2 # Copyright 2007-2020 The OpenSSL Project Authors. All Rights Reserved.
4 # Licensed under the OpenSSL license (the "License"). You may not use
5 # this file except in compliance with the License. You can obtain a copy
6 # in the file LICENSE in the source distribution or at
7 # https://www.openssl.org/source/license.html
10 # ====================================================================
11 # Written by Andy Polyakov <appro@openssl.org> for the OpenSSL
12 # project. The module is, however, dual licensed under OpenSSL and
13 # CRYPTOGAMS licenses depending on where you obtain it. For further
14 # details see http://www.openssl.org/~appro/cryptogams/.
15 # ====================================================================
19 # Montgomery multiplication for ARMv4.
21 # Performance improvement naturally varies among CPU implementations
22 # and compilers. The code was observed to provide +65-35% improvement
23 # [depending on key length, less for longer keys] on ARM920T, and
24 # +115-80% on Intel IXP425. This is compared to pre-bn_mul_mont code
25 # base and compiler generated code with in-lined umull and even umlal
26 # instructions. The latter means that this code didn't really have an
27 # "advantage" of utilizing some "secret" instruction.
29 # The code is interoperable with Thumb ISA and is rather compact, less
30 # than 1/2KB. Windows CE port would be trivial, as it's exclusively
31 # about decorations, ABI and instruction syntax are identical.
35 # Add NEON code path, which handles lengths divisible by 8. RSA/DSA
36 # performance improvement on Cortex-A8 is ~45-100% depending on key
37 # length, more for longer keys. On Cortex-A15 the span is ~10-105%.
38 # On Snapdragon S4 improvement was measured to vary from ~70% to
39 # incredible ~380%, yes, 4.8x faster, for RSA4096 sign. But this is
40 # rather because original integer-only code seems to perform
41 # suboptimally on S4. Situation on Cortex-A9 is unfortunately
42 # different. It's being looked into, but the trouble is that
43 # performance for vectors longer than 256 bits is actually couple
44 # of percent worse than for integer-only code. The code is chosen
45 # for execution on all NEON-capable processors, because gain on
46 # others outweighs the marginal loss on Cortex-A9.
50 # Align Cortex-A9 performance with November 2013 improvements, i.e.
51 # NEON code is now ~20-105% faster than integer-only one on this
52 # processor. But this optimization further improved performance even
53 # on other processors: NEON code path is ~45-180% faster than original
54 # integer-only on Cortex-A8, ~10-210% on Cortex-A15, ~70-450% on
58 if ($flavour=~/\w[\w\-]*\.\w+$/) { $output=$flavour; undef $flavour; }
59 else { while (($output=shift) && ($output!~/\w[\w\-]*\.\w+$/)) {} }
61 if ($flavour && $flavour ne "void") {
62 $0 =~ m/(.*[\/\\])[^\/\\]+$/; $dir=$1;
63 ( $xlate="${dir}arm-xlate.pl" and -f $xlate ) or
64 ( $xlate="${dir}../../perlasm/arm-xlate.pl" and -f $xlate) or
65 die "can't locate arm-xlate.pl";
67 open STDOUT,"| \"$^X\" $xlate $flavour $output";
69 open STDOUT,">$output";
72 $num="r0"; # starts as num argument, but holds &tp[num-1]
74 $bp="r2"; $bi="r2"; $rp="r2";
81 ########### # r9 is reserved by ELF as platform specific, e.g. TLS pointer
82 $alo="r10"; # sl, gcc uses it to keep @GOT
85 ########### # r13 is stack pointer
87 ########### # r15 is program counter
89 #### argument block layout relative to &tp[num-1], a.k.a. $num
91 # ap permanently resides in r1
93 # np permanently resides in r3
95 $_num="$num,#15*4"; $_bpend=$_num;
101 #if defined(__thumb2__)
108 #if __ARM_MAX_ARCH__>=7
111 .word OPENSSL_armcap_P-.Lbn_mul_mont
115 .type bn_mul_mont,%function
120 ldr ip,[sp,#4] @ load num
121 stmdb sp!,{r0,r2} @ sp points at argument block
122 #if __ARM_MAX_ARCH__>=7
126 ldr r2,.LOPENSSL_armcap
131 tst r0,#ARMV7_NEON @ NEON available?
