3 # ====================================================================
4 # Written by Andy Polyakov <appro@openssl.org> for the OpenSSL
5 # project. The module is, however, dual licensed under OpenSSL and
6 # CRYPTOGAMS licenses depending on where you obtain it. For further
7 # details see http://www.openssl.org/~appro/cryptogams/.
8 # ====================================================================
12 # Montgomery multiplication for ARMv4.
14 # Performance improvement naturally varies among CPU implementations
15 # and compilers. The code was observed to provide +65-35% improvement
16 # [depending on key length, less for longer keys] on ARM920T, and
17 # +115-80% on Intel IXP425. This is compared to pre-bn_mul_mont code
18 # base and compiler generated code with in-lined umull and even umlal
19 # instructions. The latter means that this code didn't really have an
20 # "advantage" of utilizing some "secret" instruction.
22 # The code is interoperable with Thumb ISA and is rather compact, less
23 # than 1/2KB. Windows CE port would be trivial, as it's exclusively
24 # about decorations, ABI and instruction syntax are identical.
28 # Add NEON code path, which handles lengths divisible by 8. RSA/DSA
29 # performance improvement on Cortex-A8 is ~45-100% depending on key
30 # length, more for longer keys. On Cortex-A15 the span is ~10-105%.
31 # On Snapdragon S4 improvement was measured to vary from ~70% to
32 # incredible ~380%, yes, 4.8x faster, for RSA4096 sign. But this is
33 # rather because original integer-only code seems to perform
34 # suboptimally on S4. Situation on Cortex-A9 is unfortunately
35 # different. It's being looked into, but the trouble is that
36 # performance for vectors longer than 256 bits is actually couple
37 # of percent worse than for integer-only code. The code is chosen
38 # for execution on all NEON-capable processors, because gain on
39 # others outweighs the marginal loss on Cortex-A9.
43 # Align Cortex-A9 performance with November 2013 improvements, i.e.
44 # NEON code is now ~20-105% faster than integer-only one on this
45 # processor. But this optimization further improved performance even
46 # on other processors: NEON code path is ~45-180% faster than original
47 # integer-only on Cortex-A8, ~10-210% on Cortex-A15, ~70-450% on
51 if ($flavour=~/\w[\w\-]*\.\w+$/) { $output=$flavour; undef $flavour; }
52 else { while (($output=shift) && ($output!~/\w[\w\-]*\.\w+$/)) {} }
54 if ($flavour && $flavour ne "void") {
55 $0 =~ m/(.*[\/\\])[^\/\\]+$/; $dir=$1;
56 ( $xlate="${dir}arm-xlate.pl" and -f $xlate ) or
57 ( $xlate="${dir}../../perlasm/arm-xlate.pl" and -f $xlate) or
58 die "can't locate arm-xlate.pl";
60 open STDOUT,"| \"$^X\" $xlate $flavour $output";
62 open STDOUT,">$output";
65 $num="r0"; # starts as num argument, but holds &tp[num-1]
67 $bp="r2"; $bi="r2"; $rp="r2";
74 ########### # r9 is reserved by ELF as platform specific, e.g. TLS pointer
75 $alo="r10"; # sl, gcc uses it to keep @GOT
78 ########### # r13 is stack pointer
80 ########### # r15 is program counter
82 #### argument block layout relative to &tp[num-1], a.k.a. $num
84 # ap permanently resides in r1
86 # np permanently resides in r3
88 $_num="$num,#15*4"; $_bpend=$_num;
94 #if defined(__thumb2__)
101 #if __ARM_MAX_ARCH__>=7
104 .word OPENSSL_armcap_P-.Lbn_mul_mont
108 .type bn_mul_mont,%function
113 ldr ip,[sp,#4] @ load num
114 stmdb sp!,{r0,r2} @ sp points at argument block
115 #if __ARM_MAX_ARCH__>=7
119 ldr r2,.LOPENSSL_armcap
124 tst r0,#ARMV7_NEON @ NEON available?
