P256-cortex-m0-ecdh-gcc.s

	.syntax unified
	.thumb
// P-256 ECDH
// Author: Emil Lenngren
// Licensed under the BSD 2-clause license.
// The 256x256->512 multiplication/square code is based on public domain µNaCl by Ana Helena Sánchez and Björn Haase (https://munacl.cryptojedi.org/curve25519-cortexm0.shtml)

// Note on calling conventions: some of the local functions in this file use custom calling conventions.
// Exported symbols use the standard C calling conventions for ARM, which means that r4-r11 and sp are preserved and the other registers are clobbered.

// Stack usage is 1356 bytes.

// Settings below for optimizing for speed vs size.
// When optimizing fully for speed, the run time is 4 456 738 cycles and code size is 3708 bytes.
// When optimizing fully for size, the run time is 5 764 182 cycles and code size is 2416 bytes.
// Get the time taken (in seconds) by dividing the number of cycles with the clock frequency (Hz) of the cpu.
// Different optimization levels can be done by setting some to 1 and some to 0.
// Optimizing all settings for size except use_mul_for_sqr and use_smaller_modinv gives a run time of 4 851 527 cycles and code size is 2968 bytes.

	
.set use_mul_for_sqr, 0 // 1 to enable, 0 to disable (14% slower if enabled but saves 624/460 bytes (depending on use_noninlined_sqr64) of compiled code size)

	
.set use_noninlined_mul64, 1 // 1 to enable, 0 to disable (2.6%/4.0% slower (depending on use_mul_for_sqr) if enabled but saves 308 bytes of compiled code size)

	
.set use_noninlined_sqr64, 1 // 1 to enable, 0 to disable (2.4% slower if enabled and use_mul_for_sqr=0 but saves 164 bytes of compiled code size)

	
.set use_interpreter, 1 // 1 to enable, 0 to disable (3.6% slower if enabled but saves 268 bytes of compiled code size)

	
.set use_smaller_modinv, 0 // 1 to enable, 0 to disable (3.6% slower if enabled but saves 88 bytes of compiled code size)

	.text
	.align 1

	.if use_noninlined_mul64 == 1
// in: (r4,r5) = a[0..1], (r2,r3) = b[0..1]
// out: r0-r3
// clobbers r4-r9 and lr
	.type P256_mul64, %function
P256_mul64:
	mov r6,r5
	mov r1,r2
	subs r5,r4
	sbcs r0,r0
	eors r5,r0
	subs r5,r0
	subs r1,r3
	sbcs r7,r7
	eors r1,r7
	subs r1,r7
	eors r7,r0
	mov r9,r1
	mov r8,r5
	lsrs r1,r4,#16
	uxth r4,r4
	mov r0,r4
	uxth r5,r2
	lsrs r2,#16
	muls r0,r5,r0////00
	muls r5,r1,r5////10
	muls r4,r2,r4////01
	muls r1,r2,r1////11
	lsls r2,r4,#16
	lsrs r4,r4,#16
	adds r0,r2
	adcs r1,r4
	lsls r2,r5,#16
	lsrs r4,r5,#16
	adds r0,r2
	adcs r1,r4
	lsrs r4,r6,#16
	uxth r6,r6
	uxth r5,r3
	lsrs r3,r3,#16
	mov r2,r6
	muls r2,r5,r2
	muls r5,r4,r5
	muls r6,r3,r6
	muls r3,r4,r3
	lsls r4,r5,#16
	lsrs r5,r5,#16
	adds r2,r4
	adcs r3,r5
	lsls r4,r6,#16
	lsrs r5,r6,#16
	adds r2,r4
	adcs r3,r5
	eors r6,r6
	adds r2,r1
	adcs r3,r6
	mov r1,r9
	mov r5,r8
	mov r8,r0
	lsrs r0,r1,#16
	uxth r1,r1
	mov r4,r1
	lsrs r6,r5,#16
	uxth r5,r5
	muls r1,r5,r1
	muls r4,r6,r4
	muls r5,r0,r5
	muls r0,r6,r0
	lsls r6,r4,#16
	lsrs r4,#16
	adds r1,r6
	adcs r0,r4
	lsls r6,r5,#16
	lsrs r5,#16
	adds r1,r6
	adcs r0,r5
	eors r1,r7
	eors r0,r7
	eors r4,r4
	asrs r7,r7,#1
	adcs r1,r2
	adcs r2,r0
	adcs r7,r4
	mov r0,r8
	adds r1,r0
	adcs r2,r3
	adcs r3,r7
	bx lr
	.size P256_mul64, .-P256_mul64
	.endif

// in: *r10 = a, *r11 = b, (r4,r5) = a[0..1], (r2,r3) = b[0..1]
// out: r8,r9,r2-r7
// clobbers all other registers
	.type P256_mul128, %function
P256_mul128:
	.if use_noninlined_mul64 == 1
	push {lr}
	//frame push {lr}
	.endif
			/////////MUL128/////////////
			//MUL64
			.if use_noninlined_mul64 == 0
			mov r6,r5
			mov r1,r2
			subs r5,r4
			sbcs r0,r0
			eors r5,r0
			subs r5,r0
			subs r1,r3
			sbcs r7,r7
			eors r1,r7
			subs r1,r7
			eors r7,r0
			mov r9,r1
			mov r8,r5
			lsrs r1,r4,#16
			uxth r4,r4
			mov r0,r4
			uxth r5,r2
			lsrs r2,#16
			muls r0,r5,r0////00
			muls r5,r1,r5////10
			muls r4,r2,r4////01
			muls r1,r2,r1////11
			lsls r2,r4,#16
			lsrs r4,r4,#16
			adds r0,r2
			adcs r1,r4
			lsls r2,r5,#16
			lsrs r4,r5,#16
			adds r0,r2
			adcs r1,r4
			lsrs r4,r6,#16
			uxth r6,r6
			uxth r5,r3
			lsrs r3,r3,#16
			mov r2,r6
			muls r2,r5,r2
			muls r5,r4,r5
			muls r6,r3,r6
			muls r3,r4,r3
			lsls r4,r5,#16
			lsrs r5,r5,#16
			adds r2,r4
			adcs r3,r5
			lsls r4,r6,#16
			lsrs r5,r6,#16
			adds r2,r4
			adcs r3,r5
			eors r6,r6
			adds r2,r1
			adcs r3,r6
			mov r1,r9
			mov r5,r8
			mov r8,r0
			lsrs r0,r1,#16
			uxth r1,r1
			mov r4,r1
			lsrs r6,r5,#16
			uxth r5,r5
			muls r1,r5,r1
			muls r4,r6,r4
			muls r5,r0,r5
			muls r0,r6,r0
			lsls r6,r4,#16
			lsrs r4,#16
			adds r1,r6
			adcs r0,r4
			lsls r6,r5,#16
			lsrs r5,#16
			adds r1,r6
			adcs r0,r5
			eors r1,r7
			eors r0,r7
			eors r4,r4
			asrs r7,r7,#1
			adcs r1,r2
			adcs r2,r0
			adcs r7,r4
			mov r0,r8
			adds r1,r0
			adcs r2,r3
			adcs r3,r7
			.else
			bl P256_mul64
			.endif
		push {r0,r1}
		//frame address sp,8+use_noninlined_mul64*4
		mov r1,r10
		mov r10,r2
		ldm r1,{r0,r1,r4,r5}
		mov r2,r4
		mov r7,r5
		subs r2,r0
		sbcs r7,r1
		sbcs r6,r6
		eors r2,r6
		eors r7,r6
		subs r2,r6
		sbcs r7,r6
		push {r2,r7}
		//frame address sp,16+use_noninlined_mul64*4
		mov r2,r11
		mov r11,r3
		ldm r2,{r0,r1,r2,r3}
		subs r0,r2
		sbcs r1,r3
		sbcs r7,r7
		eors r0,r7
		eors r1,r7
		subs r0,r7
		sbcs r1,r7
		eors r7,r6
		mov r12,r7
		push {r0,r1}
		//frame address sp,24+use_noninlined_mul64*4
			//MUL64
			.if use_noninlined_mul64 == 0
			mov r6,r5
			mov r1,r2
			subs r5,r4
			sbcs r0,r0
			eors r5,r0
			subs r5,r0
			subs r1,r3
			sbcs r7,r7
			eors r1,r7
			subs r1,r7
			eors r7,r0
			mov r9,r1
			mov r8,r5
			lsrs r1,r4,#16
			uxth r4,r4
			mov r0,r4
			uxth r5,r2
			lsrs r2,#16
			muls r0,r5,r0////00
			muls r5,r1,r5////10
			muls r4,r2,r4////01
			muls r1,r2,r1////11
			lsls r2,r4,#16
			lsrs r4,r4,#16
			adds r0,r2
			adcs r1,r4
			lsls r2,r5,#16
			lsrs r4,r5,#16
			adds r0,r2
			adcs r1,r4
			lsrs r4,r6,#16
			uxth r6,r6
			uxth r5,r3
			lsrs r3,r3,#16
			mov r2,r6
			muls r2,r5,r2
			muls r5,r4,r5
			muls r6,r3,r6
			muls r3,r4,r3
			lsls r4,r5,#16
			lsrs r5,r5,#16
			adds r2,r4
			adcs r3,r5
			lsls r4,r6,#16
			lsrs r5,r6,#16
			adds r2,r4
			adcs r3,r5
			eors r6,r6
			adds r2,r1
			adcs r3,r6
			mov r1,r9
			mov r5,r8
			mov r8,r0
			lsrs r0,r1,#16
			uxth r1,r1
			mov r4,r1
			lsrs r6,r5,#16
			uxth r5,r5
			muls r1,r5,r1
			muls r4,r6,r4
			muls r5,r0,r5
			muls r0,r6,r0
			lsls r6,r4,#16
			lsrs r4,#16
			adds r1,r6
			adcs r0,r4
			lsls r6,r5,#16
			lsrs r5,#16
			adds r1,r6
			adcs r0,r5
			eors r1,r7
			eors r0,r7
			eors r4,r4
			asrs r7,r7,#1
			adcs r1,r2
			adcs r2,r0
			adcs r7,r4
			mov r0,r8
			adds r1,r0
			adcs r2,r3
			adcs r3,r7
			.else
			bl P256_mul64
			.endif
		mov r4,r10
		mov r5,r11
		eors r6,r6
		adds r0,r4
		adcs r1,r5
		adcs r2,r6
		adcs r3,r6
		mov r10,r2
		mov r11,r3
		pop {r2-r5}
		//frame address sp,8+use_noninlined_mul64*4
		push {r0,r1}
		//frame address sp,16+use_noninlined_mul64*4
			.if use_noninlined_mul64 == 0
			mov r6,r5
			mov r1,r2
			subs r5,r4
			sbcs r0,r0
			eors r5,r0
			subs r5,r0
			subs r1,r3
			sbcs r7,r7
			eors r1,r7
			subs r1,r7
			eors r7,r0
			mov r9,r1
			mov r8,r5
			lsrs r1,r4,#16
			uxth r4,r4
			mov r0,r4
			uxth r5,r2
			lsrs r2,#16
			muls r0,r5,r0////00
			muls r5,r1,r5////10
			muls r4,r2,r4////01
			muls r1,r2,r1////11
			lsls r2,r4,#16
			lsrs r4,r4,#16
			adds r0,r2
			adcs r1,r4
			lsls r2,r5,#16
			lsrs r4,r5,#16
			adds r0,r2
			adcs r1,r4
			lsrs r4,r6,#16
			uxth r6,r6
			uxth r5,r3
			lsrs r3,r3,#16
			mov r2,r6
			muls r2,r5,r2
			muls r5,r4,r5
			muls r6,r3,r6
			muls r3,r4,r3
			lsls r4,r5,#16
			lsrs r5,r5,#16
			adds r2,r4
			adcs r3,r5
			lsls r4,r6,#16
			lsrs r5,r6,#16
			adds r2,r4
			adcs r3,r5
			eors r6,r6
			adds r2,r1
			adcs r3,r6
			mov r1,r9
			mov r5,r8
			mov r8,r0
			lsrs r0,r1,#16
			uxth r1,r1
			mov r4,r1
			lsrs r6,r5,#16
			uxth r5,r5
			muls r1,r5,r1
			muls r4,r6,r4
			muls r5,r0,r5
			muls r0,r6,r0
			lsls r6,r4,#16
			lsrs r4,#16
			adds r1,r6
			adcs r0,r4
			lsls r6,r5,#16
			lsrs r5,#16
			adds r1,r6
			adcs r0,r5
			eors r1,r7
			eors r0,r7
			eors r4,r4
			asrs r7,r7,#1
			adcs r1,r2
			adcs r2,r0
			adcs r7,r4
			mov r0,r8
			adds r1,r0
			adcs r2,r3
			adcs r3,r7
			.else
			bl P256_mul64
			.endif
		pop {r4,r5}
		//frame address sp,8+use_noninlined_mul64*4
		mov r6,r12
		mov r7,r12
		eors r0,r6
		eors r1,r6
		eors r2,r6
		eors r3,r6
		asrs r6,r6,#1
		adcs r0,r4
		adcs r1,r5
		adcs r4,r2
		adcs r5,r3
		eors r2,r2
		adcs r6,r2 ////0,1
		adcs r7,r2
		pop {r2,r3}
		//frame address sp,0+use_noninlined_mul64*4
		mov r8,r2
		mov r9,r3
		adds r2,r0
		adcs r3,r1
		mov r0,r10
		mov r1,r11
		adcs r4,r0
		adcs r5,r1
		adcs r6,r0
		adcs r7,r1
	.if use_noninlined_mul64 == 1
	pop {pc}
	.else
	bx lr
	.endif
	.size P256_mul128, .-P256_mul128
	
