// Package watermark implements spread-spectrum audio watermarking for fm-rds-tx.
//
// # Design
//
// The watermark is injected into the audio L/R signal (Fix B) before stereo
// encoding, so it survives FM broadcast and receiver demodulation intact.
// The payload is Reed-Solomon encoded (Fix C) for robust recovery even when
// individual bits have high error rates due to noise and audio masking.
//
// # Parameters
//
//   - PN sequence: 2048-chip LFSR-13 (seed 0x1ACE)
//   - Payload: 8 bytes (SHA-256[:8] of key) → RS(16,8) → 16 bytes → 128 bits
//   - Frame period: ~5.5 s at 228 kHz composite (repeats ~11×/min)
//   - Injection: -48 dBFS on audio L+R before stereo encode (gated on audio level)
//   - Spreading gain: 33 dB. RS erasure corrects up to 8 of 16 byte symbols.
//
// # Recovery (cmd/wmdecode)
//
//  1. Record FM receiver audio output as mono WAV (48 kHz preferred).
//  2. Phase search: slide a single-bit PN template across [0, samplesPerBit)
//     to find chip-aligned sample offset (coarse-fine search).
//  3. Extract 128 bit correlations at found phase, averaged over all frames.
//  4. Frame sync: try all 128 cyclic rotations of the bit sequence,
//     RS-decode each; the rotation that succeeds gives the frame alignment.
//  5. Sort bits by |correlation| (confidence). Mark weakest as erasures.
//  6. RS erasure-decode → 8 payload bytes → compare against known keys.
package watermark

import (
	"crypto/sha256"
)

const (
	// pnChips is the spreading factor — PN chips per data bit at composite rate.
	// Spreading gain = 10·log10(2048) = 33.1 dB.
	pnChips = 2048

	// rsDataBytes is the number of payload bytes before RS encoding.
	rsDataBytes = 8

	// rsCheckBytes is the number of RS parity bytes. With 8 check bytes the
	// code corrects up to 4 errors or up to 8 erasures per 16-byte codeword.
	rsCheckBytes = 8

	// rsTotalBytes is the full RS codeword length.
	rsTotalBytes = rsDataBytes + rsCheckBytes // 16

	// payloadBits is the total number of BPSK bits per watermark frame.
	payloadBits = rsTotalBytes * 8 // 128

	// Level is the audio injection amplitude per channel (-48 dBFS).
	// At typical audio levels this is completely inaudible.
	Level = 0.004

	// CompositeRate is the sample rate at which the watermark was embedded.
	// The recovery tool uses this to compute fractional chip indices.
	CompositeRate = 228000
)

// RecordingRate is the canonical recording rate used for chip-rate Bresenham stepping.
// The embedder advances chips at this rate, so the decoder at this rate sees
// exactly pnChips samples per bit with no fractional-stepping errors.
const RecordingRate = 48000

// Embedder continuously embeds a watermark into audio L/R samples.
// Not thread-safe: call NextSample from the single DSP goroutine only.
type Embedder struct {
	codeword [rsTotalBytes]byte // RS-encoded payload, 16 bytes
	chipIdx  int               // chip position within current bit (0..pnChips-1)
	bitIdx   int               // current bit in codeword (0..127)
	symbol   int8              // BPSK symbol for current bit: +1 or -1
	accum    int               // Bresenham accumulator for chip-rate stepping

	// Audio-level gate: mutes watermark during silence to prevent audibility.
	gateGain      float64 // smooth ramp 0.0 (muted) → 1.0 (open)
	gateThreshold float64 // audio level below which gate closes
	gateRampUp    float64 // per-sample increment when opening (~5ms)
	gateRampDown  float64 // per-sample decrement when closing (~5ms)
	gateEnabled   bool
}

// NewEmbedder creates an Embedder for the given license key.
// The key's SHA-256 hash (first 8 bytes) is RS-encoded and embedded.
// An empty key embeds a null payload (still watermarks, just anonymous).
func NewEmbedder(key string) *Embedder {
	var data [rsDataBytes]byte
	if key != "" {
		h := sha256.Sum256([]byte(key))
		copy(data[:], h[:rsDataBytes])
	}
	e := &Embedder{gateGain: 1.0}
	e.codeword = rsEncode(data)
	e.loadSymbol()
	return e
}

// NextSample returns the watermark amplitude for one composite sample.
// Add this value to both audio.Frame.L and audio.Frame.R before stereo encoding.
//
// The chip index advances using Bresenham stepping at RecordingRate/CompositeRate,
// so each chip occupies exactly CompositeRate/RecordingRate composite samples on
// average. A decoder recording at RecordingRate (48 kHz) sees exactly pnChips
// samples per data bit, enabling simple integer-stride correlation.
func (e *Embedder) NextSample() float64 {
	chip := float64(pnSequence[e.chipIdx])
	sample := Level * float64(e.symbol) * chip * e.gateGain

