2 # Copyright 2011-2016 The OpenSSL Project Authors. All Rights Reserved.
4 # Licensed under the OpenSSL license (the "License"). You may not use
5 # this file except in compliance with the License. You can obtain a copy
6 # in the file LICENSE in the source distribution or at
7 # https://www.openssl.org/source/license.html
10 # ====================================================================
11 # Written by Andy Polyakov <appro@openssl.org> for the OpenSSL
12 # project. The module is, however, dual licensed under OpenSSL and
13 # CRYPTOGAMS licenses depending on where you obtain it. For further
14 # details see http://www.openssl.org/~appro/cryptogams/.
15 # ====================================================================
19 # Companion to x86_64-mont.pl that optimizes cache-timing attack
20 # countermeasures. The subroutines are produced by replacing bp[i]
21 # references in their x86_64-mont.pl counterparts with cache-neutral
22 # references to powers table computed in BN_mod_exp_mont_consttime.
23 # In addition subroutine that scatters elements of the powers table
24 # is implemented, so that scatter-/gathering can be tuned without
25 # bn_exp.c modifications.
29 # Add MULX/AD*X code paths and additional interfaces to optimize for
30 # branch prediction unit. For input lengths that are multiples of 8
31 # the np argument is not just modulus value, but one interleaved
32 # with 0. This is to optimize post-condition...
36 if ($flavour =~ /\./) { $output = $flavour; undef $flavour; }
38 $win64=0; $win64=1 if ($flavour =~ /[nm]asm|mingw64/ || $output =~ /\.asm$/);
40 $0 =~ m/(.*[\/\\])[^\/\\]+$/; $dir=$1;
41 ( $xlate="${dir}x86_64-xlate.pl" and -f $xlate ) or
42 ( $xlate="${dir}../../perlasm/x86_64-xlate.pl" and -f $xlate) or
43 die "can't locate x86_64-xlate.pl";
45 open OUT,"| \"$^X\" \"$xlate\" $flavour \"$output\"";
48 if (`$ENV{CC} -Wa,-v -c -o /dev/null -x assembler /dev/null 2>&1`
49 =~ /GNU assembler version ([2-9]\.[0-9]+)/) {
53 if (!$addx && $win64 && ($flavour =~ /nasm/ || $ENV{ASM} =~ /nasm/) &&
54 `nasm -v 2>&1` =~ /NASM version ([2-9]\.[0-9]+)/) {
58 if (!$addx && $win64 && ($flavour =~ /masm/ || $ENV{ASM} =~ /ml64/) &&
59 `ml64 2>&1` =~ /Version ([0-9]+)\./) {
63 if (!$addx && `$ENV{CC} -v 2>&1` =~ /((?:^clang|LLVM) version|.*based on LLVM) ([3-9])\.([0-9]+)/) {
64 my $ver = $2 + $3/100.0; # 3.1->3.01, 3.10->3.10
68 # int bn_mul_mont_gather5(
69 $rp="%rdi"; # BN_ULONG *rp,
70 $ap="%rsi"; # const BN_ULONG *ap,
71 $bp="%rdx"; # const BN_ULONG *bp,
72 $np="%rcx"; # const BN_ULONG *np,
73 $n0="%r8"; # const BN_ULONG *n0,
74 $num="%r9"; # int num,
75 # int idx); # 0 to 2^5-1, "index" in $bp holding
76 # pre-computed powers of a', interlaced
77 # in such manner that b[0] is $bp[idx],
78 # b[1] is [2^5+idx], etc.
90 .extern OPENSSL_ia32cap_P
92 .globl bn_mul_mont_gather5
93 .type bn_mul_mont_gather5,\@function,6
99 .cfi_def_cfa_register %rax
103 $code.=<<___ if ($addx);
104 mov OPENSSL_ia32cap_P+8(%rip),%r11d
111 movd `($win64?56:8)`(%rsp),%xmm5 # load 7th argument
127 lea -280(%rsp,$num,8),%r10 # future alloca(8*(num+2)+256+8)
128 neg $num # restore $num
129 and \$-1024,%r10 # minimize TLB usage
131 # An OS-agnostic version of __chkstk.
133 # Some OSes (Windows) insist on stack being "wired" to
134 # physical memory in strictly sequential manner, i.e. if stack
135 # allocation spans two pages, then reference to farmost one can
136 # be punishable by SEGV. But page walking can do good even on
137 # other OSes, because it guarantees that villain thread hits
138 # the guard page before it can make damage to innocent one...
