3 # ====================================================================
4 # Written by Andy Polyakov <appro@openssl.org> for the OpenSSL
5 # project. The module is, however, dual licensed under OpenSSL and
6 # CRYPTOGAMS licenses depending on where you obtain it. For further
7 # details see http://www.openssl.org/~appro/cryptogams/.
8 # ====================================================================
12 # Companion to x86_64-mont.pl that optimizes cache-timing attack
13 # countermeasures. The subroutines are produced by replacing bp[i]
14 # references in their x86_64-mont.pl counterparts with cache-neutral
15 # references to powers table computed in BN_mod_exp_mont_consttime.
16 # In addition subroutine that scatters elements of the powers table
17 # is implemented, so that scatter-/gathering can be tuned without
18 # bn_exp.c modifications.
22 # Add MULX/AD*X code paths and additional interfaces to optimize for
23 # branch prediction unit. For input lengths that are multiples of 8
24 # the np argument is not just modulus value, but one interleaved
25 # with 0. This is to optimize post-condition...
29 if ($flavour =~ /\./) { $output = $flavour; undef $flavour; }
31 $win64=0; $win64=1 if ($flavour =~ /[nm]asm|mingw64/ || $output =~ /\.asm$/);
33 $0 =~ m/(.*[\/\\])[^\/\\]+$/; $dir=$1;
34 ( $xlate="${dir}x86_64-xlate.pl" and -f $xlate ) or
35 ( $xlate="${dir}../../perlasm/x86_64-xlate.pl" and -f $xlate) or
36 die "can't locate x86_64-xlate.pl";
38 open OUT,"| \"$^X\" $xlate $flavour $output";
41 if (`$ENV{CC} -Wa,-v -c -o /dev/null -x assembler /dev/null 2>&1`
42 =~ /GNU assembler version ([2-9]\.[0-9]+)/) {
46 if (!$addx && $win64 && ($flavour =~ /nasm/ || $ENV{ASM} =~ /nasm/) &&
47 `nasm -v 2>&1` =~ /NASM version ([2-9]\.[0-9]+)/) {
51 if (!$addx && $win64 && ($flavour =~ /masm/ || $ENV{ASM} =~ /ml64/) &&
52 `ml64 2>&1` =~ /Version ([0-9]+)\./) {
56 if (!$addx && `$ENV{CC} -v 2>&1` =~ /((?:^clang|LLVM) version|.*based on LLVM) ([3-9])\.([0-9]+)/) {
57 my $ver = $2 + $3/100.0; # 3.1->3.01, 3.10->3.10
61 # int bn_mul_mont_gather5(
62 $rp="%rdi"; # BN_ULONG *rp,
63 $ap="%rsi"; # const BN_ULONG *ap,
64 $bp="%rdx"; # const BN_ULONG *bp,
65 $np="%rcx"; # const BN_ULONG *np,
66 $n0="%r8"; # const BN_ULONG *n0,
67 $num="%r9"; # int num,
68 # int idx); # 0 to 2^5-1, "index" in $bp holding
69 # pre-computed powers of a', interlaced
70 # in such manner that b[0] is $bp[idx],
71 # b[1] is [2^5+idx], etc.
83 .extern OPENSSL_ia32cap_P
85 .globl bn_mul_mont_gather5
86 .type bn_mul_mont_gather5,\@function,6
94 $code.=<<___ if ($addx);
95 mov OPENSSL_ia32cap_P+8(%rip),%r11d
102 movd `($win64?56:8)`(%rsp),%xmm5 # load 7th argument
112 lea -280(%rsp,$num,8),%r10 # future alloca(8*(num+2)+256+8)
113 neg $num # restore $num
114 and \$-1024,%r10 # minimize TLB usage
116 # Some OSes, *cough*-dows, insist on stack being "wired" to
117 # physical memory in strictly sequential manner, i.e. if stack
118 # allocation spans two pages, then reference to farmost one can
119 # be punishable by SEGV. But page walking can do good even on
120 # other OSes, because it guarantees that villain thread hits
121 # the guard page before it can make damage to innocent one...
128 jmp .Lmul_page_walk_done
135 .Lmul_page_walk_done:
138 mov %rax,8(%rsp,$num,8) # tp[num+1]=%rsp
141 lea 128($bp),%r12 # reassign $bp (+size optimization)
144 $STRIDE=2**5*8; # 5 is "window size"
145 $N=$STRIDE/4; # should match cache line size
147 movdqa 0(%r10),%xmm0 # 00000001000000010000000000000000
148 movdqa 16(%r10),%xmm1 # 00000002000000020000000200000002
149 lea 24-112(%rsp,$num,8),%r10# place the mask after tp[num+3] (+ICache optimization)
152 pshufd \$0,%xmm5,%xmm5 # broadcast index
156 ########################################################################
157 # calculate mask by comparing 0..31 to index and save result to stack
161 pcmpeqd %xmm5,%xmm0 # compare to 1,0
165 for($k=0;$k<$STRIDE/16-4;$k+=4) {
168 pcmpeqd %xmm5,%xmm1 # compare to 3,2
169 movdqa %xmm0,`16*($k+0)+112`(%r10)
173 pcmpeqd %xmm5,%xmm2 # compare to 5,4
174 movdqa %xmm1,`16*($k+1)+112`(%r10)
178 pcmpeqd %xmm5,%xmm3 # compare to 7,6
179 movdqa %xmm2,`16*($k+2)+112`(%r10)
184 movdqa %xmm3,`16*($k+3)+112`(%r10)
188 $code.=<<___; # last iteration can be optimized
191 movdqa %xmm0,`16*($k+0)+112`(%r10)
196 movdqa %xmm1,`16*($k+1)+112`(%r10)
199 movdqa %xmm2,`16*($k+2)+112`(%r10)
200 pand `16*($k+0)-128`($bp),%xmm0 # while it's still in register
202 pand `16*($k+1)-128`($bp),%xmm1
203 pand `16*($k+2)-128`($bp),%xmm2
204 movdqa %xmm3,`16*($k+3)+112`(%r10)
205 pand `16*($k+3)-128`($bp),%xmm3
209 for($k=0;$k<$STRIDE/16-4;$k+=4) {
211 movdqa `16*($k+0)-128`($bp),%xmm4
212 movdqa `16*($k+1)-128`($bp),%xmm5
213 movdqa `16*($k+2)-128`($bp),%xmm2
214 pand `16*($k+0)+112`(%r10),%xmm4
215 movdqa `16*($k+3)-128`($bp),%xmm3
216 pand `16*($k+1)+112`(%r10),%xmm5
218 pand `16*($k+2)+112`(%r10),%xmm2
220 pand `16*($k+3)+112`(%r10),%xmm3
227 pshufd \$0x4e,%xmm0,%xmm1
230 movq %xmm0,$m0 # m0=bp[0]
232 mov ($n0),$n0 # pull n0[0] value
239 mulq $m0 # ap[0]*bp[0]
243 imulq $lo0,$m1 # "tp[0]"*n0
247 add %rax,$lo0 # discarded
260 add $hi0,$hi1 # np[j]*m1+ap[j]*bp[0]
263 mov $hi1,-16(%rsp,$j,8) # tp[j-1]
267 mulq $m0 # ap[j]*bp[0]
276 jne .L1st # note that upon exit $j==$num, so
277 # they can be used interchangeably
281 add $hi0,$hi1 # np[j]*m1+ap[j]*bp[0]
283 mov $hi1,-16(%rsp,$num,8) # tp[num-1]
290 mov $hi1,-8(%rsp,$num,8)
291 mov %rdx,(%rsp,$num,8) # store upmost overflow bit
297 lea 24+128(%rsp,$num,8),%rdx # where 256-byte mask is (+size optimization)
302 for($k=0;$k<$STRIDE/16;$k+=4) {
304 movdqa `16*($k+0)-128`($bp),%xmm0
305 movdqa `16*($k+1)-128`($bp),%xmm1
306 movdqa `16*($k+2)-128`($bp),%xmm2
307 movdqa `16*($k+3)-128`($bp),%xmm3
308 pand `16*($k+0)-128`(%rdx),%xmm0
309 pand `16*($k+1)-128`(%rdx),%xmm1
311 pand `16*($k+2)-128`(%rdx),%xmm2
313 pand `16*($k+3)-128`(%rdx),%xmm3
320 pshufd \$0x4e,%xmm4,%xmm0
324 mov ($ap),%rax # ap[0]
325 movq %xmm0,$m0 # m0=bp[i]
331 mulq $m0 # ap[0]*bp[i]
332 add %rax,$lo0 # ap[0]*bp[i]+tp[0]
336 imulq $lo0,$m1 # tp[0]*n0
340 add %rax,$lo0 # discarded
343 mov 8(%rsp),$lo0 # tp[1]
354 add $lo0,$hi1 # np[j]*m1+ap[j]*bp[i]+tp[j]
357 mov $hi1,-16(%rsp,$j,8) # tp[j-1]
361 mulq $m0 # ap[j]*bp[i]
365 add $hi0,$lo0 # ap[j]*bp[i]+tp[j]
372 jne .Linner # note that upon exit $j==$num, so
373 # they can be used interchangeably
376 add $lo0,$hi1 # np[j]*m1+ap[j]*bp[i]+tp[j]
377 mov (%rsp,$num,8),$lo0
379 mov $hi1,-16(%rsp,$num,8) # tp[num-1]
385 add $lo0,$hi1 # pull upmost overflow bit
387 mov $hi1,-8(%rsp,$num,8)
388 mov %rdx,(%rsp,$num,8) # store upmost overflow bit
394 xor $i,$i # i=0 and clear CF!
395 mov (%rsp),%rax # tp[0]
396 lea (%rsp),$ap # borrow ap for tp
400 .Lsub: sbb ($np,$i,8),%rax
401 mov %rax,($rp,$i,8) # rp[i]=tp[i]-np[i]
402 mov 8($ap,$i,8),%rax # tp[i+1]
404 dec $j # doesnn't affect CF!
407 sbb \$0,%rax # handle upmost overflow bit
414 or $np,$ap # ap=borrow?tp:rp
416 .Lcopy: # copy or in-place refresh
418 mov $i,(%rsp,$i,8) # zap temporary vector
419 mov %rax,($rp,$i,8) # rp[i]=tp[i]
424 mov 8(%rsp,$num,8),%rsi # restore %rsp
436 .size bn_mul_mont_gather5,.-bn_mul_mont_gather5
439 my @A=("%r10","%r11");
440 my @N=("%r13","%rdi");
442 .type bn_mul4x_mont_gather5,\@function,6
444 bn_mul4x_mont_gather5:
449 $code.=<<___ if ($addx);
451 cmp \$0x80108,%r11d # check for AD*X+BMI2+BMI1
464 shl \$3,${num}d # convert $num to bytes
465 lea ($num,$num,2),%r10 # 3*$num in bytes
468 ##############################################################
469 # Ensure that stack frame doesn't alias with $rptr+3*$num
470 # modulo 4096, which covers ret[num], am[num] and n[num]
471 # (see bn_exp.c). This is done to allow memory disambiguation
472 # logic do its magic. [Extra [num] is allocated in order
473 # to align with bn_power5's frame, which is cleansed after
474 # completing exponentiation. Extra 256 bytes is for power mask
475 # calculated from 7th argument, the index.]