140 mov $num,ip @ load num
148 stmdb sp!,{r4-r12,lr} @ save 10 registers
150 mov $num,$num,lsl#2 @ rescale $num for byte count
151 sub sp,sp,$num @ alloca(4*num)
152 sub sp,sp,#4 @ +extra dword
153 sub $num,$num,#4 @ "num=num-1"
154 add $tp,$bp,$num @ &bp[num-1]
156 add $num,sp,$num @ $num to point at &tp[num-1]
158 ldr $bi,[$bp] @ bp[0]
159 ldr $aj,[$ap],#4 @ ap[0],ap++
160 ldr $nj,[$np],#4 @ np[0],np++
162 str $tp,[$_bpend] @ save &bp[num]
164 umull $alo,$ahi,$aj,$bi @ ap[0]*bp[0]
165 str $n0,[$_n0] @ save n0 value
166 mul $n0,$alo,$n0 @ "tp[0]"*n0
168 umlal $alo,$nlo,$nj,$n0 @ np[0]*n0+"t[0]"
172 ldr $aj,[$ap],#4 @ ap[j],ap++
174 ldr $nj,[$np],#4 @ np[j],np++
176 umlal $alo,$ahi,$aj,$bi @ ap[j]*bp[0]
178 umlal $nlo,$nhi,$nj,$n0 @ np[j]*n0
180 str $nlo,[$tp],#4 @ tp[j-1]=,tp++
186 ldr $tp,[$_bp] @ restore bp
188 ldr $n0,[$_n0] @ restore n0
190 str $nlo,[$num] @ tp[num-1]=
192 str $nhi,[$num,#4] @ tp[num]=
195 sub $tj,$num,$tj @ "original" $num-1 value
196 sub $ap,$ap,$tj @ "rewind" ap to &ap[1]
197 ldr $bi,[$tp,#4]! @ *(++bp)
198 sub $np,$np,$tj @ "rewind" np to &np[1]
199 ldr $aj,[$ap,#-4] @ ap[0]
200 ldr $alo,[sp] @ tp[0]
201 ldr $nj,[$np,#-4] @ np[0]
202 ldr $tj,[sp,#4] @ tp[1]
205 umlal $alo,$ahi,$aj,$bi @ ap[0]*bp[i]+tp[0]
206 str $tp,[$_bp] @ save bp
209 umlal $alo,$nlo,$nj,$n0 @ np[0]*n0+"tp[0]"
213 ldr $aj,[$ap],#4 @ ap[j],ap++
214 adds $alo,$ahi,$tj @ +=tp[j]
215 ldr $nj,[$np],#4 @ np[j],np++
217 umlal $alo,$ahi,$aj,$bi @ ap[j]*bp[i]
219 umlal $nlo,$nhi,$nj,$n0 @ np[j]*n0
221 ldr $tj,[$tp,#8] @ tp[j+1]
223 str $nlo,[$tp],#4 @ tp[j-1]=,tp++
230 ldr $tp,[$_bp] @ restore bp
232 ldr $n0,[$_n0] @ restore n0
234 ldr $tj,[$_bpend] @ restore &bp[num]
236 str $nlo,[$num] @ tp[num-1]=
237 str $nhi,[$num,#4] @ tp[num]=
246 ldr $rp,[$_rp] @ pull rp
248 add $num,$num,#4 @ $num to point at &tp[num]
249 sub $aj,$num,$aj @ "original" num value
250 mov $tp,sp @ "rewind" $tp
251 mov $ap,$tp @ "borrow" $ap
252 sub $np,$np,$aj @ "rewind" $np to &np[0]
254 subs $tj,$tj,$tj @ "clear" carry flag
255 .Lsub: ldr $tj,[$tp],#4
257 sbcs $tj,$tj,$nj @ tp[j]-np[j]
258 str $tj,[$rp],#4 @ rp[j]=
