// Package watermark implements spread-spectrum audio watermarking for fm-rds-tx.
//
// # Design
//
// The watermark is injected into the audio L/R signal after all audio
// processing (LPF, clip, limiter) but before stereo encoding, so it
// survives FM broadcast, receiver demodulation, de-emphasis, and moderate
// EQ intact. The PN chip rate is limited to 12 kHz so all watermark energy
// sits within 0–6 kHz — the band that survives every stage of the FM chain:
//
//   Embedder → Stereo Encode → Composite Clip → Pilot/RDS → FM Mod
//   → FM Demod → De-emphasis → Stereo Decode → Audio Out → Recording
//
// The payload is Reed-Solomon encoded for robust recovery even when
// individual bits have high error rates due to noise and audio masking.
//
// # Parameters
//
//   - PN sequence: 2048-chip LFSR-13 (seed 0x1ACE)
//   - Payload: 8 bytes (SHA-256[:8] of key) → RS(16,8) → 16 bytes → 128 bits
//   - Chip clock: 12 kHz → PN bandwidth 0–6 kHz (survives de-emphasis)
//   - Frame period: ~21.8 s at 228 kHz composite (repeats ~2.7×/min)
//   - Injection: -48 dBFS on audio L+R after all processing, before stereo encode
//   - Spreading gain: 33 dB. RS erasure corrects up to 8 of 16 byte symbols.
//
// # Recovery (cmd/wmdecode)
//
//  1. Record FM receiver audio output as mono WAV (any sample rate ≥ 12 kHz).
//  2. Phase search: energy-based coarse/fine search for chip alignment.
//  3. Extract 128 bit correlations at found phase, averaged over all frames.
//  4. Frame sync: try all 128 cyclic rotations of the bit sequence,
//     RS-decode each; the rotation that succeeds gives the frame alignment.
//  5. Byte-level erasure + soft-decision bit-flipping for error correction.
//  6. RS erasure-decode → 8 payload bytes → compare against known keys.
package watermark

import (
	"crypto/sha256"
)

const (
	// pnChips is the spreading factor — PN chips per data bit.
	// Spreading gain = 10·log10(2048) = 33.1 dB.
	pnChips = 2048

	// rsDataBytes is the number of payload bytes before RS encoding.
	rsDataBytes = 8

	// rsCheckBytes is the number of RS parity bytes. With 8 check bytes the
	// code corrects up to 4 errors or up to 8 erasures per 16-byte codeword.
	rsCheckBytes = 8

	// rsTotalBytes is the full RS codeword length.
	rsTotalBytes = rsDataBytes + rsCheckBytes // 16

	// payloadBits is the total number of BPSK bits per watermark frame.
	payloadBits = rsTotalBytes * 8 // 128

	// Level is the audio injection amplitude per channel (-48 dBFS).
	// At typical audio levels this is completely inaudible.
	Level = 0.040

	// CompositeRate is the sample rate at which the watermark is embedded.
	CompositeRate = 228000
)

// ChipRate is the effective PN chip clock rate (Hz). Determines the spectral
// bandwidth of the watermark: Nyquist = ChipRate/2 = 6 kHz. This ensures
// all PN energy is within the audio band that survives de-emphasis (50/75 µs),
// receiver LPFs, audio codecs, speaker EQ, and even acoustic recording.
//
// At CompositeRate (228 kHz), each chip spans 228000/12000 = 19 samples.
// At any recording rate R, each chip spans R/12000 samples.
const ChipRate = 12000

// RecordingRate is the canonical recording rate for test WAV output (wmtest).
// Not used for chip stepping — ChipRate controls that.
const RecordingRate = 48000

// Embedder continuously embeds a watermark into audio L/R samples.
// Not thread-safe: call NextSample from the single DSP goroutine only.
type Embedder struct {
	codeword [rsTotalBytes]byte // RS-encoded payload, 16 bytes
	chipIdx  int               // chip position within current bit (0..pnChips-1)
	bitIdx   int               // current bit in codeword (0..127)
	symbol   int8              // BPSK symbol for current bit: +1 or -1
	accum    int               // Bresenham accumulator for chip-rate stepping

	// Audio-level gate: mutes watermark during silence to prevent audibility.
	gateGain      float64 // smooth ramp 0.0 (muted) → 1.0 (open)
	gateThreshold float64 // audio level below which gate closes
	gateRampUp    float64 // per-sample increment when opening (~5ms)
	gateRampDown  float64 // per-sample decrement when closing (~5ms)
	gateEnabled   bool
}

// NewEmbedder creates an Embedder for the given license key.
// The key's SHA-256 hash (first 8 bytes) is RS-encoded and embedded.
// An empty key embeds a null payload (still watermarks, just anonymous).
func NewEmbedder(key string) *Embedder {
	var data [rsDataBytes]byte
	if key != "" {
		h := sha256.Sum256([]byte(key))
		copy(data[:], h[:rsDataBytes])
	}
	e := &Embedder{gateGain: 1.0}
	e.codeword = rsEncode(data)
	e.loadSymbol()
	return e
}