477 lea -320(%rsp,$num,2),%r11
483 sub %r11,%rbp # align with $rp
484 lea -320(%rbp,$num,2),%rbp # future alloca(frame+2*num*8+256)
489 lea 4096-320(,$num,2),%r10
490 lea -320(%rbp,$num,2),%rbp # future alloca(frame+2*num*8+256)
504 jmp .Lmul4x_page_walk_done
511 .Lmul4x_page_walk_done:
520 mov 40(%rsp),%rsi # restore %rsp
532 .size bn_mul4x_mont_gather5,.-bn_mul4x_mont_gather5
534 .type mul4x_internal,\@abi-omnipotent
537 shl \$5,$num # $num was in bytes
538 movd `($win64?56:8)`(%rax),%xmm5 # load 7th argument, index
540 lea 128(%rdx,$num),%r13 # end of powers table (+size optimization)
541 shr \$5,$num # restore $num
544 $STRIDE=2**5*8; # 5 is "window size"
545 $N=$STRIDE/4; # should match cache line size
548 movdqa 0(%rax),%xmm0 # 00000001000000010000000000000000
549 movdqa 16(%rax),%xmm1 # 00000002000000020000000200000002
550 lea 88-112(%rsp,$num),%r10 # place the mask after tp[num+1] (+ICache optimization)
551 lea 128(%rdx),$bp # size optimization
553 pshufd \$0,%xmm5,%xmm5 # broadcast index
558 ########################################################################
559 # calculate mask by comparing 0..31 to index and save result to stack
563 pcmpeqd %xmm5,%xmm0 # compare to 1,0
567 for($i=0;$i<$STRIDE/16-4;$i+=4) {
570 pcmpeqd %xmm5,%xmm1 # compare to 3,2
571 movdqa %xmm0,`16*($i+0)+112`(%r10)
575 pcmpeqd %xmm5,%xmm2 # compare to 5,4
576 movdqa %xmm1,`16*($i+1)+112`(%r10)
580 pcmpeqd %xmm5,%xmm3 # compare to 7,6
581 movdqa %xmm2,`16*($i+2)+112`(%r10)
586 movdqa %xmm3,`16*($i+3)+112`(%r10)
590 $code.=<<___; # last iteration can be optimized
593 movdqa %xmm0,`16*($i+0)+112`(%r10)
598 movdqa %xmm1,`16*($i+1)+112`(%r10)
601 movdqa %xmm2,`16*($i+2)+112`(%r10)
602 pand `16*($i+0)-128`($bp),%xmm0 # while it's still in register
604 pand `16*($i+1)-128`($bp),%xmm1
605 pand `16*($i+2)-128`($bp),%xmm2
606 movdqa %xmm3,`16*($i+3)+112`(%r10)
607 pand `16*($i+3)-128`($bp),%xmm3
611 for($i=0;$i<$STRIDE/16-4;$i+=4) {
613 movdqa `16*($i+0)-128`($bp),%xmm4
614 movdqa `16*($i+1)-128`($bp),%xmm5
615 movdqa `16*($i+2)-128`($bp),%xmm2
616 pand `16*($i+0)+112`(%r10),%xmm4
617 movdqa `16*($i+3)-128`($bp),%xmm3
618 pand `16*($i+1)+112`(%r10),%xmm5
620 pand `16*($i+2)+112`(%r10),%xmm2
622 pand `16*($i+3)+112`(%r10),%xmm3
629 pshufd \$0x4e,%xmm0,%xmm1
632 movq %xmm0,$m0 # m0=bp[0]
634 mov %r13,16+8(%rsp) # save end of b[num]
635 mov $rp, 56+8(%rsp) # save $rp
637 mov ($n0),$n0 # pull n0[0] value
639 lea ($ap,$num),$ap # end of a[num]
643 mulq $m0 # ap[0]*bp[0]
647 imulq $A[0],$m1 # "tp[0]"*n0
652 add %rax,$A[0] # discarded
665 mov 16($ap,$num),%rax
668 lea 4*8($num),$j # j=4
677 mulq $m0 # ap[j]*bp[0]
688 add $A[0],$N[0] # np[j]*m1+ap[j]*bp[0]
690 mov $N[0],-24($tp) # tp[j-1]
693 mulq $m0 # ap[j]*bp[0]
703 add $A[1],$N[1] # np[j]*m1+ap[j]*bp[0]
705 mov $N[1],-16($tp) # tp[j-1]
708 mulq $m0 # ap[j]*bp[0]
718 add $A[0],$N[0] # np[j]*m1+ap[j]*bp[0]
720 mov $N[0],-8($tp) # tp[j-1]
723 mulq $m0 # ap[j]*bp[0]
733 add $A[1],$N[1] # np[j]*m1+ap[j]*bp[0]
736 mov $N[1],($tp) # tp[j-1]
742 mulq $m0 # ap[j]*bp[0]
753 add $A[0],$N[0] # np[j]*m1+ap[j]*bp[0]
755 mov $N[0],-24($tp) # tp[j-1]
758 mulq $m0 # ap[j]*bp[0]
766 mov ($ap,$num),%rax # ap[0]
768 add $A[1],$N[1] # np[j]*m1+ap[j]*bp[0]
770 mov $N[1],-16($tp) # tp[j-1]
773 lea ($np,$num),$np # rewind $np
784 lea 16+128($tp),%rdx # where 256-byte mask is (+size optimization)
788 for($i=0;$i<$STRIDE/16;$i+=4) {
790 movdqa `16*($i+0)-128`($bp),%xmm0
791 movdqa `16*($i+1)-128`($bp),%xmm1
792 movdqa `16*($i+2)-128`($bp),%xmm2
793 movdqa `16*($i+3)-128`($bp),%xmm3
794 pand `16*($i+0)-128`(%rdx),%xmm0
795 pand `16*($i+1)-128`(%rdx),%xmm1
797 pand `16*($i+2)-128`(%rdx),%xmm2
799 pand `16*($i+3)-128`(%rdx),%xmm3
806 pshufd \$0x4e,%xmm4,%xmm0
809 movq %xmm0,$m0 # m0=bp[i]
813 mulq $m0 # ap[0]*bp[i]
814 add %rax,$A[0] # ap[0]*bp[i]+tp[0]
818 imulq $A[0],$m1 # tp[0]*n0
820 mov $N[1],($tp) # store upmost overflow bit
822 lea ($tp,$num),$tp # rewind $tp
825 add %rax,$A[0] # "$N[0]", discarded
830 mulq $m0 # ap[j]*bp[i]
834 add 8($tp),$A[1] # +tp[1]
840 mov 16($ap,$num),%rax
842 add $A[1],$N[1] # np[j]*m1+ap[j]*bp[i]+tp[j]
843 lea 4*8($num),$j # j=4
851 mulq $m0 # ap[j]*bp[i]
855 add 16($tp),$A[0] # ap[j]*bp[i]+tp[j]
866 mov $N[1],-32($tp) # tp[j-1]
869 mulq $m0 # ap[j]*bp[i]
883 mov $N[0],-24($tp) # tp[j-1]
886 mulq $m0 # ap[j]*bp[i]
890 add ($tp),$A[0] # ap[j]*bp[i]+tp[j]
900 mov $N[1],-16($tp) # tp[j-1]
903 mulq $m0 # ap[j]*bp[i]
918 mov $N[0],-8($tp) # tp[j-1]
924 mulq $m0 # ap[j]*bp[i]
928 add 16($tp),$A[0] # ap[j]*bp[i]+tp[j]
939 mov $N[1],-32($tp) # tp[j-1]
942 mulq $m0 # ap[j]*bp[i]
953 mov ($ap,$num),%rax # ap[0]
957 mov $N[0],-24($tp) # tp[j-1]
960 mov $N[1],-16($tp) # tp[j-1]
961 lea ($np,$num),$np # rewind $np
966 add ($tp),$N[0] # pull upmost overflow bit
967 adc \$0,$N[1] # upmost overflow bit
976 sub $N[0],$m1 # compare top-most words
977 adc $j,$j # $j is zero
979 sub $N[1],%rax # %rax=-$N[1]
980 lea ($tp,$num),%rbx # tptr in .sqr4x_sub
982 lea ($np),%rbp # nptr in .sqr4x_sub
985 mov 56+8(%rsp),%rdi # rptr in .sqr4x_sub
986 dec %r12 # so that after 'not' we get -n[0]
991 jmp .Lsqr4x_sub_entry
994 my @ri=("%rax",$bp,$m0,$m1);
998 lea ($tp,$num),$tp # rewind $tp
1000 lea ($np,$N[1],8),$np
1001 mov 56+8(%rsp),$rp # restore $rp
1010 sbb 16*0($np),@ri[0]
1012 sbb 16*1($np),@ri[1]
1015 sbb 16*2($np),@ri[2]
1017 sbb 16*3($np),@ri[3]
1031 .size mul4x_internal,.-mul4x_internal
1035 ######################################################################
1037 my $rptr="%rdi"; # BN_ULONG *rptr,
1038 my $aptr="%rsi"; # const BN_ULONG *aptr,
1039 my $bptr="%rdx"; # const void *table,
1040 my $nptr="%rcx"; # const BN_ULONG *nptr,
1041 my $n0 ="%r8"; # const BN_ULONG *n0);
1042 my $num ="%r9"; # int num, has to be divisible by 8
1045 my ($i,$j,$tptr)=("%rbp","%rcx",$rptr);
1046 my @A0=("%r10","%r11");
1047 my @A1=("%r12","%r13");
1048 my ($a0,$a1,$ai)=("%r14","%r15","%rbx");
1052 .type bn_power5,\@function,6
1057 $code.=<<___ if ($addx);
1058 mov OPENSSL_ia32cap_P+8(%rip),%r11d
1060 cmp \$0x80108,%r11d # check for AD*X+BMI2+BMI1
1072 shl \$3,${num}d # convert $num to bytes
1073 lea ($num,$num,2),%r10d # 3*$num
1077 ##############################################################
1078 # Ensure that stack frame doesn't alias with $rptr+3*$num
1079 # modulo 4096, which covers ret[num], am[num] and n[num]
1080 # (see bn_exp.c). This is done to allow memory disambiguation
1081 # logic do its magic. [Extra 256 bytes is for power mask
1082 # calculated from 7th argument, the index.]