145 jmp .Lmul_page_walk_done
152 .Lmul_page_walk_done:
155 mov %rax,8(%rsp,$num,8) # tp[num+1]=%rsp
156 .cfi_cfa_expression %rsp+8,$num,8,mul,plus,deref,+8
159 lea 128($bp),%r12 # reassign $bp (+size optimization)
162 $STRIDE=2**5*8; # 5 is "window size"
163 $N=$STRIDE/4; # should match cache line size
165 movdqa 0(%r10),%xmm0 # 00000001000000010000000000000000
166 movdqa 16(%r10),%xmm1 # 00000002000000020000000200000002
167 lea 24-112(%rsp,$num,8),%r10# place the mask after tp[num+3] (+ICache optimization)
170 pshufd \$0,%xmm5,%xmm5 # broadcast index
174 ########################################################################
175 # calculate mask by comparing 0..31 to index and save result to stack
179 pcmpeqd %xmm5,%xmm0 # compare to 1,0
183 for($k=0;$k<$STRIDE/16-4;$k+=4) {
186 pcmpeqd %xmm5,%xmm1 # compare to 3,2
187 movdqa %xmm0,`16*($k+0)+112`(%r10)
191 pcmpeqd %xmm5,%xmm2 # compare to 5,4
192 movdqa %xmm1,`16*($k+1)+112`(%r10)
196 pcmpeqd %xmm5,%xmm3 # compare to 7,6
197 movdqa %xmm2,`16*($k+2)+112`(%r10)
202 movdqa %xmm3,`16*($k+3)+112`(%r10)
206 $code.=<<___; # last iteration can be optimized
209 movdqa %xmm0,`16*($k+0)+112`(%r10)
214 movdqa %xmm1,`16*($k+1)+112`(%r10)
217 movdqa %xmm2,`16*($k+2)+112`(%r10)
218 pand `16*($k+0)-128`($bp),%xmm0 # while it's still in register
220 pand `16*($k+1)-128`($bp),%xmm1
221 pand `16*($k+2)-128`($bp),%xmm2
222 movdqa %xmm3,`16*($k+3)+112`(%r10)
223 pand `16*($k+3)-128`($bp),%xmm3
227 for($k=0;$k<$STRIDE/16-4;$k+=4) {
229 movdqa `16*($k+0)-128`($bp),%xmm4
230 movdqa `16*($k+1)-128`($bp),%xmm5
231 movdqa `16*($k+2)-128`($bp),%xmm2
232 pand `16*($k+0)+112`(%r10),%xmm4
233 movdqa `16*($k+3)-128`($bp),%xmm3
234 pand `16*($k+1)+112`(%r10),%xmm5
236 pand `16*($k+2)+112`(%r10),%xmm2
238 pand `16*($k+3)+112`(%r10),%xmm3
245 pshufd \$0x4e,%xmm0,%xmm1
248 movq %xmm0,$m0 # m0=bp[0]
250 mov ($n0),$n0 # pull n0[0] value
257 mulq $m0 # ap[0]*bp[0]
261 imulq $lo0,$m1 # "tp[0]"*n0
265 add %rax,$lo0 # discarded
278 add $hi0,$hi1 # np[j]*m1+ap[j]*bp[0]
281 mov $hi1,-16(%rsp,$j,8) # tp[j-1]
285 mulq $m0 # ap[j]*bp[0]
294 jne .L1st # note that upon exit $j==$num, so
295 # they can be used interchangeably
299 add $hi0,$hi1 # np[j]*m1+ap[j]*bp[0]
301 mov $hi1,-16(%rsp,$num,8) # tp[num-1]
308 mov $hi1,-8(%rsp,$num,8)
309 mov %rdx,(%rsp,$num,8) # store upmost overflow bit
315 lea 24+128(%rsp,$num,8),%rdx # where 256-byte mask is (+size optimization)
320 for($k=0;$k<$STRIDE/16;$k+=4) {