// NextSample returns the watermark amplitude for one composite sample.
// Add this value to both audio.Frame.L and audio.Frame.R before stereo encoding.
//
// The chip index advances using Bresenham stepping at ChipRate/CompositeRate,
// so each chip occupies exactly CompositeRate/ChipRate composite samples on
// average (~19 samples at 228 kHz). The PN signal bandwidth is 0–6 kHz.
func (e *Embedder) NextSample() float64 {
	chip := float64(pnSequence[e.chipIdx])
	sample := Level * float64(e.symbol) * chip * e.gateGain

	// Bresenham: advance chip once per ChipRate/CompositeRate composite samples.
	e.accum += ChipRate
	if e.accum >= CompositeRate {
		e.accum -= CompositeRate
		e.chipIdx++
		if e.chipIdx >= pnChips {
			e.chipIdx = 0
			e.bitIdx = (e.bitIdx + 1) % payloadBits
			e.loadSymbol()
		}
	}
	return sample
}

// loadSymbol sets e.symbol from the current bit in the codeword (MSB first).
func (e *Embedder) loadSymbol() {
	byteIdx := e.bitIdx / 8
	bitPos := uint(7 - (e.bitIdx % 8))
	if (e.codeword[byteIdx]>>bitPos)&1 == 0 {
		e.symbol = 1
	} else {
		e.symbol = -1
	}
}

// PayloadHex returns the RS-encoded codeword as hex for logging.
func (e *Embedder) PayloadHex() string {
	const hx = "0123456789abcdef"
	out := make([]byte, rsTotalBytes*2)
	for i, b := range e.codeword {
		out[i*2] = hx[b>>4]
		out[i*2+1] = hx[b&0xf]
	}
	return string(out)
}

// EnableGate activates audio-level gating with asymmetric ramp times.
// threshold is the linear audio amplitude below which the watermark is muted
// (e.g. 0.01 ≈ -40 dBFS). compositeRate is needed to compute ramp speed.
// Attack (open) is fast (5ms) so the watermark starts immediately with audio.
// Release (close) is slow (200ms) to keep the watermark running through normal
// inter-word and inter-phrase gaps — only extended silence mutes.
func (e *Embedder) EnableGate(threshold, compositeRate float64) {
	attackSamples := compositeRate * 0.005  // 5ms open
	releaseSamples := compositeRate * 0.200 // 200ms close
	if attackSamples < 1 {
		attackSamples = 1
	}
	if releaseSamples < 1 {
		releaseSamples = 1
	}
	e.gateThreshold = threshold
	e.gateRampUp = 1.0 / attackSamples
	e.gateRampDown = 1.0 / releaseSamples
	e.gateEnabled = true
}

// SetAudioLevel updates the gate state based on the current audio amplitude.
// Call once per sample before NextSample. absLevel should be the absolute
// mono audio level (pre- or post-pre-emphasis, either works).
func (e *Embedder) SetAudioLevel(absLevel float64) {
	if !e.gateEnabled {
		return
	}
	if absLevel > e.gateThreshold {
		e.gateGain += e.gateRampUp
		if e.gateGain > 1.0 {
			e.gateGain = 1.0
		}
	} else {
		e.gateGain -= e.gateRampDown
		if e.gateGain < 0.0 {
			e.gateGain = 0.0
		}
	}
}

// DiagnosticState returns internal state for debugging.
type DiagnosticInfo struct {
	GateGain    float64
	GateEnabled bool
	ChipIdx     int
	BitIdx      int
	Symbol      int8
}

// DiagnosticState returns a snapshot of the embedder's internal state.
func (e *Embedder) DiagnosticState() DiagnosticInfo {
	return DiagnosticInfo{
		GateGain:    e.gateGain,
		GateEnabled: e.gateEnabled,
		ChipIdx:     e.chipIdx,
		BitIdx:      e.bitIdx,
		Symbol:      e.symbol,
	}
}

// --- RS(16,8) over GF(2^8) — GF poly 0x11d, fcr=0, generator=2 ---
// These routines are used by the embedder (encode) and the recovery tool (decode).

func gfMul(a, b byte) byte {
	if a == 0 || b == 0 {
		return 0
	}
	return gfExp[(int(gfLog[a])+int(gfLog[b]))%255]
}

func gfInv(a byte) byte {
	if a == 0 {
		return 0
	}
	return gfExp[255-int(gfLog[a])]
}

func gfPow(a byte, n int) byte {
	if a == 0 {
		return 0
	}
	return gfExp[(int(gfLog[a])*n)%255]
}