1084 lea -320(%rsp,$num,2),%r11
1090 sub %r11,%rbp # align with $aptr
1091 lea -320(%rbp,$num,2),%rbp # future alloca(frame+2*num*8+256)
1096 lea 4096-320(,$num,2),%r10
1097 lea -320(%rbp,$num,2),%rbp # future alloca(frame+2*num*8+256)
1107 lea (%rbp,%r11),%rsp
1111 jmp .Lpwr_page_walk_done
1114 lea -4096(%rsp),%rsp
1118 .Lpwr_page_walk_done:
1123 ##############################################################
1126 # +0 saved $num, used in reduction section
1127 # +8 &t[2*$num], used in reduction section
1133 mov %rax, 40(%rsp) # save original %rsp
1135 movq $rptr,%xmm1 # save $rptr, used in sqr8x
1136 movq $nptr,%xmm2 # save $nptr
1137 movq %r10, %xmm3 # -$num, used in sqr8x
1140 call __bn_sqr8x_internal
1141 call __bn_post4x_internal
1142 call __bn_sqr8x_internal
1143 call __bn_post4x_internal
1144 call __bn_sqr8x_internal
1145 call __bn_post4x_internal
1146 call __bn_sqr8x_internal
1147 call __bn_post4x_internal
1148 call __bn_sqr8x_internal
1149 call __bn_post4x_internal
1159 mov 40(%rsp),%rsi # restore %rsp
1170 .size bn_power5,.-bn_power5
1172 .globl bn_sqr8x_internal
1173 .hidden bn_sqr8x_internal
1174 .type bn_sqr8x_internal,\@abi-omnipotent
1177 __bn_sqr8x_internal:
1178 ##############################################################
1181 # a) multiply-n-add everything but a[i]*a[i];
1182 # b) shift result of a) by 1 to the left and accumulate
1183 # a[i]*a[i] products;
1185 ##############################################################
1251 lea 32(%r10),$i # $i=-($num-32)
1252 lea ($aptr,$num),$aptr # end of a[] buffer, ($aptr,$i)=&ap[2]
1254 mov $num,$j # $j=$num
1256 # comments apply to $num==8 case
1257 mov -32($aptr,$i),$a0 # a[0]
1258 lea 48+8(%rsp,$num,2),$tptr # end of tp[] buffer, &tp[2*$num]
1259 mov -24($aptr,$i),%rax # a[1]
1260 lea -32($tptr,$i),$tptr # end of tp[] window, &tp[2*$num-"$i"]
1261 mov -16($aptr,$i),$ai # a[2]
1265 mov %rax,$A0[0] # a[1]*a[0]
1268 mov $A0[0],-24($tptr,$i) # t[1]
1274 mov $A0[1],-16($tptr,$i) # t[2]
1278 mov -8($aptr,$i),$ai # a[3]
1280 mov %rax,$A1[0] # a[2]*a[1]+t[3]
1286 add %rax,$A0[0] # a[3]*a[0]+a[2]*a[1]+t[3]
1292 mov $A0[0],-8($tptr,$j) # t[3]
1297 mov ($aptr,$j),$ai # a[4]
1299 add %rax,$A1[1] # a[3]*a[1]+t[4]
1305 add %rax,$A0[1] # a[4]*a[0]+a[3]*a[1]+t[4]
1307 mov 8($aptr,$j),$ai # a[5]
1315 add %rax,$A1[0] # a[4]*a[3]+t[5]
1317 mov $A0[1],($tptr,$j) # t[4]
1322 add %rax,$A0[0] # a[5]*a[2]+a[4]*a[3]+t[5]
1324 mov 16($aptr,$j),$ai # a[6]
1331 add %rax,$A1[1] # a[5]*a[3]+t[6]
1333 mov $A0[0],8($tptr,$j) # t[5]
1338 add %rax,$A0[1] # a[6]*a[2]+a[5]*a[3]+t[6]
1340 mov 24($aptr,$j),$ai # a[7]
1348 add %rax,$A1[0] # a[6]*a[5]+t[7]
1350 mov $A0[1],16($tptr,$j) # t[6]
1356 add %rax,$A0[0] # a[7]*a[4]+a[6]*a[5]+t[6]
1362 mov $A0[0],-8($tptr,$j) # t[7]
1374 mov $A1[1],($tptr) # t[8]
1376 mov %rdx,8($tptr) # t[9]
1380 .Lsqr4x_outer: # comments apply to $num==6 case
1381 mov -32($aptr,$i),$a0 # a[0]
1382 lea 48+8(%rsp,$num,2),$tptr # end of tp[] buffer, &tp[2*$num]
1383 mov -24($aptr,$i),%rax # a[1]
1384 lea -32($tptr,$i),$tptr # end of tp[] window, &tp[2*$num-"$i"]
1385 mov -16($aptr,$i),$ai # a[2]
1389 mov -24($tptr,$i),$A0[0] # t[1]
1390 add %rax,$A0[0] # a[1]*a[0]+t[1]
1393 mov $A0[0],-24($tptr,$i) # t[1]
1400 add -16($tptr,$i),$A0[1] # a[2]*a[0]+t[2]
1403 mov $A0[1],-16($tptr,$i) # t[2]
1407 mov -8($aptr,$i),$ai # a[3]
1409 add %rax,$A1[0] # a[2]*a[1]+t[3]
1412 add -8($tptr,$i),$A1[0]
1417 add %rax,$A0[0] # a[3]*a[0]+a[2]*a[1]+t[3]
1423 mov $A0[0],-8($tptr,$i) # t[3]
1430 mov ($aptr,$j),$ai # a[4]
1432 add %rax,$A1[1] # a[3]*a[1]+t[4]
1436 add ($tptr,$j),$A1[1]
1441 add %rax,$A0[1] # a[4]*a[0]+a[3]*a[1]+t[4]
1443 mov 8($aptr,$j),$ai # a[5]
1450 add %rax,$A1[0] # a[4]*a[3]+t[5]
1451 mov $A0[1],($tptr,$j) # t[4]
1455 add 8($tptr,$j),$A1[0]
1460 add %rax,$A0[0] # a[5]*a[2]+a[4]*a[3]+t[5]
1466 mov $A0[0],-8($tptr,$j) # t[5], "preloaded t[1]" below
1478 mov $A1[1],($tptr) # t[6], "preloaded t[2]" below
1480 mov %rdx,8($tptr) # t[7], "preloaded t[3]" below
1485 # comments apply to $num==4 case
1486 mov -32($aptr),$a0 # a[0]
1487 lea 48+8(%rsp,$num,2),$tptr # end of tp[] buffer, &tp[2*$num]
1488 mov -24($aptr),%rax # a[1]
1489 lea -32($tptr,$i),$tptr # end of tp[] window, &tp[2*$num-"$i"]
1490 mov -16($aptr),$ai # a[2]
1494 add %rax,$A0[0] # a[1]*a[0]+t[1], preloaded t[1]
1502 mov $A0[0],-24($tptr) # t[1]
1505 add $A1[1],$A0[1] # a[2]*a[0]+t[2], preloaded t[2]
1506 mov -8($aptr),$ai # a[3]
1510 add %rax,$A1[0] # a[2]*a[1]+t[3], preloaded t[3]
1512 mov $A0[1],-16($tptr) # t[2]
1517 add %rax,$A0[0] # a[3]*a[0]+a[2]*a[1]+t[3]
1523 mov $A0[0],-8($tptr) # t[3]
1527 mov -16($aptr),%rax # a[2]
1532 mov $A1[1],($tptr) # t[4]
1534 mov %rdx,8($tptr) # t[5]
1539 my ($shift,$carry)=($a0,$a1);
1540 my @S=(@A1,$ai,$n0);
1544 sub $num,$i # $i=16-$num
1547 add $A1[0],%rax # t[5]
1549 mov %rax,8($tptr) # t[5]
1550 mov %rdx,16($tptr) # t[6]
1551 mov $carry,24($tptr) # t[7]
1553 mov -16($aptr,$i),%rax # a[0]
1554 lea 48+8(%rsp),$tptr
1555 xor $A0[0],$A0[0] # t[0]
1556 mov 8($tptr),$A0[1] # t[1]
1558 lea ($shift,$A0[0],2),$S[0] # t[2*i]<<1 | shift
1560 lea ($j,$A0[1],2),$S[1] # t[2*i+1]<<1 |
1562 or $A0[0],$S[1] # | t[2*i]>>63
1563 mov 16($tptr),$A0[0] # t[2*i+2] # prefetch
1564 mov $A0[1],$shift # shift=t[2*i+1]>>63
1565 mul %rax # a[i]*a[i]
1566 neg $carry # mov $carry,cf
1567 mov 24($tptr),$A0[1] # t[2*i+2+1] # prefetch
1569 mov -8($aptr,$i),%rax # a[i+1] # prefetch
1573 lea ($shift,$A0[0],2),$S[2] # t[2*i]<<1 | shift
1575 sbb $carry,$carry # mov cf,$carry
1577 lea ($j,$A0[1],2),$S[3] # t[2*i+1]<<1 |
1579 or $A0[0],$S[3] # | t[2*i]>>63
1580 mov 32($tptr),$A0[0] # t[2*i+2] # prefetch
1581 mov $A0[1],$shift # shift=t[2*i+1]>>63
1582 mul %rax # a[i]*a[i]
1583 neg $carry # mov $carry,cf
1584 mov 40($tptr),$A0[1] # t[2*i+2+1] # prefetch
1586 mov 0($aptr,$i),%rax # a[i+1] # prefetch
1591 sbb $carry,$carry # mov cf,$carry
1593 jmp .Lsqr4x_shift_n_add
1596 .Lsqr4x_shift_n_add:
1597 lea ($shift,$A0[0],2),$S[0] # t[2*i]<<1 | shift
1599 lea ($j,$A0[1],2),$S[1] # t[2*i+1]<<1 |
1601 or $A0[0],$S[1] # | t[2*i]>>63
1602 mov -16($tptr),$A0[0] # t[2*i+2] # prefetch
1603 mov $A0[1],$shift # shift=t[2*i+1]>>63
1604 mul %rax # a[i]*a[i]
1605 neg $carry # mov $carry,cf
1606 mov -8($tptr),$A0[1] # t[2*i+2+1] # prefetch
1608 mov -8($aptr,$i),%rax # a[i+1] # prefetch
1609 mov $S[0],-32($tptr)
1612 lea ($shift,$A0[0],2),$S[2] # t[2*i]<<1 | shift
1613 mov $S[1],-24($tptr)
1614 sbb $carry,$carry # mov cf,$carry
1616 lea ($j,$A0[1],2),$S[3] # t[2*i+1]<<1 |
1618 or $A0[0],$S[3] # | t[2*i]>>63
1619 mov 0($tptr),$A0[0] # t[2*i+2] # prefetch
1620 mov $A0[1],$shift # shift=t[2*i+1]>>63
1621 mul %rax # a[i]*a[i]
1622 neg $carry # mov $carry,cf
1623 mov 8($tptr),$A0[1] # t[2*i+2+1] # prefetch
1625 mov 0($aptr,$i),%rax # a[i+1] # prefetch
1626 mov $S[2],-16($tptr)
1629 lea ($shift,$A0[0],2),$S[0] # t[2*i]<<1 | shift
1631 sbb $carry,$carry # mov cf,$carry
1633 lea ($j,$A0[1],2),$S[1] # t[2*i+1]<<1 |
1635 or $A0[0],$S[1] # | t[2*i]>>63
1636 mov 16($tptr),$A0[0] # t[2*i+2] # prefetch
1637 mov $A0[1],$shift # shift=t[2*i+1]>>63
1638 mul %rax # a[i]*a[i]
