69 static u64 *ecc_alloc_digits_space(unsigned int ndigits)  in ecc_alloc_digits_space()  argument
71 	size_t len = ndigits * sizeof(u64);  in ecc_alloc_digits_space()
84 static struct ecc_point *ecc_alloc_point(unsigned int ndigits)  in ecc_alloc_point()  argument
91 	p->x = ecc_alloc_digits_space(ndigits);  in ecc_alloc_point()
95 	p->y = ecc_alloc_digits_space(ndigits);  in ecc_alloc_point()
99 	p->ndigits = ndigits;  in ecc_alloc_point()
120 static void vli_clear(u64 *vli, unsigned int ndigits)  in vli_clear()  argument
124 	for (i = 0; i < ndigits; i++)  in vli_clear()
129 bool vli_is_zero(const u64 *vli, unsigned int ndigits)  in vli_is_zero()  argument
133 	for (i = 0; i < ndigits; i++) {  in vli_is_zero()
148 static bool vli_is_negative(const u64 *vli, unsigned int ndigits)  in vli_is_negative()  argument
150 	return vli_test_bit(vli, ndigits * 64 - 1);  in vli_is_negative()
154 static unsigned int vli_num_digits(const u64 *vli, unsigned int ndigits)  in vli_num_digits()  argument
162 	for (i = ndigits - 1; i >= 0 && vli[i] == 0; i--);  in vli_num_digits()
168 static unsigned int vli_num_bits(const u64 *vli, unsigned int ndigits)  in vli_num_bits()  argument
173 	num_digits = vli_num_digits(vli, ndigits);  in vli_num_bits()
185 void vli_from_be64(u64 *dest, const void *src, unsigned int ndigits)  in vli_from_be64()  argument
190 	for (i = 0; i < ndigits; i++)  in vli_from_be64()
191 		dest[i] = get_unaligned_be64(&from[ndigits - 1 - i]);  in vli_from_be64()
195 void vli_from_le64(u64 *dest, const void *src, unsigned int ndigits)  in vli_from_le64()  argument
200 	for (i = 0; i < ndigits; i++)  in vli_from_le64()
206 static void vli_set(u64 *dest, const u64 *src, unsigned int ndigits)  in vli_set()  argument
210 	for (i = 0; i < ndigits; i++)  in vli_set()
215 int vli_cmp(const u64 *left, const u64 *right, unsigned int ndigits)  in vli_cmp()  argument
219 	for (i = ndigits - 1; i >= 0; i--) {  in vli_cmp()
234 		      unsigned int ndigits)  in vli_lshift()  argument
239 	for (i = 0; i < ndigits; i++) {  in vli_lshift()
250 static void vli_rshift1(u64 *vli, unsigned int ndigits)  in vli_rshift1()  argument
255 	vli += ndigits;  in vli_rshift1()
266 		   unsigned int ndigits)  in vli_add()  argument
271 	for (i = 0; i < ndigits; i++) {  in vli_add()
286 		    unsigned int ndigits)  in vli_uadd()  argument
291 	for (i = 0; i < ndigits; i++) {  in vli_uadd()
308 		   unsigned int ndigits)  in vli_sub()  argument
313 	for (i = 0; i < ndigits; i++) {  in vli_sub()
329 	     unsigned int ndigits)  in vli_usub()  argument
334 	for (i = 0; i < ndigits; i++) {  in vli_usub()
389 		     unsigned int ndigits)  in vli_mult()  argument
398 	for (k = 0; k < ndigits * 2 - 1; k++) {  in vli_mult()
401 		if (k < ndigits)  in vli_mult()
404 			min = (k + 1) - ndigits;  in vli_mult()
406 		for (i = min; i <= k && i < ndigits; i++) {  in vli_mult()
421 	result[ndigits * 2 - 1] = r01.m_low;  in vli_mult()
426 		      unsigned int ndigits)  in vli_umult()  argument
431 	for (k = 0; k < ndigits; k++) {  in vli_umult()
442 	for (++k; k < ndigits * 2; k++)  in vli_umult()