133 mov $num,ip @ load num
141 stmdb sp!,{r4-r12,lr} @ save 10 registers
143 mov $num,$num,lsl#2 @ rescale $num for byte count
144 sub sp,sp,$num @ alloca(4*num)
145 sub sp,sp,#4 @ +extra dword
146 sub $num,$num,#4 @ "num=num-1"
147 add $tp,$bp,$num @ &bp[num-1]
149 add $num,sp,$num @ $num to point at &tp[num-1]
151 ldr $bi,[$bp] @ bp[0]
152 ldr $aj,[$ap],#4 @ ap[0],ap++
153 ldr $nj,[$np],#4 @ np[0],np++
155 str $tp,[$_bpend] @ save &bp[num]
157 umull $alo,$ahi,$aj,$bi @ ap[0]*bp[0]
158 str $n0,[$_n0] @ save n0 value
159 mul $n0,$alo,$n0 @ "tp[0]"*n0
161 umlal $alo,$nlo,$nj,$n0 @ np[0]*n0+"t[0]"
165 ldr $aj,[$ap],#4 @ ap[j],ap++
167 ldr $nj,[$np],#4 @ np[j],np++
169 umlal $alo,$ahi,$aj,$bi @ ap[j]*bp[0]
171 umlal $nlo,$nhi,$nj,$n0 @ np[j]*n0
173 str $nlo,[$tp],#4 @ tp[j-1]=,tp++
179 ldr $tp,[$_bp] @ restore bp
181 ldr $n0,[$_n0] @ restore n0
183 str $nlo,[$num] @ tp[num-1]=
185 str $nhi,[$num,#4] @ tp[num]=
188 sub $tj,$num,$tj @ "original" $num-1 value
189 sub $ap,$ap,$tj @ "rewind" ap to &ap[1]
190 ldr $bi,[$tp,#4]! @ *(++bp)
191 sub $np,$np,$tj @ "rewind" np to &np[1]
192 ldr $aj,[$ap,#-4] @ ap[0]
193 ldr $alo,[sp] @ tp[0]
194 ldr $nj,[$np,#-4] @ np[0]
195 ldr $tj,[sp,#4] @ tp[1]
198 umlal $alo,$ahi,$aj,$bi @ ap[0]*bp[i]+tp[0]
199 str $tp,[$_bp] @ save bp
202 umlal $alo,$nlo,$nj,$n0 @ np[0]*n0+"tp[0]"
206 ldr $aj,[$ap],#4 @ ap[j],ap++
207 adds $alo,$ahi,$tj @ +=tp[j]
208 ldr $nj,[$np],#4 @ np[j],np++
210 umlal $alo,$ahi,$aj,$bi @ ap[j]*bp[i]
212 umlal $nlo,$nhi,$nj,$n0 @ np[j]*n0
214 ldr $tj,[$tp,#8] @ tp[j+1]
216 str $nlo,[$tp],#4 @ tp[j-1]=,tp++
223 ldr $tp,[$_bp] @ restore bp
225 ldr $n0,[$_n0] @ restore n0
227 ldr $tj,[$_bpend] @ restore &bp[num]
229 str $nlo,[$num] @ tp[num-1]=
230 str $nhi,[$num,#4] @ tp[num]=
239 ldr $rp,[$_rp] @ pull rp
241 add $num,$num,#4 @ $num to point at &tp[num]
242 sub $aj,$num,$aj @ "original" num value
243 mov $tp,sp @ "rewind" $tp
244 mov $ap,$tp @ "borrow" $ap
245 sub $np,$np,$aj @ "rewind" $np to &np[0]
247 subs $tj,$tj,$tj @ "clear" carry flag
248 .Lsub: ldr $tj,[$tp],#4
250 sbcs $tj,$tj,$nj @ tp[j]-np[j]
251 str $tj,[$rp],#4 @ rp[j]=