259 teq $tp,$num @ preserve carry
261 sbcs $nhi,$nhi,#0 @ upmost carry
262 mov $tp,sp @ "rewind" $tp
263 sub $rp,$rp,$aj @ "rewind" $rp
265 .Lcopy: ldr $tj,[$tp] @ conditional copy
267 str sp,[$tp],#4 @ zap tp
273 teq $tp,$num @ preserve carry
277 add sp,sp,#4 @ skip over tp[num+1]
278 ldmia sp!,{r4-r12,lr} @ restore registers
279 add sp,sp,#2*4 @ skip over {r0,r2}
286 moveq pc,lr @ be binary compatible with V4, yet
287 bx lr @ interoperable with Thumb ISA:-)
289 .size bn_mul_mont,.-bn_mul_mont
292 my ($A0,$A1,$A2,$A3)=map("d$_",(0..3));
293 my ($N0,$N1,$N2,$N3)=map("d$_",(4..7));
294 my ($Z,$Temp)=("q4","q5");
295 my @ACC=map("q$_",(6..13));
296 my ($Bi,$Ni,$M0)=map("d$_",(28..31));
300 my ($rptr,$aptr,$bptr,$nptr,$n0,$num)=map("r$_",(0..5));
301 my ($tinptr,$toutptr,$inner,$outer,$bnptr)=map("r$_",(6..11));
304 #if __ARM_MAX_ARCH__>=7
308 .type bn_mul8x_mont_neon,%function
313 vstmdb sp!,{d8-d15} @ ABI specification says so
314 ldmia ip,{r4-r5} @ load rest of parameter block
320 @ special case for $num==8, everything is in register bank...
322 vld1.32 {${Bi}[0]}, [$bptr,:32]!
323 veor $zero,$zero,$zero
324 sub $toutptr,sp,$num,lsl#4
325 vld1.32 {$A0-$A3}, [$aptr]! @ can't specify :32 :-(
326 and $toutptr,$toutptr,#-64
327 vld1.32 {${M0}[0]}, [$n0,:32]
328 mov sp,$toutptr @ alloca
331 vmull.u32 @ACC[0],$Bi,${A0}[0]
332 vmull.u32 @ACC[1],$Bi,${A0}[1]
333 vmull.u32 @ACC[2],$Bi,${A1}[0]
334 vshl.i64 $Ni,@ACC[0]#hi,#16
335 vmull.u32 @ACC[3],$Bi,${A1}[1]
337 vadd.u64 $Ni,$Ni,@ACC[0]#lo
338 veor $zero,$zero,$zero
341 vmull.u32 @ACC[4],$Bi,${A2}[0]
342 vld1.32 {$N0-$N3}, [$nptr]!
343 vmull.u32 @ACC[5],$Bi,${A2}[1]
344 vmull.u32 @ACC[6],$Bi,${A3}[0]
346 vmull.u32 @ACC[7],$Bi,${A3}[1]
348 vmlal.u32 @ACC[0],$Ni,${N0}[0]
350 vmlal.u32 @ACC[1],$Ni,${N0}[1]
351 vmlal.u32 @ACC[2],$Ni,${N1}[0]
352 vmlal.u32 @ACC[3],$Ni,${N1}[1]
354 vmlal.u32 @ACC[4],$Ni,${N2}[0]
356 vmlal.u32 @ACC[5],$Ni,${N2}[1]
358 vmlal.u32 @ACC[6],$Ni,${N3}[0]
360 vmlal.u32 @ACC[7],$Ni,${N3}[1]
363 vshr.u64 $temp,$temp,#16
366 vadd.u64 $temp,$temp,$Temp#hi
369 vshr.u64 $temp,$temp,#16
375 vld1.32 {${Bi}[0]}, [$bptr,:32]!