	// Bresenham: advance chip once per RecordingRate/CompositeRate composite samples.
	e.accum += RecordingRate
	if e.accum >= CompositeRate {
		e.accum -= CompositeRate
		e.chipIdx++
		if e.chipIdx >= pnChips {
			e.chipIdx = 0
			e.bitIdx = (e.bitIdx + 1) % payloadBits
			e.loadSymbol()
		}
	}
	return sample
}

// loadSymbol sets e.symbol from the current bit in the codeword (MSB first).
func (e *Embedder) loadSymbol() {
	byteIdx := e.bitIdx / 8
	bitPos := uint(7 - (e.bitIdx % 8))
	if (e.codeword[byteIdx]>>bitPos)&1 == 0 {
		e.symbol = 1
	} else {
		e.symbol = -1
	}
}

// PayloadHex returns the RS-encoded codeword as hex for logging.
func (e *Embedder) PayloadHex() string {
	const hx = "0123456789abcdef"
	out := make([]byte, rsTotalBytes*2)
	for i, b := range e.codeword {
		out[i*2] = hx[b>>4]
		out[i*2+1] = hx[b&0xf]
	}
	return string(out)
}

// EnableGate activates audio-level gating with asymmetric ramp times.
// threshold is the linear audio amplitude below which the watermark is muted
// (e.g. 0.01 ≈ -40 dBFS). compositeRate is needed to compute ramp speed.
// Attack (open) is fast (5ms) so the watermark starts immediately with audio.
// Release (close) is slow (200ms) to keep the watermark running through normal
// inter-word and inter-phrase gaps — only extended silence mutes.
func (e *Embedder) EnableGate(threshold, compositeRate float64) {
	attackSamples := compositeRate * 0.005  // 5ms open
	releaseSamples := compositeRate * 0.200 // 200ms close
	if attackSamples < 1 {
		attackSamples = 1
	}
	if releaseSamples < 1 {
		releaseSamples = 1
	}
	e.gateThreshold = threshold
	e.gateRampUp = 1.0 / attackSamples
	e.gateRampDown = 1.0 / releaseSamples
	e.gateEnabled = true
}

// SetAudioLevel updates the gate state based on the current audio amplitude.
// Call once per sample before NextSample. absLevel should be the absolute
// mono audio level (pre- or post-pre-emphasis, either works).
func (e *Embedder) SetAudioLevel(absLevel float64) {
	if !e.gateEnabled {
		return
	}
	if absLevel > e.gateThreshold {
		e.gateGain += e.gateRampUp
		if e.gateGain > 1.0 {
			e.gateGain = 1.0
		}
	} else {
		e.gateGain -= e.gateRampDown
		if e.gateGain < 0.0 {
			e.gateGain = 0.0
		}
	}
}

// --- RS(16,8) over GF(2^8) — GF poly 0x11d, fcr=0, generator=2 ---
// These routines are used by the embedder (encode) and the recovery tool (decode).

func gfMul(a, b byte) byte {
	if a == 0 || b == 0 {
		return 0
	}
	return gfExp[(int(gfLog[a])+int(gfLog[b]))%255]
}

func gfInv(a byte) byte {
	if a == 0 {
		return 0
	}
	return gfExp[255-int(gfLog[a])]
}

func gfPow(a byte, n int) byte {
	if a == 0 {
		return 0
	}
	return gfExp[(int(gfLog[a])*n)%255]
}

// rsEncode encodes 8 data bytes into a 16-byte RS codeword.
func rsEncode(data [rsDataBytes]byte) [rsTotalBytes]byte {
	var work [rsTotalBytes]byte
	copy(work[:rsDataBytes], data[:])
	// Polynomial long division by the generator polynomial.
	for i := 0; i < rsDataBytes; i++ {
		fb := work[i]
		if fb != 0 {
			for j := 1; j <= rsCheckBytes; j++ {
				work[i+j] ^= gfMul(rsGen[j], fb)
			}
		}
	}
	var cw [rsTotalBytes]byte
	copy(cw[:rsDataBytes], data[:])
	copy(cw[rsDataBytes:], work[rsDataBytes:])
	return cw
}