// rsEncode encodes 8 data bytes into a 16-byte RS codeword.
func rsEncode(data [rsDataBytes]byte) [rsTotalBytes]byte {
	var work [rsTotalBytes]byte
	copy(work[:rsDataBytes], data[:])
	// Polynomial long division by the generator polynomial.
	for i := 0; i < rsDataBytes; i++ {
		fb := work[i]
		if fb != 0 {
			for j := 1; j <= rsCheckBytes; j++ {
				work[i+j] ^= gfMul(rsGen[j], fb)
			}
		}
	}
	var cw [rsTotalBytes]byte
	copy(cw[:rsDataBytes], data[:])
	copy(cw[rsDataBytes:], work[rsDataBytes:])
	return cw
}

// RSDecode recovers 8 data bytes from a (possibly corrupted) 16-byte codeword.
// erasurePositions lists the byte indices (0..15) of symbols with low confidence
// that should be treated as erasures. Up to 8 erasures can be corrected.
// Returns (data, true) on success, (zero, false) on decoding failure.
func RSDecode(recv [rsTotalBytes]byte, erasurePositions []int) ([rsDataBytes]byte, bool) {
	// Step 1: compute syndromes S[i] = C(α^i) via Horner's method.
	// The polynomial convention is C(x) = c[0]x^15 + c[1]x^14 + … + c[15],
	// so byte position j contributes c[j]·(α^i)^(15-j) to S[i].
	var S [rsCheckBytes]byte
	for i := 0; i < rsCheckBytes; i++ {
		var acc byte
		for _, c := range recv {
			acc = gfMul(acc, gfPow(2, i)) ^ c
		}
		S[i] = acc
	}

	// Step 2: all syndromes zero → valid codeword.
	hasErr := false
	for _, s := range S {
		if s != 0 {
			hasErr = true
			break
		}
	}
	if !hasErr {
		var out [rsDataBytes]byte
		copy(out[:], recv[:rsDataBytes])
		return out, true
	}
	ne := len(erasurePositions)
	if ne == 0 || ne > rsCheckBytes {
		return [rsDataBytes]byte{}, false
	}

	// Step 3: Solve for error magnitudes via Vandermonde system.
	//
	// Because C(x) = c[0]x^15 + … + c[15], byte position j maps to
	// polynomial power (15-j). The "locator" for position j is
	// X_j = α^(15-j). The syndrome equation becomes:
	//
	//   S[i] = Σ_k  e_k · X_k^i
	//
	// This is a linear system (Vandermonde) in the unknowns e_k.
	// Solve by Gaussian elimination in GF(2^8).

	// Build locators
	X := make([]byte, ne)
	for k, pos := range erasurePositions {
		X[k] = gfPow(2, rsTotalBytes-1-pos)
	}

	// Augmented matrix [V | S], ne × (ne+1)
	mat := make([][]byte, ne)
	for i := range mat {
		mat[i] = make([]byte, ne+1)
		for k := 0; k < ne; k++ {
			mat[i][k] = gfPow(X[k], i)
		}
		mat[i][ne] = S[i]
	}

	// Gaussian elimination with partial pivoting
	for col := 0; col < ne; col++ {
		pivot := -1
		for row := col; row < ne; row++ {
			if mat[row][col] != 0 {
				pivot = row
				break
			}
		}
		if pivot < 0 {
			return [rsDataBytes]byte{}, false // singular
		}
		mat[col], mat[pivot] = mat[pivot], mat[col]
		inv := gfInv(mat[col][col])
		for j := 0; j <= ne; j++ {
			mat[col][j] = gfMul(mat[col][j], inv)
		}
		for row := 0; row < ne; row++ {
			if row == col {
				continue
			}
			f := mat[row][col]
			if f == 0 {
				continue
			}
			for j := 0; j <= ne; j++ {
				mat[row][j] ^= gfMul(f, mat[col][j])
			}
		}
	}

	// Apply corrections
	result := recv
	for k := 0; k < ne; k++ {
		result[erasurePositions[k]] ^= mat[k][ne]
	}

	// Verify syndromes after correction
	for i := 0; i < rsCheckBytes; i++ {
		var acc byte
		for _, c := range result {
			acc = gfMul(acc, gfPow(2, i)) ^ c
		}
		if acc != 0 {
			return [rsDataBytes]byte{}, false
		}
	}

	var out [rsDataBytes]byte
	copy(out[:], result[:rsDataBytes])
	return out, true
}

// KeyMatchesPayload returns true if SHA-256(key)[:8] matches payload.
func KeyMatchesPayload(key string, payload [rsDataBytes]byte) bool {
	h := sha256.Sum256([]byte(key))
	var expected [rsDataBytes]byte
	copy(expected[:], h[:rsDataBytes])
	return expected == payload
}

