p[0];  in point_zero()
578 	while (xlen -- > 0) {  in point_mul()
581 		for (k = 6; k >= 0; k -= 2) {  in point_mul()
590 			bnz = NEQ(bits, 0);  in point_mul()
605  * the point at infinity. If the point is invalid then this returns 0, but
613 	 * -- first byte is 0x04;  in point_decode()
618 	 * has value 0x06 or 0x07, depending on the least significant bit  in point_decode()
635 	plen = (cc->p[0] - (cc->p[0] >> 5) + 7) >> 3;  in point_decode()
637 		return 0;  in point_decode()
639 	r = br_i31_decode_mod(P->c[0], buf + 1, plen, cc->p);  in point_decode()
645 	r &= EQ(buf[0], 0x04);  in point_decode()
647 	r &= EQ(buf[0], 0x04) | (EQ(buf[0] & 0xFE, 0x06)  in point_decode()
648 		& ~(uint32_t)(buf[0] ^ buf[plen << 1]));  in point_decode()
654 	zlen = ((cc->p[0] + 63) >> 5) * sizeof(uint32_t);  in point_decode()
655 	memcpy(Q.c[0], cc->R2, zlen);  in point_decode()
676 	xbl = cc->p[0];  in point_encode()
679 	buf[0] = 0x04;  in point_encode()
683 	br_i31_encode(buf + 1, plen, Q.c[0]);  in point_encode()
739 		return 0;  in api_mul()
777 		return 0;  in api_muladd()
795 	 * -- If P+Q = 0 then we must report an error.  in api_muladd()
802 	 * If z is 1 then either P+Q = 0 (t = 1) or P = Q (t = 0). So we  in api_muladd()
805 	 *   z = 0, t = 0   return P (normal addition)  in api_muladd()
806 	 *   z = 0, t = 1   return P (normal addition)  in api_muladd()
807 	 *   z = 1, t = 0   return Q (a 'double' case)  in api_muladd()
808 	 *   z = 1, t = 1   report an error (P+Q = 0)  in api_muladd()
819 	(uint32_t)0x03800000,