	.if use_mul_for_sqr == 1
.thumb_func
P256_sqrmod :
	mov r2,r1
	// fallthrough
	.endif

// *r0 = out, *r1 = a, *r2 = b
	.type P256_mulmod, %function
P256_mulmod:
	push {r0,lr}
	//frame push {lr}
	//frame address sp,8
	sub sp,#64
	//frame address sp,72
	push {r1-r2}
	//frame address sp,80
	mov r10,r2
	mov r11,r1
	mov r0,r2
	ldm r0!,{r4,r5}
	adds r0,#8
	ldm r1!,{r2,r3}
	adds r1,#8
	push {r0,r1}
	//frame address sp,88
	
	bl P256_mul128
	add r0,sp,#24
	stm r0!,{r2,r3}
	add r0,sp,#16
	mov r2,r8
	mov r3,r9
	stm r0!,{r2,r3}

	//pop {r0} //result+8
	//stm r0!,{r2,r3}
	pop {r1,r2} //a+16 b+16
	//frame address sp,80
	//push {r0}
	push {r4-r7}
	//frame address sp,96
	mov r10,r1
	mov r11,r2
	ldm r1!,{r4,r5}
	ldm r2,{r2,r3}
	
	bl P256_mul128
	
	mov r0,r8
	mov r1,r9
	mov r8,r6
	mov r9,r7
	pop {r6,r7}
	//frame address sp,88
	adds r0,r6
	adcs r1,r7
	pop {r6,r7}
	//frame address sp,80
	adcs r2,r6
	adcs r3,r7
	//pop {r7} //result+16
	add r7,sp,#24
	stm r7!,{r0-r3}
	mov r10,r7
	eors r0,r0
	mov r6,r8
	mov r7,r9
	adcs r4,r0
	adcs r5,r0
	adcs r6,r0
	adcs r7,r0
	pop {r1,r2} //b a
	//frame address sp,72
	mov r12,r2
	push {r4-r7}
	//frame address sp,88
	ldm r1,{r0-r7}
	subs r0,r4
	sbcs r1,r5
	sbcs r2,r6
	sbcs r3,r7
	eors r4,r4
	sbcs r4,r4
	eors r0,r4
	eors r1,r4
	eors r2,r4
	eors r3,r4
	subs r0,r4
	sbcs r1,r4
	sbcs r2,r4
	sbcs r3,r4
	mov r6,r12
	mov r12,r4 ////carry
	mov r5,r10
	stm r5!,{r0-r3}
	mov r11,r5
	mov r8,r0
	mov r9,r1
	ldm r6,{r0-r7}
	subs r4,r0
	sbcs r5,r1
	sbcs r6,r2
	sbcs r7,r3
	eors r0,r0
	sbcs r0,r0
	eors r4,r0
	eors r5,r0
	eors r6,r0
	eors r7,r0
	subs r4,r0
	sbcs r5,r0
	sbcs r6,r0
	sbcs r7,r0
	mov r1,r12
	eors r0,r1
	mov r1,r11
	stm r1!,{r4-r7}
	push {r0}
	//frame address sp,92
	mov r2,r8
	mov r3,r9
	
	bl P256_mul128
	
	pop {r0} ////r0,r1
	//frame address sp,88
	mov r12,r0 ////negative
	eors r2,r0
	eors r3,r0
	eors r4,r0
	eors r5,r0
	eors r6,r0
	eors r7,r0
	push {r4-r7}
	//frame address sp,104
	add r1,sp,#32 //result
	ldm r1!,{r4-r7}
	//mov r11,r1 ////reference
	mov r1,r9
	eors r1,r0
	mov r10,r4
	mov r4,r8
	asrs r0,#1
	eors r0,r4
	mov r4,r10
	adcs r0,r4
	adcs r1,r5
	adcs r2,r6
	adcs r3,r7
	eors r4,r4
	adcs r4,r4
	mov r10,r4 ////carry
	//mov r4,r11
	add r4,sp,#32+16
	ldm r4,{r4-r7}
	adds r0,r4
	adcs r1,r5
	adcs r2,r6
	adcs r3,r7
	mov r9,r4
	//mov r4,r11
	add r4,sp,#32+16
	stm r4!,{r0-r3}
	//mov r11,r4
	pop {r0-r3}
	//frame address sp,88
	mov r4,r9
	adcs r4,r0
	adcs r5,r1
	adcs r6,r2
	adcs r7,r3
	movs r1,#0
	adcs r1,r1
	mov r0,r10
	mov r10,r1 ////carry
	asrs r0,#1
	pop {r0-r3}
	//frame address sp,72
	adcs r4,r0
	adcs r5,r1
	adcs r6,r2
	adcs r7,r3
	mov r8,r0
	//mov r0,r11
	add r0,sp,#32
	stm r0!,{r4-r7}
	//mov r11,r0
	mov r0,r8
	mov r6,r12
	mov r5,r10
	eors r4,r4
	adcs r5,r6
	adcs r6,r4
	adds r0,r5
	adcs r1,r6
	adcs r2,r6
	adcs r3,r6
	//mov r7,r11
	add r7,sp,#32+16
	stm r7!,{r0-r3}
	
	// multiplication done, now reducing

reduce :
	pop {r0-r7}
	//frame address sp,40
	adds r3,r0
	adcs r4,r1
	adcs r5,r2
	adcs r6,r0
	mov r8,r2
	mov r9,r3
	mov r10,r4
	mov r11,r5
	mov r12,r6
	adcs r7,r1
	pop {r2-r5} //8,9,10,11
	//frame address sp,24
	adcs r2,r0 //8+0
	adcs r3,r1 //9+1
	movs r6,#0
	adcs r4,r6 //10+#0
	adcs r5,r6 //11+#0
	adcs r6,r6 //C
	
	subs r7,r0 //7-0
	sbcs r2,r1 //8-1
	// r0,r1 dead
	mov r0,r8 //2
	mov r1,r9 //3
	sbcs r3,r0 //9-2
	sbcs r4,r1 //10-3
	movs r0,#0
	sbcs r5,r0 //11-#0
	sbcs r6,r0 //C-#0
	
	mov r0,r12 //6
	adds r0,r1 //6+3
	mov r12,r0
	mov r0,r10 //4
	adcs r7,r0 //7+4
	mov lr,r7
	mov r0,r8 //2
	adcs r2,r0 //8+2
	adcs r3,r1 //9+3
	adcs r4,r0 //10+2
	adcs r5,r1 //11+3
	movs r7,#0
	adcs r6,r7 //C+#0
	