1639 neg $carry # mov $carry,cf
1640 mov 24($tptr),$A0[1] # t[2*i+2+1] # prefetch
1642 mov 8($aptr,$i),%rax # a[i+1] # prefetch
1646 lea ($shift,$A0[0],2),$S[2] # t[2*i]<<1 | shift
1648 sbb $carry,$carry # mov cf,$carry
1650 lea ($j,$A0[1],2),$S[3] # t[2*i+1]<<1 |
1652 or $A0[0],$S[3] # | t[2*i]>>63
1653 mov 32($tptr),$A0[0] # t[2*i+2] # prefetch
1654 mov $A0[1],$shift # shift=t[2*i+1]>>63
1655 mul %rax # a[i]*a[i]
1656 neg $carry # mov $carry,cf
1657 mov 40($tptr),$A0[1] # t[2*i+2+1] # prefetch
1659 mov 16($aptr,$i),%rax # a[i+1] # prefetch
1663 sbb $carry,$carry # mov cf,$carry
1666 jnz .Lsqr4x_shift_n_add
1668 lea ($shift,$A0[0],2),$S[0] # t[2*i]<<1 | shift
1671 lea ($j,$A0[1],2),$S[1] # t[2*i+1]<<1 |
1673 or $A0[0],$S[1] # | t[2*i]>>63
1674 mov -16($tptr),$A0[0] # t[2*i+2] # prefetch
1675 mov $A0[1],$shift # shift=t[2*i+1]>>63
1676 mul %rax # a[i]*a[i]
1677 neg $carry # mov $carry,cf
1678 mov -8($tptr),$A0[1] # t[2*i+2+1] # prefetch
1680 mov -8($aptr),%rax # a[i+1] # prefetch
1681 mov $S[0],-32($tptr)
1684 lea ($shift,$A0[0],2),$S[2] # t[2*i]<<1|shift
1685 mov $S[1],-24($tptr)
1686 sbb $carry,$carry # mov cf,$carry
1688 lea ($j,$A0[1],2),$S[3] # t[2*i+1]<<1 |
1690 or $A0[0],$S[3] # | t[2*i]>>63
1691 mul %rax # a[i]*a[i]
1692 neg $carry # mov $carry,cf
1695 mov $S[2],-16($tptr)
1699 ######################################################################
1700 # Montgomery reduction part, "word-by-word" algorithm.
1702 # This new path is inspired by multiple submissions from Intel, by
1703 # Shay Gueron, Vlad Krasnov, Erdinc Ozturk, James Guilford,
1706 my ($nptr,$tptr,$carry,$m0)=("%rbp","%rdi","%rsi","%rbx");
1710 __bn_sqr8x_reduction:
1712 lea ($nptr,$num),%rcx # end of n[]
1713 lea 48+8(%rsp,$num,2),%rdx # end of t[] buffer
1715 lea 48+8(%rsp,$num),$tptr # end of initial t[] window
1718 jmp .L8x_reduction_loop
1721 .L8x_reduction_loop:
1722 lea ($tptr,$num),$tptr # start of current t[] window
1732 mov %rax,(%rdx) # store top-most carry bit
1733 lea 8*8($tptr),$tptr
1737 imulq 32+8(%rsp),$m0 # n0*a[0]
1738 mov 8*0($nptr),%rax # n[0]
1745 mov 8*1($nptr),%rax # n[1]
1755 mov $m0,48-8+8(%rsp,%rcx,8) # put aside n0*a[i]
1764 mov 32+8(%rsp),$carry # pull n0, borrow $carry
1772 imulq %r8,$carry # modulo-scheduled
1802 mov $carry,$m0 # n0*a[i]
1804 mov 8*0($nptr),%rax # n[0]
1813 lea 8*8($nptr),$nptr
1815 mov 8+8(%rsp),%rdx # pull end of t[]
1816 cmp 0+8(%rsp),$nptr # end of n[]?
1828 sbb $carry,$carry # top carry
1830 mov 48+56+8(%rsp),$m0 # pull n0*a[0]
1840 mov %r8,($tptr) # save result
1849 lea 8($tptr),$tptr # $tptr++
1894 mov 48-16+8(%rsp,%rcx,8),$m0# pull n0*a[i]
1898 mov 8*0($nptr),%rax # pull n[0]
1905 lea 8*8($nptr),$nptr
1906 mov 8+8(%rsp),%rdx # pull end of t[]
1907 cmp 0+8(%rsp),$nptr # end of n[]?
1908 jae .L8x_tail_done # break out of loop
1910 mov 48+56+8(%rsp),$m0 # pull n0*a[0]
1912 mov 8*0($nptr),%rax # pull n[0]
1921 sbb $carry,$carry # top carry
1928 add (%rdx),%r8 # can this overflow?
1935 adc \$0,%r15 # can't overflow, because we
1936 # started with "overhung" part
1950 adc \$0,%rax # top-most carry
1951 mov -8($nptr),%rcx # np[num-1]
1954 movq %xmm2,$nptr # restore $nptr
1956 mov %r8,8*0($tptr) # store top 512 bits
1958 movq %xmm3,$num # $num is %r9, can't be moved upwards
1965 lea 8*8($tptr),$tptr
1967 cmp %rdx,$tptr # end of t[]?
1968 jb .L8x_reduction_loop
1970 .size bn_sqr8x_internal,.-bn_sqr8x_internal
1973 ##############################################################
1974 # Post-condition, 4x unrolled
1977 my ($tptr,$nptr)=("%rbx","%rbp");
1979 .type __bn_post4x_internal,\@abi-omnipotent
1981 __bn_post4x_internal:
1983 lea (%rdi,$num),$tptr # %rdi was $tptr above
1985 movq %xmm1,$rptr # restore $rptr
1987 movq %xmm1,$aptr # prepare for back-to-back call
1989 dec %r12 # so that after 'not' we get -n[0]
1994 jmp .Lsqr4x_sub_entry
2003 lea 8*4($nptr),$nptr
2013 neg %r10 # mov %r10,%cf
2019 lea 8*4($tptr),$tptr
2021 sbb %r10,%r10 # mov %cf,%r10
2024 lea 8*4($rptr),$rptr
2029 mov $num,%r10 # prepare for back-to-back call
2030 neg $num # restore $num
2032 .size __bn_post4x_internal,.-__bn_post4x_internal
2037 .globl bn_from_montgomery
2038 .type bn_from_montgomery,\@abi-omnipotent
2041 testl \$7,`($win64?"48(%rsp)":"%r9d")`
2045 .size bn_from_montgomery,.-bn_from_montgomery
2047 .type bn_from_mont8x,\@function,6
2060 shl \$3,${num}d # convert $num to bytes
2061 lea ($num,$num,2),%r10 # 3*$num in bytes
2065 ##############################################################
2066 # Ensure that stack frame doesn't alias with $rptr+3*$num
2067 # modulo 4096, which covers ret[num], am[num] and n[num]
2068 # (see bn_exp.c). The stack is allocated to aligned with
2069 # bn_power5's frame, and as bn_from_montgomery happens to be
2070 # last operation, we use the opportunity to cleanse it.
2072 lea -320(%rsp,$num,2),%r11
2078 sub %r11,%rbp # align with $aptr
2079 lea -320(%rbp,$num,2),%rbp # future alloca(frame+2*$num*8+256)
2084 lea 4096-320(,$num,2),%r10
2085 lea -320(%rbp,$num,2),%rbp # future alloca(frame+2*$num*8+256)
2095 lea (%rbp,%r11),%rsp
2099 jmp .Lfrom_page_walk_done
2102 lea -4096(%rsp),%rsp
2106 .Lfrom_page_walk_done:
2111 ##############################################################
2114 # +0 saved $num, used in reduction section
2115 # +8 &t[2*$num], used in reduction section
2121 mov %rax, 40(%rsp) # save original %rsp
2130 movdqu ($aptr),%xmm1
2131 movdqu 16($aptr),%xmm2
2132 movdqu 32($aptr),%xmm3
2133 movdqa %xmm0,(%rax,$num)
2134 movdqu 48($aptr),%xmm4
2135 movdqa %xmm0,16(%rax,$num)
2136 .byte 0x48,0x8d,0xb6,0x40,0x00,0x00,0x00 # lea 64($aptr),$aptr
2138 movdqa %xmm0,32(%rax,$num)
2139 movdqa %xmm2,16(%rax)
2140 movdqa %xmm0,48(%rax,$num)
2141 movdqa %xmm3,32(%rax)
2142 movdqa %xmm4,48(%rax)
2151 movq %r10, %xmm3 # -num
2153 $code.=<<___ if ($addx);
2154 mov OPENSSL_ia32cap_P+8(%rip),%r11d
2156 cmp \$0x80108,%r11d # check for AD*X+BMI2+BMI1
2159 lea (%rax,$num),$rptr
2160 call __bn_sqrx8x_reduction
2161 call __bn_postx4x_internal
2165 mov 40(%rsp),%rsi # restore %rsp
2166 jmp .Lfrom_mont_zero
2172 call __bn_sqr8x_reduction
2173 call __bn_post4x_internal
2177 mov 40(%rsp),%rsi # restore %rsp
2178 jmp .Lfrom_mont_zero
2182 movdqa %xmm0,16*0(%rax)
2183 movdqa %xmm0,16*1(%rax)
2184 movdqa %xmm0,16*2(%rax)
2185 movdqa %xmm0,16*3(%rax)
2188 jnz .Lfrom_mont_zero
2200 .size bn_from_mont8x,.-bn_from_mont8x
2206 my $bp="%rdx"; # restore original value
2209 .type bn_mulx4x_mont_gather5,\@function,6
2211 bn_mulx4x_mont_gather5:
2222 shl \$3,${num}d # convert $num to bytes
2223 lea ($num,$num,2),%r10 # 3*$num in bytes
2227 ##############################################################
2228 # Ensure that stack frame doesn't alias with $rptr+3*$num
2229 # modulo 4096, which covers ret[num], am[num] and n[num]
2230 # (see bn_exp.c). This is done to allow memory disambiguation
2231 # logic do its magic. [Extra [num] is allocated in order
2232 # to align with bn_power5's frame, which is cleansed after
2233 # completing exponentiation. Extra 256 bytes is for power mask
2234 # calculated from 7th argument, the index.]
