3 # ====================================================================
4 # Written by Andy Polyakov <appro@fy.chalmers.se> for the OpenSSL
5 # project. The module is, however, dual licensed under OpenSSL and
6 # CRYPTOGAMS licenses depending on where you obtain it. For further
7 # details see http://www.openssl.org/~appro/cryptogams/.
8 # ====================================================================
12 # Montgomery multiplication for ARMv4.
14 # Performance improvement naturally varies among CPU implementations
15 # and compilers. The code was observed to provide +65-35% improvement
16 # [depending on key length, less for longer keys] on ARM920T, and
17 # +115-80% on Intel IXP425. This is compared to pre-bn_mul_mont code
18 # base and compiler generated code with in-lined umull and even umlal
19 # instructions. The latter means that this code didn't really have an
20 # "advantage" of utilizing some "secret" instruction.
22 # The code is interoperable with Thumb ISA and is rather compact, less
23 # than 1/2KB. Windows CE port would be trivial, as it's exclusively
24 # about decorations, ABI and instruction syntax are identical.
26 while (($output=shift) && ($output!~/^\w[\w\-]*\.\w+$/)) {}
27 open STDOUT,">$output";
29 $num="r0"; # starts as num argument, but holds &tp[num-1]
31 $bp="r2"; $bi="r2"; $rp="r2";
38 ########### # r9 is reserved by ELF as platform specific, e.g. TLS pointer
39 $alo="r10"; # sl, gcc uses it to keep @GOT
42 ########### # r13 is stack pointer
44 ########### # r15 is program counter
46 #### argument block layout relative to &tp[num-1], a.k.a. $num
48 # ap permanently resides in r1
50 # np permanently resides in r3
52 $_num="$num,#15*4"; $_bpend=$_num;
58 .type bn_mul_mont,%function
62 stmdb sp!,{r0,r2} @ sp points at argument block
63 ldr $num,[sp,#3*4] @ load num
69 stmdb sp!,{r4-r12,lr} @ save 10 registers
71 mov $num,$num,lsl#2 @ rescale $num for byte count
72 sub sp,sp,$num @ alloca(4*num)
73 sub sp,sp,#4 @ +extra dword
74 sub $num,$num,#4 @ "num=num-1"
75 add $tp,$bp,$num @ &bp[num-1]
77 add $num,sp,$num @ $num to point at &tp[num-1]
80 ldr $aj,[$ap],#4 @ ap[0],ap++
81 ldr $nj,[$np],#4 @ np[0],np++
83 str $tp,[$_bpend] @ save &bp[num]
85 umull $alo,$ahi,$aj,$bi @ ap[0]*bp[0]
86 str $n0,[$_n0] @ save n0 value
87 mul $n0,$alo,$n0 @ "tp[0]"*n0
89 umlal $alo,$nlo,$nj,$n0 @ np[0]*n0+"t[0]"
93 ldr $aj,[$ap],#4 @ ap[j],ap++
96 umlal $alo,$ahi,$aj,$bi @ ap[j]*bp[0]
97 ldr $nj,[$np],#4 @ np[j],np++
99 umlal $nlo,$nhi,$nj,$n0 @ np[j]*n0
101 str $nlo,[$tp],#4 @ tp[j-1]=,tp++
109 ldr $tp,[$_bp] @ restore bp
110 str $nlo,[$num] @ tp[num-1]=
111 ldr $n0,[$_n0] @ restore n0
112 str $nhi,[$num,#4] @ tp[num]=
115 sub $tj,$num,sp @ "original" $num-1 value
116 sub $ap,$ap,$tj @ "rewind" ap to &ap[1]
117 sub $np,$np,$tj @ "rewind" np to &np[1]
118 ldr $bi,[$tp,#4]! @ *(++bp)
119 ldr $aj,[$ap,#-4] @ ap[0]
120 ldr $nj,[$np,#-4] @ np[0]
121 ldr $alo,[sp] @ tp[0]
122 ldr $tj,[sp,#4] @ tp[1]
125 umlal $alo,$ahi,$aj,$bi @ ap[0]*bp[i]+tp[0]
126 str $tp,[$_bp] @ save bp
129 umlal $alo,$nlo,$nj,$n0 @ np[0]*n0+"tp[0]"
133 ldr $aj,[$ap],#4 @ ap[j],ap++
134 adds $alo,$ahi,$tj @ +=tp[j]
136 umlal $alo,$ahi,$aj,$bi @ ap[j]*bp[i]
137 ldr $nj,[$np],#4 @ np[j],np++
139 umlal $nlo,$nhi,$nj,$n0 @ np[j]*n0
140 ldr $tj,[$tp,#8] @ tp[j+1]
143 str $nlo,[$tp],#4 @ tp[j-1]=,tp++
153 ldr $tp,[$_bp] @ restore bp
154 ldr $tj,[$_bpend] @ restore &bp[num]
155 str $nlo,[$num] @ tp[num-1]=
156 ldr $n0,[$_n0] @ restore n0
157 str $nhi,[$num,#4] @ tp[num]=
162 ldr $rp,[$_rp] @ pull rp
163 add $num,$num,#4 @ $num to point at &tp[num]
164 sub $aj,$num,sp @ "original" num value
165 mov $tp,sp @ "rewind" $tp
166 mov $ap,$tp @ "borrow" $ap
167 sub $np,$np,$aj @ "rewind" $np to &np[0]
169 subs $tj,$tj,$tj @ "clear" carry flag
170 .Lsub: ldr $tj,[$tp],#4
172 sbcs $tj,$tj,$nj @ tp[j]-np[j]
173 str $tj,[$rp],#4 @ rp[j]=
174 teq $tp,$num @ preserve carry
176 sbcs $nhi,$nhi,#0 @ upmost carry
177 mov $tp,sp @ "rewind" $tp
178 sub $rp,$rp,$aj @ "rewind" $rp
182 orr $ap,$ap,$np @ ap=borrow?tp:rp
184 .Lcopy: ldr $tj,[$ap],#4 @ copy or in-place refresh
185 str sp,[$tp],#4 @ zap tp
190 add sp,$num,#4 @ skip over tp[num+1]
191 ldmia sp!,{r4-r12,lr} @ restore registers
192 add sp,sp,#2*4 @ skip over {r0,r2}
195 moveq pc,lr @ be binary compatible with V4, yet
196 bx lr @ interoperable with Thumb ISA:-)
197 .size bn_mul_mont,.-bn_mul_mont
198 .asciz "Montgomery multiplication for ARMv4, CRYPTOGAMS by <appro\@openssl.org>"
202 $code =~ s/\bbx\s+lr\b/.word\t0xe12fff1e/gm; # make it possible to compile with -march=armv4