376 veor $zero,$zero,$zero
378 vadd.u64 @ACC[0]#lo,@ACC[0]#lo,$temp
380 vmlal.u32 @ACC[0],$Bi,${A0}[0]
381 vmlal.u32 @ACC[1],$Bi,${A0}[1]
382 vmlal.u32 @ACC[2],$Bi,${A1}[0]
383 vshl.i64 $Ni,@ACC[0]#hi,#16
384 vmlal.u32 @ACC[3],$Bi,${A1}[1]
386 vadd.u64 $Ni,$Ni,@ACC[0]#lo
387 veor $zero,$zero,$zero
388 subs $outer,$outer,#1
391 vmlal.u32 @ACC[4],$Bi,${A2}[0]
392 vmlal.u32 @ACC[5],$Bi,${A2}[1]
393 vmlal.u32 @ACC[6],$Bi,${A3}[0]
395 vmlal.u32 @ACC[7],$Bi,${A3}[1]
397 vmlal.u32 @ACC[0],$Ni,${N0}[0]
398 vmlal.u32 @ACC[1],$Ni,${N0}[1]
399 vmlal.u32 @ACC[2],$Ni,${N1}[0]
400 vmlal.u32 @ACC[3],$Ni,${N1}[1]
402 vmlal.u32 @ACC[4],$Ni,${N2}[0]
404 vmlal.u32 @ACC[5],$Ni,${N2}[1]
406 vmlal.u32 @ACC[6],$Ni,${N3}[0]
408 vmlal.u32 @ACC[7],$Ni,${N3}[1]
411 vshr.u64 $temp,$temp,#16
414 vadd.u64 $temp,$temp,$Temp#hi
417 vshr.u64 $temp,$temp,#16
421 vadd.u64 @ACC[0]#lo,@ACC[0]#lo,$temp
423 vshr.u64 $temp,@ACC[0]#lo,#16
425 vadd.u64 @ACC[0]#hi,@ACC[0]#hi,$temp
427 vshr.u64 $temp,@ACC[0]#hi,#16
428 vzip.16 @ACC[0]#lo,@ACC[0]#hi
434 veor @ACC[0],@ACC[0],@ACC[0]
436 veor @ACC[1],@ACC[1],@ACC[1]
437 sub $toutptr,$toutptr,$num,lsl#4
438 veor @ACC[2],@ACC[2],@ACC[2]
439 and $toutptr,$toutptr,#-64
440 veor @ACC[3],@ACC[3],@ACC[3]
441 mov sp,$toutptr @ alloca
442 veor @ACC[4],@ACC[4],@ACC[4]
443 add $toutptr,$toutptr,#256
444 veor @ACC[5],@ACC[5],@ACC[5]
446 veor @ACC[6],@ACC[6],@ACC[6]
447 veor @ACC[7],@ACC[7],@ACC[7]
450 vst1.64 {@ACC[0]-@ACC[1]},[$toutptr,:256]!
451 subs $inner,$inner,#8
452 vst1.64 {@ACC[2]-@ACC[3]},[$toutptr,:256]!
453 vst1.64 {@ACC[4]-@ACC[5]},[$toutptr,:256]!
454 vst1.64 {@ACC[6]-@ACC[7]},[$toutptr,:256]!
458 vld1.32 {$A0-$A3},[$aptr]!
460 vld1.32 {${M0}[0]},[$n0,:32]
466 vld1.32 {${Bi}[0]},[$bptr,:32]! @ *b++
467 veor $zero,$zero,$zero
470 vld1.32 {$N0-$N3},[$nptr]!