252 teq $tp,$num @ preserve carry
254 sbcs $nhi,$nhi,#0 @ upmost carry
255 mov $tp,sp @ "rewind" $tp
256 sub $rp,$rp,$aj @ "rewind" $rp
260 orr $ap,$ap,$np @ ap=borrow?tp:rp
262 .Lcopy: ldr $tj,[$ap],#4 @ copy or in-place refresh
263 str sp,[$tp],#4 @ zap tp
269 add sp,sp,#4 @ skip over tp[num+1]
270 ldmia sp!,{r4-r12,lr} @ restore registers
271 add sp,sp,#2*4 @ skip over {r0,r2}
278 moveq pc,lr @ be binary compatible with V4, yet
279 bx lr @ interoperable with Thumb ISA:-)
281 .size bn_mul_mont,.-bn_mul_mont
284 my ($A0,$A1,$A2,$A3)=map("d$_",(0..3));
285 my ($N0,$N1,$N2,$N3)=map("d$_",(4..7));
286 my ($Z,$Temp)=("q4","q5");
287 my @ACC=map("q$_",(6..13));
288 my ($Bi,$Ni,$M0)=map("d$_",(28..31));
292 my ($rptr,$aptr,$bptr,$nptr,$n0,$num)=map("r$_",(0..5));
293 my ($tinptr,$toutptr,$inner,$outer,$bnptr)=map("r$_",(6..11));
296 #if __ARM_MAX_ARCH__>=7
300 .type bn_mul8x_mont_neon,%function
305 vstmdb sp!,{d8-d15} @ ABI specification says so
306 ldmia ip,{r4-r5} @ load rest of parameter block
312 @ special case for $num==8, everything is in register bank...
314 vld1.32 {${Bi}[0]}, [$bptr,:32]!
315 veor $zero,$zero,$zero
316 sub $toutptr,sp,$num,lsl#4
317 vld1.32 {$A0-$A3}, [$aptr]! @ can't specify :32 :-(
318 and $toutptr,$toutptr,#-64
319 vld1.32 {${M0}[0]}, [$n0,:32]
320 mov sp,$toutptr @ alloca
323 vmull.u32 @ACC[0],$Bi,${A0}[0]
324 vmull.u32 @ACC[1],$Bi,${A0}[1]
325 vmull.u32 @ACC[2],$Bi,${A1}[0]
326 vshl.i64 $Ni,@ACC[0]#hi,#16
327 vmull.u32 @ACC[3],$Bi,${A1}[1]
329 vadd.u64 $Ni,$Ni,@ACC[0]#lo
330 veor $zero,$zero,$zero
333 vmull.u32 @ACC[4],$Bi,${A2}[0]
334 vld1.32 {$N0-$N3}, [$nptr]!
335 vmull.u32 @ACC[5],$Bi,${A2}[1]
336 vmull.u32 @ACC[6],$Bi,${A3}[0]
338 vmull.u32 @ACC[7],$Bi,${A3}[1]
340 vmlal.u32 @ACC[0],$Ni,${N0}[0]
342 vmlal.u32 @ACC[1],$Ni,${N0}[1]
343 vmlal.u32 @ACC[2],$Ni,${N1}[0]
344 vmlal.u32 @ACC[3],$Ni,${N1}[1]
346 vmlal.u32 @ACC[4],$Ni,${N2}[0]
348 vmlal.u32 @ACC[5],$Ni,${N2}[1]
350 vmlal.u32 @ACC[6],$Ni,${N3}[0]
352 vmlal.u32 @ACC[7],$Ni,${N3}[1]
355 vshr.u64 $temp,$temp,#16
358 vadd.u64 $temp,$temp,$Temp#hi
361 vshr.u64 $temp,$temp,#16
367 vld1.32 {${Bi}[0]}, [$bptr,:32]!