322 movdqa `16*($k+0)-128`($bp),%xmm0
323 movdqa `16*($k+1)-128`($bp),%xmm1
324 movdqa `16*($k+2)-128`($bp),%xmm2
325 movdqa `16*($k+3)-128`($bp),%xmm3
326 pand `16*($k+0)-128`(%rdx),%xmm0
327 pand `16*($k+1)-128`(%rdx),%xmm1
329 pand `16*($k+2)-128`(%rdx),%xmm2
331 pand `16*($k+3)-128`(%rdx),%xmm3
338 pshufd \$0x4e,%xmm4,%xmm0
342 mov ($ap),%rax # ap[0]
343 movq %xmm0,$m0 # m0=bp[i]
349 mulq $m0 # ap[0]*bp[i]
350 add %rax,$lo0 # ap[0]*bp[i]+tp[0]
354 imulq $lo0,$m1 # tp[0]*n0
358 add %rax,$lo0 # discarded
361 mov 8(%rsp),$lo0 # tp[1]
372 add $lo0,$hi1 # np[j]*m1+ap[j]*bp[i]+tp[j]
375 mov $hi1,-16(%rsp,$j,8) # tp[j-1]
379 mulq $m0 # ap[j]*bp[i]
383 add $hi0,$lo0 # ap[j]*bp[i]+tp[j]
390 jne .Linner # note that upon exit $j==$num, so
391 # they can be used interchangeably
394 add $lo0,$hi1 # np[j]*m1+ap[j]*bp[i]+tp[j]
395 mov (%rsp,$num,8),$lo0
397 mov $hi1,-16(%rsp,$num,8) # tp[num-1]
403 add $lo0,$hi1 # pull upmost overflow bit
405 mov $hi1,-8(%rsp,$num,8)
406 mov %rdx,(%rsp,$num,8) # store upmost overflow bit
412 xor $i,$i # i=0 and clear CF!
413 mov (%rsp),%rax # tp[0]
414 lea (%rsp),$ap # borrow ap for tp
418 .Lsub: sbb ($np,$i,8),%rax
419 mov %rax,($rp,$i,8) # rp[i]=tp[i]-np[i]
420 mov 8($ap,$i,8),%rax # tp[i+1]
422 dec $j # doesn't affect CF!
425 sbb \$0,%rax # handle upmost overflow bit
432 or $np,$ap # ap=borrow?tp:rp
434 .Lcopy: # copy or in-place refresh
436 mov $i,(%rsp,$i,8) # zap temporary vector
437 mov %rax,($rp,$i,8) # rp[i]=tp[i]
442 mov 8(%rsp,$num,8),%rsi # restore %rsp
459 .cfi_def_cfa_register %rsp
463 .size bn_mul_mont_gather5,.-bn_mul_mont_gather5
466 my @A=("%r10","%r11");
467 my @N=("%r13","%rdi");
469 .type bn_mul4x_mont_gather5,\@function,6
471 bn_mul4x_mont_gather5:
475 .cfi_def_cfa_register %rax
478 $code.=<<___ if ($addx);
480 cmp \$0x80108,%r11d # check for AD*X+BMI2+BMI1
499 shl \$3,${num}d # convert $num to bytes
500 lea ($num,$num,2),%r10 # 3*$num in bytes
503 ##############################################################
504 # Ensure that stack frame doesn't alias with $rptr+3*$num
505 # modulo 4096, which covers ret[num], am[num] and n[num]
506 # (see bn_exp.c). This is done to allow memory disambiguation
507 # logic do its magic. [Extra [num] is allocated in order
508 # to align with bn_power5's frame, which is cleansed after
509 # completing exponentiation. Extra 256 bytes is for power mask
510 # calculated from 7th argument, the index.]