472 vmlal.u32 @ACC[0],$Bi,${A0}[0]
473 vmlal.u32 @ACC[1],$Bi,${A0}[1]
474 veor $zero,$zero,$zero
475 vmlal.u32 @ACC[2],$Bi,${A1}[0]
476 vshl.i64 $Ni,@ACC[0]#hi,#16
477 vmlal.u32 @ACC[3],$Bi,${A1}[1]
478 vadd.u64 $Ni,$Ni,@ACC[0]#lo
479 vmlal.u32 @ACC[4],$Bi,${A2}[0]
481 vmlal.u32 @ACC[5],$Bi,${A2}[1]
482 vst1.32 {$Bi},[sp,:64] @ put aside smashed b[8*i+0]
483 vmlal.u32 @ACC[6],$Bi,${A3}[0]
485 vmlal.u32 @ACC[7],$Bi,${A3}[1]
489 vld1.32 {${Bi}[0]},[$bptr,:32]! @ *b++
490 vmlal.u32 @ACC[0],$Ni,${N0}[0]
491 veor $temp,$temp,$temp
492 vmlal.u32 @ACC[1],$Ni,${N0}[1]
494 vmlal.u32 @ACC[2],$Ni,${N1}[0]
495 vshr.u64 @ACC[0]#lo,@ACC[0]#lo,#16
496 vmlal.u32 @ACC[3],$Ni,${N1}[1]
497 vmlal.u32 @ACC[4],$Ni,${N2}[0]
498 vadd.u64 @ACC[0]#lo,@ACC[0]#lo,@ACC[0]#hi
499 vmlal.u32 @ACC[5],$Ni,${N2}[1]
500 vshr.u64 @ACC[0]#lo,@ACC[0]#lo,#16
501 vmlal.u32 @ACC[6],$Ni,${N3}[0]
502 vmlal.u32 @ACC[7],$Ni,${N3}[1]
503 vadd.u64 @ACC[1]#lo,@ACC[1]#lo,@ACC[0]#lo
504 vst1.32 {$Ni},[$bnptr,:64]! @ put aside smashed m[8*i+$i]
506 push(@ACC,shift(@ACC)); $i++;
508 vmlal.u32 @ACC[0],$Bi,${A0}[0]
509 vld1.64 {@ACC[7]},[$tinptr,:128]!
510 vmlal.u32 @ACC[1],$Bi,${A0}[1]
511 veor $zero,$zero,$zero
512 vmlal.u32 @ACC[2],$Bi,${A1}[0]
513 vshl.i64 $Ni,@ACC[0]#hi,#16
514 vmlal.u32 @ACC[3],$Bi,${A1}[1]
515 vadd.u64 $Ni,$Ni,@ACC[0]#lo
516 vmlal.u32 @ACC[4],$Bi,${A2}[0]
518 vmlal.u32 @ACC[5],$Bi,${A2}[1]
519 vst1.32 {$Bi},[$bnptr,:64]! @ put aside smashed b[8*i+$i]
520 vmlal.u32 @ACC[6],$Bi,${A3}[0]
522 vmlal.u32 @ACC[7],$Bi,${A3}[1]
526 vld1.32 {$Bi},[sp,:64] @ pull smashed b[8*i+0]
527 vmlal.u32 @ACC[0],$Ni,${N0}[0]
528 vld1.32 {$A0-$A3},[$aptr]!
529 vmlal.u32 @ACC[1],$Ni,${N0}[1]
530 vmlal.u32 @ACC[2],$Ni,${N1}[0]
531 vshr.u64 @ACC[0]#lo,@ACC[0]#lo,#16
532 vmlal.u32 @ACC[3],$Ni,${N1}[1]
533 vmlal.u32 @ACC[4],$Ni,${N2}[0]
534 vadd.u64 @ACC[0]#lo,@ACC[0]#lo,@ACC[0]#hi
535 vmlal.u32 @ACC[5],$Ni,${N2}[1]
536 vshr.u64 @ACC[0]#lo,@ACC[0]#lo,#16
537 vmlal.u32 @ACC[6],$Ni,${N3}[0]
538 vmlal.u32 @ACC[7],$Ni,${N3}[1]
539 vadd.u64 @ACC[1]#lo,@ACC[1]#lo,@ACC[0]#lo
540 vst1.32 {$Ni},[$bnptr,:64] @ put aside smashed m[8*i+$i]
541 add $bnptr,sp,#8 @ rewind
543 push(@ACC,shift(@ACC));
550 subs $inner,$inner,#8
551 vmlal.u32 @ACC[0],$Bi,${A0}[0]
552 vld1.64 {@ACC[7]},[$tinptr,:128]
553 vmlal.u32 @ACC[1],$Bi,${A0}[1]
554 vld1.32 {$Ni},[$bnptr,:64]! @ pull smashed m[8*i+0]
555 vmlal.u32 @ACC[2],$Bi,${A1}[0]
556 vld1.32 {$N0-$N3},[$nptr]!