446 static void vli_square(u64 *result, const u64 *left, unsigned int ndigits)  in vli_square()  argument
452 	for (k = 0; k < ndigits * 2 - 1; k++) {  in vli_square()
455 		if (k < ndigits)  in vli_square()
458 			min = (k + 1) - ndigits;  in vli_square()
482 	result[ndigits * 2 - 1] = r01.m_low;  in vli_square()
489 			const u64 *mod, unsigned int ndigits)  in vli_mod_add()  argument
493 	carry = vli_add(result, left, right, ndigits);  in vli_mod_add()
498 	if (carry || vli_cmp(result, mod, ndigits) >= 0)  in vli_mod_add()
499 		vli_sub(result, result, mod, ndigits);  in vli_mod_add()
506 			const u64 *mod, unsigned int ndigits)  in vli_mod_sub()  argument
508 	u64 borrow = vli_sub(result, left, right, ndigits);  in vli_mod_sub()
515 		vli_add(result, result, mod, ndigits);  in vli_mod_sub()
528 			      const u64 *mod, unsigned int ndigits)  in vli_mmod_special()  argument
534 	vli_set(r, product, ndigits * 2);  in vli_mmod_special()
535 	while (!vli_is_zero(r + ndigits, ndigits)) {  in vli_mmod_special()
536 		vli_umult(t, r + ndigits, c, ndigits);  in vli_mmod_special()
537 		vli_clear(r + ndigits, ndigits);  in vli_mmod_special()
538 		vli_add(r, r, t, ndigits * 2);  in vli_mmod_special()
540 	vli_set(t, mod, ndigits);  in vli_mmod_special()
541 	vli_clear(t + ndigits, ndigits);  in vli_mmod_special()
542 	while (vli_cmp(r, t, ndigits * 2) >= 0)  in vli_mmod_special()
543 		vli_sub(r, r, t, ndigits * 2);  in vli_mmod_special()
544 	vli_set(result, r, ndigits);  in vli_mmod_special()
562 			       const u64 *mod, unsigned int ndigits)  in vli_mmod_special2()  argument
571 	vli_set(m, mod, ndigits);  in vli_mmod_special2()
572 	vli_clear(m + ndigits, ndigits);  in vli_mmod_special2()
574 	vli_set(r, product, ndigits);  in vli_mmod_special2()
576 	vli_set(q, product + ndigits, ndigits);  in vli_mmod_special2()
577 	vli_clear(r + ndigits, ndigits);  in vli_mmod_special2()
578 	carry = vli_is_negative(r, ndigits);  in vli_mmod_special2()
580 		r[ndigits - 1] &= (1ull << 63) - 1;  in vli_mmod_special2()
581 	for (i = 1; carry || !vli_is_zero(q, ndigits); i++) {  in vli_mmod_special2()
584 		vli_umult(qc, q, c2, ndigits);  in vli_mmod_special2()
586 			vli_uadd(qc, qc, mod[0], ndigits * 2);  in vli_mmod_special2()
587 		vli_set(q, qc + ndigits, ndigits);  in vli_mmod_special2()
588 		vli_clear(qc + ndigits, ndigits);  in vli_mmod_special2()
589 		carry = vli_is_negative(qc, ndigits);  in vli_mmod_special2()
591 			qc[ndigits - 1] &= (1ull << 63) - 1;  in vli_mmod_special2()
593 			vli_sub(r, r, qc, ndigits * 2);  in vli_mmod_special2()
595 			vli_add(r, r, qc, ndigits * 2);  in vli_mmod_special2()
597 	while (vli_is_negative(r, ndigits * 2))  in vli_mmod_special2()
598 		vli_add(r, r, m, ndigits * 2);  in vli_mmod_special2()
599 	while (vli_cmp(r, m, ndigits * 2) >= 0)  in vli_mmod_special2()
600 		vli_sub(r, r, m, ndigits * 2);  in vli_mmod_special2()
602 	vli_set(result, r, ndigits);  in vli_mmod_special2()
611 			  unsigned int ndigits)  in vli_mmod_slow()  argument
619 	int shift = (ndigits * 2 * 64) - vli_num_bits(mod, ndigits);  in vli_mmod_slow()