368 veor $zero,$zero,$zero
370 vadd.u64 @ACC[0]#lo,@ACC[0]#lo,$temp
372 vmlal.u32 @ACC[0],$Bi,${A0}[0]
373 vmlal.u32 @ACC[1],$Bi,${A0}[1]
374 vmlal.u32 @ACC[2],$Bi,${A1}[0]
375 vshl.i64 $Ni,@ACC[0]#hi,#16
376 vmlal.u32 @ACC[3],$Bi,${A1}[1]
378 vadd.u64 $Ni,$Ni,@ACC[0]#lo
379 veor $zero,$zero,$zero
380 subs $outer,$outer,#1
383 vmlal.u32 @ACC[4],$Bi,${A2}[0]
384 vmlal.u32 @ACC[5],$Bi,${A2}[1]
385 vmlal.u32 @ACC[6],$Bi,${A3}[0]
387 vmlal.u32 @ACC[7],$Bi,${A3}[1]
389 vmlal.u32 @ACC[0],$Ni,${N0}[0]
390 vmlal.u32 @ACC[1],$Ni,${N0}[1]
391 vmlal.u32 @ACC[2],$Ni,${N1}[0]
392 vmlal.u32 @ACC[3],$Ni,${N1}[1]
394 vmlal.u32 @ACC[4],$Ni,${N2}[0]
396 vmlal.u32 @ACC[5],$Ni,${N2}[1]
398 vmlal.u32 @ACC[6],$Ni,${N3}[0]
400 vmlal.u32 @ACC[7],$Ni,${N3}[1]
403 vshr.u64 $temp,$temp,#16
406 vadd.u64 $temp,$temp,$Temp#hi
409 vshr.u64 $temp,$temp,#16
413 vadd.u64 @ACC[0]#lo,@ACC[0]#lo,$temp
415 vshr.u64 $temp,@ACC[0]#lo,#16
417 vadd.u64 @ACC[0]#hi,@ACC[0]#hi,$temp
419 vshr.u64 $temp,@ACC[0]#hi,#16
420 vzip.16 @ACC[0]#lo,@ACC[0]#hi
426 veor @ACC[0],@ACC[0],@ACC[0]
428 veor @ACC[1],@ACC[1],@ACC[1]
429 sub $toutptr,$toutptr,$num,lsl#4
430 veor @ACC[2],@ACC[2],@ACC[2]
431 and $toutptr,$toutptr,#-64
432 veor @ACC[3],@ACC[3],@ACC[3]
433 mov sp,$toutptr @ alloca
434 veor @ACC[4],@ACC[4],@ACC[4]
435 add $toutptr,$toutptr,#256
436 veor @ACC[5],@ACC[5],@ACC[5]
438 veor @ACC[6],@ACC[6],@ACC[6]
439 veor @ACC[7],@ACC[7],@ACC[7]
442 vst1.64 {@ACC[0]-@ACC[1]},[$toutptr,:256]!
443 subs $inner,$inner,#8
444 vst1.64 {@ACC[2]-@ACC[3]},[$toutptr,:256]!
445 vst1.64 {@ACC[4]-@ACC[5]},[$toutptr,:256]!
446 vst1.64 {@ACC[6]-@ACC[7]},[$toutptr,:256]!
450 vld1.32 {$A0-$A3},[$aptr]!
452 vld1.32 {${M0}[0]},[$n0,:32]
458 vld1.32 {${Bi}[0]},[$bptr,:32]! @ *b++
459 veor $zero,$zero,$zero
462 vld1.32 {$N0-$N3},[$nptr]!