557 vmlal.u32 @ACC[3],$Bi,${A1}[1]
559 addne $tinptr,$tinptr,#16 @ don't advance in last iteration
560 vmlal.u32 @ACC[4],$Bi,${A2}[0]
561 vmlal.u32 @ACC[5],$Bi,${A2}[1]
562 vmlal.u32 @ACC[6],$Bi,${A3}[0]
563 vmlal.u32 @ACC[7],$Bi,${A3}[1]
565 for ($i=1; $i<8; $i++) {
567 vld1.32 {$Bi},[$bnptr,:64]! @ pull smashed b[8*i+$i]
568 vmlal.u32 @ACC[0],$Ni,${N0}[0]
569 vmlal.u32 @ACC[1],$Ni,${N0}[1]
570 vmlal.u32 @ACC[2],$Ni,${N1}[0]
571 vmlal.u32 @ACC[3],$Ni,${N1}[1]
572 vmlal.u32 @ACC[4],$Ni,${N2}[0]
573 vmlal.u32 @ACC[5],$Ni,${N2}[1]
574 vmlal.u32 @ACC[6],$Ni,${N3}[0]
575 vmlal.u32 @ACC[7],$Ni,${N3}[1]
576 vst1.64 {@ACC[0]},[$toutptr,:128]!
578 push(@ACC,shift(@ACC));
580 vmlal.u32 @ACC[0],$Bi,${A0}[0]
581 vld1.64 {@ACC[7]},[$tinptr,:128]
582 vmlal.u32 @ACC[1],$Bi,${A0}[1]
583 vld1.32 {$Ni},[$bnptr,:64]! @ pull smashed m[8*i+$i]
584 vmlal.u32 @ACC[2],$Bi,${A1}[0]
586 addne $tinptr,$tinptr,#16 @ don't advance in last iteration
587 vmlal.u32 @ACC[3],$Bi,${A1}[1]
588 vmlal.u32 @ACC[4],$Bi,${A2}[0]
589 vmlal.u32 @ACC[5],$Bi,${A2}[1]
590 vmlal.u32 @ACC[6],$Bi,${A3}[0]
591 vmlal.u32 @ACC[7],$Bi,${A3}[1]
596 subeq $aptr,$aptr,$num,lsl#2 @ rewind
597 vmlal.u32 @ACC[0],$Ni,${N0}[0]
598 vld1.32 {$Bi},[sp,:64] @ pull smashed b[8*i+0]
599 vmlal.u32 @ACC[1],$Ni,${N0}[1]
600 vld1.32 {$A0-$A3},[$aptr]!
601 vmlal.u32 @ACC[2],$Ni,${N1}[0]
602 add $bnptr,sp,#8 @ rewind
603 vmlal.u32 @ACC[3],$Ni,${N1}[1]
604 vmlal.u32 @ACC[4],$Ni,${N2}[0]
605 vmlal.u32 @ACC[5],$Ni,${N2}[1]
606 vmlal.u32 @ACC[6],$Ni,${N3}[0]
607 vst1.64 {@ACC[0]},[$toutptr,:128]!
608 vmlal.u32 @ACC[7],$Ni,${N3}[1]
612 push(@ACC,shift(@ACC));
615 vst1.64 {@ACC[0]-@ACC[1]},[$toutptr,:256]!
616 veor q2,q2,q2 @ $N0-$N1
617 vst1.64 {@ACC[2]-@ACC[3]},[$toutptr,:256]!
618 veor q3,q3,q3 @ $N2-$N3
619 vst1.64 {@ACC[4]-@ACC[5]},[$toutptr,:256]!
620 vst1.64 {@ACC[6]},[$toutptr,:128]
622 subs $outer,$outer,#8
623 vld1.64 {@ACC[0]-@ACC[1]},[$tinptr,:256]!
624 vld1.64 {@ACC[2]-@ACC[3]},[$tinptr,:256]!
625 vld1.64 {@ACC[4]-@ACC[5]},[$tinptr,:256]!
626 vld1.64 {@ACC[6]-@ACC[7]},[$tinptr,:256]!
629 subne $nptr,$nptr,$num,lsl#2 @ rewind
633 vst1.64 {q2-q3}, [sp,:256]! @ start wiping stack frame
634 vshr.u64 $temp,@ACC[0]#lo,#16
635 vst1.64 {q2-q3},[sp,:256]!