// KeyToPayload returns SHA-256(key)[:8].
func KeyToPayload(key string) [rsDataBytes]byte {
	var data [rsDataBytes]byte
	h := sha256.Sum256([]byte(key))
	copy(data[:], h[:rsDataBytes])
	return data
}

// RSEncode encodes 8 data bytes into a 16-byte RS codeword.
func RSEncode(data [rsDataBytes]byte) [rsTotalBytes]byte {
	return rsEncode(data)
}

// Constants exported for the recovery tool.
const (
	PnChips       = pnChips
	PayloadBits   = payloadBits
	RsDataBytes   = rsDataBytes
	RsTotalBytes  = rsTotalBytes
	RsCheckBytes  = rsCheckBytes
)

// PnSequenceAt returns the PN chip value (+1.0 or -1.0) at the given index.
// Used by the decoder for rate-compensated correlation.
func PnSequenceAt(chipIdx int) float64 {
	return float64(pnSequence[chipIdx%pnChips])
}

// PNSequence exposes the raw PN chip values for the chip-rate decoder.
var PNSequence = &pnSequence

// CorrelateAt returns the correlation of received samples at the given bit
// position. recRate is the WAV sample rate.
//
// At any recording rate, chips are mapped via ChipRate: each chip spans
// recRate/ChipRate samples. At 48 kHz: 4 samples/chip, 8192 samples/bit.
// At 192 kHz: 16 samples/chip, 32768 samples/bit.
func CorrelateAt(samples []float64, bitStart int, recRate float64) float64 {
	samplesPerBit := int(float64(pnChips) * recRate / float64(ChipRate))
	if samplesPerBit < 1 {
		samplesPerBit = 1
	}
	n := samplesPerBit
	if bitStart+n > len(samples) {
		n = len(samples) - bitStart
	}
	var acc float64
	for i := 0; i < n; i++ {
		chipIdx := int(float64(i)*float64(ChipRate)/recRate) % pnChips
		acc += samples[bitStart+i] * float64(pnSequence[chipIdx])
	}
	return acc
}