625 		for (i = 0; i < ndigits; ++i) {  in vli_mmod_slow()
630 		vli_set(mod_m + word_shift, mod, ndigits);  in vli_mmod_slow()
636 		for (j = 0; j < ndigits * 2; ++j) {  in vli_mmod_slow()
644 		vli_rshift1(mod_m, ndigits);  in vli_mmod_slow()
645 		mod_m[ndigits - 1] |= mod_m[ndigits] << (64 - 1);  in vli_mmod_slow()
646 		vli_rshift1(mod_m + ndigits, ndigits);  in vli_mmod_slow()
648 	vli_set(result, v[i], ndigits);  in vli_mmod_slow()
661 			     unsigned int ndigits)  in vli_mmod_barrett()  argument
665 	const u64 *mu = mod + ndigits;  in vli_mmod_barrett()
667 	vli_mult(q, product + ndigits, mu, ndigits);  in vli_mmod_barrett()
668 	if (mu[ndigits])  in vli_mmod_barrett()
669 		vli_add(q + ndigits, q + ndigits, product + ndigits, ndigits);  in vli_mmod_barrett()
670 	vli_mult(r, mod, q + ndigits, ndigits);  in vli_mmod_barrett()
671 	vli_sub(r, product, r, ndigits * 2);  in vli_mmod_barrett()
672 	while (!vli_is_zero(r + ndigits, ndigits) ||  in vli_mmod_barrett()
673 	       vli_cmp(r, mod, ndigits) != -1) {  in vli_mmod_barrett()
676 		carry = vli_sub(r, r, mod, ndigits);  in vli_mmod_barrett()
677 		vli_usub(r + ndigits, r + ndigits, carry, ndigits);  in vli_mmod_barrett()
679 	vli_set(result, r, ndigits);  in vli_mmod_barrett()
689 	const unsigned int ndigits = 3;  in vli_mmod_fast_192()  local
692 	vli_set(result, product, ndigits);  in vli_mmod_fast_192()
694 	vli_set(tmp, &product[3], ndigits);  in vli_mmod_fast_192()
695 	carry = vli_add(result, result, tmp, ndigits);  in vli_mmod_fast_192()
700 	carry += vli_add(result, result, tmp, ndigits);  in vli_mmod_fast_192()
704 	carry += vli_add(result, result, tmp, ndigits);  in vli_mmod_fast_192()
706 	while (carry || vli_cmp(curve_prime, result, ndigits) != 1)  in vli_mmod_fast_192()
707 		carry -= vli_sub(result, result, curve_prime, ndigits);  in vli_mmod_fast_192()
717 	const unsigned int ndigits = 4;  in vli_mmod_fast_256()  local
720 	vli_set(result, product, ndigits);  in vli_mmod_fast_256()
727 	carry = vli_lshift(tmp, tmp, 1, ndigits);  in vli_mmod_fast_256()
728 	carry += vli_add(result, result, tmp, ndigits);  in vli_mmod_fast_256()
734 	carry += vli_lshift(tmp, tmp, 1, ndigits);  in vli_mmod_fast_256()
735 	carry += vli_add(result, result, tmp, ndigits);  in vli_mmod_fast_256()
742 	carry += vli_add(result, result, tmp, ndigits);  in vli_mmod_fast_256()
749 	carry += vli_add(result, result, tmp, ndigits);  in vli_mmod_fast_256()
756 	carry -= vli_sub(result, result, tmp, ndigits);  in vli_mmod_fast_256()
763 	carry -= vli_sub(result, result, tmp, ndigits);  in vli_mmod_fast_256()
770 	carry -= vli_sub(result, result, tmp, ndigits);  in vli_mmod_fast_256()
777 	carry -= vli_sub(result, result, tmp, ndigits);  in vli_mmod_fast_256()
781 			carry += vli_add(result, result, curve_prime, ndigits);  in vli_mmod_fast_256()
784 		while (carry || vli_cmp(curve_prime, result, ndigits) != 1)  in vli_mmod_fast_256()
785 			carry -= vli_sub(result, result, curve_prime, ndigits);  in vli_mmod_fast_256()
800 	const unsigned int ndigits = 6;  in vli_mmod_fast_384()  local
803 	vli_set(result, product, ndigits);  in vli_mmod_fast_384()