464 vmlal.u32 @ACC[0],$Bi,${A0}[0]
465 vmlal.u32 @ACC[1],$Bi,${A0}[1]
466 veor $zero,$zero,$zero
467 vmlal.u32 @ACC[2],$Bi,${A1}[0]
468 vshl.i64 $Ni,@ACC[0]#hi,#16
469 vmlal.u32 @ACC[3],$Bi,${A1}[1]
470 vadd.u64 $Ni,$Ni,@ACC[0]#lo
471 vmlal.u32 @ACC[4],$Bi,${A2}[0]
473 vmlal.u32 @ACC[5],$Bi,${A2}[1]
474 vst1.32 {$Bi},[sp,:64] @ put aside smashed b[8*i+0]
475 vmlal.u32 @ACC[6],$Bi,${A3}[0]
477 vmlal.u32 @ACC[7],$Bi,${A3}[1]
481 vld1.32 {${Bi}[0]},[$bptr,:32]! @ *b++
482 vmlal.u32 @ACC[0],$Ni,${N0}[0]
483 veor $temp,$temp,$temp
484 vmlal.u32 @ACC[1],$Ni,${N0}[1]
486 vmlal.u32 @ACC[2],$Ni,${N1}[0]
487 vshr.u64 @ACC[0]#lo,@ACC[0]#lo,#16
488 vmlal.u32 @ACC[3],$Ni,${N1}[1]
489 vmlal.u32 @ACC[4],$Ni,${N2}[0]
490 vadd.u64 @ACC[0]#lo,@ACC[0]#lo,@ACC[0]#hi
491 vmlal.u32 @ACC[5],$Ni,${N2}[1]
492 vshr.u64 @ACC[0]#lo,@ACC[0]#lo,#16
493 vmlal.u32 @ACC[6],$Ni,${N3}[0]
494 vmlal.u32 @ACC[7],$Ni,${N3}[1]
495 vadd.u64 @ACC[1]#lo,@ACC[1]#lo,@ACC[0]#lo
496 vst1.32 {$Ni},[$bnptr,:64]! @ put aside smashed m[8*i+$i]
498 push(@ACC,shift(@ACC)); $i++;
500 vmlal.u32 @ACC[0],$Bi,${A0}[0]
501 vld1.64 {@ACC[7]},[$tinptr,:128]!
502 vmlal.u32 @ACC[1],$Bi,${A0}[1]
503 veor $zero,$zero,$zero
504 vmlal.u32 @ACC[2],$Bi,${A1}[0]
505 vshl.i64 $Ni,@ACC[0]#hi,#16
506 vmlal.u32 @ACC[3],$Bi,${A1}[1]
507 vadd.u64 $Ni,$Ni,@ACC[0]#lo
508 vmlal.u32 @ACC[4],$Bi,${A2}[0]
510 vmlal.u32 @ACC[5],$Bi,${A2}[1]
511 vst1.32 {$Bi},[$bnptr,:64]! @ put aside smashed b[8*i+$i]
512 vmlal.u32 @ACC[6],$Bi,${A3}[0]
514 vmlal.u32 @ACC[7],$Bi,${A3}[1]
518 vld1.32 {$Bi},[sp,:64] @ pull smashed b[8*i+0]
519 vmlal.u32 @ACC[0],$Ni,${N0}[0]
520 vld1.32 {$A0-$A3},[$aptr]!
521 vmlal.u32 @ACC[1],$Ni,${N0}[1]
522 vmlal.u32 @ACC[2],$Ni,${N1}[0]
523 vshr.u64 @ACC[0]#lo,@ACC[0]#lo,#16
524 vmlal.u32 @ACC[3],$Ni,${N1}[1]
525 vmlal.u32 @ACC[4],$Ni,${N2}[0]
526 vadd.u64 @ACC[0]#lo,@ACC[0]#lo,@ACC[0]#hi
527 vmlal.u32 @ACC[5],$Ni,${N2}[1]
528 vshr.u64 @ACC[0]#lo,@ACC[0]#lo,#16
529 vmlal.u32 @ACC[6],$Ni,${N3}[0]
530 vmlal.u32 @ACC[7],$Ni,${N3}[1]
531 vadd.u64 @ACC[1]#lo,@ACC[1]#lo,@ACC[0]#lo
532 vst1.32 {$Ni},[$bnptr,:64] @ put aside smashed m[8*i+$i]
533 add $bnptr,sp,#8 @ rewind
535 push(@ACC,shift(@ACC));
542 subs $inner,$inner,#8
543 vmlal.u32 @ACC[0],$Bi,${A0}[0]
544 vld1.64 {@ACC[7]},[$tinptr,:128]
545 vmlal.u32 @ACC[1],$Bi,${A0}[1]
546 vld1.32 {$Ni},[$bnptr,:64]! @ pull smashed m[8*i+0]
547 vmlal.u32 @ACC[2],$Bi,${A1}[0]
548 vld1.32 {$N0-$N3},[$nptr]!