2236 lea -320(%rsp,$num,2),%r11
2242 sub %r11,%rbp # align with $aptr
2243 lea -320(%rbp,$num,2),%rbp # future alloca(frame+2*$num*8+256)
2247 lea 4096-320(,$num,2),%r10
2248 lea -320(%rbp,$num,2),%rbp # future alloca(frame+2*$num*8+256)
2254 and \$-64,%rbp # ensure alignment
2258 lea (%rbp,%r11),%rsp
2261 ja .Lmulx4x_page_walk
2262 jmp .Lmulx4x_page_walk_done
2265 lea -4096(%rsp),%rsp
2268 ja .Lmulx4x_page_walk
2269 .Lmulx4x_page_walk_done:
2271 ##############################################################
2274 # +8 off-loaded &b[i]
2283 mov $n0, 32(%rsp) # save *n0
2284 mov %rax,40(%rsp) # save original %rsp
2286 call mulx4x_internal
2288 mov 40(%rsp),%rsi # restore %rsp
2300 .size bn_mulx4x_mont_gather5,.-bn_mulx4x_mont_gather5
2302 .type mulx4x_internal,\@abi-omnipotent
2305 mov $num,8(%rsp) # save -$num (it was in bytes)
2307 neg $num # restore $num
2309 neg %r10 # restore $num
2310 lea 128($bp,$num),%r13 # end of powers table (+size optimization)
2312 movd `($win64?56:8)`(%rax),%xmm5 # load 7th argument
2314 lea .Linc(%rip),%rax
2315 mov %r13,16+8(%rsp) # end of b[num]
2316 mov $num,24+8(%rsp) # inner counter
2317 mov $rp, 56+8(%rsp) # save $rp
2319 my ($aptr, $bptr, $nptr, $tptr, $mi, $bi, $zero, $num)=
2320 ("%rsi","%rdi","%rcx","%rbx","%r8","%r9","%rbp","%rax");
2322 my $STRIDE=2**5*8; # 5 is "window size"
2323 my $N=$STRIDE/4; # should match cache line size
2325 movdqa 0(%rax),%xmm0 # 00000001000000010000000000000000
2326 movdqa 16(%rax),%xmm1 # 00000002000000020000000200000002
2327 lea 88-112(%rsp,%r10),%r10 # place the mask after tp[num+1] (+ICache optimizaton)
2328 lea 128($bp),$bptr # size optimization
2330 pshufd \$0,%xmm5,%xmm5 # broadcast index
2335 ########################################################################
2336 # calculate mask by comparing 0..31 to index and save result to stack
2341 pcmpeqd %xmm5,%xmm0 # compare to 1,0
2344 for($i=0;$i<$STRIDE/16-4;$i+=4) {
2347 pcmpeqd %xmm5,%xmm1 # compare to 3,2
2348 movdqa %xmm0,`16*($i+0)+112`(%r10)
2352 pcmpeqd %xmm5,%xmm2 # compare to 5,4
2353 movdqa %xmm1,`16*($i+1)+112`(%r10)
2357 pcmpeqd %xmm5,%xmm3 # compare to 7,6
2358 movdqa %xmm2,`16*($i+2)+112`(%r10)
2363 movdqa %xmm3,`16*($i+3)+112`(%r10)
2367 $code.=<<___; # last iteration can be optimized
2371 movdqa %xmm0,`16*($i+0)+112`(%r10)
2375 movdqa %xmm1,`16*($i+1)+112`(%r10)
2378 movdqa %xmm2,`16*($i+2)+112`(%r10)
2380 pand `16*($i+0)-128`($bptr),%xmm0 # while it's still in register
2381 pand `16*($i+1)-128`($bptr),%xmm1
2382 pand `16*($i+2)-128`($bptr),%xmm2
2383 movdqa %xmm3,`16*($i+3)+112`(%r10)
2384 pand `16*($i+3)-128`($bptr),%xmm3
2388 for($i=0;$i<$STRIDE/16-4;$i+=4) {
2390 movdqa `16*($i+0)-128`($bptr),%xmm4
2391 movdqa `16*($i+1)-128`($bptr),%xmm5
2392 movdqa `16*($i+2)-128`($bptr),%xmm2
2393 pand `16*($i+0)+112`(%r10),%xmm4
2394 movdqa `16*($i+3)-128`($bptr),%xmm3
2395 pand `16*($i+1)+112`(%r10),%xmm5
2397 pand `16*($i+2)+112`(%r10),%xmm2
2399 pand `16*($i+3)+112`(%r10),%xmm3
2406 pshufd \$0x4e,%xmm0,%xmm1
2408 lea $STRIDE($bptr),$bptr
2409 movq %xmm0,%rdx # bp[0]
2410 lea 64+8*4+8(%rsp),$tptr
2413 mulx 0*8($aptr),$mi,%rax # a[0]*b[0]
2414 mulx 1*8($aptr),%r11,%r12 # a[1]*b[0]
2416 mulx 2*8($aptr),%rax,%r13 # ...
2419 mulx 3*8($aptr),%rax,%r14
2422 imulq 32+8(%rsp),$mi # "t[0]"*n0
2423 xor $zero,$zero # cf=0, of=0
2426 mov $bptr,8+8(%rsp) # off-load &b[i]
2428 lea 4*8($aptr),$aptr
2430 adcx $zero,%r14 # cf=0
2432 mulx 0*8($nptr),%rax,%r10
2433 adcx %rax,%r15 # discarded
2435 mulx 1*8($nptr),%rax,%r11
2438 mulx 2*8($nptr),%rax,%r12
2439 mov 24+8(%rsp),$bptr # counter value
2440 mov %r10,-8*4($tptr)
2443 mulx 3*8($nptr),%rax,%r15
2445 mov %r11,-8*3($tptr)
2447 adox $zero,%r15 # of=0
2448 lea 4*8($nptr),$nptr
2449 mov %r12,-8*2($tptr)
2454 adcx $zero,%r15 # cf=0, modulo-scheduled
2455 mulx 0*8($aptr),%r10,%rax # a[4]*b[0]
2457 mulx 1*8($aptr),%r11,%r14 # a[5]*b[0]
2459 mulx 2*8($aptr),%r12,%rax # ...
2461 mulx 3*8($aptr),%r13,%r14
2465 adcx $zero,%r14 # cf=0
2466 lea 4*8($aptr),$aptr
2467 lea 4*8($tptr),$tptr
2470 mulx 0*8($nptr),%rax,%r15
2473 mulx 1*8($nptr),%rax,%r15
2476 mulx 2*8($nptr),%rax,%r15
2477 mov %r10,-5*8($tptr)
2479 mov %r11,-4*8($tptr)
2481 mulx 3*8($nptr),%rax,%r15
2483 mov %r12,-3*8($tptr)
2486 lea 4*8($nptr),$nptr
2487 mov %r13,-2*8($tptr)
2489 dec $bptr # of=0, pass cf
2492 mov 8(%rsp),$num # load -num
2493 adc $zero,%r15 # modulo-scheduled
2494 lea ($aptr,$num),$aptr # rewind $aptr
2496 mov 8+8(%rsp),$bptr # re-load &b[i]
2497 adc $zero,$zero # top-most carry
2498 mov %r14,-1*8($tptr)
2503 lea 16-256($tptr),%r10 # where 256-byte mask is (+density control)
2508 for($i=0;$i<$STRIDE/16;$i+=4) {
2510 movdqa `16*($i+0)-128`($bptr),%xmm0
2511 movdqa `16*($i+1)-128`($bptr),%xmm1
2512 movdqa `16*($i+2)-128`($bptr),%xmm2
2513 pand `16*($i+0)+256`(%r10),%xmm0
2514 movdqa `16*($i+3)-128`($bptr),%xmm3
2515 pand `16*($i+1)+256`(%r10),%xmm1
2517 pand `16*($i+2)+256`(%r10),%xmm2
2519 pand `16*($i+3)+256`(%r10),%xmm3
2526 pshufd \$0x4e,%xmm4,%xmm0
2528 lea $STRIDE($bptr),$bptr
2529 movq %xmm0,%rdx # m0=bp[i]
2531 mov $zero,($tptr) # save top-most carry
2532 lea 4*8($tptr,$num),$tptr # rewind $tptr
2533 mulx 0*8($aptr),$mi,%r11 # a[0]*b[i]
2534 xor $zero,$zero # cf=0, of=0
2536 mulx 1*8($aptr),%r14,%r12 # a[1]*b[i]
2537 adox -4*8($tptr),$mi # +t[0]
2539 mulx 2*8($aptr),%r15,%r13 # ...
2540 adox -3*8($tptr),%r11
2542 mulx 3*8($aptr),%rdx,%r14
2543 adox -2*8($tptr),%r12
2545 lea ($nptr,$num),$nptr # rewind $nptr
2546 lea 4*8($aptr),$aptr
2547 adox -1*8($tptr),%r13
2552 imulq 32+8(%rsp),$mi # "t[0]"*n0
2555 xor $zero,$zero # cf=0, of=0
2556 mov $bptr,8+8(%rsp) # off-load &b[i]
2558 mulx 0*8($nptr),%rax,%r10
2559 adcx %rax,%r15 # discarded
2561 mulx 1*8($nptr),%rax,%r11
2564 mulx 2*8($nptr),%rax,%r12
2567 mulx 3*8($nptr),%rax,%r15
2569 mov 24+8(%rsp),$bptr # counter value
2570 mov %r10,-8*4($tptr)
2572 mov %r11,-8*3($tptr)
2573 adox $zero,%r15 # of=0
2574 mov %r12,-8*2($tptr)
2575 lea 4*8($nptr),$nptr
2580 mulx 0*8($aptr),%r10,%rax # a[4]*b[i]
2581 adcx $zero,%r15 # cf=0, modulo-scheduled
2583 mulx 1*8($aptr),%r11,%r14 # a[5]*b[i]
2584 adcx 0*8($tptr),%r10
2586 mulx 2*8($aptr),%r12,%rax # ...