812 	carry = vli_lshift(tmp, tmp, 1, ndigits);  in vli_mmod_fast_384()
813 	carry += vli_add(result, result, tmp, ndigits);  in vli_mmod_fast_384()
822 	carry += vli_add(result, result, tmp, ndigits);  in vli_mmod_fast_384()
831 	carry += vli_add(result, result, tmp, ndigits);  in vli_mmod_fast_384()
840 	carry += vli_add(result, result, tmp, ndigits);  in vli_mmod_fast_384()
849 	carry += vli_add(result, result, tmp, ndigits);  in vli_mmod_fast_384()
858 	carry += vli_add(result, result, tmp, ndigits);  in vli_mmod_fast_384()
867 	carry -= vli_sub(result, result, tmp, ndigits);  in vli_mmod_fast_384()
876 	carry -= vli_sub(result, result, tmp, ndigits);  in vli_mmod_fast_384()
885 	carry -= vli_sub(result, result, tmp, ndigits);  in vli_mmod_fast_384()
889 			carry += vli_add(result, result, curve_prime, ndigits);  in vli_mmod_fast_384()
892 		while (carry || vli_cmp(curve_prime, result, ndigits) != 1)  in vli_mmod_fast_384()
893 			carry -= vli_sub(result, result, curve_prime, ndigits);  in vli_mmod_fast_384()
912 	const unsigned int ndigits = curve->g.ndigits;  in vli_mmod_fast()  local
917 		if (curve_prime[ndigits - 1] == -1ull) {  in vli_mmod_fast()
919 					 ndigits);  in vli_mmod_fast()
921 		} else if (curve_prime[ndigits - 1] == 1ull << 63 &&  in vli_mmod_fast()
922 			   curve_prime[ndigits - 2] == 0) {  in vli_mmod_fast()
924 					  ndigits);  in vli_mmod_fast()
927 		vli_mmod_barrett(result, product, curve_prime, ndigits);  in vli_mmod_fast()
931 	switch (ndigits) {  in vli_mmod_fast()
953 		       const u64 *mod, unsigned int ndigits)  in vli_mod_mult_slow()  argument
957 	vli_mult(product, left, right, ndigits);  in vli_mod_mult_slow()
958 	vli_mmod_slow(result, product, mod, ndigits);  in vli_mod_mult_slow()
968 	vli_mult(product, left, right, curve->g.ndigits);  in vli_mod_mult_fast()
978 	vli_square(product, left, curve->g.ndigits);  in vli_mod_square_fast()
988 			unsigned int ndigits)  in vli_mod_inv()  argument
995 	if (vli_is_zero(input, ndigits)) {  in vli_mod_inv()
996 		vli_clear(result, ndigits);  in vli_mod_inv()
1000 	vli_set(a, input, ndigits);  in vli_mod_inv()
1001 	vli_set(b, mod, ndigits);  in vli_mod_inv()
1002 	vli_clear(u, ndigits);  in vli_mod_inv()
1004 	vli_clear(v, ndigits);  in vli_mod_inv()
1006 	while ((cmp_result = vli_cmp(a, b, ndigits)) != 0) {  in vli_mod_inv()
1010 			vli_rshift1(a, ndigits);  in vli_mod_inv()
1013 				carry = vli_add(u, u, mod, ndigits);  in vli_mod_inv()
1015 			vli_rshift1(u, ndigits);  in vli_mod_inv()
1017 				u[ndigits - 1] |= 0x8000000000000000ull;  in vli_mod_inv()
1019 			vli_rshift1(b, ndigits);  in vli_mod_inv()
1022 				carry = vli_add(v, v, mod, ndigits);  in vli_mod_inv()
1024 			vli_rshift1(v, ndigits);  in vli_mod_inv()
1026 				v[ndigits - 1] |= 0x8000000000000000ull;  in vli_mod_inv()
1028 			vli_sub(a, a, b, ndigits);  in vli_mod_inv()
1029 			vli_rshift1(a, ndigits);  in vli_mod_inv()
1031 			if (vli_cmp(u, v, ndigits) < 0)  in vli_mod_inv()
1032 				vli_add(u, u, mod, ndigits);  in vli_mod_inv()
1034 			vli_sub(u, u, v, ndigits);  in vli_mod_inv()