	//2-3 are now dead (r8,r9)
	//4   5   6   7  8  9  10 11 C
	//r10 r11 r12 lr r2 r3 r4 r5 r6
	//r7: 0
	
	pop {r0,r1} //12,13
	//frame address sp,16
	
	adds r6,r0 //12+C
	adcs r1,r7 //13+#0
	adcs r7,r7 //new Carry for 14
	
	//r0 dead
	
	mov r0,r11 //5
	adds r2,r0 //8+5
	mov r8,r2
	mov r2,r12 //6
	adcs r3,r2 //9+6
	mov r9,r3
	mov r3,r10 //4
	adcs r4,r3 //10+4
	mov r10,r4
	adcs r5,r0 //11+5
	adcs r6,r3 //12+4
	adcs r1,r0 //13+5
	pop {r2,r4} //14,15
	//frame address sp,8
	adcs r2,r7 //14+C
	movs r7,#0
	adcs r4,r7 //15+#0
	adcs r7,r7 //new Carry for 16
	
	//4  5  6   7  8  9  10  11 12 13 14 15 C
	//r3 r0 r12 lr r8 r9 r10 r5 r6 r1 r2 r4 r7
	//r11 is available
	
	subs r5,r3 //11-4
	sbcs r6,r0 //12-5
	mov r3,r12 //6
	mov r0,lr //7
	sbcs r1,r3 //13-6
	sbcs r2,r0 //14-7
	movs r3,#0
	sbcs r4,r3 //15-#0
	sbcs r7,r3 //C-#0
	mov lr,r4
	mov r11,r7
	
	mov r4,r10 //10
	adds r4,r0 //10+7
	adcs r5,r3 //11+#0
	mov r7,r12 //6
	adcs r6,r7 //12+6
	adcs r1,r0 //13+7
	adcs r2,r7 //14+6
	mov r7,lr //15
	adcs r7,r0 //15+7
	mov r0,r11 //C
	adcs r0,r3 //C+#0
	
	// now (T + mN) / R is
	// 8 9 4 5 6 1 2 7 6 (lsb -> msb)
	
	subs r3,r3 //set r3 to 0 and C to 1
	mov r10,r0
	mov r0,r8
	adcs r0,r3
	mov r11,r7
	mov r7,r9
	adcs r7,r3
	mov r12,r0
	mov r9,r7
	adcs r4,r3
	sbcs r5,r3
	sbcs r6,r3
	sbcs r1,r3
	movs r3,#1
	sbcs r2,r3
	movs r3,#0
	mov r0,r11
	mov r7,r10
	adcs r0,r3
	sbcs r7,r3
	
	// r12 r9 r4 r5 | r6 r1 r2 r0
	
	mov r8,r2
	mov r2,r12
	mov r11,r0
	mov r3,r9
reduce2 :
	adds r2,r7
	adcs r3,r7
	adcs r4,r7
	movs r0,#0
	adcs r5,r0
	adcs r6,r0
	adcs r1,r0
	pop {r0}
	//frame address sp,4
	stm r0!,{r2-r6}
	movs r5,#1
	ands r5,r7
	mov r2,r8
	mov r3,r11
	adcs r2,r5
	adcs r3,r7
	stm r0!,{r1-r3}
	
	pop {pc}
	
	.size P256_mulmod, .-P256_mulmod


	.if use_mul_for_sqr == 0

	.if use_noninlined_sqr64 == 1

	.type P256_sqr64, %function
P256_sqr64:
	 // START: sqr 64 Refined Karatsuba
 // Input operands in r4,r5
 // Result in r0,r1,r2,r3
 // Clobbers: r4-r6
 // START: sqr 32
 // Input operand in r4
 // Result in r0 ,r1
 // Clobbers: r2, r3
	uxth r0,r4
	lsrs r1,r4,#16
	mov r2,r0
	muls r2,r1,r2
	muls r0,r0,r0
	muls r1,r1,r1
	lsrs r3,r2,#15
	lsls r2,r2,#17
	adds r0,r2
	adcs r1,r3
 // End: sqr 32
 // Result in r0 ,r1
	subs r4,r5
	sbcs r6,r6
	eors r4,r6
	subs r4,r6
 // START: sqr 32
 // Input operand in r5
 // Result in r2 ,r3
 // Clobbers: r5, r6
	uxth r2,r5
	lsrs r3,r5,#16
	mov r5,r2
	muls r5,r3,r5
	muls r2,r2,r2
	muls r3,r3,r3
	lsrs r6,r5,#15
	lsls r5,r5,#17
	adds r2,r5
	adcs r3,r6
 // End: sqr 32
 // Result in r2 ,r3
	movs r6,#0
	adds r2,r1
	adcs r3,r6
 // START: sqr 32
 // Input operand in r4
 // Result in r4 ,r5
 // Clobbers: r1, r6
	lsrs r5,r4,#16
	uxth r4,r4
	mov r1,r4
	muls r1,r5,r1
	muls r4,r4,r4
	muls r5,r5,r5
	lsrs r6,r1,#15
	lsls r1,r1,#17
	adds r4,r1
	adcs r5,r6
 // End: sqr 32
 // Result in r4 ,r5
	mov r1,r2
	subs r1,r4
	sbcs r2,r5
	mov r5,r3
	movs r6,#0
	sbcs r3,r6
	adds r1,r0
	adcs r2,r5
	adcs r3,r6
 // END: sqr 64 Refined Karatsuba
 // Result in r0,r1,r2,r3
 // Leaves r6 zero.
	bx lr
	.size P256_sqr64, .-P256_sqr64

	.type P256_sqr128, %function
P256_sqr128:
	push {lr}
	//frame push {lr}
 // sqr 128 Refined Karatsuba
 // Input in r4 ... r7
 // Result in r0 ... r7
 // clobbers all registers
	mov r0,r4
	mov r1,r5
	subs r0,r6
	sbcs r1,r7
	sbcs r2,r2
	eors r0,r2
	eors r1,r2
	subs r0,r2
	sbcs r1,r2
	mov r8,r0
	mov r9,r1
	mov r10,r6

	bl P256_sqr64

	mov r4,r10
	mov r5,r7
	mov r10,r0
	mov r11,r1
	mov r12,r2
	mov r7,r3

	bl P256_sqr64

	mov r4,r12
	adds r0,r4
	adcs r1,r7
	adcs r2,r6
	adcs r3,r6
	mov r7,r3
	mov r12,r0
	mov r4,r8
	mov r8,r1
	mov r5,r9
	mov r9,r2