512 lea -320(%rsp,$num,2),%r11
518 sub %r11,%rbp # align with $rp
519 lea -320(%rbp,$num,2),%rbp # future alloca(frame+2*num*8+256)
524 lea 4096-320(,$num,2),%r10
525 lea -320(%rbp,$num,2),%rbp # future alloca(frame+2*num*8+256)
539 jmp .Lmul4x_page_walk_done
546 .Lmul4x_page_walk_done:
551 .cfi_cfa_expression %rsp+40,deref,+8
556 mov 40(%rsp),%rsi # restore %rsp
573 .cfi_def_cfa_register %rsp
577 .size bn_mul4x_mont_gather5,.-bn_mul4x_mont_gather5
579 .type mul4x_internal,\@abi-omnipotent
582 shl \$5,$num # $num was in bytes
583 movd `($win64?56:8)`(%rax),%xmm5 # load 7th argument, index
585 lea 128(%rdx,$num),%r13 # end of powers table (+size optimization)
586 shr \$5,$num # restore $num
589 $STRIDE=2**5*8; # 5 is "window size"
590 $N=$STRIDE/4; # should match cache line size
593 movdqa 0(%rax),%xmm0 # 00000001000000010000000000000000
594 movdqa 16(%rax),%xmm1 # 00000002000000020000000200000002
595 lea 88-112(%rsp,$num),%r10 # place the mask after tp[num+1] (+ICache optimization)
596 lea 128(%rdx),$bp # size optimization
598 pshufd \$0,%xmm5,%xmm5 # broadcast index
603 ########################################################################
604 # calculate mask by comparing 0..31 to index and save result to stack
608 pcmpeqd %xmm5,%xmm0 # compare to 1,0
612 for($i=0;$i<$STRIDE/16-4;$i+=4) {
615 pcmpeqd %xmm5,%xmm1 # compare to 3,2
616 movdqa %xmm0,`16*($i+0)+112`(%r10)
620 pcmpeqd %xmm5,%xmm2 # compare to 5,4
621 movdqa %xmm1,`16*($i+1)+112`(%r10)
625 pcmpeqd %xmm5,%xmm3 # compare to 7,6
626 movdqa %xmm2,`16*($i+2)+112`(%r10)
631 movdqa %xmm3,`16*($i+3)+112`(%r10)
635 $code.=<<___; # last iteration can be optimized
638 movdqa %xmm0,`16*($i+0)+112`(%r10)
643 movdqa %xmm1,`16*($i+1)+112`(%r10)
646 movdqa %xmm2,`16*($i+2)+112`(%r10)
647 pand `16*($i+0)-128`($bp),%xmm0 # while it's still in register
649 pand `16*($i+1)-128`($bp),%xmm1
650 pand `16*($i+2)-128`($bp),%xmm2
651 movdqa %xmm3,`16*($i+3)+112`(%r10)
652 pand `16*($i+3)-128`($bp),%xmm3
656 for($i=0;$i<$STRIDE/16-4;$i+=4) {
658 movdqa `16*($i+0)-128`($bp),%xmm4
659 movdqa `16*($i+1)-128`($bp),%xmm5
660 movdqa `16*($i+2)-128`($bp),%xmm2
661 pand `16*($i+0)+112`(%r10),%xmm4
662 movdqa `16*($i+3)-128`($bp),%xmm3
663 pand `16*($i+1)+112`(%r10),%xmm5
665 pand `16*($i+2)+112`(%r10),%xmm2
667 pand `16*($i+3)+112`(%r10),%xmm3
674 pshufd \$0x4e,%xmm0,%xmm1
677 movq %xmm0,$m0 # m0=bp[0]
679 mov %r13,16+8(%rsp) # save end of b[num]
680 mov $rp, 56+8(%rsp) # save $rp
682 mov ($n0),$n0 # pull n0[0] value
684 lea ($ap,$num),$ap # end of a[num]
688 mulq $m0 # ap[0]*bp[0]
692 imulq $A[0],$m1 # "tp[0]"*n0
697 add %rax,$A[0] # discarded
710 mov 16($ap,$num),%rax
713 lea 4*8($num),$j # j=4
722 mulq $m0 # ap[j]*bp[0]
733 add $A[0],$N[0] # np[j]*m1+ap[j]*bp[0]
735 mov $N[0],-24($tp) # tp[j-1]
738 mulq $m0 # ap[j]*bp[0]
748 add $A[1],$N[1] # np[j]*m1+ap[j]*bp[0]
750 mov $N[1],-16($tp) # tp[j-1]
753 mulq $m0 # ap[j]*bp[0]
763 add $A[0],$N[0] # np[j]*m1+ap[j]*bp[0]
765 mov $N[0],-8($tp) # tp[j-1]
768 mulq $m0 # ap[j]*bp[0]
778 add $A[1],$N[1] # np[j]*m1+ap[j]*bp[0]
781 mov $N[1],($tp) # tp[j-1]
787 mulq $m0 # ap[j]*bp[0]
798 add $A[0],$N[0] # np[j]*m1+ap[j]*bp[0]
800 mov $N[0],-24($tp) # tp[j-1]
803 mulq $m0 # ap[j]*bp[0]
811 mov ($ap,$num),%rax # ap[0]
813 add $A[1],$N[1] # np[j]*m1+ap[j]*bp[0]
815 mov $N[1],-16($tp) # tp[j-1]