549 vmlal.u32 @ACC[3],$Bi,${A1}[1]
551 addne $tinptr,$tinptr,#16 @ don't advance in last iteration
552 vmlal.u32 @ACC[4],$Bi,${A2}[0]
553 vmlal.u32 @ACC[5],$Bi,${A2}[1]
554 vmlal.u32 @ACC[6],$Bi,${A3}[0]
555 vmlal.u32 @ACC[7],$Bi,${A3}[1]
557 for ($i=1; $i<8; $i++) {
559 vld1.32 {$Bi},[$bnptr,:64]! @ pull smashed b[8*i+$i]
560 vmlal.u32 @ACC[0],$Ni,${N0}[0]
561 vmlal.u32 @ACC[1],$Ni,${N0}[1]
562 vmlal.u32 @ACC[2],$Ni,${N1}[0]
563 vmlal.u32 @ACC[3],$Ni,${N1}[1]
564 vmlal.u32 @ACC[4],$Ni,${N2}[0]
565 vmlal.u32 @ACC[5],$Ni,${N2}[1]
566 vmlal.u32 @ACC[6],$Ni,${N3}[0]
567 vmlal.u32 @ACC[7],$Ni,${N3}[1]
568 vst1.64 {@ACC[0]},[$toutptr,:128]!
570 push(@ACC,shift(@ACC));
572 vmlal.u32 @ACC[0],$Bi,${A0}[0]
573 vld1.64 {@ACC[7]},[$tinptr,:128]
574 vmlal.u32 @ACC[1],$Bi,${A0}[1]
575 vld1.32 {$Ni},[$bnptr,:64]! @ pull smashed m[8*i+$i]
576 vmlal.u32 @ACC[2],$Bi,${A1}[0]
578 addne $tinptr,$tinptr,#16 @ don't advance in last iteration
579 vmlal.u32 @ACC[3],$Bi,${A1}[1]
580 vmlal.u32 @ACC[4],$Bi,${A2}[0]
581 vmlal.u32 @ACC[5],$Bi,${A2}[1]
582 vmlal.u32 @ACC[6],$Bi,${A3}[0]
583 vmlal.u32 @ACC[7],$Bi,${A3}[1]
588 subeq $aptr,$aptr,$num,lsl#2 @ rewind
589 vmlal.u32 @ACC[0],$Ni,${N0}[0]
590 vld1.32 {$Bi},[sp,:64] @ pull smashed b[8*i+0]
591 vmlal.u32 @ACC[1],$Ni,${N0}[1]
592 vld1.32 {$A0-$A3},[$aptr]!
593 vmlal.u32 @ACC[2],$Ni,${N1}[0]
594 add $bnptr,sp,#8 @ rewind
595 vmlal.u32 @ACC[3],$Ni,${N1}[1]
596 vmlal.u32 @ACC[4],$Ni,${N2}[0]
597 vmlal.u32 @ACC[5],$Ni,${N2}[1]
598 vmlal.u32 @ACC[6],$Ni,${N3}[0]
599 vst1.64 {@ACC[0]},[$toutptr,:128]!
600 vmlal.u32 @ACC[7],$Ni,${N3}[1]
604 push(@ACC,shift(@ACC));
607 vst1.64 {@ACC[0]-@ACC[1]},[$toutptr,:256]!
608 veor q2,q2,q2 @ $N0-$N1
609 vst1.64 {@ACC[2]-@ACC[3]},[$toutptr,:256]!
610 veor q3,q3,q3 @ $N2-$N3
611 vst1.64 {@ACC[4]-@ACC[5]},[$toutptr,:256]!
612 vst1.64 {@ACC[6]},[$toutptr,:128]
614 subs $outer,$outer,#8
615 vld1.64 {@ACC[0]-@ACC[1]},[$tinptr,:256]!
616 vld1.64 {@ACC[2]-@ACC[3]},[$tinptr,:256]!
617 vld1.64 {@ACC[4]-@ACC[5]},[$tinptr,:256]!
618 vld1.64 {@ACC[6]-@ACC[7]},[$tinptr,:256]!
621 subne $nptr,$nptr,$num,lsl#2 @ rewind
625 vst1.64 {q2-q3}, [sp,:256]! @ start wiping stack frame
626 vshr.u64 $temp,@ACC[0]#lo,#16
627 vst1.64 {q2-q3},[sp,:256]!