1036 				carry = vli_add(u, u, mod, ndigits);  in vli_mod_inv()
1038 			vli_rshift1(u, ndigits);  in vli_mod_inv()
1040 				u[ndigits - 1] |= 0x8000000000000000ull;  in vli_mod_inv()
1042 			vli_sub(b, b, a, ndigits);  in vli_mod_inv()
1043 			vli_rshift1(b, ndigits);  in vli_mod_inv()
1045 			if (vli_cmp(v, u, ndigits) < 0)  in vli_mod_inv()
1046 				vli_add(v, v, mod, ndigits);  in vli_mod_inv()
1048 			vli_sub(v, v, u, ndigits);  in vli_mod_inv()
1050 				carry = vli_add(v, v, mod, ndigits);  in vli_mod_inv()
1052 			vli_rshift1(v, ndigits);  in vli_mod_inv()
1054 				v[ndigits - 1] |= 0x8000000000000000ull;  in vli_mod_inv()
1058 	vli_set(result, u, ndigits);  in vli_mod_inv()
1067 	return (vli_is_zero(point->x, point->ndigits) &&  in ecc_point_is_zero()
1068 		vli_is_zero(point->y, point->ndigits));  in ecc_point_is_zero()
1083 	const unsigned int ndigits = curve->g.ndigits;  in ecc_point_double_jacobian()  local
1085 	if (vli_is_zero(z1, ndigits))  in ecc_point_double_jacobian()
1100 	vli_mod_add(x1, x1, z1, curve_prime, ndigits);  in ecc_point_double_jacobian()
1102 	vli_mod_add(z1, z1, z1, curve_prime, ndigits);  in ecc_point_double_jacobian()
1104 	vli_mod_sub(z1, x1, z1, curve_prime, ndigits);  in ecc_point_double_jacobian()
1109 	vli_mod_add(z1, x1, x1, curve_prime, ndigits);  in ecc_point_double_jacobian()
1111 	vli_mod_add(x1, x1, z1, curve_prime, ndigits);  in ecc_point_double_jacobian()
1113 		u64 carry = vli_add(x1, x1, curve_prime, ndigits);  in ecc_point_double_jacobian()
1115 		vli_rshift1(x1, ndigits);  in ecc_point_double_jacobian()
1116 		x1[ndigits - 1] |= carry << 63;  in ecc_point_double_jacobian()
1118 		vli_rshift1(x1, ndigits);  in ecc_point_double_jacobian()
1125 	vli_mod_sub(z1, z1, t5, curve_prime, ndigits);  in ecc_point_double_jacobian()
1127 	vli_mod_sub(z1, z1, t5, curve_prime, ndigits);  in ecc_point_double_jacobian()
1129 	vli_mod_sub(t5, t5, z1, curve_prime, ndigits);  in ecc_point_double_jacobian()
1133 	vli_mod_sub(t4, x1, t4, curve_prime, ndigits);  in ecc_point_double_jacobian()
1135 	vli_set(x1, z1, ndigits);  in ecc_point_double_jacobian()
1136 	vli_set(z1, y1, ndigits);  in ecc_point_double_jacobian()
1137 	vli_set(y1, t4, ndigits);  in ecc_point_double_jacobian()
1156 	const unsigned int ndigits = curve->g.ndigits;  in xycz_initial_double()  local
1158 	vli_set(x2, x1, ndigits);  in xycz_initial_double()
1159 	vli_set(y2, y1, ndigits);  in xycz_initial_double()
1161 	vli_clear(z, ndigits);  in xycz_initial_double()
1165 		vli_set(z, p_initial_z, ndigits);  in xycz_initial_double()
1184 	const unsigned int ndigits = curve->g.ndigits;  in xycz_add()  local
1187 	vli_mod_sub(t5, x2, x1, curve_prime, ndigits);  in xycz_add()
1195 	vli_mod_sub(y2, y2, y1, curve_prime, ndigits);  in xycz_add()
1200 	vli_mod_sub(t5, t5, x1, curve_prime, ndigits);  in xycz_add()
1202 	vli_mod_sub(t5, t5, x2, curve_prime, ndigits);  in xycz_add()
1204 	vli_mod_sub(x2, x2, x1, curve_prime, ndigits);  in xycz_add()
1208 	vli_mod_sub(x2, x1, t5, curve_prime, ndigits);  in xycz_add()
1212 	vli_mod_sub(y2, y2, y1, curve_prime, ndigits);  in xycz_add()