	bl P256_sqr64

	mov r4,r12
	mov r5,r8
	mov r6,r9
	subs r4,r0
	sbcs r5,r1
	mov r0,r6
	mov r1,r7
	sbcs r0,r2
	sbcs r1,r3
	movs r2,#0
	sbcs r6,r2
	sbcs r7,r2
	mov r2,r10
	adds r2,r4
	mov r3,r11
	adcs r3,r5
	mov r4,r12
	adcs r4,r0
	mov r5,r8
	adcs r5,r1
	movs r0,#0
	adcs r6,r0
	adcs r7,r0
	mov r0,r10
	mov r1,r11
 // END: sqr 128 Refined Karatsuba
	pop {pc}
	.size P256_sqr128, .-P256_sqr128
	.else
	.type P256_sqr128, %function
P256_sqr128:
 // sqr 128 Refined Karatsuba
 // Input in r4 ... r7
 // Result in r0 ... r7
 // clobbers all registers
	mov r0,r4
	mov r1,r5
	subs r0,r6
	sbcs r1,r7
	sbcs r2,r2
	eors r0,r2
	eors r1,r2
	subs r0,r2
	sbcs r1,r2
	mov r8,r0
	mov r9,r1
	mov r10,r6
 // START: sqr 64 Refined Karatsuba
 // Input operands in r4,r5
 // Result in r0,r1,r2,r3
 // Clobbers: r4-r6
 // START: sqr 32
 // Input operand in r4
 // Result in r0 ,r1
 // Clobbers: r2, r3
	uxth r0,r4
	lsrs r1,r4,#16
	mov r2,r0
	muls r2,r1,r2
	muls r0,r0,r0
	muls r1,r1,r1
	lsrs r3,r2,#15
	lsls r2,r2,#17
	adds r0,r2
	adcs r1,r3
 // End: sqr 32
 // Result in r0 ,r1
	subs r4,r5
	sbcs r6,r6
	eors r4,r6
	subs r4,r6
 // START: sqr 32
 // Input operand in r5
 // Result in r2 ,r3
 // Clobbers: r5, r6
	uxth r2,r5
	lsrs r3,r5,#16
	mov r5,r2
	muls r5,r3,r5
	muls r2,r2,r2
	muls r3,r3,r3
	lsrs r6,r5,#15
	lsls r5,r5,#17
	adds r2,r5
	adcs r3,r6
 // End: sqr 32
 // Result in r2 ,r3
	movs r6,#0
	adds r2,r1
	adcs r3,r6
 // START: sqr 32
 // Input operand in r4
 // Result in r4 ,r5
 // Clobbers: r1, r6
	lsrs r5,r4,#16
	uxth r4,r4
	mov r1,r4
	muls r1,r5,r1
	muls r4,r4,r4
	muls r5,r5,r5
	lsrs r6,r1,#15
	lsls r1,r1,#17
	adds r4,r1
	adcs r5,r6
 // End: sqr 32
 // Result in r4 ,r5
	mov r1,r2
	subs r1,r4
	sbcs r2,r5
	mov r5,r3
	movs r6,#0
	sbcs r3,r6
	adds r1,r0
	adcs r2,r5
	adcs r3,r6
 // END: sqr 64 Refined Karatsuba
 // Result in r0,r1,r2,r3
 // Leaves r6 zero.
	mov r6,r10
	mov r10,r0
	mov r11,r1
	mov r12,r2
	mov r1,r3
 // START: sqr 64 Refined Karatsuba
 // Input operands in r6,r7
 // Result in r2,r3,r4,r5
 // Clobbers: r0,r7,r6
 // START: sqr 32
 // Input operand in r6
 // Result in r2 ,r3
 // Clobbers: r4, r5
	uxth r2,r6
	lsrs r3,r6,#16
	mov r4,r2
	muls r4,r3,r4
	muls r2,r2,r2
	muls r3,r3,r3
	lsrs r5,r4,#15
	lsls r4,r4,#17
	adds r2,r4
	adcs r3,r5
 // End: sqr 32
 // Result in r2 ,r3
	subs r6,r7
	sbcs r4,r4
	eors r6,r4
	subs r6,r4
 // START: sqr 32
 // Input operand in r7
 // Result in r4 ,r5
 // Clobbers: r0, r7
	uxth r4,r7
	lsrs r5,r7,#16
	mov r0,r4
	muls r0,r5,r0
	muls r4,r4,r4
	muls r5,r5,r5
	lsrs r7,r0,#15
	lsls r0,r0,#17
	adds r4,r0
	adcs r5,r7
 // End: sqr 32
 // Result in r4 ,r5
	movs r7,#0
	adds r4,r3
	adcs r5,r7
 // START: sqr 32
 // Input operand in r6
 // Result in r7 ,r0
 // Clobbers: r6, r3
	uxth r7,r6
	lsrs r0,r6,#16
	mov r6,r7
	muls r6,r0,r6
	muls r7,r7,r7
	muls r0,r0,r0
	lsrs r3,r6,#15
	lsls r6,r6,#17
	adds r7,r6
	adcs r0,r3
 // End: sqr 32
 // Result in r7 ,r0
	mov r3,r4
	subs r3,r7
	sbcs r4,r0
	mov r0,r5
	movs r6,#0
	sbcs r5,r6
	adds r3,r2
	adcs r4,r0
	adcs r5,r6
 // END: sqr 64 Refined Karatsuba
 // Result in r2,r3,r4,r5
 // Leaves r6 zero.
	mov r0,r12
	adds r2,r0
	adcs r3,r1
	adcs r4,r6
	adcs r5,r6
	mov r12,r2
	mov r2,r8
	mov r8,r3
	mov r3,r9
	mov r9,r4
 // START: sqr 64 Refined Karatsuba
 // Input operands in r2,r3
 // Result in r6,r7,r0,r1
 // Clobbers: r2,r3,r4
 // START: sqr 32
 // Input operand in r2
 // Result in r6 ,r7
 // Clobbers: r0, r1
	uxth r6,r2
	lsrs r7,r2,#16
	mov r0,r6
	muls r0,r7,r0
	muls r6,r6,r6
	muls r7,r7,r7
	lsrs r1,r0,#15
	lsls r0,r0,#17
	adds r6,r0
	adcs r7,r1
 // End: sqr 32
 // Result in r6 ,r7
	subs r2,r3
	sbcs r4,r4
	eors r2,r4
	subs r2,r4
 // START: sqr 32
 // Input operand in r3
 // Result in r0 ,r1
 // Clobbers: r3, r4
	uxth r0,r3
	lsrs r1,r3,#16
	mov r3,r0
	muls r3,r1,r3
	muls r0,r0,r0
	muls r1,r1,r1
	lsrs r4,r3,#15
	lsls r3,r3,#17
	adds r0,r3
	adcs r1,r4
 // End: sqr 32
 // Result in r0 ,r1
	movs r4,#0
	adds r0,r7
	adcs r1,r4
 // START: sqr 32
 // Input operand in r2
 // Result in r3 ,r4
 // Clobbers: r2, r7
	uxth r3,r2
	lsrs r4,r2,#16
	mov r2,r3
	muls r2,r4,r2
	muls r3,r3,r3
	muls r4,r4,r4
	lsrs r7,r2,#15
	lsls r2,r2,#17
	adds r3,r2
	adcs r4,r7
 // End: sqr 32
 // Result in r3 ,r4
	mov r7,r0
	subs r7,r3
	sbcs r0,r4
	mov r2,r1
	movs r4,#0
	sbcs r1,r4
	adds r7,r6
	adcs r0,r2
	adcs r1,r4
 // END: sqr 64 Refined Karatsuba
 // Result in r6,r7,r0,r1
 // Returns r4 as zero.
	mov r2,r12
	mov r3,r8
	mov r4,r9
	subs r2,r6
	sbcs r3,r7
	mov r6,r4
	mov r7,r5
	sbcs r4,r0
	sbcs r5,r1
	movs r0,#0
	sbcs r6,r0
	sbcs r7,r0
	mov r0,r10
	adds r2,r0
	mov r1,r11
	adcs r3,r1
	mov r0,r12
	adcs r4,r0
	mov r0,r8
	adcs r5,r0
	movs r0,#0
	adcs r6,r0
	adcs r7,r0
	mov r0,r10
 // END: sqr 128 Refined Karatsuba
 // Result in r0 ... r7
	bx lr
	.size P256_sqr128, .-P256_sqr128
	
	.endif

// ######################
// ASM Square 256 refined karatsuba:
// ######################
 // sqr 256 Refined Karatsuba
 // pInput in r1
 // pResult in r0
	.type P256_sqrmod, %function
P256_sqrmod:
	push {r0,lr}
	//frame push {lr}
	//frame address sp,8
	sub sp,#64
	//frame address sp,72
	//mov lr,sp
	push {r1}
	//frame address sp,76
	ldm r1!,{r4,r5,r6,r7}

	bl P256_sqr128

	push {r4,r5,r6,r7}
	//frame address sp,92
	//mov r4,lr
	add r4,sp,#20
	stm r4!,{r0,r1,r2,r3}
	ldr r4,[sp,#16]
	adds r4,#16
	ldm r4,{r4,r5,r6,r7}

	bl P256_sqr128

	mov r8,r4
	mov r9,r5
	mov r10,r6
	mov r11,r7
	pop {r4,r5,r6,r7}
	//frame address sp,76
	adds r0,r4
	adcs r1,r5
	adcs r2,r6
	adcs r3,r7
	mov r4,r8
	mov r5,r9
	mov r6,r10
	mov r7,r11
	mov r8,r0
	movs r0,#0
	adcs r4,r0
	adcs r5,r0
	adcs r6,r0
	adcs r7,r0
	mov r0,r8
	push {r0,r1,r2,r3,r4,r5,r6,r7}
	//frame address sp,108
	ldr r4,[sp,#32]
	ldm r4,{r0,r1,r2,r3,r4,r5,r6,r7}
	subs r4,r0
	sbcs r5,r1
	sbcs r6,r2
	sbcs r7,r3
	sbcs r0,r0
	eors r4,r0
	eors r5,r0
	eors r6,r0
	eors r7,r0
	subs r4,r0
	sbcs r5,r0
	sbcs r6,r0
	sbcs r7,r0

	bl P256_sqr128

	mvns r0,r0
	mvns r1,r1
	mvns r2,r2
	mvns r3,r3
	mvns r4,r4
	mvns r5,r5
	mvns r6,r6
	mvns r7,r7
	mov r8,r4
	mov r9,r5
	mov r10,r6
	mov r11,r7
	subs r4,r4
	pop {r4,r5,r6,r7}
	//frame address sp,92
	adcs r0,r4
	adcs r1,r5
	adcs r2,r6
	adcs r3,r7
	mov r12,r4
	//movs r4,#16
	//add r4,lr
	add r4,sp,#20+16
	stm r4!,{r0,r1,r2,r3}
	mov r4,r12
	mov r0,r8
	adcs r0,r4
	mov r8,r0
	mov r1,r9
	adcs r1,r5
	mov r9,r1
	mov r2,r10
	adcs r2,r6
	mov r10,r2
	mov r3,r11
	adcs r3,r7
	mov r11,r3
	movs r0,#0
	adcs r0,r0
	mov r12,r0
	//mov r0,lr
	add r0,sp,#20
	ldm r0,{r0,r1,r2,r3,r4,r5,r6,r7}
	adds r0,r4
	adcs r1,r5
	adcs r2,r6
	adcs r3,r7
	//movs r4,#16
	//add r4,lr
	add r4,sp,#20+16
	stm r4!,{r0,r1,r2,r3}
	//mov lr,r4
	mov r0,r13
	ldm r0!,{r4,r5,r6,r7}
	mov r1,r8
	adcs r4,r1
	mov r1,r9
	adcs r5,r1
	mov r1,r10
	adcs r6,r1
	mov r1,r11
	adcs r7,r1
	//mov r0,lr
	add r0,sp,#20+32
	stm r0!,{r4,r5,r6,r7}
	pop {r4,r5,r6,r7}
	//frame address sp,76
	mov r1,r12
	movs r2,#0
	mvns r2,r2
	adcs r1,r2
	asrs r2,r1,#4
	adds r4,r1
	adcs r5,r2
	adcs r6,r2
	adcs r7,r2
	stm r0!,{r4,r5,r6,r7}
	add sp,#4
	//frame address sp,72
	b reduce
	.size P256_sqrmod, .-P256_sqrmod
	.endif

// *r0 = output, *r1 = a, *r2 = b
	.type P256_addmod, %function
P256_addmod:
	push {r0,lr}
	//frame push {lr}
	//frame address sp,8
	ldm r1!,{r0,r3,r4}
	ldm r2!,{r5,r6,r7}
	adds r0,r5
	adcs r3,r6
	adcs r4,r7
	mov r8,r0
	mov r9,r3
	mov r10,r4
	ldm r1!,{r5,r6}
	ldm r2!,{r3,r4}
	adcs r5,r3
	adcs r6,r4
	ldm r1,{r1,r3,r4}
	ldm r2,{r0,r2,r7}
	adcs r1,r0
	adcs r3,r2
	adcs r4,r7
	movs r7,#0
	adcs r7,r7
	
	subs r0,r0 //set r0 to 0 and C to 1
	mov r2,r8
	mov r8,r7
	mov r7,r9
	mov r9,r4
	mov r4,r10
	adcs r2,r0
	mov r10,r2
	adcs r7,r0
	mov r11,r7
	adcs r4,r0
	sbcs r5,r0
	sbcs r6,r0
	sbcs r1,r0
	movs r0,#1
	sbcs r3,r0
	movs r0,#0
	mov r2,r9
	adcs r2,r0
	mov r7,r8
	sbcs r7,r0
	