2587 adcx 1*8($tptr),%r11
2589 mulx 3*8($aptr),%r13,%r14
2591 adcx 2*8($tptr),%r12
2593 adcx 3*8($tptr),%r13
2594 adox $zero,%r14 # of=0
2595 lea 4*8($aptr),$aptr
2596 lea 4*8($tptr),$tptr
2597 adcx $zero,%r14 # cf=0
2600 mulx 0*8($nptr),%rax,%r15
2603 mulx 1*8($nptr),%rax,%r15
2606 mulx 2*8($nptr),%rax,%r15
2607 mov %r10,-5*8($tptr)
2610 mov %r11,-4*8($tptr)
2611 mulx 3*8($nptr),%rax,%r15
2613 lea 4*8($nptr),$nptr
2614 mov %r12,-3*8($tptr)
2617 mov %r13,-2*8($tptr)
2619 dec $bptr # of=0, pass cf
2622 mov 0+8(%rsp),$num # load -num
2623 adc $zero,%r15 # modulo-scheduled
2624 sub 0*8($tptr),$bptr # pull top-most carry to %cf
2625 mov 8+8(%rsp),$bptr # re-load &b[i]
2628 lea ($aptr,$num),$aptr # rewind $aptr
2629 adc $zero,$zero # top-most carry
2630 mov %r14,-1*8($tptr)
2637 mov ($nptr,$num),%r12
2638 lea ($nptr,$num),%rbp # rewind $nptr
2640 lea ($tptr,$num),%rdi # rewind $tptr
2643 sub %r14,%r10 # compare top-most words
2647 sub %r8,%rax # %rax=-%r8
2648 mov 56+8(%rsp),%rdx # restore rp
2649 dec %r12 # so that after 'not' we get -n[0]
2654 jmp .Lsqrx4x_sub_entry # common post-condition
2655 .size mulx4x_internal,.-mulx4x_internal
2658 ######################################################################
2660 my $rptr="%rdi"; # BN_ULONG *rptr,
2661 my $aptr="%rsi"; # const BN_ULONG *aptr,
2662 my $bptr="%rdx"; # const void *table,
2663 my $nptr="%rcx"; # const BN_ULONG *nptr,
2664 my $n0 ="%r8"; # const BN_ULONG *n0);
2665 my $num ="%r9"; # int num, has to be divisible by 8
2668 my ($i,$j,$tptr)=("%rbp","%rcx",$rptr);
2669 my @A0=("%r10","%r11");
2670 my @A1=("%r12","%r13");
2671 my ($a0,$a1,$ai)=("%r14","%r15","%rbx");
2674 .type bn_powerx5,\@function,6
2687 shl \$3,${num}d # convert $num to bytes
2688 lea ($num,$num,2),%r10 # 3*$num in bytes
2692 ##############################################################
2693 # Ensure that stack frame doesn't alias with $rptr+3*$num
2694 # modulo 4096, which covers ret[num], am[num] and n[num]
2695 # (see bn_exp.c). This is done to allow memory disambiguation
2696 # logic do its magic. [Extra 256 bytes is for power mask
2697 # calculated from 7th argument, the index.]
2699 lea -320(%rsp,$num,2),%r11
2705 sub %r11,%rbp # align with $aptr
2706 lea -320(%rbp,$num,2),%rbp # future alloca(frame+2*$num*8+256)
2711 lea 4096-320(,$num,2),%r10
2712 lea -320(%rbp,$num,2),%rbp # alloca(frame+2*$num*8+256)
2722 lea (%rbp,%r11),%rsp
2726 jmp .Lpwrx_page_walk_done
2729 lea -4096(%rsp),%rsp
2733 .Lpwrx_page_walk_done:
2738 ##############################################################
2741 # +0 saved $num, used in reduction section
2742 # +8 &t[2*$num], used in reduction section
2743 # +16 intermediate carry bit
2744 # +24 top-most carry bit, used in reduction section
2750 movq $rptr,%xmm1 # save $rptr
2751 movq $nptr,%xmm2 # save $nptr
2752 movq %r10, %xmm3 # -$num
2755 mov %rax, 40(%rsp) # save original %rsp
2758 call __bn_sqrx8x_internal
2759 call __bn_postx4x_internal
2760 call __bn_sqrx8x_internal
2761 call __bn_postx4x_internal
2762 call __bn_sqrx8x_internal
2763 call __bn_postx4x_internal
2764 call __bn_sqrx8x_internal
2765 call __bn_postx4x_internal
2766 call __bn_sqrx8x_internal
2767 call __bn_postx4x_internal
2769 mov %r10,$num # -num
2775 call mulx4x_internal
2777 mov 40(%rsp),%rsi # restore %rsp
2789 .size bn_powerx5,.-bn_powerx5
2791 .globl bn_sqrx8x_internal
2792 .hidden bn_sqrx8x_internal
2793 .type bn_sqrx8x_internal,\@abi-omnipotent
2796 __bn_sqrx8x_internal:
2797 ##################################################################
2800 # a) multiply-n-add everything but a[i]*a[i];
2801 # b) shift result of a) by 1 to the left and accumulate
2802 # a[i]*a[i] products;
2804 ##################################################################
2805 # a[7]a[7]a[6]a[6]a[5]a[5]a[4]a[4]a[3]a[3]a[2]a[2]a[1]a[1]a[0]a[0]
2836 # a[7]a[7]a[6]a[6]a[5]a[5]a[4]a[4]a[3]a[3]a[2]a[2]a[1]a[1]a[0]a[0]
2839 my ($zero,$carry)=("%rbp","%rcx");
2842 lea 48+8(%rsp),$tptr
2843 lea ($aptr,$num),$aaptr
2844 mov $num,0+8(%rsp) # save $num
2845 mov $aaptr,8+8(%rsp) # save end of $aptr
2846 jmp .Lsqr8x_zero_start
2849 .byte 0x66,0x66,0x66,0x2e,0x0f,0x1f,0x84,0x00,0x00,0x00,0x00,0x00
2852 movdqa %xmm0,0*8($tptr)
2853 movdqa %xmm0,2*8($tptr)
2854 movdqa %xmm0,4*8($tptr)
2855 movdqa %xmm0,6*8($tptr)
2856 .Lsqr8x_zero_start: # aligned at 32
2857 movdqa %xmm0,8*8($tptr)
2858 movdqa %xmm0,10*8($tptr)
2859 movdqa %xmm0,12*8($tptr)
2860 movdqa %xmm0,14*8($tptr)
2861 lea 16*8($tptr),$tptr
2865 mov 0*8($aptr),%rdx # a[0], modulo-scheduled
2866 #xor %r9,%r9 # t[1], ex-$num, zero already
2873 lea 48+8(%rsp),$tptr
2874 xor $zero,$zero # cf=0, cf=0
2875 jmp .Lsqrx8x_outer_loop
2878 .Lsqrx8x_outer_loop:
2879 mulx 1*8($aptr),%r8,%rax # a[1]*a[0]
2880 adcx %r9,%r8 # a[1]*a[0]+=t[1]
2882 mulx 2*8($aptr),%r9,%rax # a[2]*a[0]
2885 .byte 0xc4,0xe2,0xab,0xf6,0x86,0x18,0x00,0x00,0x00 # mulx 3*8($aptr),%r10,%rax # ...
2888 .byte 0xc4,0xe2,0xa3,0xf6,0x86,0x20,0x00,0x00,0x00 # mulx 4*8($aptr),%r11,%rax
2891 mulx 5*8($aptr),%r12,%rax
2894 mulx 6*8($aptr),%r13,%rax
2897 mulx 7*8($aptr),%r14,%r15
2898 mov 1*8($aptr),%rdx # a[1]
2902 mov %r8,1*8($tptr) # t[1]
2903 mov %r9,2*8($tptr) # t[2]
2904 sbb $carry,$carry # mov %cf,$carry
2905 xor $zero,$zero # cf=0, of=0
2908 mulx 2*8($aptr),%r8,%rbx # a[2]*a[1]
2909 mulx 3*8($aptr),%r9,%rax # a[3]*a[1]
2912 mulx 4*8($aptr),%r10,%rbx # ...
2915 .byte 0xc4,0xe2,0xa3,0xf6,0x86,0x28,0x00,0x00,0x00 # mulx 5*8($aptr),%r11,%rax
2918 .byte 0xc4,0xe2,0x9b,0xf6,0x9e,0x30,0x00,0x00,0x00 # mulx 6*8($aptr),%r12,%rbx
2921 .byte 0xc4,0x62,0x93,0xf6,0xb6,0x38,0x00,0x00,0x00 # mulx 7*8($aptr),%r13,%r14
2922 mov 2*8($aptr),%rdx # a[2]
2926 adox $zero,%r14 # of=0
2927 adcx $zero,%r14 # cf=0
2929 mov %r8,3*8($tptr) # t[3]
2930 mov %r9,4*8($tptr) # t[4]
2932 mulx 3*8($aptr),%r8,%rbx # a[3]*a[2]
2933 mulx 4*8($aptr),%r9,%rax # a[4]*a[2]
2936 mulx 5*8($aptr),%r10,%rbx # ...
2939 .byte 0xc4,0xe2,0xa3,0xf6,0x86,0x30,0x00,0x00,0x00 # mulx 6*8($aptr),%r11,%rax
2942 .byte 0xc4,0x62,0x9b,0xf6,0xae,0x38,0x00,0x00,0x00 # mulx 7*8($aptr),%r12,%r13
2944 mov 3*8($aptr),%rdx # a[3]
2948 mov %r8,5*8($tptr) # t[5]
2949 mov %r9,6*8($tptr) # t[6]
2950 mulx 4*8($aptr),%r8,%rax # a[4]*a[3]
2951 adox $zero,%r13 # of=0
2952 adcx $zero,%r13 # cf=0
2954 mulx 5*8($aptr),%r9,%rbx # a[5]*a[3]
2957 mulx 6*8($aptr),%r10,%rax # ...
2960 mulx 7*8($aptr),%r11,%r12
2961 mov 4*8($aptr),%rdx # a[4]
2962 mov 5*8($aptr),%r14 # a[5]
2965 mov 6*8($aptr),%r15 # a[6]
2967 adox $zero,%r12 # of=0
2968 adcx $zero,%r12 # cf=0
2970 mov %r8,7*8($tptr) # t[7]
2971 mov %r9,8*8($tptr) # t[8]
2973 mulx %r14,%r9,%rax # a[5]*a[4]
2974 mov 7*8($aptr),%r8 # a[7]
2976 mulx %r15,%r10,%rbx # a[6]*a[4]
2979 mulx %r8,%r11,%rax # a[7]*a[4]
2980 mov %r14,%rdx # a[5]
2983 #adox $zero,%rax # of=0
2984 adcx $zero,%rax # cf=0
2986 mulx %r15,%r14,%rbx # a[6]*a[5]
2987 mulx %r8,%r12,%r13 # a[7]*a[5]
2988 mov %r15,%rdx # a[6]
2989 lea 8*8($aptr),$aptr
2996 mulx %r8,%r8,%r14 # a[7]*a[6]
3001 je .Lsqrx8x_outer_break
3003 neg $carry # mov $carry,%cf
3007 adcx 9*8($tptr),%r9 # +=t[9]
3008 adcx 10*8($tptr),%r10 # ...