1214 	vli_set(x2, t5, ndigits);  in xycz_add()
1229 	const unsigned int ndigits = curve->g.ndigits;  in xycz_add_c()  local
1232 	vli_mod_sub(t5, x2, x1, curve_prime, ndigits);  in xycz_add_c()
1240 	vli_mod_add(t5, y2, y1, curve_prime, ndigits);  in xycz_add_c()
1242 	vli_mod_sub(y2, y2, y1, curve_prime, ndigits);  in xycz_add_c()
1245 	vli_mod_sub(t6, x2, x1, curve_prime, ndigits);  in xycz_add_c()
1249 	vli_mod_add(t6, x1, x2, curve_prime, ndigits);  in xycz_add_c()
1253 	vli_mod_sub(x2, x2, t6, curve_prime, ndigits);  in xycz_add_c()
1256 	vli_mod_sub(t7, x1, x2, curve_prime, ndigits);  in xycz_add_c()
1260 	vli_mod_sub(y2, y2, y1, curve_prime, ndigits);  in xycz_add_c()
1265 	vli_mod_sub(t7, t7, t6, curve_prime, ndigits);  in xycz_add_c()
1267 	vli_mod_sub(t6, t7, x1, curve_prime, ndigits);  in xycz_add_c()
1271 	vli_mod_sub(y1, t6, y1, curve_prime, ndigits);  in xycz_add_c()
1273 	vli_set(x1, t7, ndigits);  in xycz_add_c()
1279 			   unsigned int ndigits)  in ecc_point_mult()  argument
1291 	carry = vli_add(sk[0], scalar, curve->n, ndigits);  in ecc_point_mult()
1292 	vli_add(sk[1], sk[0], curve->n, ndigits);  in ecc_point_mult()
1294 	num_bits = sizeof(u64) * ndigits * 8 + 1;  in ecc_point_mult()
1296 	vli_set(rx[1], point->x, ndigits);  in ecc_point_mult()
1297 	vli_set(ry[1], point->y, ndigits);  in ecc_point_mult()
1312 	vli_mod_sub(z, rx[1], rx[0], curve_prime, ndigits);  in ecc_point_mult()
1319 	vli_mod_inv(z, z, curve_prime, point->ndigits);  in ecc_point_mult()
1331 	vli_set(result->x, rx[0], ndigits);  in ecc_point_mult()
1332 	vli_set(result->y, ry[0], ndigits);  in ecc_point_mult()
1343 	unsigned int ndigits = curve->g.ndigits;  in ecc_point_add()  local
1345 	vli_set(result->x, q->x, ndigits);  in ecc_point_add()
1346 	vli_set(result->y, q->y, ndigits);  in ecc_point_add()
1347 	vli_mod_sub(z, result->x, p->x, curve->p, ndigits);  in ecc_point_add()
1348 	vli_set(px, p->x, ndigits);  in ecc_point_add()
1349 	vli_set(py, p->y, ndigits);  in ecc_point_add()
1351 	vli_mod_inv(z, z, curve->p, ndigits);  in ecc_point_add()
1367 	unsigned int ndigits = curve->g.ndigits;  in ecc_point_mult_shamir()  local
1369 	struct ecc_point sum = ECC_POINT_INIT(sump[0], sump[1], ndigits);  in ecc_point_mult_shamir()
1381 	num_bits = max(vli_num_bits(u1, ndigits), vli_num_bits(u2, ndigits));  in ecc_point_mult_shamir()
1386 	vli_set(rx, point->x, ndigits);  in ecc_point_mult_shamir()
1387 	vli_set(ry, point->y, ndigits);  in ecc_point_mult_shamir()
1388 	vli_clear(z + 1, ndigits - 1);  in ecc_point_mult_shamir()
1400 			vli_set(tx, point->x, ndigits);  in ecc_point_mult_shamir()
1401 			vli_set(ty, point->y, ndigits);  in ecc_point_mult_shamir()
1403 			vli_mod_sub(tz, rx, tx, curve->p, ndigits);  in ecc_point_mult_shamir()
1408 	vli_mod_inv(z, z, curve->p, ndigits);  in ecc_point_mult_shamir()
1414 			      const u64 *private_key, unsigned int ndigits)  in __ecc_is_key_valid()  argument
1422 	if (curve->g.ndigits != ndigits)  in __ecc_is_key_valid()
1426 	if (vli_cmp(one, private_key, ndigits) != -1)  in __ecc_is_key_valid()
1428 	vli_sub(res, curve->n, one, ndigits);  in __ecc_is_key_valid()