	// r10 r11 r4 r5 | r6 r1 r3 r2 | r7
	
	mov r8,r3
	mov r3,r11
	mov r11,r2
	mov r2,r10
	
	// r2 r3 r4 r5 | r6 r1 r8 r11 | r7
	
	b reduce2
	
	.size P256_addmod, .-P256_addmod
	
// *r0 = output, *r1 = a, *r2 = b
	.type P256_submod, %function
P256_submod:
	push {r0,lr}
	//frame push {lr}
	//frame address sp,8
	ldm r1!,{r0,r3,r4}
	ldm r2!,{r5,r6,r7}
	subs r0,r5
	sbcs r3,r6
	sbcs r4,r7
	mov r8,r0
	mov r9,r3
	mov r10,r4
	ldm r1!,{r5,r6}
	ldm r2!,{r3,r4}
	sbcs r5,r3
	sbcs r6,r4
	ldm r1,{r1,r3,r4}
	ldm r2,{r0,r2,r7}
	sbcs r1,r0
	sbcs r3,r2
	sbcs r4,r7
	
	sbcs r7,r7
	
	mov r2,r8
	mov r8,r3
	mov r11,r4
	mov r3,r9
	mov r4,r10
	b reduce2
	
	.size P256_submod, .-P256_submod

// in: *r0 = output (8 words)
// out: r0 is preserved
	.type P256_load_1, %function
P256_load_1:
	movs r1,#1
	stm r0!,{r1}
	movs r1,#0
	movs r2,#0
	stm r0!,{r1-r2}
	stm r0!,{r1-r2}
	stm r0!,{r1-r2}
	stm r0!,{r1}
	subs r0,#32
	bx lr
	.size P256_load_1, .-P256_load_1

// in: *r1
// out: *r0
	.type P256_to_montgomery, %function
P256_to_montgomery:
	push {r4-r7,lr}
	//frame push {r4-r7,lr}
	adr r2,P256_R2_mod_p
	bl P256_mulmod
	pop {r4-r7,pc}
	.size P256_to_montgomery, .-P256_to_montgomery

	.align 2
	// (2^256)^2 mod p
P256_R2_mod_p:
	.word 3
	.word 0
	.word 0xffffffff
	.word 0xfffffffb
	.word 0xfffffffe
	.word 0xffffffff
	.word 0xfffffffd
	.word 4

// in: *r1
// out: *r0
	.type P256_from_montgomery, %function
P256_from_montgomery:
	push {r4-r7,lr}
	//frame push {r4-r7,lr}
	movs r2,#0
	movs r3,#0
	push {r2-r3}
	//frame address sp,28
	push {r2-r3}
	//frame address sp,36
	push {r2-r3}
	//frame address sp,44
	movs r2,#1
	push {r2-r3}
	//frame address sp,52
	mov r2,sp
	bl P256_mulmod
	add sp,#32
	//frame address sp,20
	pop {r4-r7,pc}
	.size P256_from_montgomery, .-P256_from_montgomery

// Elliptic curve operations on the NIST curve P256

// Checks if a point is on curve
// in: *r0 = x,y(,scratch) in Montgomery form
// out: r0 = 1 if on curve, otherwise 0
	.type P256_point_is_on_curve, %function
P256_point_is_on_curve:
	.if use_interpreter == 1
	push {r0,lr}
	//frame push {lr}
	//frame address sp,8
	adr r2,P256_point_is_on_curve_program
	bl P256_interpreter
	ldr r0,[sp]
	adds r0,#64
	adr r1,P256_b_mont
	bl P256_greater_or_equal_than
	beq 0f
	adr r0,P256_b_mont
	ldr r1,[sp]
	adds r1,#64
	bl P256_greater_or_equal_than
0:
	pop {r1,pc}
	.else
	push {r0,r4-r7,lr}
	//frame push {r4-r7,lr}
	//frame address sp,24
	
	// We verify y^2 - (x^3 - 3x) = b
	
	// y^2
	mov r1,r0
	adds r1,#32
	sub sp,#32
	//frame address sp,56
	mov r0,sp
	bl P256_sqrmod
	
	// x^2
	ldr r1,[sp,#32]
	sub sp,#32
	//frame address sp,88
	mov r0,sp
	bl P256_sqrmod
	
	// x^3
	mov r0,sp
	ldr r1,[sp,#64]
	mov r2,sp
	bl P256_mulmod
	
	// x^3 - 3x
	movs r0,#3
0:
	push {r0}
	//frame address sp,92
	add r0,sp,#4
	add r1,sp,#4
	ldr r2,[sp,#68]
	bl P256_submod
	pop {r0}
	//frame address sp,88
	subs r0,#1
	bne 0b
	
	// y^2 - (x^3 - 3x)
	mov r0,sp
	add r1,sp,#32
	mov r2,sp
	bl P256_submod
	
	// compare with b
	mov r0,sp
	adr r1,P256_b_mont
	bl P256_greater_or_equal_than
	beq 1f
	adr r0,P256_b_mont
	mov r1,sp
	bl P256_greater_or_equal_than
1:
	add sp,#68
	//frame address sp,20
	
	pop {r4-r7,pc}
	.endif
	
	.size P256_point_is_on_curve, .-P256_point_is_on_curve

	.align 2
P256_b_mont:
	.word 0x29c4bddf
	.word 0xd89cdf62
	.word 0x78843090
	.word 0xacf005cd
	.word 0xf7212ed6
	.word 0xe5a220ab
	.word 0x04874834
	.word 0xdc30061d
		
	.if use_interpreter == 1
P256_point_is_on_curve_program:
	.hword 0x2040
	.hword 0x2130
	.hword 0x1113
	.hword 0x4113
	.hword 0x4113
	.hword 0x4113
	.hword 0x4501
	.hword 0x0000
	.endif

// input: *r0 = value, *r1 = limit
// output: 1 if value >= limit, otherwise 0
	.type P256_greater_or_equal_than, %function
P256_greater_or_equal_than:
	push {r4-r6,lr}
	//frame push {r4-r6,lr}
	subs r5,r5 // set r5 to 0 and C to 1
	mvns r6,r5 // set r6 to -1
	movs r2,#8
0:
	ldm r0!,{r3}
	ldm r1!,{r4}
	sbcs r3,r4
	add r2,r2,r6
	tst r2,r2
	bne 0b
	
	adcs r5,r5
	mov r0,r5
	pop {r4-r6,pc}
	.size P256_greater_or_equal_than, .-P256_greater_or_equal_than

// in: *r0 = output location, *r1 = input, *r2 = 0/1, *r3 = m
// if r2 = 0, then *r0 is set to *r1
// if r2 = 1, then *r0 is set to m - *r1
// note that *r1 should be in the range [1,m-1]
// out: r0 and r1 will have advanced 32 bytes, r2 will remain as the input
	.type P256_negate_mod_m_if, %function
P256_negate_mod_m_if:
	push {r4-r7,lr}
	//frame push {r4-r7,lr}
	movs r4,#1
	rsbs r5,r4,#0 // r5=-1
	mov r8,r5
	subs r4,r4,r2 // r4=!r2, C=1
	movs r6,#8
0:
	ldm r1!,{r5}
	ldm r3!,{r7}
	sbcs r7,r5
	muls r7,r2,r7
	muls r5,r4,r5
	add r7,r7,r5
	stm r0!,{r7}
	add r6,r6,r8
	tst r6,r6
	bne 0b
	
	pop {r4-r7,pc}
	.size P256_negate_mod_m_if, .-P256_negate_mod_m_if

// copies 8 words
// in: *r0 = result, *r1 = input
// out: *r0 = end of result, *r1 = end of input
	.type P256_copy32, %function
P256_copy32:
	push {r4-r5,lr}
	//frame push {r4-r5,lr}
	ldm r1!,{r2-r5}
	stm r0!,{r2-r5}
	ldm r1!,{r2-r5}
	stm r0!,{r2-r5}
	pop {r4-r5,pc}
	.size P256_copy32, .-P256_copy32


// copies 32 bytes
// in: *r0 = result, *r1 = input
// out: *r0 = end of result, *r1 = end of input
	.type P256_copy32_unaligned, %function
P256_copy32_unaligned:
	movs r2,#32
	add r2,r0
0:
	ldrb r3,[r1]
	strb r3,[r0]
	adds r1,#1
	adds r0,#1
	cmp r0,r2
	bne 0b
	bx lr
	.size P256_copy32_unaligned, .-P256_copy32_unaligned

// Selects one of many values
// *r0 = output, *r1 = table, r2 = index to choose [0..7]
	.type P256_select, %function
P256_select:
	push {r2,r4-r7,lr}
	//frame push {r4-r7,lr}
	//frame address sp,24
	
	movs r6,#4
0:
	push {r0,r6}
	//frame address sp,32
	
	movs r7,#0
	mov r8,r7
	mov r9,r7
	mov r10,r7
	mov r11,r7
	mov r12,r7
	mov lr,r7
1:
	ldr r0,[sp,#8]
	eors r0,r7
	mrs r0,apsr
	lsrs r0,#30
	
	ldm r1!,{r2-r4}
	muls r2,r0,r2
	muls r3,r0,r3
	muls r4,r0,r4
	add r8,r2
	add r9,r3
	add r10,r4
	ldm r1!,{r2-r4}
	muls r2,r0,r2
	muls r3,r0,r3
	muls r4,r0,r4
	add r11,r2
	add r12,r3
	add lr,r4
	
	adds r1,#72
	adds r7,#1
	cmp r7,#8
	bne 1b
	
	pop {r0,r6}
	//frame address sp,24
	mov r2,r8
	mov r3,r9
	mov r4,r10
	stm r0!,{r2-r4}
	mov r2,r11
	mov r3,r12
	mov r4,lr
	stm r0!,{r2-r4}
	subs r1,#248
	subs r1,#248
	subs r1,#248
	subs r6,#1
	bne 0b
	
	pop {r0,r4-r7,pc}
	.size P256_select, .-P256_select

// Doubles the point in Jacobian form (integers are in Montgomery form)
// *r0 = out, *r1 = in
	.type P256_double_j, %function
P256_double_j:
	.if use_interpreter == 1
	adr r2,P256_double_j_prog
	b P256_interpreter
	.else
	push {r0,r1,r4-r7,lr}
	//frame push {r4-r7,lr}
	//frame address sp,28
	