3009 adcx 11*8($tptr),%r11
3010 adc 12*8($tptr),%r12
3011 adc 13*8($tptr),%r13
3012 adc 14*8($tptr),%r14
3013 adc 15*8($tptr),%r15
3015 lea 2*64($tptr),$tptr
3016 sbb %rax,%rax # mov %cf,$carry
3018 mov -64($aptr),%rdx # a[0]
3019 mov %rax,16+8(%rsp) # offload $carry
3020 mov $tptr,24+8(%rsp)
3022 #lea 8*8($tptr),$tptr # see 2*8*8($tptr) above
3023 xor %eax,%eax # cf=0, of=0
3029 mulx 0*8($aaptr),%rax,%r8 # a[8]*a[i]
3030 adcx %rax,%rbx # +=t[8]
3033 mulx 1*8($aaptr),%rax,%r9 # ...
3037 mulx 2*8($aaptr),%rax,%r10
3041 mulx 3*8($aaptr),%rax,%r11
3045 .byte 0xc4,0x62,0xfb,0xf6,0xa5,0x20,0x00,0x00,0x00 # mulx 4*8($aaptr),%rax,%r12
3049 mulx 5*8($aaptr),%rax,%r13
3053 mulx 6*8($aaptr),%rax,%r14
3054 mov %rbx,($tptr,%rcx,8) # store t[8+i]
3059 .byte 0xc4,0x62,0xfb,0xf6,0xbd,0x38,0x00,0x00,0x00 # mulx 7*8($aaptr),%rax,%r15
3060 mov 8($aptr,%rcx,8),%rdx # a[i]
3062 adox %rbx,%r15 # %rbx is 0, of=0
3063 adcx %rbx,%r15 # cf=0
3069 lea 8*8($aaptr),$aaptr
3071 cmp 8+8(%rsp),$aaptr # done?
3074 sub 16+8(%rsp),%rbx # mov 16(%rsp),%cf
3085 lea 8*8($tptr),$tptr
3087 sbb %rax,%rax # mov %cf,%rax
3088 xor %ebx,%ebx # cf=0, of=0
3089 mov %rax,16+8(%rsp) # offload carry
3094 sub 16+8(%rsp),%r8 # consume last carry
3095 mov 24+8(%rsp),$carry # initial $tptr, borrow $carry
3096 mov 0*8($aptr),%rdx # a[8], modulo-scheduled
3097 xor %ebp,%ebp # xor $zero,$zero
3099 cmp $carry,$tptr # cf=0, of=0
3100 je .Lsqrx8x_outer_loop
3105 mov 2*8($carry),%r10
3107 mov 3*8($carry),%r11
3109 mov 4*8($carry),%r12
3111 mov 5*8($carry),%r13
3113 mov 6*8($carry),%r14
3115 mov 7*8($carry),%r15
3117 jmp .Lsqrx8x_outer_loop
3120 .Lsqrx8x_outer_break:
3121 mov %r9,9*8($tptr) # t[9]
3122 movq %xmm3,%rcx # -$num
3123 mov %r10,10*8($tptr) # ...
3124 mov %r11,11*8($tptr)
3125 mov %r12,12*8($tptr)
3126 mov %r13,13*8($tptr)
3127 mov %r14,14*8($tptr)
3132 lea 48+8(%rsp),$tptr
3133 mov ($aptr,$i),%rdx # a[0]
3135 mov 8($tptr),$A0[1] # t[1]
3136 xor $A0[0],$A0[0] # t[0], of=0, cf=0
3137 mov 0+8(%rsp),$num # restore $num
3139 mov 16($tptr),$A1[0] # t[2] # prefetch
3140 mov 24($tptr),$A1[1] # t[3] # prefetch
3141 #jmp .Lsqrx4x_shift_n_add # happens to be aligned
3144 .Lsqrx4x_shift_n_add:
3148 .byte 0x48,0x8b,0x94,0x0e,0x08,0x00,0x00,0x00 # mov 8($aptr,$i),%rdx # a[i+1] # prefetch
3149 .byte 0x4c,0x8b,0x97,0x20,0x00,0x00,0x00 # mov 32($tptr),$A0[0] # t[2*i+4] # prefetch
3152 mov 40($tptr),$A0[1] # t[2*i+4+1] # prefetch
3159 mov 16($aptr,$i),%rdx # a[i+2] # prefetch
3160 mov 48($tptr),$A1[0] # t[2*i+6] # prefetch
3163 mov 56($tptr),$A1[1] # t[2*i+6+1] # prefetch
3170 mov 24($aptr,$i),%rdx # a[i+3] # prefetch
3172 mov 64($tptr),$A0[0] # t[2*i+8] # prefetch
3175 mov 72($tptr),$A0[1] # t[2*i+8+1] # prefetch
3182 jrcxz .Lsqrx4x_shift_n_add_break
3183 .byte 0x48,0x8b,0x94,0x0e,0x00,0x00,0x00,0x00 # mov 0($aptr,$i),%rdx # a[i+4] # prefetch
3186 mov 80($tptr),$A1[0] # t[2*i+10] # prefetch
3187 mov 88($tptr),$A1[1] # t[2*i+10+1] # prefetch
3192 jmp .Lsqrx4x_shift_n_add
3195 .Lsqrx4x_shift_n_add_break:
3199 lea 64($tptr),$tptr # end of t[] buffer
3202 ######################################################################
3203 # Montgomery reduction part, "word-by-word" algorithm.
3205 # This new path is inspired by multiple submissions from Intel, by
3206 # Shay Gueron, Vlad Krasnov, Erdinc Ozturk, James Guilford,
3209 my ($nptr,$carry,$m0)=("%rbp","%rsi","%rdx");
3213 __bn_sqrx8x_reduction:
3214 xor %eax,%eax # initial top-most carry bit
3215 mov 32+8(%rsp),%rbx # n0
3216 mov 48+8(%rsp),%rdx # "%r8", 8*0($tptr)
3217 lea -8*8($nptr,$num),%rcx # end of n[]
3218 #lea 48+8(%rsp,$num,2),$tptr # end of t[] buffer
3219 mov %rcx, 0+8(%rsp) # save end of n[]
3220 mov $tptr,8+8(%rsp) # save end of t[]
3222 lea 48+8(%rsp),$tptr # initial t[] window
3223 jmp .Lsqrx8x_reduction_loop
3226 .Lsqrx8x_reduction_loop:
3232 imulq %rbx,%rdx # n0*a[i]
3236 mov %rax,24+8(%rsp) # store top-most carry bit
3238 lea 8*8($tptr),$tptr
3239 xor $carry,$carry # cf=0,of=0
3246 mulx 8*0($nptr),%rax,%r8 # n[0]
3247 adcx %rbx,%rax # discarded
3250 mulx 8*1($nptr),%rbx,%r9 # n[1]
3254 mulx 8*2($nptr),%rbx,%r10
3258 mulx 8*3($nptr),%rbx,%r11
3262 .byte 0xc4,0x62,0xe3,0xf6,0xa5,0x20,0x00,0x00,0x00 # mulx 8*4($nptr),%rbx,%r12
3268 mulx 32+8(%rsp),%rbx,%rdx # %rdx discarded
3270 mov %rax,64+48+8(%rsp,%rcx,8) # put aside n0*a[i]
3272 mulx 8*5($nptr),%rax,%r13
3276 mulx 8*6($nptr),%rax,%r14
3280 mulx 8*7($nptr),%rax,%r15
3283 adox $carry,%r15 # $carry is 0
3284 adcx $carry,%r15 # cf=0
3286 .byte 0x67,0x67,0x67
3290 mov $carry,%rax # xor %rax,%rax
3291 cmp 0+8(%rsp),$nptr # end of n[]?
3292 jae .Lsqrx8x_no_tail
3294 mov 48+8(%rsp),%rdx # pull n0*a[0]
3296 lea 8*8($nptr),$nptr
3299 adcx 8*2($tptr),%r10
3305 lea 8*8($tptr),$tptr
3306 sbb %rax,%rax # top carry
3308 xor $carry,$carry # of=0, cf=0
3315 mulx 8*0($nptr),%rax,%r8
3319 mulx 8*1($nptr),%rax,%r9
3323 mulx 8*2($nptr),%rax,%r10
3327 mulx 8*3($nptr),%rax,%r11
3331 .byte 0xc4,0x62,0xfb,0xf6,0xa5,0x20,0x00,0x00,0x00 # mulx 8*4($nptr),%rax,%r12
3335 mulx 8*5($nptr),%rax,%r13
3339 mulx 8*6($nptr),%rax,%r14
3343 mulx 8*7($nptr),%rax,%r15
3344 mov 72+48+8(%rsp,%rcx,8),%rdx # pull n0*a[i]
3347 mov %rbx,($tptr,%rcx,8) # save result
3349 adcx $carry,%r15 # cf=0
3354 cmp 0+8(%rsp),$nptr # end of n[]?
3355 jae .Lsqrx8x_tail_done # break out of loop
3357 sub 16+8(%rsp),$carry # mov 16(%rsp),%cf
3358 mov 48+8(%rsp),%rdx # pull n0*a[0]
3359 lea 8*8($nptr),$nptr
3368 lea 8*8($tptr),$tptr
3370 sub \$8,%rcx # mov \$-8,%rcx
3372 xor $carry,$carry # of=0, cf=0
3378 add 24+8(%rsp),%r8 # can this overflow?
3385 adc \$0,%r15 # can't overflow, because we
3386 # started with "overhung" part
3388 mov $carry,%rax # xor %rax,%rax
3390 sub 16+8(%rsp),$carry # mov 16(%rsp),%cf
3391 .Lsqrx8x_no_tail: # %cf is 0 if jumped here
3395 mov 8*7($nptr),$carry
3396 movq %xmm2,$nptr # restore $nptr
3403 adc %rax,%rax # top-most carry
3405 mov 32+8(%rsp),%rbx # n0
3406 mov 8*8($tptr,%rcx),%rdx # modulo-scheduled "%r8"
3408 mov %r8,8*0($tptr) # store top 512 bits
3409 lea 8*8($tptr),%r8 # borrow %r8
3418 lea 8*8($tptr,%rcx),$tptr # start of current t[] window
3419 cmp 8+8(%rsp),%r8 # end of t[]?