818 lea ($np,$num),$np # rewind $np
829 lea 16+128($tp),%rdx # where 256-byte mask is (+size optimization)
833 for($i=0;$i<$STRIDE/16;$i+=4) {
835 movdqa `16*($i+0)-128`($bp),%xmm0
836 movdqa `16*($i+1)-128`($bp),%xmm1
837 movdqa `16*($i+2)-128`($bp),%xmm2
838 movdqa `16*($i+3)-128`($bp),%xmm3
839 pand `16*($i+0)-128`(%rdx),%xmm0
840 pand `16*($i+1)-128`(%rdx),%xmm1
842 pand `16*($i+2)-128`(%rdx),%xmm2
844 pand `16*($i+3)-128`(%rdx),%xmm3
851 pshufd \$0x4e,%xmm4,%xmm0
854 movq %xmm0,$m0 # m0=bp[i]
858 mulq $m0 # ap[0]*bp[i]
859 add %rax,$A[0] # ap[0]*bp[i]+tp[0]
863 imulq $A[0],$m1 # tp[0]*n0
865 mov $N[1],($tp) # store upmost overflow bit
867 lea ($tp,$num),$tp # rewind $tp
870 add %rax,$A[0] # "$N[0]", discarded
875 mulq $m0 # ap[j]*bp[i]
879 add 8($tp),$A[1] # +tp[1]
885 mov 16($ap,$num),%rax
887 add $A[1],$N[1] # np[j]*m1+ap[j]*bp[i]+tp[j]
888 lea 4*8($num),$j # j=4
896 mulq $m0 # ap[j]*bp[i]
900 add 16($tp),$A[0] # ap[j]*bp[i]+tp[j]
911 mov $N[1],-32($tp) # tp[j-1]
914 mulq $m0 # ap[j]*bp[i]
928 mov $N[0],-24($tp) # tp[j-1]
931 mulq $m0 # ap[j]*bp[i]
935 add ($tp),$A[0] # ap[j]*bp[i]+tp[j]
945 mov $N[1],-16($tp) # tp[j-1]
948 mulq $m0 # ap[j]*bp[i]
963 mov $N[0],-8($tp) # tp[j-1]
969 mulq $m0 # ap[j]*bp[i]
973 add 16($tp),$A[0] # ap[j]*bp[i]+tp[j]
984 mov $N[1],-32($tp) # tp[j-1]
987 mulq $m0 # ap[j]*bp[i]
998 mov ($ap,$num),%rax # ap[0]
1002 mov $N[0],-24($tp) # tp[j-1]
1005 mov $N[1],-16($tp) # tp[j-1]
1006 lea ($np,$num),$np # rewind $np
1011 add ($tp),$N[0] # pull upmost overflow bit
1012 adc \$0,$N[1] # upmost overflow bit
1021 sub $N[0],$m1 # compare top-most words
1022 adc $j,$j # $j is zero
1024 sub $N[1],%rax # %rax=-$N[1]
1025 lea ($tp,$num),%rbx # tptr in .sqr4x_sub
1027 lea ($np),%rbp # nptr in .sqr4x_sub
1030 mov 56+8(%rsp),%rdi # rptr in .sqr4x_sub
1031 dec %r12 # so that after 'not' we get -n[0]
1036 jmp .Lsqr4x_sub_entry
1039 my @ri=("%rax",$bp,$m0,$m1);
1043 lea ($tp,$num),$tp # rewind $tp
1045 lea ($np,$N[1],8),$np
1046 mov 56+8(%rsp),$rp # restore $rp
1055 sbb 16*0($np),@ri[0]
1057 sbb 16*1($np),@ri[1]
1060 sbb 16*2($np),@ri[2]
1062 sbb 16*3($np),@ri[3]
1076 .size mul4x_internal,.-mul4x_internal
1080 ######################################################################
1082 my $rptr="%rdi"; # BN_ULONG *rptr,
1083 my $aptr="%rsi"; # const BN_ULONG *aptr,
1084 my $bptr="%rdx"; # const void *table,
1085 my $nptr="%rcx"; # const BN_ULONG *nptr,
1086 my $n0 ="%r8"; # const BN_ULONG *n0);
1087 my $num ="%r9"; # int num, has to be divisible by 8
1090 my ($i,$j,$tptr)=("%rbp","%rcx",$rptr);
1091 my @A0=("%r10","%r11");
1092 my @A1=("%r12","%r13");
1093 my ($a0,$a1,$ai)=("%r14","%r15","%rbx");
1097 .type bn_power5,\@function,6
1102 .cfi_def_cfa_register %rax
1104 $code.=<<___ if ($addx);
1105 mov OPENSSL_ia32cap_P+8(%rip),%r11d
1107 cmp \$0x80108,%r11d # check for AD*X+BMI2+BMI1
1125 shl \$3,${num}d # convert $num to bytes
1126 lea ($num,$num,2),%r10d # 3*$num
1130 ##############################################################
1131 # Ensure that stack frame doesn't alias with $rptr+3*$num
1132 # modulo 4096, which covers ret[num], am[num] and n[num]
1133 # (see bn_exp.c). This is done to allow memory disambiguation
1134 # logic do its magic. [Extra 256 bytes is for power mask
1135 # calculated from 7th argument, the index.]