	// https://eprint.iacr.org/2014/130.pdf, algorithm 10
	
	// t1 = Z1^2
	sub sp,#32
	//frame address sp,60
	mov r0,sp
	adds r1,#64
	bl P256_sqrmod
	
	// Z2 = Y1 * Z1
	ldr r0,[sp,#32]
	ldr r1,[sp,#36]
	adds r0,#64
	adds r1,#32
	movs r2,#32
	adds r2,r1
	bl P256_mulmod
	
	// t2 = X1 + t1
	ldr r1,[sp,#36]
	mov r2,sp
	sub sp,#32
	//frame address sp,92
	mov r0,sp
	bl P256_addmod
	
	// t1 = X1 - t1
	ldr r1,[sp,#68]
	add r2,sp,#32
	mov r0,r2
	bl P256_submod
	
	// t1 = t1 * t2
	add r1,sp,#32
	mov r2,sp
	mov r0,r1
	bl P256_mulmod
	
	// t2 = t1 / 2
	add sp,#32
	//frame address sp,60
	mov r7,sp
	ldm r7!,{r0-r3}
	lsls r6,r0,#31
	asrs r5,r6,#31
	lsrs r6,#31
	movs r4,#0
	adds r0,r5
	adcs r1,r5
	adcs r2,r5
	adcs r3,r4
	push {r0-r3}
	//frame address sp,76
	ldm r7!,{r0-r3}
	adcs r0,r4
	adcs r1,r4
	adcs r2,r6
	adcs r3,r5
	movs r4,#0
	adcs r4,r4
	lsls r7,r4,#31
	lsrs r6,r3,#1
	orrs r7,r6
	lsls r6,r3,#31
	lsrs r5,r2,#1
	orrs r6,r5
	lsls r5,r2,#31
	lsrs r4,r1,#1
	orrs r5,r4
	lsls r4,r1,#31
	lsrs r3,r0,#1
	orrs r4,r3
	lsls r3,r0,#31
	mov r8,r3
	pop {r0-r3}
	//frame address sp,60
	push {r4-r7}
	//frame address sp,76
	mov r7,r8
	lsrs r6,r3,#1
	orrs r7,r6
	lsls r6,r3,#31
	lsrs r5,r2,#1
	orrs r6,r5
	lsls r5,r2,#31
	lsrs r4,r1,#1
	orrs r5,r4
	lsls r4,r1,#31
	lsrs r3,r0,#1
	orrs r4,r3
	push {r4-r7}
	//frame address sp,92
	
	// t1 = t1 + t2
	add r1,sp,#32
	mov r2,sp
	mov r0,r1
	bl P256_addmod
	
	// t2 = t1^2
	mov r0,sp
	add r1,sp,#32
	bl P256_sqrmod
	
	// Y2 = Y1^2
	ldr r0,[sp,#64]
	ldr r1,[sp,#68]
	adds r0,#32
	adds r1,#32
	bl P256_sqrmod
	
	// t3 = Y2^2
	ldr r1,[sp,#64]
	adds r1,#32
	sub sp,#32
	//frame address sp,124
	mov r0,sp
	bl P256_sqrmod
	
	// Y2 = X1 * Y2
	ldr r0,[sp,#96]
	ldr r1,[sp,#100]
	adds r0,#32
	mov r2,r0
	bl P256_mulmod
	
	// X2 = 2 * Y2
	ldr r0,[sp,#96]
	mov r1,r0
	adds r1,#32
	mov r2,r1
	bl P256_addmod
	
	// X2 = t2 - X2
	ldr r0,[sp,#96]
	add r1,sp,#32
	mov r2,r0
	bl P256_submod
	
	// t2 = Y2 - X2
	ldr r2,[sp,#96]
	mov r1,r2
	adds r1,#32
	add r0,sp,#32
	bl P256_submod
	
	// t1 = t1 * t2
	add r0,sp,#64
	add r1,sp,#64
	add r2,sp,#32
	bl P256_mulmod
	
	// Y2 = t1 - t3
	ldr r0,[sp,#96]
	adds r0,#32
	add r1,sp,#64
	mov r2,sp
	bl P256_submod
	
	add sp,#104
	//frame address sp,20
	
	pop {r4-r7,pc}
	.endif
	.size P256_double_j, .-P256_double_j


// Adds or subtracts points in Jacobian form (integers are in Montgomery form)
// The first operand is located in *r0, the second in *r1 (may not overlap)
// The result is stored at *r0
//
// Requirements:
// - no operand is the point at infinity
// - both operand must be different
// - one operand must not be the negation of the other
// If requirements are not met, the returned Z point will be 0
	.type P256_add_j, %function
P256_add_j:
	.if use_interpreter == 1
	adr r2,P256_add_j_prog
	b P256_interpreter
	.else
	push {r0,r1,r4-r7,lr}
	//frame push {r4-r7,lr}
	//frame address sp,28
	
	// Here a variant of
	// https://www.hyperelliptic.org/EFD/g1p/auto-code/shortw/jacobian-3/addition/add-1998-cmo-2.op3
	// is used, but rearranged and uses less temporaries.
	// The first operand to the function is both (X3,Y3,Z3) and (X2,Y2,Z2).
	// The second operand to the function is (X1,Y1,Z1)
	
	// Z1Z1 = Z1^2
	sub sp,#32
	//frame address sp,60
	mov r0,sp
	adds r1,#64
	bl P256_sqrmod
	
	// U2 = X2*Z1Z1
	ldr r1,[sp,#32]
	mov r2,sp
	mov r0,r1
	bl P256_mulmod
	
	// t1 = Z1*Z1Z1
	ldr r1,[sp,#36]
	adds r1,#64
	mov r2,sp
	mov r0,sp
	bl P256_mulmod
	
	// S2 = Y2*t1
	ldr r1,[sp,#32]
	adds r1,#32
	mov r2,sp
	mov r0,r1
	bl P256_mulmod
	
	// Z2Z2 = Z2^2
	sub sp,#32
	//frame address sp,92
	mov r0,sp
	ldr r1,[sp,#64]
	adds r1,#64
	bl P256_sqrmod
	
	// U1 = X1*Z2Z2
	ldr r1,[sp,#68]
	mov r2,sp
	add r0,sp,#32
	bl P256_mulmod
	
	// t2 = Z2*Z2Z2
	ldr r1,[sp,#64]
	adds r1,#64
	mov r2,sp
	mov r0,sp
	bl P256_mulmod
	
	// S1 = Y1*t2
	ldr r1,[sp,#68]
	adds r1,#32
	mov r2,sp
	mov r0,sp
	bl P256_mulmod
	
	// H = U2-U1
	ldr r1,[sp,#64]
	add r2,sp,#32
	mov r0,r1
	bl P256_submod
	
	// HH = H^2
	ldr r1,[sp,#64]
	sub sp,#32
	//frame address sp,124
	mov r0,sp
	bl P256_sqrmod
	
	// Z3 = Z2*H
	ldr r2,[sp,#96]
	mov r1,r2
	adds r1,#64
	mov r0,r1
	bl P256_mulmod
	
	// Z3 = Z1*Z3
	ldr r1,[sp,#100]
	adds r1,#64
	ldr r2,[sp,#96]
	adds r2,#64
	mov r0,r2
	bl P256_mulmod
	
	// HHH = H*HH
	ldr r1,[sp,#96]
	mov r2,sp
	mov r0,r1
	bl P256_mulmod
	
	// r = S2-S1
	ldr r1,[sp,#96]
	adds r1,#32
	add r2,sp,#32
	mov r0,r1
	bl P256_submod
	
	// V = U1*HH
	add r1,sp,#64
	mov r2,sp
	mov r0,r1
	bl P256_mulmod
	
	// t3 = r^2
	ldr r1,[sp,#96]
	adds r1,#32
	mov r0,sp
	bl P256_sqrmod
	
	// t2 = S1*HHH
	add r1,sp,#32
	ldr r2,[sp,#96]
	add r0,sp,#32
	bl P256_mulmod
	
	// X3 = t3-HHH
	mov r1,sp
	ldr r2,[sp,#96]
	mov r0,r2
	bl P256_submod
	
	// t3 = 2*V
	add r1,sp,#64
	add r2,sp,#64
	mov r0,sp
	bl P256_addmod
	
	// X3 = X3-t3
	ldr r1,[sp,#96]
	mov r2,sp
	mov r0,r1
	bl P256_submod
	
	// t3 = V-X3
	add r1,sp,#64
	ldr r2,[sp,#96]
	mov r0,sp
	bl P256_submod
	
	// t3 = r*t3
	ldr r1,[sp,#96]
	adds r1,#32
	mov r2,sp
	mov r0,sp
	bl P256_mulmod
	
	// Y3 = t3-t2
	mov r1,sp
	add r2,sp,#32
	ldr r0,[sp,#96]
	adds r0,#32
	bl P256_submod
	
	add sp,#104
	//frame address sp,20
	
	pop {r4-r7,pc}
	.endif
	.size P256_add_j, .-P256_add_j

	.if use_interpreter == 1
	.align 2
P256_add_j_prog:
	.hword 0x2080
	.hword 0x1330
	.hword 0x1080
	.hword 0x1440
	.hword 0x2150
	.hword 0x1061
	.hword 0x1151
	.hword 0x1171
	.hword 0x4330
	.hword 0x2230
	.hword 0x1553
	.hword 0x1585
	.hword 0x1332
	.hword 0x4441
	.hword 0x1002
	.hword 0x2240
	.hword 0x1113
	.hword 0x4323
	.hword 0x3200
	.hword 0x4332
	.hword 0x4203
	.hword 0x1242
	.hword 0x4421
	.hword 0x0000
	