// RSDecode recovers 8 data bytes from a (possibly corrupted) 16-byte codeword.
// erasurePositions lists the byte indices (0..15) of symbols with low confidence
// that should be treated as erasures. Up to 8 erasures can be corrected.
// Returns (data, true) on success, (zero, false) on decoding failure.
func RSDecode(recv [rsTotalBytes]byte, erasurePositions []int) ([rsDataBytes]byte, bool) {
	// Step 1: compute syndromes.
	var S [rsCheckBytes]byte
	for i := 0; i < rsCheckBytes; i++ {
		var acc byte
		for _, c := range recv {
			acc = gfMul(acc, gfPow(2, i)) ^ c
		}
		S[i] = acc
	}

	// Step 2: if no erasures and all syndromes zero, no errors.
	hasErr := false
	for _, s := range S {
		if s != 0 {
			hasErr = true
			break
		}
	}
	if !hasErr && len(erasurePositions) == 0 {
		// Valid codeword, no errors, no erasures.
		var out [rsDataBytes]byte
		copy(out[:], recv[:rsDataBytes])
		return out, true
	}
	if hasErr && len(erasurePositions) == 0 {
		// Errors present but no erasure positions supplied — cannot correct.
		// BUG FIX: previously fell through to ne==0 check and returned wrong
		// data as correct. Now correctly signals failure so the caller can
		// retry with erasure positions.
		return [rsDataBytes]byte{}, false
	}

	// Step 3: erasure locator polynomial Γ(x) = ∏(1 - α^(e_j)·x).
	gamma := []byte{1}
	for _, pos := range erasurePositions {
		// multiply gamma by (1 + α^pos · x)
		alpha := gfPow(2, pos)
		next := make([]byte, len(gamma)+1)
		for j, g := range gamma {
			next[j] ^= g
			next[j+1] ^= gfMul(g, alpha)
		}
		gamma = next
	}

	// Step 4: modified syndrome T(x) = S(x)·Γ(x).
	t := make([]byte, rsCheckBytes)
	for i := 0; i < rsCheckBytes; i++ {
		var acc byte
		for j := 0; j < len(gamma) && j <= i; j++ {
			if i-j < rsCheckBytes {
				acc ^= gfMul(gamma[j], S[i-j])
			}
		}
		t[i] = acc
	}

	// Step 5: compute error magnitudes using Forney's formula.
	// For erasure-only decoding (no additional errors), the error locator
	// is Γ itself. Evaluate omega = T mod x^(ne) where ne = len(erasures).
	ne := len(erasurePositions)
	if ne == 0 {
		// Should not be reachable: handled above. Fail safely.
		return [rsDataBytes]byte{}, false
	}
	if ne > rsCheckBytes {
		return [rsDataBytes]byte{}, false
	}

	result := recv
	for _, pos := range erasurePositions {
		xi := gfPow(2, pos)
		// Evaluate omega at xi^-1.
		xiInv := gfInv(xi)
		var omega byte
		for j := 0; j < ne && j < rsCheckBytes; j++ {
			omega ^= gfMul(t[j], gfPow(xiInv, j))
		}
		// Formal derivative of gamma at xi^-1 (only odd-degree terms survive in GF(2)).
		var gammaPrime byte
		for j := 1; j < len(gamma); j += 2 {
			gammaPrime ^= gfMul(gamma[j], gfPow(xiInv, j-1))
		}
		if gammaPrime == 0 {
			return [rsDataBytes]byte{}, false
		}
		magnitude := gfMul(omega, gfInv(gammaPrime))
		result[pos] ^= magnitude
	}

	// Verify syndromes after correction.
	for i := 0; i < rsCheckBytes; i++ {
		var acc byte
		for _, c := range result {
			acc = gfMul(acc, gfPow(2, i)) ^ c
		}
		if acc != 0 {
			return [rsDataBytes]byte{}, false
		}
	}

	var out [rsDataBytes]byte
	copy(out[:], result[:rsDataBytes])
	return out, true
}

// KeyMatchesPayload returns true if SHA-256(key)[:8] matches payload.
func KeyMatchesPayload(key string, payload [rsDataBytes]byte) bool {
	h := sha256.Sum256([]byte(key))
	var expected [rsDataBytes]byte
	copy(expected[:], h[:rsDataBytes])
	return expected == payload
}

// Constants exported for the recovery tool.
const (
	PnChips       = pnChips
	PayloadBits   = payloadBits
	RsDataBytes   = rsDataBytes
	RsTotalBytes  = rsTotalBytes
	RsCheckBytes  = rsCheckBytes
)