// pnSequence is the 2048-chip LFSR-13 spreading code (seed 0x1ACE).
var pnSequence = [pnChips]int8{
		 1, -1, -1, -1,  1,  1, -1, -1,  1, -1,  1, -1, -1,  1, -1, -1,
		-1, -1, -1,  1, -1,  1,  1, -1,  1,  1, -1,  1,  1,  1, -1,  1,
		-1, -1,  1,  1,  1,  1,  1, -1, -1,  1,  1,  1,  1, -1,  1, -1,
		 1, -1,  1, -1, -1, -1, -1, -1, -1, -1,  1,  1,  1,  1, -1, -1,
		-1,  1, -1, -1, -1,  1, -1,  1, -1,  1, -1, -1, -1,  1,  1,  1,
		-1,  1, -1, -1,  1, -1,  1,  1,  1, -1, -1,  1,  1,  1,  1, -1,
		 1, -1, -1,  1,  1, -1,  1,  1, -1, -1,  1,  1,  1,  1, -1,  1,
		-1,  1,  1, -1, -1, -1,  1,  1, -1, -1,  1, -1,  1,  1, -1, -1,
		-1,  1, -1,  1, -1, -1, -1, -1,  1,  1, -1,  1,  1,  1,  1, -1,
		-1, -1,  1, -1, -1,  1,  1,  1,  1,  1,  1,  1, -1,  1,  1, -1,
		 1,  1, -1, -1,  1,  1, -1, -1,  1, -1,  1, -1, -1,  1,  1,  1,
		-1, -1,  1, -1, -1,  1, -1,  1,  1,  1,  1,  1,  1, -1,  1, -1,
		-1, -1, -1,  1,  1, -1, -1,  1,  1, -1,  1, -1, -1, -1,  1, -1,
		 1, -1, -1, -1, -1, -1,  1,  1,  1, -1,  1, -1, -1,  1, -1, -1,
		-1,  1, -1,  1, -1,  1,  1, -1,  1,  1, -1,  1,  1,  1,  1, -1,
		-1, -1, -1, -1,  1,  1, -1,  1, -1,  1, -1,  1,  1,  1, -1,  1,
		 1, -1, -1, -1, -1,  1,  1,  1,  1,  1,  1, -1, -1,  1, -1, -1,
		-1,  1,  1, -1, -1,  1,  1, -1,  1,  1, -1,  1,  1,  1,  1,  1,
		-1,  1, -1,  1,  1, -1, -1, -1, -1, -1, -1, -1, -1,  1,  1,  1,
		 1,  1, -1,  1,  1,  1, -1,  1,  1,  1,  1,  1,  1,  1,  1, -1,
		-1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1, -1,  1, -1,  1,
		-1,  1, -1,  1, -1,  1, -1,  1, -1, -1,  1, -1,  1,  1, -1,  1,
		-1, -1,  1, -1,  1,  1,  1,  1, -1, -1,  1, -1,  1,  1,  1,  1,
		-1, -1,  1,  1, -1,  1,  1, -1,  1, -1,  1, -1,  1,  1,  1,  1,
		 1, -1, -1,  1, -1,  1,  1, -1,  1, -1,  1, -1,  1, -1, -1, -1,
		-1,  1,  1, -1,  1, -1, -1,  1, -1,  1,  1,  1, -1,  1, -1,  1,
		 1, -1,  1,  1, -1,  1, -1,  1, -1, -1,  1, -1,  1, -1, -1,  1,
		 1,  1,  1, -1, -1, -1,  1,  1,  1,  1, -1,  1, -1,  1, -1,  1,
		 1,  1, -1, -1,  1,  1, -1,  1, -1, -1,  1, -1,  1, -1,  1,  1,
		 1,  1,  1, -1, -1, -1,  1,  1,  1,  1, -1, -1,  1,  1, -1, -1,
		-1,  1, -1,  1, -1,  1, -1, -1, -1, -1, -1,  1, -1, -1,  1, -1,
		 1,  1, -1,  1,  1,  1, -1,  1, -1, -1, -1, -1,  1,  1, -1,  1,
		-1,  1, -1, -1,  1, -1, -1, -1,  1,  1, -1,  1, -1, -1,  1, -1,
		-1,  1, -1, -1, -1, -1, -1,  1,  1,  1, -1, -1, -1,  1,  1,  1,
		-1,  1,  1,  1,  1,  1,  1, -1,  1,  1, -1, -1,  1, -1,  1, -1,
		 1, -1,  1, -1, -1,  1,  1,  1, -1, -1, -1, -1,  1,  1,  1,  1,
		-1,  1, -1,  1, -1, -1, -1,  1, -1,  1, -1,  1, -1, -1,  1, -1,
		 1,  1,  1, -1, -1, -1, -1,  1,  1,  1, -1, -1, -1, -1, -1, -1,
		 1, -1, -1, -1, -1, -1, -1,  1, -1, -1, -1,  1, -1,  1,  1,  1,
		-1,  1,  1,  1,  1, -1,  1,  1, -1,  1, -1,  1, -1, -1,  1,  1,
		-1, -1, -1, -1, -1,  1,  1,  1,  1, -1,  1, -1,  1,  1,  1, -1,
		 1,  1, -1, -1,  1,  1,  1,  1, -1, -1,  1,  1,  1,  1,  1, -1,