	.align 2
P256_double_j_prog:
	.hword 0x2080
	.hword 0x1578
	.hword 0x3160
	.hword 0x4060
	.hword 0x1001
	.hword 0x5100
	.hword 0x3001
	.hword 0x2100
	.hword 0x2470
	.hword 0x2240
	.hword 0x1464
	.hword 0x3344
	.hword 0x4313
	.hword 0x4143
	.hword 0x1001
	.hword 0x4402
	.hword 0x0000

// in: *r0 = output, *r1 = input
	.type P256_div2mod, %function
P256_div2mod:
	mov r9,r0
	mov r7,r1
	ldm r7!,{r0-r3}
	lsls r6,r0,#31
	asrs r5,r6,#31
	lsrs r6,#31
	movs r4,#0
	adds r0,r5
	adcs r1,r5
	adcs r2,r5
	adcs r3,r4
	push {r0-r3}
	//frame address sp,76
	ldm r7!,{r0-r3}
	adcs r0,r4
	adcs r1,r4
	adcs r2,r6
	adcs r3,r5
	movs r4,#0
	adcs r4,r4
	lsls r7,r4,#31
	lsrs r6,r3,#1
	orrs r7,r6
	lsls r6,r3,#31
	lsrs r5,r2,#1
	orrs r6,r5
	lsls r5,r2,#31
	lsrs r4,r1,#1
	orrs r5,r4
	lsls r4,r1,#31
	lsrs r3,r0,#1
	orrs r4,r3
	lsls r3,r0,#31
	mov r0,r9
	adds r0,#16
	stm r0!,{r4-r7}
	mov r7,r3
	pop {r0-r3}
	lsrs r6,r3,#1
	orrs r7,r6
	lsls r6,r3,#31
	lsrs r5,r2,#1
	orrs r6,r5
	lsls r5,r2,#31
	lsrs r4,r1,#1
	orrs r5,r4
	lsls r4,r1,#31
	lsrs r3,r0,#1
	orrs r4,r3
	mov r0,r9
	stm r0!,{r4-r7}
	bx lr
	.size P256_div2mod, .-P256_div2mod

// in: *r0 = op1, *r1 = op2, *r2 = program
// program is an array of 16-bit integers, ending with 0x0000
// in an opcode, bit 12-15 is function to execute (exit, mul, sqr, add, sub, div2),
// bit 8-11 is dest, bit 4-7 is first operand, bit 0-3 is second operand
// the operand is encoded like this:
// operand 0-2 is temporary variable 0-2
// operand 3-5 is op1[0], op1[1], op1[2]
// operand 6-8 is op2[0], op2[1], op2[2]
// each variable is 32 bytes
// for a function taking less than two parameters, the extra parameters are ignored
	.type P256_interpreter, %function
P256_interpreter:
	push {r4-r7,lr}
	//frame push {r4-r7,lr}
	
	sub sp,#96
	//frame address sp,116
	
	movs r3,#32
	mov r4,r1
	adds r5,r1,r3
	adds r6,r5,r3
	push {r4-r6}
	//frame address sp,128
	mov r4,r0
	adds r5,r0,r3
	adds r6,r5,r3
	push {r4-r6}
	//frame address sp,140
	add r4,sp,#24
	adds r5,r4,r3
	adds r6,r5,r3
	push {r4-r6}
	//frame address sp,152
	
0:
	movs r4,#0x3c
	mov r5,sp
	ldrh r3,[r2]
	adds r2,#2
	push {r2}
	//frame address sp,156
	lsls r2,r3,#2
	ands r2,r4
	ldr r2,[r5,r2]
	lsrs r1,r3,#2
	ands r1,r4
	ldr r1,[r5,r1]
	lsrs r0,r3,#6
	ands r0,r4
	ldr r0,[r5,r0]
	adr r5,P256_functions-4
	lsrs r6,r3,#10
	ands r6,r4
	beq 1f
	ldr r6,[r5,r6]
	blx r6
	pop {r2}
	//frame address sp,152
	b 0b
1:
	//frame address sp,156
	add sp,#136
	//frame address sp,20
	pop {r4-r7,pc}
	.size P256_interpreter, .-P256_interpreter

	.align 2
P256_functions:
	.word P256_mulmod  //1
	.word P256_sqrmod  //2
	.word P256_addmod  //3
	.word P256_submod  //4
	.word P256_div2mod //5

	.endif

	.if use_smaller_modinv == 1
// in/out: r0-r7
	.type P256_modinv, %function
P256_modinv:
	push {r0-r7,lr}
	//frame push {r4-r7,lr}
	//frame address sp,36
	sub sp,#36
	//frame address sp,72
	mov r0,sp
	bl P256_load_1
	mov r1,r0
	bl P256_to_montgomery
	adr r0,P256_p
	ldm r0,{r0-r7}
	subs r0,#2
	push {r0-r7}
	//frame address sp,104
	
	movs r0,#255
0:
	str r0,[sp,#64]
	add r0,sp,#32
	add r1,sp,#32
	bl P256_sqrmod
	ldr r0,[sp,#64]
	lsrs r1,r0,#3
	add r1,r1,sp
	ldrb r1,[r1]
	movs r2,#7
	ands r2,r2,r0
	lsrs r1,r2
	movs r2,#1
	tst r1,r2
	beq 1f
	add r0,sp,#32
	add r1,sp,#32
	add r2,sp,#68
	bl P256_mulmod
1:
	ldr r0,[sp,#64]
	subs r0,#1
	bpl 0b
	
	add sp,#32
	//frame address sp,72
	pop {r0-r7}
	//frame address sp,40
	add sp,#36
	//frame address sp,4
	pop {pc}
	.size P256_modinv, .-P256_modinv

	.else

// in: *r0 = input/output, r1 = count, *r2 = operand for final multiplication
	.type P256_sqrmod_many_and_mulmod, %function
P256_sqrmod_many_and_mulmod:
	push {r0,r2,lr}
	//frame push {lr}
	//frame address sp,12
	cmp r1,#0
	beq 1f
0:
	push {r1}
	//frame address sp,16
	ldr r0,[sp,#4]
	mov r1,r0
	bl P256_sqrmod
	pop {r1}
	//frame address sp,12
	subs r1,#1
	bne 0b
1:
	pop {r0,r1}
	//frame address sp,4
	mov r2,r0
	bl P256_mulmod
	pop {pc}
	.size P256_sqrmod_many_and_mulmod, .-P256_sqrmod_many_and_mulmod


// in: *r0 = value in/out
// for modinv, call input a, then if a = A * R % p, then it calculates A^-1 * R % p = (a/R)^-1 * R % p = R^2 / a % p
	.type P256_modinv, %function
P256_modinv:
	push {r0,lr}
	//frame push {lr}
	//frame address sp,8
	
	ldm r0,{r0-r7}
	push {r0-r7}
	//frame address sp,40
	
	// t = a^2*a
	ldr r0,[sp,#32]
	movs r1,#1
	mov r2,sp
	bl P256_sqrmod_many_and_mulmod
	ldr r0,[sp,#32]
	ldm r0,{r0-r7}
	push {r0-r7}
	//frame address sp,72
	
	// a4_2 = a2_0^(2^2)
	
	ldr r0,[sp,#64]
	mov r1,r0
	bl P256_sqrmod
	ldr r0,[sp,#64]
	mov r1,r0
	bl P256_sqrmod
	ldr r0,[sp,#64]
	ldm r0,{r0-r7}
	push {r0-r7}
	//frame address sp,104
	
	// a4_0 = a4_2*a2_0
	ldr r0,[sp,#96]
	mov r1,sp
	add r2,sp,#32
	bl P256_mulmod
	add r0,sp,#32
	ldr r1,[sp,#96]
	bl P256_copy32
	
	ldr r7,[sp,#96]
	movs r4,#0
0:
	adr r2,P256_invtbl
	ldrsb r0,[r2,r4]
	adds r2,#1
	ldrb r5,[r2,r4]
	lsls r6,r0,#2
	bpl 1f
	sub sp,#32
	//frame address sp,200 // not always correct
	mov r0,sp
	mov r1,r7
	bl P256_copy32
1:
	mov r0,r7
	uxtb r1,r6
	mov r2,r5
	add r2,sp
	push {r4,r7}
	//frame address sp,208 // not always correct
	bl P256_sqrmod_many_and_mulmod
	pop {r4,r7}
	//frame address sp,200 // not always correct
	adds r4,#2
	cmp r4,#22
	bne 0b

	add sp,#6*32+4
	//frame address sp,4
	
	pop {pc}
	
	.size P256_modinv, .-P256_modinv

	.align 2
P256_invtbl:
	.byte ((8-4)>>2)
	.byte 32
	
	.byte ((16-8)>>2)+128
	.byte 0
	
	.byte (16>>2)+128
	.byte 0
	
	.byte (32>>2)+128
	.byte 5*32
	
	.byte (192-64)>>2
	.byte 0
	
	.byte (224-192)>>2
	.byte 0
	
	.byte (240-224)>>2
	.byte 32
	
	.byte (248-240)>>2
	.byte 64
	
	.byte (252-248)>>2
	.byte 128
	
	.byte (256-252)>>2
	.byte 96
	
	.byte 0
	.byte 5*32
	
	.endif


// *r0 = output affine montgomery/input jacobian montgomery
	.type P256_jacobian_to_affine, %function
P256_jacobian_to_affine:
	push {r0,r4-r7,lr}
	//frame push {r4-r7,lr}
	//frame address sp,24
	
	adds r0,#64
	ldm r0,{r0-r7}
	.if use_smaller_modinv == 0
		push {r0-r7}
		//frame address sp,56
		mov r0,sp
		bl P256_modinv
	.else
		bl P256_modinv
		push {r0-r7}
		//frame address sp,56
	.endif
	
	mov r1,sp
	sub sp,#32
	//frame address sp,88
	mov r0,sp
	bl P256_sqrmod
	
	add r1,sp,#32
	mov r2,sp
	mov r0,r1
	bl P256_mulmod
	
	mov r1,sp
	ldr r0,[sp,#64]
	mov r2,r0
	bl P256_mulmod
	
	add r1,sp,#32
	ldr r0,[sp,#64]
	adds r0,#32
	mov r2,r0
	bl P256_mulmod
	
	add sp,#68
	//frame address sp,20
	
	pop {r4-r7,pc}
	.size P256_jacobian_to_affine, .-P256_jacobian_to_affine

// performs r0 := abs(r0)
	.type P256_abs_int, %function
P256_abs_int:
	rsbs r2,r0,#0
	asrs r3,r0,#31
	ands r3,r2
	asrs r2,#31
	ands r0,r2
	orrs r0,r0,r3
	bx lr
	.size P256_abs_int, .-P256_abs_int