1137 lea -320(%rsp,$num,2),%r11
1143 sub %r11,%rbp # align with $aptr
1144 lea -320(%rbp,$num,2),%rbp # future alloca(frame+2*num*8+256)
1149 lea 4096-320(,$num,2),%r10
1150 lea -320(%rbp,$num,2),%rbp # future alloca(frame+2*num*8+256)
1160 lea (%rbp,%r11),%rsp
1164 jmp .Lpwr_page_walk_done
1167 lea -4096(%rsp),%rsp
1171 .Lpwr_page_walk_done:
1176 ##############################################################
1179 # +0 saved $num, used in reduction section
1180 # +8 &t[2*$num], used in reduction section
1186 mov %rax, 40(%rsp) # save original %rsp
1187 .cfi_cfa_expression %rsp+40,deref,+8
1189 movq $rptr,%xmm1 # save $rptr, used in sqr8x
1190 movq $nptr,%xmm2 # save $nptr
1191 movq %r10, %xmm3 # -$num, used in sqr8x
1194 call __bn_sqr8x_internal
1195 call __bn_post4x_internal
1196 call __bn_sqr8x_internal
1197 call __bn_post4x_internal
1198 call __bn_sqr8x_internal
1199 call __bn_post4x_internal
1200 call __bn_sqr8x_internal
1201 call __bn_post4x_internal
1202 call __bn_sqr8x_internal
1203 call __bn_post4x_internal
1213 mov 40(%rsp),%rsi # restore %rsp
1229 .cfi_def_cfa_register %rsp
1233 .size bn_power5,.-bn_power5
1235 .globl bn_sqr8x_internal
1236 .hidden bn_sqr8x_internal
1237 .type bn_sqr8x_internal,\@abi-omnipotent
1240 __bn_sqr8x_internal:
1241 ##############################################################
1244 # a) multiply-n-add everything but a[i]*a[i];
1245 # b) shift result of a) by 1 to the left and accumulate
1246 # a[i]*a[i] products;
1248 ##############################################################
1314 lea 32(%r10),$i # $i=-($num-32)
1315 lea ($aptr,$num),$aptr # end of a[] buffer, ($aptr,$i)=&ap[2]
1317 mov $num,$j # $j=$num
1319 # comments apply to $num==8 case
1320 mov -32($aptr,$i),$a0 # a[0]
1321 lea 48+8(%rsp,$num,2),$tptr # end of tp[] buffer, &tp[2*$num]
1322 mov -24($aptr,$i),%rax # a[1]
1323 lea -32($tptr,$i),$tptr # end of tp[] window, &tp[2*$num-"$i"]
1324 mov -16($aptr,$i),$ai # a[2]
1328 mov %rax,$A0[0] # a[1]*a[0]
1331 mov $A0[0],-24($tptr,$i) # t[1]
1337 mov $A0[1],-16($tptr,$i) # t[2]
1341 mov -8($aptr,$i),$ai # a[3]
1343 mov %rax,$A1[0] # a[2]*a[1]+t[3]
1349 add %rax,$A0[0] # a[3]*a[0]+a[2]*a[1]+t[3]
1355 mov $A0[0],-8($tptr,$j) # t[3]
1360 mov ($aptr,$j),$ai # a[4]
1362 add %rax,$A1[1] # a[3]*a[1]+t[4]
1368 add %rax,$A0[1] # a[4]*a[0]+a[3]*a[1]+t[4]
1370 mov 8($aptr,$j),$ai # a[5]
1378 add %rax,$A1[0] # a[4]*a[3]+t[5]
1380 mov $A0[1],($tptr,$j) # t[4]
1385 add %rax,$A0[0] # a[5]*a[2]+a[4]*a[3]+t[5]
1387 mov 16($aptr,$j),$ai # a[6]
1394 add %rax,$A1[1] # a[5]*a[3]+t[6]