// CorrelateAt returns the correlation of received samples at the given bit
// position. recRate is the WAV sample rate.
//
// At recRate = RecordingRate (48000 Hz) the chip stride is exactly 1 — the
// embedder was designed for this rate. At other rates the chip index is
// scaled proportionally (still works with enough frame averaging).
func CorrelateAt(samples []float64, bitStart int, recRate float64) float64 {
	// Samples per bit at the canonical recording rate.
	// At RecordingRate: samplesPerBit = pnChips (integer, perfect).
	// At other rates: scale proportionally.
	samplesPerBit := int(float64(pnChips) * recRate / float64(RecordingRate))
	if samplesPerBit < 1 {
		samplesPerBit = 1
	}
	n := samplesPerBit
	if bitStart+n > len(samples) {
		n = len(samples) - bitStart
	}
	var acc float64
	for i := 0; i < n; i++ {
		// Map recording-rate sample index to chip index.
		chipIdx := int(float64(i)*float64(RecordingRate)/recRate) % pnChips
		acc += samples[bitStart+i] * float64(pnSequence[chipIdx])
	}
	return acc
}


// pnSequence is the 2048-chip LFSR-13 spreading code (seed 0x1ACE).
var pnSequence = [pnChips]int8{
		 1, -1, -1, -1,  1,  1, -1, -1,  1, -1,  1, -1, -1,  1, -1, -1,
		-1, -1, -1,  1, -1,  1,  1, -1,  1,  1, -1,  1,  1,  1, -1,  1,
		-1, -1,  1,  1,  1,  1,  1, -1, -1,  1,  1,  1,  1, -1,  1, -1,
		 1, -1,  1, -1, -1, -1, -1, -1, -1, -1,  1,  1,  1,  1, -1, -1,
		-1,  1, -1, -1, -1,  1, -1,  1, -1,  1, -1, -1, -1,  1,  1,  1,
		-1,  1, -1, -1,  1, -1,  1,  1,  1, -1, -1,  1,  1,  1,  1, -1,
		 1, -1, -1,  1,  1, -1,  1,  1, -1, -1,  1,  1,  1,  1, -1,  1,
		-1,  1,  1, -1, -1, -1,  1,  1, -1, -1,  1, -1,  1,  1, -1, -1,
		-1,  1, -1,  1, -1, -1, -1, -1,  1,  1, -1,  1,  1,  1,  1, -1,
		-1, -1,  1, -1, -1,  1,  1,  1,  1,  1,  1,  1, -1,  1,  1, -1,
		 1,  1, -1, -1,  1,  1, -1, -1,  1, -1,  1, -1, -1,  1,  1,  1,
		-1, -1,  1, -1, -1,  1, -1,  1,  1,  1,  1,  1,  1, -1,  1, -1,
		-1, -1, -1,  1,  1, -1, -1,  1,  1, -1,  1, -1, -1, -1,  1, -1,
		 1, -1, -1, -1, -1, -1,  1,  1,  1, -1,  1, -1, -1,  1, -1, -1,
		-1,  1, -1,  1, -1,  1,  1, -1,  1,  1, -1,  1,  1,  1,  1, -1,
		-1, -1, -1, -1,  1,  1, -1,  1, -1,  1, -1,  1,  1,  1, -1,  1,
		 1, -1, -1, -1, -1,  1,  1,  1,  1,  1,  1, -1, -1,  1, -1, -1,
		-1,  1,  1, -1, -1,  1,  1, -1,  1,  1, -1,  1,  1,  1,  1,  1,
		-1,  1, -1,  1,  1, -1, -1, -1, -1, -1, -1, -1, -1,  1,  1,  1,