636 vadd.u64 @ACC[0]#hi,@ACC[0]#hi,$temp
637 vst1.64 {q2-q3}, [sp,:256]!
638 vshr.u64 $temp,@ACC[0]#hi,#16
639 vst1.64 {q2-q3}, [sp,:256]!
640 vzip.16 @ACC[0]#lo,@ACC[0]#hi
647 vadd.u64 @ACC[0]#lo,@ACC[0]#lo,$temp
648 vshr.u64 $temp,@ACC[0]#lo,#16
649 vld1.64 {@ACC[2]-@ACC[3]}, [$tinptr, :256]!
650 vadd.u64 @ACC[0]#hi,@ACC[0]#hi,$temp
651 vld1.64 {@ACC[4]-@ACC[5]}, [$tinptr, :256]!
652 vshr.u64 $temp,@ACC[0]#hi,#16
653 vld1.64 {@ACC[6]-@ACC[7]}, [$tinptr, :256]!
654 vzip.16 @ACC[0]#lo,@ACC[0]#hi
658 for ($i=1; $i<8; $i++) {
660 vadd.u64 @ACC[1]#lo,@ACC[1]#lo,$temp
661 vst1.32 {@ACC[0]#lo[0]}, [$toutptr, :32]!
662 vshr.u64 $temp,@ACC[1]#lo,#16
663 vadd.u64 @ACC[1]#hi,@ACC[1]#hi,$temp
664 vshr.u64 $temp,@ACC[1]#hi,#16
665 vzip.16 @ACC[1]#lo,@ACC[1]#hi
667 push(@ACC,shift(@ACC));
669 push(@ACC,shift(@ACC));
671 vld1.64 {@ACC[0]-@ACC[1]}, [$tinptr, :256]!
672 subs $inner,$inner,#8
673 vst1.32 {@ACC[7]#lo[0]}, [$toutptr, :32]!
676 vst1.32 {${temp}[0]}, [$toutptr, :32] @ top-most bit
677 sub $nptr,$nptr,$num,lsl#2 @ rewind $nptr
678 subs $aptr,sp,#0 @ clear carry flag
679 add $bptr,sp,$num,lsl#2
682 ldmia $aptr!, {r4-r7}
683 ldmia $nptr!, {r8-r11}
688 teq $aptr,$bptr @ preserves carry
689 stmia $rptr!, {r8-r11}
692 ldr r10, [$aptr] @ load top-most bit
695 sub r11,$bptr,r11 @ this is num*4
698 sub $rptr,$rptr,r11 @ rewind $rptr
699 mov $nptr,$bptr @ second 3/4th of frame
700 sbcs r10,r10,#0 @ result is carry flag
703 ldmia $aptr!, {r4-r7}
704 ldmia $rptr, {r8-r11}
707 vst1.64 {q0-q1}, [$nptr,:256]! @ wipe
711 vst1.64 {q0-q1}, [$nptr,:256]! @ wipe
715 stmia $rptr!, {r8-r11}
717 ldmia $rptr, {r8-r11}
720 vst1.64 {q0-q1}, [$aptr,:256]! @ wipe
724 vst1.64 {q0-q1}, [$nptr,:256]! @ wipe
727 teq $aptr,$bptr @ preserves carry
728 stmia $rptr!, {r8-r11}
729 bne .LNEON_copy_n_zap
735 .size bn_mul8x_mont_neon,.-bn_mul8x_mont_neon
740 .asciz "Montgomery multiplication for ARMv4/NEON, CRYPTOGAMS by <appro\@openssl.org>"
742 #if __ARM_MAX_ARCH__>=7
743 .comm OPENSSL_armcap_P,4,4
747 foreach (split("\n",$code)) {
748 s/\`([^\`]*)\`/eval $1/ge;
750 s/\bq([0-9]+)#(lo|hi)/sprintf "d%d",2*$1+($2 eq "hi")/ge or
752 s/\bbx\s+lr\b/.word\t0xe12fff1e/g; # make it possible to compile with -march=armv4
757 close STDOUT or die "error closing STDOUT: $!";