3 # ====================================================================
4 # Written by Andy Polyakov <appro@fy.chalmers.se> for the OpenSSL
5 # project. The module is, however, dual licensed under OpenSSL and
6 # CRYPTOGAMS licenses depending on where you obtain it. For further
7 # details see http://www.openssl.org/~appro/cryptogams/.
8 # ====================================================================
12 # Montgomery multiplication routine for x86_64. While it gives modest
13 # 9% improvement of rsa4096 sign on Opteron, rsa512 sign runs more
14 # than twice, >2x, as fast. Most common rsa1024 sign is improved by
15 # respectful 50%. It remains to be seen if loop unrolling and
16 # dedicated squaring routine can provide further improvement...
20 $0 =~ m/(.*[\/\\])[^\/\\]+$/; $dir=$1;
21 ( $xlate="${dir}x86_64-xlate.pl" and -f $xlate ) or
22 ( $xlate="${dir}../../perlasm/x86_64-xlate.pl" and -f $xlate) or
23 die "can't locate x86_64-xlate.pl";
25 open STDOUT,"| $^X $xlate $output";
28 $rp="%rdi"; # BN_ULONG *rp,
29 $ap="%rsi"; # const BN_ULONG *ap,
30 $bp="%rdx"; # const BN_ULONG *bp,
31 $np="%rcx"; # const BN_ULONG *np,
32 $n0="%r8"; # const BN_ULONG *n0,
33 $num="%r9"; # int num);
36 $bp="%r12"; # reassign $bp
47 .type bn_mul_mont,\@function,6
60 lea (%rsp,%rax,8),%rsp # tp=alloca(8*(num+2))
61 and \$-1024,%rsp # minimize TLB usage
63 mov %rbp,8(%rsp,$num,8) # tp[num+1]=%rsp
64 mov %rdx,$bp # $bp reassigned, remember?
66 mov ($n0),$n0 # pull n0[0] value
71 mov ($bp),$m0 # m0=bp[0]
73 mulq $m0 # ap[0]*bp[0]
77 imulq $n0,%rax # "tp[0]"*n0
81 add $lo0,%rax # discarded
88 mulq $m0 # ap[j]*bp[0]
99 add $lo0,%rax # np[j]*m1+ap[j]*bp[0]
101 mov %rax,-16(%rsp,$j,8) # tp[j-1]
109 mov $hi1,-8(%rsp,$num,8)
110 mov %rdx,(%rsp,$num,8) # store upmost overflow bit
117 mov ($bp,$i,8),$m0 # m0=bp[i]
118 mov ($ap),%rax # ap[0]
119 mulq $m0 # ap[0]*bp[i]
120 add (%rsp),%rax # ap[0]*bp[i]+tp[0]
125 imulq $n0,%rax # tp[0]*n0
128 mulq ($np,$j,8) # np[0]*m1
129 add $lo0,%rax # discarded
130 mov 8(%rsp),$lo0 # tp[1]
138 mulq $m0 # ap[j]*bp[i]
141 add %rax,$lo0 # ap[j]*bp[i]+tp[j]
150 add $lo0,%rax # np[j]*m1+ap[j]*bp[i]+tp[j]
154 mov %rax,-16(%rsp,$j,8) # tp[j-1]
161 add $lo0,$hi1 # pull upmost overflow bit
163 mov $hi1,-8(%rsp,$num,8)
164 mov %rdx,(%rsp,$num,8) # store upmost overflow bit
170 mov -8($np,$num,8),%rax # np[num-1]
171 lea (%rsp),$ap # borrow ap for tp
172 shr \$62,%rax # check for boundary condition
173 lea -1($num),$j # j=num-1
176 mov ($ap),%rax # tp[0]
177 xor $i,$i # i=0 and clear CF!
180 .Lsub: sbb ($np,$i,8),%rax
181 mov %rax,($rp,$i,8) # rp[i]=tp[i]-np[i]
182 dec $j # doesn't affect CF!
183 mov 8($ap,$i,8),%rax # tp[i+1]
187 sbb \$0,%rax # handle upmost overflow bit
193 or $np,$ap # ap=borrow?tp:rp
195 .Lcopy: # copy or in-place refresh
197 mov %rax,($rp,$j,8) # rp[i]=tp[i]
198 mov $i,(%rsp,$j,8) # zap temporary vector
202 mov 8(%rsp,$num,8),%rsp # restore %rsp
211 .size bn_mul_mont,.-bn_mul_mont
212 .asciz "Montgomery Multiplication for x86_64, CRYPTOGAMS by <appro\@openssl.org>"