1429 	vli_sub(res, res, one, ndigits);  in __ecc_is_key_valid()
1430 	if (vli_cmp(res, private_key, ndigits) != 1)  in __ecc_is_key_valid()
1436 int ecc_is_key_valid(unsigned int curve_id, unsigned int ndigits,  in ecc_is_key_valid()  argument
1442 	nbytes = ndigits << ECC_DIGITS_TO_BYTES_SHIFT;  in ecc_is_key_valid()
1447 	return __ecc_is_key_valid(curve, private_key, ndigits);  in ecc_is_key_valid()
1463 int ecc_gen_privkey(unsigned int curve_id, unsigned int ndigits, u64 *privkey)  in ecc_gen_privkey()  argument
1467 	unsigned int nbytes = ndigits << ECC_DIGITS_TO_BYTES_SHIFT;  in ecc_gen_privkey()
1468 	unsigned int nbits = vli_num_bits(curve->n, ndigits);  in ecc_gen_privkey()
1472 	if (nbits < 160 || ndigits > ARRAY_SIZE(priv))  in ecc_gen_privkey()
1495 	if (__ecc_is_key_valid(curve, priv, ndigits))  in ecc_gen_privkey()
1498 	ecc_swap_digits(priv, privkey, ndigits);  in ecc_gen_privkey()
1504 int ecc_make_pub_key(unsigned int curve_id, unsigned int ndigits,  in ecc_make_pub_key()  argument
1512 	if (!private_key || !curve || ndigits > ARRAY_SIZE(priv)) {  in ecc_make_pub_key()
1517 	ecc_swap_digits(private_key, priv, ndigits);  in ecc_make_pub_key()
1519 	pk = ecc_alloc_point(ndigits);  in ecc_make_pub_key()
1525 	ecc_point_mult(pk, &curve->g, priv, NULL, curve, ndigits);  in ecc_make_pub_key()
1533 	ecc_swap_digits(pk->x, public_key, ndigits);  in ecc_make_pub_key()
1534 	ecc_swap_digits(pk->y, &public_key[ndigits], ndigits);  in ecc_make_pub_key()
1549 	if (WARN_ON(pk->ndigits != curve->g.ndigits))  in ecc_is_pubkey_valid_partial()
1557 	if (vli_cmp(curve->p, pk->x, pk->ndigits) != 1)  in ecc_is_pubkey_valid_partial()
1559 	if (vli_cmp(curve->p, pk->y, pk->ndigits) != 1)  in ecc_is_pubkey_valid_partial()
1567 	vli_mod_add(w, w, curve->b, curve->p, pk->ndigits); /* a·x + b */  in ecc_is_pubkey_valid_partial()
1568 	vli_mod_add(w, w, xxx, curve->p, pk->ndigits); /* x^3 + a·x + b */  in ecc_is_pubkey_valid_partial()
1569 	if (vli_cmp(yy, w, pk->ndigits) != 0) /* Equation */  in ecc_is_pubkey_valid_partial()
1589 	nQ = ecc_alloc_point(pk->ndigits);  in ecc_is_pubkey_valid_full()
1593 	ecc_point_mult(nQ, pk, curve->n, NULL, curve, pk->ndigits);  in ecc_is_pubkey_valid_full()
1603 int crypto_ecdh_shared_secret(unsigned int curve_id, unsigned int ndigits,  in crypto_ecdh_shared_secret()  argument
1615 	    ndigits > ARRAY_SIZE(priv) || ndigits > ARRAY_SIZE(rand_z)) {  in crypto_ecdh_shared_secret()
1620 	nbytes = ndigits << ECC_DIGITS_TO_BYTES_SHIFT;  in crypto_ecdh_shared_secret()
1624 	pk = ecc_alloc_point(ndigits);  in crypto_ecdh_shared_secret()
1630 	ecc_swap_digits(public_key, pk->x, ndigits);  in crypto_ecdh_shared_secret()
1631 	ecc_swap_digits(&public_key[ndigits], pk->y, ndigits);  in crypto_ecdh_shared_secret()
1636 	ecc_swap_digits(private_key, priv, ndigits);  in crypto_ecdh_shared_secret()
1638 	product = ecc_alloc_point(ndigits);  in crypto_ecdh_shared_secret()
1644 	ecc_point_mult(product, pk, priv, rand_z, curve, ndigits);  in crypto_ecdh_shared_secret()
1651 	ecc_swap_digits(product->x, secret, ndigits);  in crypto_ecdh_shared_secret()