		 1,  1, -1,  1,  1,  1, -1,  1,  1,  1,  1,  1,  1,  1,  1, -1,
		-1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1, -1,  1, -1,  1,
		-1,  1, -1,  1, -1,  1, -1,  1, -1, -1,  1, -1,  1,  1, -1,  1,
		-1, -1,  1, -1,  1,  1,  1,  1, -1, -1,  1, -1,  1,  1,  1,  1,
		-1, -1,  1,  1, -1,  1,  1, -1,  1, -1,  1, -1,  1,  1,  1,  1,
		 1, -1, -1,  1, -1,  1,  1, -1,  1, -1,  1, -1,  1, -1, -1, -1,
		-1,  1,  1, -1,  1, -1, -1,  1, -1,  1,  1,  1, -1,  1, -1,  1,
		 1, -1,  1,  1, -1,  1, -1,  1, -1, -1,  1, -1,  1, -1, -1,  1,
		 1,  1,  1, -1, -1, -1,  1,  1,  1,  1, -1,  1, -1,  1, -1,  1,
		 1,  1, -1, -1,  1,  1, -1,  1, -1, -1,  1, -1,  1, -1,  1,  1,
		 1,  1,  1, -1, -1, -1,  1,  1,  1,  1, -1, -1,  1,  1, -1, -1,
		-1,  1, -1,  1, -1,  1, -1, -1, -1, -1, -1,  1, -1, -1,  1, -1,
		 1,  1, -1,  1,  1,  1, -1,  1, -1, -1, -1, -1,  1,  1, -1,  1,
		-1,  1, -1, -1,  1, -1, -1, -1,  1,  1, -1,  1, -1, -1,  1, -1,
		-1,  1, -1, -1, -1, -1, -1,  1,  1,  1, -1, -1, -1,  1,  1,  1,
		-1,  1,  1,  1,  1,  1,  1, -1,  1,  1, -1, -1,  1, -1,  1, -1,
		 1, -1,  1, -1, -1,  1,  1,  1, -1, -1, -1, -1,  1,  1,  1,  1,
		-1,  1, -1,  1, -1, -1, -1,  1, -1,  1, -1,  1, -1, -1,  1, -1,
		 1,  1,  1, -1, -1, -1, -1,  1,  1,  1, -1, -1, -1, -1, -1, -1,
		 1, -1, -1, -1, -1, -1, -1,  1, -1, -1, -1,  1, -1,  1,  1,  1,
		-1,  1,  1,  1,  1, -1,  1,  1, -1,  1, -1,  1, -1, -1,  1,  1,
		-1, -1, -1, -1, -1,  1,  1,  1,  1, -1,  1, -1,  1,  1,  1, -1,
		 1,  1, -1, -1,  1,  1,  1,  1, -1, -1,  1,  1,  1,  1,  1, -1,
		 1, -1,  1, -1,  1,  1,  1,  1,  1,  1,  1,  1, -1, -1, -1, -1,
		 1,  1, -1, -1,  1,  1, -1, -1,  1, -1, -1, -1,  1,  1, -1,  1,
		 1, -1, -1, -1,  1,  1,  1, -1,  1, -1,  1,  1, -1, -1, -1,  1,
		-1,  1, -1,  1,  1, -1,  1, -1,  1,  1,  1, -1, -1, -1, -1,  1,
		 1, -1,  1, -1, -1,  1,  1, -1,  1,  1,  1, -1, -1,  1, -1,  1,
		 1,  1,  1,  1, -1, -1,  1,  1,  1, -1, -1, -1, -1, -1, -1, -1,
		-1,  1, -1,  1, -1,  1,  1,  1, -1,  1,  1,  1, -1,  1, -1, -1,
		 1, -1,  1, -1,  1,  1, -1, -1,  1, -1,  1,  1,  1,  1, -1, -1,
		-1, -1, -1,  1, -1,  1,  1, -1, -1,  1,  1,  1, -1,  1,  1,  1,
		 1, -1, -1,  1, -1, -1,  1,  1, -1,  1, -1,  1, -1,  1,  1,  1,
		 1, -1,  1, -1,  1,  1, -1,  1, -1, -1,  1,  1, -1, -1, -1, -1,
		 1,  1, -1,  1, -1, -1, -1, -1, -1,  1, -1, -1, -1, -1, -1,  1,
		 1,  1, -1,  1,  1,  1,  1, -1,  1,  1,  1, -1, -1,  1,  1,  1,