// in: *r0 = output, *r1 = point, *r2 = scalar, r3 = include y in result (1/0)
// out: r0 = 1 on success, 0 if invalid point or scalar
	.type P256_pointmult, %function
P256_pointmult:
	.global P256_pointmult
	push {r4-r7,lr}
	//frame push {r4-r7,lr}
	mov r4,r8
	mov r5,r9
	mov r6,r10
	mov r7,r11
	push {r0-r1,r4-r7}
	//frame address sp,44
	//frame save {r8-r11},-36
	sub sp,#256
	//frame address sp,300
	
	lsls r6,r3,#16
	
	// load scalar into an aligned position
	add r0,sp,#32
	mov r1,r2
	bl P256_copy32_unaligned
	
	// fail .if scalar == 0
	mov r0,sp
	bl P256_load_1
	add r0,sp,#32
	mov r1,sp
	bl P256_greater_or_equal_than
	bne 1f
0:
	add sp,#256+8
	//frame address sp,36
	b 10f
	//frame address sp,300
1:
	// fail if not (scalar < n)
	add r0,sp,#32
	adr r1,P256_order
	bl P256_greater_or_equal_than
	subs r0,#1
	beq 0b
	
	// select scalar if scalar is odd and -scalar mod n if scalar is even
	mov r0,sp
	add r1,sp,#32
	ldr r2,[r1]
	movs r3,#1
	ands r2,r3
	eors r2,r3
	add r6,r2 // save original parity of scalar
	adr r3,P256_order
	bl P256_negate_mod_m_if
	
	// stack layout (initially offset 768):
	// 0-767: table of jacobian points P, 3P, 5P, ..., 15P
	// 768-863: current point (in jacobian form)
	// 864-927: scalar rewritten into 4-bit window, each element having an odd signed value
	// 928-1023: extracted selected point from the table
	// 1024-1027: output pointer
	// 1028-1031: input point
	
	// rewrite scalar into 4-bit window where every value is odd
	add r1,sp,#864-768
	ldr r0,[sp]
	lsls r0,#28
	lsrs r0,#28
	movs r2,#1
	mov r4,sp
	movs r5,#1
2:
	lsrs r3,r2,#1
	ldrb r3,[r4,r3]
	lsls r7,r2,#31
	lsrs r7,#29
	lsrs r3,r7
	lsls r3,#28
	lsrs r3,#28
	movs r7,#1
	ands r7,r3
	eors r7,r5
	lsls r7,#4
	subs r0,r7
	strb r0,[r1]
	adds r1,#1
	orrs r3,r5
	mov r0,r3
	adds r2,#1
	cmp r2,#64
	bne 2b
	strb r0,[r1]
	
	// load point into an aligned position
	ldr r1,[sp,#1028-768]
	sub sp,#384
	//frame address sp,684
	sub sp,#384
	//frame address sp,1068
	mov r0,sp
	bl P256_copy32_unaligned
	bl P256_copy32_unaligned
	
	// fail if not x, y < p
	mov r0,sp
	adr r1,P256_p
	bl P256_greater_or_equal_than
	subs r0,#1
	bne 4f
3:
	add sp,#384
	//frame address sp,684
	add sp,#384
	//frame address sp,300
	b 0b
	//frame address sp,1068
4:
	add r0,sp,#32
	adr r1,P256_p
	bl P256_greater_or_equal_than
	subs r0,#1
	beq 3b
	
	// convert basepoint x, y to montgomery form,
	// and place result as first element in table of Jacobian points
	
	mov r0,sp
	mov r1,sp
	bl P256_to_montgomery
	add r0,sp,#32
	add r1,sp,#32
	bl P256_to_montgomery
	
	// check that the basepoint lies on the curve
	mov r0,sp
	bl P256_point_is_on_curve
	cmp r0,#0
	beq 3b
	
	// load montgomery 1 for Z
	add r0,sp,#64
	bl P256_load_1
	mov r1,r0
	bl P256_to_montgomery
	
	// temporarily calculate 2P
	add r0,sp,#7*96
	mov r1,sp
	bl P256_double_j
	
	// calculate rest of the table (3P, 5P, ..., 15P)
	add r4,sp,#96
	movs r5,#7
5:
	mov r0,r4
	add r1,sp,#7*96
	bl P256_copy32
	bl P256_copy32
	bl P256_copy32
	mov r0,r4
	mov r1,r0
	subs r1,#96
	bl P256_add_j
	adds r4,#96
	subs r5,#1
	bne 5b
	
	// select the initial current point based on the first highest 4 scalar bits
	add r7,sp,#928
	subs r7,#1
	ldrb r0,[r7]
	subs r7,#1
	sxtb r0,r0
	bl P256_abs_int
	lsrs r2,r0,#1
	add r0,sp,#768
	mov r1,sp
	bl P256_select
	
	// main loop iterating from index 62 to 0 of the windowed scalar
	add r5,sp,#864
6:
	movs r4,#4
7:
	add r0,sp,#768
	mov r1,r0
	bl P256_double_j
	subs r4,#1
	bne 7b
	
	// select the point to add, and then add to the current point
	ldrb r0,[r7]
	subs r7,#1
	sxtb r0,r0
	lsrs r4,r0,#31
	bl P256_abs_int
	lsrs r2,r0,#1
	add r0,sp,#928
	mov r1,sp
	bl P256_select
	add r0,sp,#960
	mov r1,r0
	mov r2,r4
	adr r3,P256_p
	bl P256_negate_mod_m_if
	cmp r7,r5
	bge 8f
	// see note below
	add r0,sp,#672
	add r1,sp,#768
	bl P256_double_j
8:
	add r0,sp,#768
	add r1,sp,#928
	bl P256_add_j
	cmp r7,r5
	bge 6b
	
	// Note: ONLY for the scalars 2 and -2 mod n, the last addition will
	// be an addition where both input values are equal. The addition algorithm
	// fails for such a case (returns Z=0) and we must therefore use the doubling
	// formula. Both values are computed and then the correct value is selected
	// in constant time based on whether the addition formula returned Z=0.
	// Obviously if the scalar (private key) is properly randomized, this would
	// (with extremely high probability), never occur.
	mov r0,sp
	bl P256_load_1
	add r0,sp,#768+64
	mov r1,sp
	bl P256_greater_or_equal_than
	adds r2,r0,#6
	add r0,sp,#928
	add r1,sp,#96
	bl P256_select
	
	add sp,#464 //928/2
	//frame address sp,604
	add sp,#464
	//frame address sp,140
	
	mov r0,sp
	bl P256_jacobian_to_affine
	
	mov r0,sp
	mov r1,sp
	bl P256_from_montgomery
	add r0,sp,#32
	add r1,sp,#32
	bl P256_from_montgomery
	
	add r0,sp,#32
	add r1,sp,#32
	uxtb r2,r6
	adr r3,P256_p
	bl P256_negate_mod_m_if
	
	ldr r0,[sp,#96]
	mov r1,sp
	bl P256_copy32_unaligned
	lsrs r6,#16
	beq 9f
	bl P256_copy32_unaligned
9:
	
	movs r0,#1
	add sp,#96+8
	//frame address sp,36
10:
	pop {r4-r7}
	//frame address sp,20
	mov r8,r4
	mov r9,r5
	mov r10,r6
	mov r11,r7
	pop {r4-r7,pc}
	.size P256_pointmult, .-P256_pointmult

// in: *r0 = output, *r1 = private key scalar
// out: r0 = 1 on success, 0 if scalar is out of range
	.type P256_ecdh_keygen, %function
P256_ecdh_keygen:
	.global P256_ecdh_keygen
	mov r2,r1
	adr r1,P256_basepoint
	movs r3,#1
	b P256_pointmult
	.size P256_ecdh_keygen, .-P256_ecdh_keygen

// in: *r0 = output, *r1 = other's public point, *r2 = private key scalar
// out: r0 = 1 on success, 0 if invalid public point or private key scalar
	.type P256_ecdh_shared_secret, %function
P256_ecdh_shared_secret:
	.global P256_ecdh_shared_secret
	movs r3,#0
	b P256_pointmult
	.size P256_ecdh_shared_secret, .-P256_ecdh_shared_secret

	.align 2
P256_p:
	.word 0xffffffff
	.word 0xffffffff
	.word 0xffffffff
	.word 0
	.word 0
	.word 0
	.word 1
	.word 0xffffffff

P256_order:
	.word 0xFC632551
	.word 0xF3B9CAC2
	.word 0xA7179E84
	.word 0xBCE6FAAD
	.word 0xFFFFFFFF
	.word 0xFFFFFFFF
	.word 0
	.word 0xFFFFFFFF

P256_basepoint:
	.word 0xD898C296
	.word 0xF4A13945
	.word 0x2DEB33A0
	.word 0x77037D81
	.word 0x63A440F2
	.word 0xF8BCE6E5
	.word 0xE12C4247
	.word 0x6B17D1F2
	.word 0x37BF51F5
	.word 0xCBB64068
	.word 0x6B315ECE
	.word 0x2BCE3357
	.word 0x7C0F9E16
	.word 0x8EE7EB4A
	.word 0xFE1A7F9B
	.word 0x4FE342E2
	
	.end