3420 jb .Lsqrx8x_reduction_loop
3422 .size bn_sqrx8x_internal,.-bn_sqrx8x_internal
3425 ##############################################################
3426 # Post-condition, 4x unrolled
3429 my ($rptr,$nptr)=("%rdx","%rbp");
3432 __bn_postx4x_internal:
3434 mov %rcx,%r10 # -$num
3435 mov %rcx,%r9 # -$num
3438 #lea 48+8(%rsp,%r9),$tptr
3439 movq %xmm1,$rptr # restore $rptr
3440 movq %xmm1,$aptr # prepare for back-to-back call
3441 dec %r12 # so that after 'not' we get -n[0]
3446 jmp .Lsqrx4x_sub_entry
3456 lea 8*4($nptr),$nptr
3461 neg %r8 # mov %r8,%cf
3467 lea 8*4($tptr),$tptr
3469 sbb %r8,%r8 # mov %cf,%r8
3472 lea 8*4($rptr),$rptr
3477 neg %r9 # restore $num
3480 .size __bn_postx4x_internal,.-__bn_postx4x_internal
3485 my ($inp,$num,$tbl,$idx)=$win64?("%rcx","%edx","%r8", "%r9d") : # Win64 order
3486 ("%rdi","%esi","%rdx","%ecx"); # Unix order
3493 .type bn_get_bits5,\@abi-omnipotent
3505 movzw (%r10,$num,2),%eax
3509 .size bn_get_bits5,.-bn_get_bits5
3512 .type bn_scatter5,\@abi-omnipotent
3516 jz .Lscatter_epilogue
3517 lea ($tbl,$idx,8),$tbl
3527 .size bn_scatter5,.-bn_scatter5
3530 .type bn_gather5,\@abi-omnipotent
3533 .LSEH_begin_bn_gather5: # Win64 thing, but harmless in other cases
3534 # I can't trust assembler to use specific encoding:-(
3535 .byte 0x4c,0x8d,0x14,0x24 #lea (%rsp),%r10
3536 .byte 0x48,0x81,0xec,0x08,0x01,0x00,0x00 #sub $0x108,%rsp
3537 lea .Linc(%rip),%rax
3538 and \$-16,%rsp # shouldn't be formally required
3541 movdqa 0(%rax),%xmm0 # 00000001000000010000000000000000
3542 movdqa 16(%rax),%xmm1 # 00000002000000020000000200000002
3543 lea 128($tbl),%r11 # size optimization
3544 lea 128(%rsp),%rax # size optimization
3546 pshufd \$0,%xmm5,%xmm5 # broadcast $idx
3550 ########################################################################
3551 # calculate mask by comparing 0..31 to $idx and save result to stack
3553 for($i=0;$i<$STRIDE/16;$i+=4) {
3556 pcmpeqd %xmm5,%xmm0 # compare to 1,0
3558 $code.=<<___ if ($i);
3559 movdqa %xmm3,`16*($i-1)-128`(%rax)
3565 pcmpeqd %xmm5,%xmm1 # compare to 3,2
3566 movdqa %xmm0,`16*($i+0)-128`(%rax)
3570 pcmpeqd %xmm5,%xmm2 # compare to 5,4
3571 movdqa %xmm1,`16*($i+1)-128`(%rax)
3575 pcmpeqd %xmm5,%xmm3 # compare to 7,6
3576 movdqa %xmm2,`16*($i+2)-128`(%rax)
3581 movdqa %xmm3,`16*($i-1)-128`(%rax)
3589 for($i=0;$i<$STRIDE/16;$i+=4) {
3591 movdqa `16*($i+0)-128`(%r11),%xmm0
3592 movdqa `16*($i+1)-128`(%r11),%xmm1
3593 movdqa `16*($i+2)-128`(%r11),%xmm2
3594 pand `16*($i+0)-128`(%rax),%xmm0
3595 movdqa `16*($i+3)-128`(%r11),%xmm3
3596 pand `16*($i+1)-128`(%rax),%xmm1
3598 pand `16*($i+2)-128`(%rax),%xmm2
3600 pand `16*($i+3)-128`(%rax),%xmm3
3607 lea $STRIDE(%r11),%r11
3608 pshufd \$0x4e,%xmm4,%xmm0
3610 movq %xmm0,($out) # m0=bp[0]
3617 .LSEH_end_bn_gather5:
3618 .size bn_gather5,.-bn_gather5
3626 .asciz "Montgomery Multiplication with scatter/gather for x86_64, CRYPTOGAMS by <appro\@openssl.org>"
3629 # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame,
3630 # CONTEXT *context,DISPATCHER_CONTEXT *disp)
3638 .extern __imp_RtlVirtualUnwind
3639 .type mul_handler,\@abi-omnipotent
3653 mov 120($context),%rax # pull context->Rax
3654 mov 248($context),%rbx # pull context->Rip
3656 mov 8($disp),%rsi # disp->ImageBase
3657 mov 56($disp),%r11 # disp->HandlerData
3659 mov 0(%r11),%r10d # HandlerData[0]
3660 lea (%rsi,%r10),%r10 # end of prologue label
3661 cmp %r10,%rbx # context->Rip<end of prologue label
3662 jb .Lcommon_seh_tail
3664 mov 4(%r11),%r10d # HandlerData[1]
3665 lea (%rsi,%r10),%r10 # epilogue label
3666 cmp %r10,%rbx # context->Rip>=epilogue label
3667 jb .Lcommon_pop_regs
3669 mov 152($context),%rax # pull context->Rsp
3671 mov 8(%r11),%r10d # HandlerData[2]
3672 lea (%rsi,%r10),%r10 # epilogue label
3673 cmp %r10,%rbx # context->Rip>=epilogue label
3674 jae .Lcommon_seh_tail
3676 lea .Lmul_epilogue(%rip),%r10
3680 mov 192($context),%r10 # pull $num
3681 mov 8(%rax,%r10,8),%rax # pull saved stack pointer
3683 jmp .Lcommon_pop_regs
3686 mov 40(%rax),%rax # pull saved stack pointer
3694 mov %rbx,144($context) # restore context->Rbx
3695 mov %rbp,160($context) # restore context->Rbp
3696 mov %r12,216($context) # restore context->R12
3697 mov %r13,224($context) # restore context->R13
3698 mov %r14,232($context) # restore context->R14
3699 mov %r15,240($context) # restore context->R15
3704 mov %rax,152($context) # restore context->Rsp
3705 mov %rsi,168($context) # restore context->Rsi
3706 mov %rdi,176($context) # restore context->Rdi
3708 mov 40($disp),%rdi # disp->ContextRecord
3709 mov $context,%rsi # context
3710 mov \$154,%ecx # sizeof(CONTEXT)
3711 .long 0xa548f3fc # cld; rep movsq
3714 xor %rcx,%rcx # arg1, UNW_FLAG_NHANDLER
3715 mov 8(%rsi),%rdx # arg2, disp->ImageBase
3716 mov 0(%rsi),%r8 # arg3, disp->ControlPc
3717 mov 16(%rsi),%r9 # arg4, disp->FunctionEntry
3718 mov 40(%rsi),%r10 # disp->ContextRecord
3719 lea 56(%rsi),%r11 # &disp->HandlerData
3720 lea 24(%rsi),%r12 # &disp->EstablisherFrame
3721 mov %r10,32(%rsp) # arg5
3722 mov %r11,40(%rsp) # arg6
3723 mov %r12,48(%rsp) # arg7
3724 mov %rcx,56(%rsp) # arg8, (NULL)
3725 call *__imp_RtlVirtualUnwind(%rip)
3727 mov \$1,%eax # ExceptionContinueSearch
3739 .size mul_handler,.-mul_handler
3743 .rva .LSEH_begin_bn_mul_mont_gather5
3744 .rva .LSEH_end_bn_mul_mont_gather5
3745 .rva .LSEH_info_bn_mul_mont_gather5
3747 .rva .LSEH_begin_bn_mul4x_mont_gather5
3748 .rva .LSEH_end_bn_mul4x_mont_gather5
3749 .rva .LSEH_info_bn_mul4x_mont_gather5
3751 .rva .LSEH_begin_bn_power5
3752 .rva .LSEH_end_bn_power5
3753 .rva .LSEH_info_bn_power5
3755 .rva .LSEH_begin_bn_from_mont8x
3756 .rva .LSEH_end_bn_from_mont8x
3757 .rva .LSEH_info_bn_from_mont8x
3759 $code.=<<___ if ($addx);
3760 .rva .LSEH_begin_bn_mulx4x_mont_gather5
3761 .rva .LSEH_end_bn_mulx4x_mont_gather5
3762 .rva .LSEH_info_bn_mulx4x_mont_gather5
3764 .rva .LSEH_begin_bn_powerx5
3765 .rva .LSEH_end_bn_powerx5
3766 .rva .LSEH_info_bn_powerx5
3769 .rva .LSEH_begin_bn_gather5
3770 .rva .LSEH_end_bn_gather5
3771 .rva .LSEH_info_bn_gather5
3775 .LSEH_info_bn_mul_mont_gather5:
3778 .rva .Lmul_body,.Lmul_body,.Lmul_epilogue # HandlerData[]
3780 .LSEH_info_bn_mul4x_mont_gather5:
3783 .rva .Lmul4x_prologue,.Lmul4x_body,.Lmul4x_epilogue # HandlerData[]
3785 .LSEH_info_bn_power5:
3788 .rva .Lpower5_prologue,.Lpower5_body,.Lpower5_epilogue # HandlerData[]
3790 .LSEH_info_bn_from_mont8x:
3793 .rva .Lfrom_prologue,.Lfrom_body,.Lfrom_epilogue # HandlerData[]
3795 $code.=<<___ if ($addx);
3797 .LSEH_info_bn_mulx4x_mont_gather5:
3800 .rva .Lmulx4x_prologue,.Lmulx4x_body,.Lmulx4x_epilogue # HandlerData[]
3802 .LSEH_info_bn_powerx5:
3805 .rva .Lpowerx5_prologue,.Lpowerx5_body,.Lpowerx5_epilogue # HandlerData[]
3809 .LSEH_info_bn_gather5:
3810 .byte 0x01,0x0b,0x03,0x0a
3811 .byte 0x0b,0x01,0x21,0x00 # sub rsp,0x108
3812 .byte 0x04,0xa3,0x00,0x00 # lea r10,(rsp)
3817 $code =~ s/\`([^\`]*)\`/eval($1)/gem;