		 1,  1,  1,  1, -1, -1,  1,  1,  1, -1, -1,  1,  1, -1, -1,  1,
		 1,  1, -1, -1,  1,  1,  1, -1, -1,  1, -1, -1,  1,  1, -1,  1,
		 1, -1, -1,  1, -1, -1,  1, -1, -1,  1,  1,  1,  1,  1, -1,  1,
		-1, -1, -1, -1,  1, -1,  1, -1,  1, -1,  1,  1, -1,  1,  1,  1,
		-1, -1, -1, -1,  1,  1,  1,  1,  1, -1, -1,  1,  1,  1, -1,  1,
		 1, -1, -1,  1,  1, -1,  1,  1, -1, -1,  1, -1,  1, -1, -1, -1,
		-1, -1,  1,  1, -1,  1,  1, -1,  1, -1, -1, -1,  1, -1, -1,  1,
		 1,  1,  1,  1, -1, -1, -1,  1, -1,  1,  1,  1,  1,  1,  1,  1,
		 1, -1,  1,  1, -1,  1, -1,  1, -1,  1, -1,  1, -1,  1,  1, -1,
		-1, -1, -1,  1,  1,  1,  1, -1, -1, -1, -1, -1,  1, -1, -1, -1,
		-1, -1, -1, -1,  1, -1, -1, -1,  1,  1,  1, -1,  1,  1,  1, -1,
		 1, -1, -1, -1,  1,  1, -1, -1, -1, -1, -1, -1,  1,  1,  1, -1,
		 1, -1,  1,  1,  1, -1,  1,  1,  1,  1,  1,  1, -1, -1, -1, -1,
		-1, -1,  1,  1, -1, -1,  1,  1, -1,  1,  1,  1, -1,  1,  1, -1,
		-1, -1,  1,  1, -1,  1, -1,  1, -1, -1,  1,  1,  1, -1,  1, -1,
		 1,  1, -1,  1, -1, -1, -1, -1, -1, -1,  1,  1,  1,  1,  1, -1,
		-1, -1,  1, -1, -1, -1,  1,  1, -1, -1,  1,  1,  1, -1,  1, -1,
		-1, -1,  1,  1, -1,  1,  1, -1, -1,  1, -1,  1,  1,  1, -1, -1,
		 1, -1,  1, -1, -1, -1, -1,  1,  1, -1, -1, -1,  1,  1,  1,  1,
		-1,  1,  1,  1,  1,  1, -1,  1,  1, -1, -1,  1,  1,  1,  1,  1,
		 1,  1,  1, -1, -1,  1, -1, -1,  1,  1, -1, -1,  1,  1, -1, -1,
		-1,  1,  1,  1, -1, -1,  1, -1, -1,  1,  1,  1, -1,  1, -1,  1,
		-1, -1, -1, -1,  1, -1,  1, -1,  1,  1, -1,  1, -1, -1, -1,  1,
		-1,  1,  1, -1,  1, -1,  1,  1, -1,  1,  1,  1,  1, -1, -1,  1,
		-1,  1,  1, -1, -1, -1, -1, -1, -1, -1,  1, -1,  1,  1, -1, -1,
		-1,  1, -1, -1, -1,  1, -1,  1,  1, -1, -1, -1,  1, -1,  1,  1,
		 1, -1, -1, -1, -1, -1,  1, -1, -1,  1, -1,  1, -1,  1,  1,  1,
		-1,  1,  1, -1,  1,  1, -1,  1, -1, -1,  1,  1, -1,  1, -1,  1,
		 1, -1, -1, -1, -1,  1, -1,  1, -1, -1,  1, -1,  1, -1, -1, -1,
		 1, -1,  1,  1, -1,  1,  1, -1,  1, -1, -1, -1,  1,  1,  1,  1,
		 1, -1, -1,  1, -1,  1,  1,  1, -1, -1,  1,  1, -1, -1, -1,  1,
		 1,  1,  1,  1,  1, -1,  1, -1,  1,  1,  1, -1, -1,  1,  1, -1,
		-1,  1, -1,  1,  1, -1, -1,  1, -1, -1,  1,  1,  1, -1, -1, -1,
		-1, -1,  1, -1,  1,  1,  1,  1,  1,  1, -1,  1,  1,  1, -1, -1,
		-1, -1, -1, -1, -1, -1, -1,  1,  1, -1, -1, -1,  1, -1, -1, -1,
		 1, -1, -1, -1, -1, -1,  1, -1, -1,  1, -1, -1, -1, -1,  1, -1,
		-1, -1,  1,  1,  1, -1, -1, -1,  1, -1, -1,  1, -1, -1, -1, -1,