		 1, -1,  1, -1,  1,  1,  1,  1,  1,  1,  1,  1, -1, -1, -1, -1,
		 1,  1, -1, -1,  1,  1, -1, -1,  1, -1, -1, -1,  1,  1, -1,  1,
		 1, -1, -1, -1,  1,  1,  1, -1,  1, -1,  1,  1, -1, -1, -1,  1,
		-1,  1, -1,  1,  1, -1,  1, -1,  1,  1,  1, -1, -1, -1, -1,  1,
		 1, -1,  1, -1, -1,  1,  1, -1,  1,  1,  1, -1, -1,  1, -1,  1,
		 1,  1,  1,  1, -1, -1,  1,  1,  1, -1, -1, -1, -1, -1, -1, -1,
		-1,  1, -1,  1, -1,  1,  1,  1, -1,  1,  1,  1, -1,  1, -1, -1,
		 1, -1,  1, -1,  1,  1, -1, -1,  1, -1,  1,  1,  1,  1, -1, -1,
		-1, -1, -1,  1, -1,  1,  1, -1, -1,  1,  1,  1, -1,  1,  1,  1,
		 1, -1, -1,  1, -1, -1,  1,  1, -1,  1, -1,  1, -1,  1,  1,  1,
		 1, -1,  1, -1,  1,  1, -1,  1, -1, -1,  1,  1, -1, -1, -1, -1,
		 1,  1, -1,  1, -1, -1, -1, -1, -1,  1, -1, -1, -1, -1, -1,  1,
		 1,  1, -1,  1,  1,  1,  1, -1,  1,  1,  1, -1, -1,  1,  1,  1,
		 1,  1,  1,  1, -1, -1,  1,  1,  1, -1, -1,  1,  1, -1, -1,  1,
		 1,  1, -1, -1,  1,  1,  1, -1, -1,  1, -1, -1,  1,  1, -1,  1,
		 1, -1, -1,  1, -1, -1,  1, -1, -1,  1,  1,  1,  1,  1, -1,  1,
		-1, -1, -1, -1,  1, -1,  1, -1,  1, -1,  1,  1, -1,  1,  1,  1,
		-1, -1, -1, -1,  1,  1,  1,  1,  1, -1, -1,  1,  1,  1, -1,  1,
		 1, -1, -1,  1,  1, -1,  1,  1, -1, -1,  1, -1,  1, -1, -1, -1,
		-1, -1,  1,  1, -1,  1,  1, -1,  1, -1, -1, -1,  1, -1, -1,  1,
		 1,  1,  1,  1, -1, -1, -1,  1, -1,  1,  1,  1,  1,  1,  1,  1,
		 1, -1,  1,  1, -1,  1, -1,  1, -1,  1, -1,  1, -1,  1,  1, -1,
		-1, -1, -1,  1,  1,  1,  1, -1, -1, -1, -1, -1,  1, -1, -1, -1,
		-1, -1, -1, -1,  1, -1, -1, -1,  1,  1,  1, -1,  1,  1,  1, -1,
		 1, -1, -1, -1,  1,  1, -1, -1, -1, -1, -1, -1,  1,  1,  1, -1,
		 1, -1,  1,  1,  1, -1,  1,  1,  1,  1,  1,  1, -1, -1, -1, -1,
		-1, -1,  1,  1, -1, -1,  1,  1, -1,  1,  1,  1, -1,  1,  1, -1,
		-1, -1,  1,  1, -1,  1, -1,  1, -1, -1,  1,  1,  1, -1,  1, -1,
		 1,  1, -1,  1, -1, -1, -1, -1, -1, -1,  1,  1,  1,  1,  1, -1,
		-1, -1,  1, -1, -1, -1,  1,  1, -1, -1,  1,  1,  1, -1,  1, -1,
		-1, -1,  1,  1, -1,  1,  1, -1, -1,  1, -1,  1,  1,  1, -1, -1,
		 1, -1,  1, -1, -1, -1, -1,  1,  1, -1, -1, -1,  1,  1,  1,  1,
		-1,  1,  1,  1,  1,  1, -1,  1,  1, -1, -1,  1,  1,  1,  1,  1,
		 1,  1,  1, -1, -1,  1, -1, -1,  1,  1, -1, -1,  1,  1, -1, -1,
		-1,  1,  1,  1, -1, -1,  1, -1, -1,  1,  1,  1, -1,  1, -1,  1,
		-1, -1, -1, -1,  1, -1,  1, -1,  1,  1, -1,  1, -1, -1, -1,  1,
		-1,  1,  1, -1,  1, -1,  1,  1, -1,  1,  1,  1,  1, -1, -1,  1,
		-1,  1,  1, -1, -1, -1, -1, -1, -1, -1,  1, -1,  1,  1, -1, -1,
		-1,  1, -1, -1, -1,  1, -1,  1,  1, -1, -1, -1,  1, -1,  1,  1,
		 1, -1, -1, -1, -1, -1,  1, -1, -1,  1, -1,  1, -1,  1,  1,  1,
		-1,  1,  1, -1,  1,  1, -1,  1, -1, -1,  1,  1, -1,  1, -1,  1,
		 1, -1, -1, -1, -1,  1, -1,  1, -1, -1,  1, -1,  1, -1, -1, -1,
		 1, -1,  1,  1, -1,  1,  1, -1,  1, -1, -1, -1,  1,  1,  1,  1,
