270 	 * p = -1 mod 2^64, we can compute f = d[0] + a[u]*b[0] mod 2^64.  in f256_montymul()
373 	 * p = -1 mod 2^64, we can compute f = d[0] + a[u]*b[0] mod 2^64.  in f256_montymul()
548 	 * We compute a^(p-2) mod p. The exponent pattern (from high to  in f256_invert()
742 	/* Compute affine coordinates x (in t1) and y (in t2). */  in point_encode()
801 	 * Compute z^2 in t1.  in p256_double()
806 	 * Compute x-z^2 in t2 and x+z^2 in t1.  in p256_double()
812 	 * Compute 3*(x+z^2)*(x-z^2) in t1.  in p256_double()
819 	 * Compute 4*x*y^2 (in t2) and 2*y^2 (in t3).  in p256_double()
827 	 * Compute x' = m^2 - 2*s.  in p256_double()
834 	 * Compute z' = 2*y*z.  in p256_double()
840 	 * Compute y' = m*(s - x') - 8*y^4. Note that we already have  in p256_double()
903 	 * Compute u1 = x1*z2^2 (in t1) and s1 = y1*z2^3 (in t3).  in p256_add()
911 	 * Compute u2 = x2*z1^2 (in t2) and s2 = y2*z1^3 (in t4).  in p256_add()
919 	 * Compute h = h2 - u1 (in t2) and r = s2 - s1 (in t4).  in p256_add()
931 	 * Compute u1*h^2 (in t6) and h^3 (in t5);  in p256_add()
938 	 * Compute x3 = r^2 - h^3 - 2*u1*h^2.  in p256_add()
946 	 * Compute y3 = r*(u1*h^2 - x3) - s1*h^3.  in p256_add()
954 	 * Compute z3 = h*z1*z2.  in p256_add()
1015 	 * Compute u1 = x1 (in t1) and s1 = y1 (in t3).  in p256_add_mixed()
1021 	 * Compute u2 = x2*z1^2 (in t2) and s2 = y2*z1^3 (in t4).  in p256_add_mixed()
1029 	 * Compute h = h2 - u1 (in t2) and r = s2 - s1 (in t4).  in p256_add_mixed()
1041 	 * Compute u1*h^2 (in t6) and h^3 (in t5);  in p256_add_mixed()
1048 	 * Compute x3 = r^2 - h^3 - 2*u1*h^2.  in p256_add_mixed()
1056 	 * Compute y3 = r*(u1*h^2 - x3) - s1*h^3.  in p256_add_mixed()
1064 	 * Compute z3 = h*z1*z2.  in p256_add_mixed()
1113 	 * or all-zero otherwise; then we can compute the double of P2
1138 	 * Compute u1 = x1 (in t1) and s1 = y1 (in t3).
1144 	 * Compute u2 = x2*z1^2 (in t2) and s2 = y2*z1^3 (in t4).
1152 	 * Compute h = h2 - u1 (in t2) and r = s2 - s1 (in t4).
1168 	 * Compute u1*h^2 (in t6) and h^3 (in t5);
1175 	 * Compute x3 = r^2 - h^3 - 2*u1*h^2.
1183 	 * Compute y3 = r*(u1*h^2 - x3) - s1*h^3.
1191 	 * Compute z3 = h*z1.
1200 	 * Compute z' = 2*y2 (in t1).
1205 	 * Compute 2*(y2^2) (in t2) and s = 4*x2*(y2^2) (in t3).
1213 	 * Compute m = 3*(x2^2 - 1) (in t4).
1221 	 * Compute x' = m^2 - 2*s (in t5).
1228 	 * Compute y' = m*(s - x') - 8*y2^4 (in t6).
1355 	 * we compute u = 1/(z1*z2*z3*z4), and then we have:  in window_to_affine()
1480 	 * Compute window, in Jacobian coordinates.  in p256_mul()