		-1, -1,  1, -1, -1,  1, -1, -1,  1, -1, -1, -1,  1, -1, -1,  1,
		-1, -1,  1, -1, -1,  1, -1, -1, -1, -1,  1, -1,  1,  1,  1,  1,
		-1,  1, -1, -1, -1,  1, -1,  1,  1, -1, -1,  1,  1,  1,  1, -1,
		 1,  1, -1,  1, -1,  1,  1,  1,  1,  1,  1,  1, -1, -1,  1, -1,
		 1,  1, -1, -1,  1,  1, -1, -1,  1, -1, -1,  1, -1,  1, -1, -1,
		-1, -1, -1,  1, -1,  1,  1,  1,  1, -1, -1, -1,  1, -1, -1, -1,
		-1,  1,  1, -1, -1,  1, -1, -1, -1, -1,  1, -1, -1, -1, -1, -1,
		 1, -1,  1,  1,  1, -1,  1, -1, -1, -1,  1, -1, -1,  1, -1,  1,
		-1,  1,  1, -1,  1,  1,  1,  1, -1,  1, -1, -1,  1, -1,  1, -1,
		-1,  1,  1, -1, -1, -1, -1,  1, -1,  1,  1, -1,  1,  1, -1, -1,
		-1,  1, -1, -1,  1, -1,  1, -1, -1,  1,  1,  1, -1,  1, -1, -1,
		-1, -1,  1,  1,  1, -1, -1,  1,  1,  1,  1, -1,  1,  1,  1,  1,
		 1,  1, -1,  1, -1,  1, -1,  1,  1, -1, -1,  1,  1, -1, -1, -1,
		-1,  1,  1,  1,  1,  1, -1,  1, -1,  1,  1,  1, -1,  1, -1,  1,
		-1,  1, -1, -1,  1, -1,  1, -1,  1,  1, -1,  1, -1, -1,  1, -1,
		-1,  1, -1,  1,  1, -1, -1, -1, -1,  1, -1,  1,  1,  1,  1, -1,
		-1,  1, -1, -1, -1,  1,  1,  1,  1,  1,  1,  1, -1,  1, -1, -1,
		-1,  1,  1, -1, -1,  1,  1, -1, -1, -1, -1,  1, -1, -1,  1,  1,
		 1, -1, -1,  1, -1, -1, -1,  1,  1,  1, -1, -1,  1,  1,  1, -1,
		-1, -1,  1, -1,  1, -1,  1,  1,  1,  1,  1,  1, -1,  1,  1, -1,
		 1, -1, -1,  1,  1, -1, -1,  1,  1,  1,  1,  1, -1, -1, -1,  1,
		 1, -1,  1,  1, -1, -1,  1,  1, -1,  1,  1,  1,  1,  1, -1, -1,
		 1, -1, -1,  1,  1,  1,  1,  1,  1,  1,  1, -1,  1, -1, -1, -1,
		-1, -1, -1, -1, -1, -1, -1, -1,  1,  1,  1, -1,  1,  1,  1, -1,
		 1,  1,  1, -1,  1, -1,  1, -1, -1,  1,  1, -1,  1, -1,  1, -1,
		-1,  1, -1,  1,  1,  1,  1,  1, -1, -1, -1, -1,  1, -1,  1,  1,
		-1, -1,  1,  1, -1,  1,  1,  1, -1, -1, -1, -1, -1,  1, -1,  1,
		-1, -1,  1,  1, -1,  1,  1,  1, -1,  1, -1, -1,  1, -1, -1,  1,
		 1,  1,  1,  1,  1, -1, -1, -1,  1,  1,  1, -1, -1,  1,  1, -1,
		-1,  1, -1, -1, -1, -1, -1, -1,  1, -1,  1, -1, -1, -1, -1,  1,
		-1, -1, -1,  1, -1,  1,  1, -1,  1,  1,  1, -1, -1, -1,  1, -1,
		 1,  1, -1, -1, -1, -1, -1, -1,  1, -1, -1,  1, -1,  1, -1, -1,
		-1,  1, -1, -1, -1, -1,  1, -1,  1,  1, -1,  1,  1,  1,  1, -1,
		 1,  1,  1,  1, -1, -1,  1, -1,  1, -1,  1, -1, -1,  1,  1, -1,
		-1, -1,  1,  1,  1,  1, -1, -1, -1,  1,  1, -1,  1,  1,  1,  1,
		 1,  1,  1, -1,  1,  1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
}