628 vadd.u64 @ACC[0]#hi,@ACC[0]#hi,$temp
629 vst1.64 {q2-q3}, [sp,:256]!
630 vshr.u64 $temp,@ACC[0]#hi,#16
631 vst1.64 {q2-q3}, [sp,:256]!
632 vzip.16 @ACC[0]#lo,@ACC[0]#hi
639 vadd.u64 @ACC[0]#lo,@ACC[0]#lo,$temp
640 vshr.u64 $temp,@ACC[0]#lo,#16
641 vld1.64 {@ACC[2]-@ACC[3]}, [$tinptr, :256]!
642 vadd.u64 @ACC[0]#hi,@ACC[0]#hi,$temp
643 vld1.64 {@ACC[4]-@ACC[5]}, [$tinptr, :256]!
644 vshr.u64 $temp,@ACC[0]#hi,#16
645 vld1.64 {@ACC[6]-@ACC[7]}, [$tinptr, :256]!
646 vzip.16 @ACC[0]#lo,@ACC[0]#hi
650 for ($i=1; $i<8; $i++) {
652 vadd.u64 @ACC[1]#lo,@ACC[1]#lo,$temp
653 vst1.32 {@ACC[0]#lo[0]}, [$toutptr, :32]!
654 vshr.u64 $temp,@ACC[1]#lo,#16
655 vadd.u64 @ACC[1]#hi,@ACC[1]#hi,$temp
656 vshr.u64 $temp,@ACC[1]#hi,#16
657 vzip.16 @ACC[1]#lo,@ACC[1]#hi
659 push(@ACC,shift(@ACC));
661 push(@ACC,shift(@ACC));
663 vld1.64 {@ACC[0]-@ACC[1]}, [$tinptr, :256]!
664 subs $inner,$inner,#8
665 vst1.32 {@ACC[7]#lo[0]}, [$toutptr, :32]!
668 vst1.32 {${temp}[0]}, [$toutptr, :32] @ top-most bit
669 sub $nptr,$nptr,$num,lsl#2 @ rewind $nptr
670 subs $aptr,sp,#0 @ clear carry flag
671 add $bptr,sp,$num,lsl#2
674 ldmia $aptr!, {r4-r7}
675 ldmia $nptr!, {r8-r11}
680 teq $aptr,$bptr @ preserves carry
681 stmia $rptr!, {r8-r11}
684 ldr r10, [$aptr] @ load top-most bit
687 sub r11,$bptr,r11 @ this is num*4
690 sub $rptr,$rptr,r11 @ rewind $rptr
691 mov $nptr,$bptr @ second 3/4th of frame
692 sbcs r10,r10,#0 @ result is carry flag
695 ldmia $aptr!, {r4-r7}
696 ldmia $rptr, {r8-r11}
699 vst1.64 {q0-q1}, [$nptr,:256]! @ wipe
703 vst1.64 {q0-q1}, [$nptr,:256]! @ wipe
707 stmia $rptr!, {r8-r11}
709 ldmia $rptr, {r8-r11}
712 vst1.64 {q0-q1}, [$aptr,:256]! @ wipe
716 vst1.64 {q0-q1}, [$nptr,:256]! @ wipe
719 teq $aptr,$bptr @ preserves carry
720 stmia $rptr!, {r8-r11}
721 bne .LNEON_copy_n_zap
727 .size bn_mul8x_mont_neon,.-bn_mul8x_mont_neon
732 .asciz "Montgomery multiplication for ARMv4/NEON, CRYPTOGAMS by <appro\@openssl.org>"
734 #if __ARM_MAX_ARCH__>=7
735 .comm OPENSSL_armcap_P,4,4
739 foreach (split("\n",$code)) {
740 s/\`([^\`]*)\`/eval $1/ge;
742 s/\bq([0-9]+)#(lo|hi)/sprintf "d%d",2*$1+($2 eq "hi")/ge or
744 s/\bbx\s+lr\b/.word\t0xe12fff1e/g; # make it possible to compile with -march=armv4