/* fe25519.h -- arithmetic mod p = 2^255-19, for Ed25519.
 *
 * Five-limb representation, uniform radix 2^51 (value =
 * sum(limb[i] * 2^(51*i)), limb i in roughly [0, 2^51)) -- the standard
 * Ed25519 reference layout (matches the widely-reviewed "amd64-51"-style
 * implementations), not something invented for this codebase. 51*5=255
 * exactly, so unlike a mismatched limb-count/width choice, the reduction
 * constant is the clean 2^255 mod p = 19 with no extra scaling.
 *
 * Uses __int128 for multiply-accumulate (product of two ~51-bit limbs is
 * up to ~102 bits, summed across up to 5 terms per bucket -- needs a
 * wide type). Confirmed safe in this kernel's freestanding -nostdlib
 * build by direct toolchain testing (gcc/aarch64-linux-gnu-gcc/
 * riscv64-linux-gnu-gcc, matching Makefile.starkernel's exact flags):
 * __int128 multiply, add, and shift-by-constant all compile with zero
 * undefined symbols on all three target architectures. This is DIFFERENT
 * from __int128 DIVISION, which src/starkernel/arch/amd64/timer.c
 * documents as broken (needs libgcc's __udivti3, undefined in this
 * -nostdlib build) -- this file never divides __int128 values, so that
 * restriction doesn't apply here. An earlier draft of this file avoided
 * __int128 entirely (10 limbs, radix 2^26, int64_t only) out of
 * over-caution before this was checked directly; abandoned after running
 * into real bugs from that scheme's own complexity, not from __int128
 * unavailability -- __int128 was never actually the constraint once
 * verified.
 */
#ifndef FE25519_H
#define FE25519_H

#include <stdint.h>

/* int64_t, not uint64_t: fe25519_sub produces negative intermediate
 * limbs (a[i] - b[i] can be < 0 for a specific limb even when the total
 * value a-b, mod p, is what's wanted), and fe25519_carry() relies on
 * arithmetic right shift to propagate negative "borrows" the same way
 * it propagates positive carries -- proven correct by the property-based
 * host test, not just assumed. */
typedef struct { int64_t v[5]; } fe25519;

void fe25519_0(fe25519 *r);
void fe25519_1(fe25519 *r);
void fe25519_copy(fe25519 *r, const fe25519 *a);
void fe25519_add(fe25519 *r, const fe25519 *a, const fe25519 *b);
void fe25519_sub(fe25519 *r, const fe25519 *a, const fe25519 *b);
void fe25519_neg(fe25519 *r, const fe25519 *a);
void fe25519_mul(fe25519 *r, const fe25519 *a, const fe25519 *b);
void fe25519_sq(fe25519 *r, const fe25519 *a);
void fe25519_invert(fe25519 *r, const fe25519 *a);
void fe25519_mul_small(fe25519 *r, const fe25519 *a, uint32_t c);

/* Pack to 32 little-endian bytes (fully reduced mod p) / unpack from same. */
void fe25519_pack(uint8_t out[32], const fe25519 *a);
void fe25519_unpack(fe25519 *r, const uint8_t in[32]);

/* 1 if a == b (as field elements, after full reduction), else 0. */
int fe25519_eq(const fe25519 *a, const fe25519 *b);
/* Parity of the fully-reduced value's low bit (used for point decompression's sign bit). */
int fe25519_parity(const fe25519 *a);

#endif /* FE25519_H */