// GF(2^8) tables with primitive polynomial 0x11d.
var gfExp = [512]byte{1, 2, 4, 8, 16, 32, 64, 128, 29, 58, 116, 232, 205, 135, 19, 38, 76, 152, 45, 90, 180, 117, 234, 201, 143, 3, 6, 12, 24, 48, 96, 192, 157, 39, 78, 156, 37, 74, 148, 53, 106, 212, 181, 119, 238, 193, 159, 35, 70, 140, 5, 10, 20, 40, 80, 160, 93, 186, 105, 210, 185, 111, 222, 161, 95, 190, 97, 194, 153, 47, 94, 188, 101, 202, 137, 15, 30, 60, 120, 240, 253, 231, 211, 187, 107, 214, 177, 127, 254, 225, 223, 163, 91, 182, 113, 226, 217, 175, 67, 134, 17, 34, 68, 136, 13, 26, 52, 104, 208, 189, 103, 206, 129, 31, 62, 124, 248, 237, 199, 147, 59, 118, 236, 197, 151, 51, 102, 204, 133, 23, 46, 92, 184, 109, 218, 169, 79, 158, 33, 66, 132, 21, 42, 84, 168, 77, 154, 41, 82, 164, 85, 170, 73, 146, 57, 114, 228, 213, 183, 115, 230, 209, 191, 99, 198, 145, 63, 126, 252, 229, 215, 179, 123, 246, 241, 255, 227, 219, 171, 75, 150, 49, 98, 196, 149, 55, 110, 220, 165, 87, 174, 65, 130, 25, 50, 100, 200, 141, 7, 14, 28, 56, 112, 224, 221, 167, 83, 166, 81, 162, 89, 178, 121, 242, 249, 239, 195, 155, 43, 86, 172, 69, 138, 9, 18, 36, 72, 144, 61, 122, 244, 245, 247, 243, 251, 235, 203, 139, 11, 22, 44, 88, 176, 125, 250, 233, 207, 131, 27, 54, 108, 216, 173, 71, 142, 1, 2, 4, 8, 16, 32, 64, 128, 29, 58, 116, 232, 205, 135, 19, 38, 76, 152, 45, 90, 180, 117, 234, 201, 143, 3, 6, 12, 24, 48, 96, 192, 157, 39, 78, 156, 37, 74, 148, 53, 106, 212, 181, 119, 238, 193, 159, 35, 70, 140, 5, 10, 20, 40, 80, 160, 93, 186, 105, 210, 185, 111, 222, 161, 95, 190, 97, 194, 153, 47, 94, 188, 101, 202, 137, 15, 30, 60, 120, 240, 253, 231, 211, 187, 107, 214, 177, 127, 254, 225, 223, 163, 91, 182, 113, 226, 217, 175, 67, 134, 17, 34, 68, 136, 13, 26, 52, 104, 208, 189, 103, 206, 129, 31, 62, 124, 248, 237, 199, 147, 59, 118, 236, 197, 151, 51, 102, 204, 133, 23, 46, 92, 184, 109, 218, 169, 79, 158, 33, 66, 132, 21, 42, 84, 168, 77, 154, 41, 82, 164, 85, 170, 73, 146, 57, 114, 228, 213, 183, 115, 230, 209, 191, 99, 198, 145, 63, 126, 252, 229, 215, 179, 123, 246, 241, 255, 227, 219, 171, 75, 150, 49, 98, 196, 149, 55, 110, 220, 165, 87, 174, 65, 130, 25, 50, 100, 200, 141, 7, 14, 28, 56, 112, 224, 221, 167, 83, 166, 81, 162, 89, 178, 121, 242, 249, 239, 195, 155, 43, 86, 172, 69, 138, 9, 18, 36, 72, 144, 61, 122, 244, 245, 247, 243, 251, 235, 203, 139, 11, 22, 44, 88, 176, 125, 250, 233, 207, 131, 27, 54, 108, 216, 173, 71, 142, 1, 2}
var gfLog = [256]byte{0, 0, 1, 25, 2, 50, 26, 198, 3, 223, 51, 238, 27, 104, 199, 75, 4, 100, 224, 14, 52, 141, 239, 129, 28, 193, 105, 248, 200, 8, 76, 113, 5, 138, 101, 47, 225, 36, 15, 33, 53, 147, 142, 218, 240, 18, 130, 69, 29, 181, 194, 125, 106, 39, 249, 185, 201, 154, 9, 120, 77, 228, 114, 166, 6, 191, 139, 98, 102, 221, 48, 253, 226, 152, 37, 179, 16, 145, 34, 136, 54, 208, 148, 206, 143, 150, 219, 189, 241, 210, 19, 92, 131, 56, 70, 64, 30, 66, 182, 163, 195, 72, 126, 110, 107, 58, 40, 84, 250, 133, 186, 61, 202, 94, 155, 159, 10, 21, 121, 43, 78, 212, 229, 172, 115, 243, 167, 87, 7, 112, 192, 247, 140, 128, 99, 13, 103, 74, 222, 237, 49, 197, 254, 24, 227, 165, 153, 119, 38, 184, 180, 124, 17, 68, 146, 217, 35, 32, 137, 46, 55, 63, 209, 91, 149, 188, 207, 205, 144, 135, 151, 178, 220, 252, 190, 97, 242, 86, 211, 171, 20, 42, 93, 158, 132, 60, 57, 83, 71, 109, 65, 162, 31, 45, 67, 216, 183, 123, 164, 118, 196, 23, 73, 236, 127, 12, 111, 246, 108, 161, 59, 82, 41, 157, 85, 170, 251, 96, 134, 177, 187, 204, 62, 90, 203, 89, 95, 176, 156, 169, 160, 81, 11, 245, 22, 235, 122, 117, 44, 215, 79, 174, 213, 233, 230, 231, 173, 232, 116, 214, 244, 234, 168, 80, 88, 175}
var rsGen = [9]byte{1, 255, 11, 81, 54, 239, 173, 200, 24}


// rsGen is the RS(16,8) generator polynomial coefficients (fcr=0).