1396 mov $A0[0],8($tptr,$j) # t[5]
1401 add %rax,$A0[1] # a[6]*a[2]+a[5]*a[3]+t[6]
1403 mov 24($aptr,$j),$ai # a[7]
1411 add %rax,$A1[0] # a[6]*a[5]+t[7]
1413 mov $A0[1],16($tptr,$j) # t[6]
1419 add %rax,$A0[0] # a[7]*a[4]+a[6]*a[5]+t[6]
1425 mov $A0[0],-8($tptr,$j) # t[7]
1437 mov $A1[1],($tptr) # t[8]
1439 mov %rdx,8($tptr) # t[9]
1443 .Lsqr4x_outer: # comments apply to $num==6 case
1444 mov -32($aptr,$i),$a0 # a[0]
1445 lea 48+8(%rsp,$num,2),$tptr # end of tp[] buffer, &tp[2*$num]
1446 mov -24($aptr,$i),%rax # a[1]
1447 lea -32($tptr,$i),$tptr # end of tp[] window, &tp[2*$num-"$i"]
1448 mov -16($aptr,$i),$ai # a[2]
1452 mov -24($tptr,$i),$A0[0] # t[1]
1453 add %rax,$A0[0] # a[1]*a[0]+t[1]
1456 mov $A0[0],-24($tptr,$i) # t[1]
1463 add -16($tptr,$i),$A0[1] # a[2]*a[0]+t[2]
1466 mov $A0[1],-16($tptr,$i) # t[2]
1470 mov -8($aptr,$i),$ai # a[3]
1472 add %rax,$A1[0] # a[2]*a[1]+t[3]
1475 add -8($tptr,$i),$A1[0]
1480 add %rax,$A0[0] # a[3]*a[0]+a[2]*a[1]+t[3]
1486 mov $A0[0],-8($tptr,$i) # t[3]
1493 mov ($aptr,$j),$ai # a[4]
1495 add %rax,$A1[1] # a[3]*a[1]+t[4]
1499 add ($tptr,$j),$A1[1]
1504 add %rax,$A0[1] # a[4]*a[0]+a[3]*a[1]+t[4]
1506 mov 8($aptr,$j),$ai # a[5]
1513 add %rax,$A1[0] # a[4]*a[3]+t[5]
1514 mov $A0[1],($tptr,$j) # t[4]
1518 add 8($tptr,$j),$A1[0]
1523 add %rax,$A0[0] # a[5]*a[2]+a[4]*a[3]+t[5]
1529 mov $A0[0],-8($tptr,$j) # t[5], "preloaded t[1]" below
1541 mov $A1[1],($tptr) # t[6], "preloaded t[2]" below
1543 mov %rdx,8($tptr) # t[7], "preloaded t[3]" below
1548 # comments apply to $num==4 case
1549 mov -32($aptr),$a0 # a[0]
1550 lea 48+8(%rsp,$num,2),$tptr # end of tp[] buffer, &tp[2*$num]
1551 mov -24($aptr),%rax # a[1]
1552 lea -32($tptr,$i),$tptr # end of tp[] window, &tp[2*$num-"$i"]
1553 mov -16($aptr),$ai # a[2]
1557 add %rax,$A0[0] # a[1]*a[0]+t[1], preloaded t[1]
1565 mov $A0[0],-24($tptr) # t[1]
1568 add $A1[1],$A0[1] # a[2]*a[0]+t[2], preloaded t[2]
1569 mov -8($aptr),$ai # a[3]
1573 add %rax,$A1[0] # a[2]*a[1]+t[3], preloaded t[3]
1575 mov $A0[1],-16($tptr) # t[2]
1580 add %rax,$A0[0] # a[3]*a[0]+a[2]*a[1]+t[3]
1586 mov $A0[0],-8($tptr) # t[3]
1590 mov -16($aptr),%rax # a[2]
1595 mov $A1[1],($tptr) # t[4]
1597 mov %rdx,8($tptr) # t[5]
1602 my ($shift,$carry)=($a0,$a1);
1603 my @S=(@A1,$ai,$n0);
1607 sub $num,$i # $i=16-$num
1610 add $A1[0],%rax # t[5]
1612 mov %rax,8($tptr) # t[5]
1613 mov %rdx,16($tptr) # t[6]
1614 mov $carry,24($tptr) # t[7]
1616 mov -16($aptr,$i),%rax # a[0]
1617 lea 48+8(%rsp),$tptr
1618 xor $A0[0],$A0[0] # t[0]
1619 mov 8($tptr),$A0[1] # t[1]
1621 lea ($shift,$A0[0],2),$S[0] # t[2*i]<<1 | shift