		 1, -1, -1,  1, -1,  1,  1,  1, -1, -1,  1,  1, -1, -1, -1,  1,
		 1,  1,  1,  1,  1, -1,  1, -1,  1,  1,  1, -1, -1,  1,  1, -1,
		-1,  1, -1,  1,  1, -1, -1,  1, -1, -1,  1,  1,  1, -1, -1, -1,
		-1, -1,  1, -1,  1,  1,  1,  1,  1,  1, -1,  1,  1,  1, -1, -1,
		-1, -1, -1, -1, -1, -1, -1,  1,  1, -1, -1, -1,  1, -1, -1, -1,
		 1, -1, -1, -1, -1, -1,  1, -1, -1,  1, -1, -1, -1, -1,  1, -1,
		-1, -1,  1,  1,  1, -1, -1, -1,  1, -1, -1,  1, -1, -1, -1, -1,
		-1, -1,  1, -1, -1,  1, -1, -1,  1, -1, -1, -1,  1, -1, -1,  1,
		-1, -1,  1, -1, -1,  1, -1, -1, -1, -1,  1, -1,  1,  1,  1,  1,
		-1,  1, -1, -1, -1,  1, -1,  1,  1, -1, -1,  1,  1,  1,  1, -1,
		 1,  1, -1,  1, -1,  1,  1,  1,  1,  1,  1,  1, -1, -1,  1, -1,
		 1,  1, -1, -1,  1,  1, -1, -1,  1, -1, -1,  1, -1,  1, -1, -1,
		-1, -1, -1,  1, -1,  1,  1,  1,  1, -1, -1, -1,  1, -1, -1, -1,
		-1,  1,  1, -1, -1,  1, -1, -1, -1, -1,  1, -1, -1, -1, -1, -1,
		 1, -1,  1,  1,  1, -1,  1, -1, -1, -1,  1, -1, -1,  1, -1,  1,
		-1,  1,  1, -1,  1,  1,  1,  1, -1,  1, -1, -1,  1, -1,  1, -1,
		-1,  1,  1, -1, -1, -1, -1,  1, -1,  1,  1, -1,  1,  1, -1, -1,
		-1,  1, -1, -1,  1, -1,  1, -1, -1,  1,  1,  1, -1,  1, -1, -1,
		-1, -1,  1,  1,  1, -1, -1,  1,  1,  1,  1, -1,  1,  1,  1,  1,
		 1,  1, -1,  1, -1,  1, -1,  1,  1, -1, -1,  1,  1, -1, -1, -1,
		-1,  1,  1,  1,  1,  1, -1,  1, -1,  1,  1,  1, -1,  1, -1,  1,
		-1,  1, -1, -1,  1, -1,  1, -1,  1,  1, -1,  1, -1, -1,  1, -1,
		-1,  1, -1,  1,  1, -1, -1, -1, -1,  1, -1,  1,  1,  1,  1, -1,
		-1,  1, -1, -1, -1,  1,  1,  1,  1,  1,  1,  1, -1,  1, -1, -1,
		-1,  1,  1, -1, -1,  1,  1, -1, -1, -1, -1,  1, -1, -1,  1,  1,
		 1, -1, -1,  1, -1, -1, -1,  1,  1,  1, -1, -1,  1,  1,  1, -1,
		-1, -1,  1, -1,  1, -1,  1,  1,  1,  1,  1,  1, -1,  1,  1, -1,
		 1, -1, -1,  1,  1, -1, -1,  1,  1,  1,  1,  1, -1, -1, -1,  1,
		 1, -1,  1,  1, -1, -1,  1,  1, -1,  1,  1,  1,  1,  1, -1, -1,
		 1, -1, -1,  1,  1,  1,  1,  1,  1,  1,  1, -1,  1, -1, -1, -1,
		-1, -1, -1, -1, -1, -1, -1, -1,  1,  1,  1, -1,  1,  1,  1, -1,
		 1,  1,  1, -1,  1, -1,  1, -1, -1,  1,  1, -1,  1, -1,  1, -1,
		-1,  1, -1,  1,  1,  1,  1,  1, -1, -1, -1, -1,  1, -1,  1,  1,
		-1, -1,  1,  1, -1,  1,  1,  1, -1, -1, -1, -1, -1,  1, -1,  1,
		-1, -1,  1,  1, -1,  1,  1,  1, -1,  1, -1, -1,  1, -1, -1,  1,
		 1,  1,  1,  1,  1, -1, -1, -1,  1,  1,  1, -1, -1,  1,  1, -1,
		-1,  1, -1, -1, -1, -1, -1, -1,  1, -1,  1, -1, -1, -1, -1,  1,
		-1, -1, -1,  1, -1,  1,  1, -1,  1,  1,  1, -1, -1, -1,  1, -1,
		 1,  1, -1, -1, -1, -1, -1, -1,  1, -1, -1,  1, -1,  1, -1, -1,
		-1,  1, -1, -1, -1, -1,  1, -1,  1,  1, -1,  1,  1,  1,  1, -1,
		 1,  1,  1,  1, -1, -1,  1, -1,  1, -1,  1, -1, -1,  1,  1, -1,
		-1, -1,  1,  1,  1,  1, -1, -1, -1,  1,  1, -1,  1,  1,  1,  1,
		 1,  1,  1, -1,  1,  1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
}

// GF(2^8) tables with primitive polynomial 0x11d.
var gfExp = [512]byte{1, 2, 4, 8, 16, 32, 64, 128, 29, 58, 116, 232, 205, 135, 19, 38, 76, 152, 45, 90, 180, 117, 234, 201, 143, 3, 6, 12, 24, 48, 96, 192, 157, 39, 78, 156, 37, 74, 148, 53, 106, 212, 181, 119, 238, 193, 159, 35, 70, 140, 5, 10, 20, 40, 80, 160, 93, 186, 105, 210, 185, 111, 222, 161, 95, 190, 97, 194, 153, 47, 94, 188, 101, 202, 137, 15, 30, 60, 120, 240, 253, 231, 211, 187, 107, 214, 177, 127, 254, 225, 223, 163, 91, 182, 113, 226, 217, 175, 67, 134, 17, 34, 68, 136, 13, 26, 52, 104, 208, 189, 103, 206, 129, 31, 62, 124, 248, 237, 199, 147, 59, 118, 236, 197, 151, 51, 102, 204, 133, 23, 46, 92, 184, 109, 218, 169, 79, 158, 33, 66, 132, 21, 42, 84, 168, 77, 154, 41, 82, 164, 85, 170, 73, 146, 57, 114, 228, 213, 183, 115, 230, 209, 191, 99, 198, 145, 63, 126, 252, 229, 215, 179, 123, 246, 241, 255, 227, 219, 171, 75, 150, 49, 98, 196, 149, 55, 110, 220, 165, 87, 174, 65, 130, 25, 50, 100, 200, 141, 7, 14, 28, 56, 112, 224, 221, 167, 83, 166, 81, 162, 89, 178, 121, 242, 249, 239, 195, 155, 43, 86, 172, 69, 138, 9, 18, 36, 72, 144, 61, 122, 244, 245, 247, 243, 251, 235, 203, 139, 11, 22, 44, 88, 176, 125, 250, 233, 207, 131, 27, 54, 108, 216, 173, 71, 142, 1, 2, 4, 8, 16, 32, 64, 128, 29, 58, 116, 232, 205, 135, 19, 38, 76, 152, 45, 90, 180, 117, 234, 201, 143, 3, 6, 12, 24, 48, 96, 192, 157, 39, 78, 156, 37, 74, 148, 53, 106, 212, 181, 119, 238, 193, 159, 35, 70, 140, 5, 10, 20, 40, 80, 160, 93, 186, 105, 210, 185, 111, 222, 161, 95, 190, 97, 194, 153, 47, 94, 188, 101, 202, 137, 15, 30, 60, 120, 240, 253, 231, 211, 187, 107, 214, 177, 127, 254, 225, 223, 163, 91, 182, 113, 226, 217, 175, 67, 134, 17, 34, 68, 136, 13, 26, 52, 104, 208, 189, 103, 206, 129, 31, 62, 124, 248, 237, 199, 147, 59, 118, 236, 197, 151, 51, 102, 204, 133, 23, 46, 92, 184, 109, 218, 169, 79, 158, 33, 66, 132, 21, 42, 84, 168, 77, 154, 41, 82, 164, 85, 170, 73, 146, 57, 114, 228, 213, 183, 115, 230, 209, 191, 99, 198, 145, 63, 126, 252, 229, 215, 179, 123, 246, 241, 255, 227, 219, 171, 75, 150, 49, 98, 196, 149, 55, 110, 220, 165, 87, 174, 65, 130, 25, 50, 100, 200, 141, 7, 14, 28, 56, 112, 224, 221, 167, 83, 166, 81, 162, 89, 178, 121, 242, 249, 239, 195, 155, 43, 86, 172, 69, 138, 9, 18, 36, 72, 144, 61, 122, 244, 245, 247, 243, 251, 235, 203, 139, 11, 22, 44, 88, 176, 125, 250, 233, 207, 131, 27, 54, 108, 216, 173, 71, 142, 1, 2}
var gfLog = [256]byte{0, 0, 1, 25, 2, 50, 26, 198, 3, 223, 51, 238, 27, 104, 199, 75, 4, 100, 224, 14, 52, 141, 239, 129, 28, 193, 105, 248, 200, 8, 76, 113, 5, 138, 101, 47, 225, 36, 15, 33, 53, 147, 142, 218, 240, 18, 130, 69, 29, 181, 194, 125, 106, 39, 249, 185, 201, 154, 9, 120, 77, 228, 114, 166, 6, 191, 139, 98, 102, 221, 48, 253, 226, 152, 37, 179, 16, 145, 34, 136, 54, 208, 148, 206, 143, 150, 219, 189, 241, 210, 19, 92, 131, 56, 70, 64, 30, 66, 182, 163, 195, 72, 126, 110, 107, 58, 40, 84, 250, 133, 186, 61, 202, 94, 155, 159, 10, 21, 121, 43, 78, 212, 229, 172, 115, 243, 167, 87, 7, 112, 192, 247, 140, 128, 99, 13, 103, 74, 222, 237, 49, 197, 254, 24, 227, 165, 153, 119, 38, 184, 180, 124, 17, 68, 146, 217, 35, 32, 137, 46, 55, 63, 209, 91, 149, 188, 207, 205, 144, 135, 151, 178, 220, 252, 190, 97, 242, 86, 211, 171, 20, 42, 93, 158, 132, 60, 57, 83, 71, 109, 65, 162, 31, 45, 67, 216, 183, 123, 164, 118, 196, 23, 73, 236, 127, 12, 111, 246, 108, 161, 59, 82, 41, 157, 85, 170, 251, 96, 134, 177, 187, 204, 62, 90, 203, 89, 95, 176, 156, 169, 160, 81, 11, 245, 22, 235, 122, 117, 44, 215, 79, 174, 213, 233, 230, 231, 173, 232, 116, 214, 244, 234, 168, 80, 88, 175}
var rsGen = [9]byte{1, 255, 11, 81, 54, 239, 173, 200, 24}


// rsGen is the RS(16,8) generator polynomial coefficients (fcr=0).