1623 lea ($j,$A0[1],2),$S[1] # t[2*i+1]<<1 |
1625 or $A0[0],$S[1] # | t[2*i]>>63
1626 mov 16($tptr),$A0[0] # t[2*i+2] # prefetch
1627 mov $A0[1],$shift # shift=t[2*i+1]>>63
1628 mul %rax # a[i]*a[i]
1629 neg $carry # mov $carry,cf
1630 mov 24($tptr),$A0[1] # t[2*i+2+1] # prefetch
1632 mov -8($aptr,$i),%rax # a[i+1] # prefetch
1636 lea ($shift,$A0[0],2),$S[2] # t[2*i]<<1 | shift
1638 sbb $carry,$carry # mov cf,$carry
1640 lea ($j,$A0[1],2),$S[3] # t[2*i+1]<<1 |
1642 or $A0[0],$S[3] # | t[2*i]>>63
1643 mov 32($tptr),$A0[0] # t[2*i+2] # prefetch
1644 mov $A0[1],$shift # shift=t[2*i+1]>>63
1645 mul %rax # a[i]*a[i]
1646 neg $carry # mov $carry,cf
1647 mov 40($tptr),$A0[1] # t[2*i+2+1] # prefetch
1649 mov 0($aptr,$i),%rax # a[i+1] # prefetch
1654 sbb $carry,$carry # mov cf,$carry
1656 jmp .Lsqr4x_shift_n_add
1659 .Lsqr4x_shift_n_add:
1660 lea ($shift,$A0[0],2),$S[0] # t[2*i]<<1 | shift
1662 lea ($j,$A0[1],2),$S[1] # t[2*i+1]<<1 |
1664 or $A0[0],$S[1] # | t[2*i]>>63
1665 mov -16($tptr),$A0[0] # t[2*i+2] # prefetch
1666 mov $A0[1],$shift # shift=t[2*i+1]>>63
1667 mul %rax # a[i]*a[i]
1668 neg $carry # mov $carry,cf
1669 mov -8($tptr),$A0[1] # t[2*i+2+1] # prefetch
1671 mov -8($aptr,$i),%rax # a[i+1] # prefetch
1672 mov $S[0],-32($tptr)
1675 lea ($shift,$A0[0],2),$S[2] # t[2*i]<<1 | shift
1676 mov $S[1],-24($tptr)
1677 sbb $carry,$carry # mov cf,$carry
1679 lea ($j,$A0[1],2),$S[3] # t[2*i+1]<<1 |
1681 or $A0[0],$S[3] # | t[2*i]>>63
1682 mov 0($tptr),$A0[0] # t[2*i+2] # prefetch
1683 mov $A0[1],$shift # shift=t[2*i+1]>>63
1684 mul %rax # a[i]*a[i]
1685 neg $carry # mov $carry,cf
1686 mov 8($tptr),$A0[1] # t[2*i+2+1] # prefetch
1688 mov 0($aptr,$i),%rax # a[i+1] # prefetch
1689 mov $S[2],-16($tptr)
1692 lea ($shift,$A0[0],2),$S[0] # t[2*i]<<1 | shift
1694 sbb $carry,$carry # mov cf,$carry
1696 lea ($j,$A0[1],2),$S[1] # t[2*i+1]<<1 |
1698 or $A0[0],$S[1] # | t[2*i]>>63
1699 mov 16($tptr),$A0[0] # t[2*i+2] # prefetch
1700 mov $A0[1],$shift # shift=t[2*i+1]>>63
1701 mul %rax # a[i]*a[i]
1702 neg $carry # mov $carry,cf
1703 mov 24($tptr),$A0[1] # t[2*i+2+1] # prefetch
1705 mov 8($aptr,$i),%rax # a[i+1] # prefetch
1709 lea ($shift,$A0[0],2),$S[2] # t[2*i]<<1 | shift
1711 sbb $carry,$carry # mov cf,$carry
1713 lea ($j,$A0[1],2),$S[3] # t[2*i+1]<<1 |
1715 or $A0[0],$S[3] # | t[2*i]>>63
1716 mov 32($tptr),$A0[0] # t[2*i+2] # prefetch
1717 mov $A0[1],$shift # shift=t[2*i+1]>>63
1718 mul %rax # a[i]*a[i]
1719 neg $carry # mov $carry,cf
1720 mov 40($tptr),$A0[1] # t[2*i+2+1] # prefetch
1722 mov 16($aptr,$i),%rax # a[i+1] # prefetch
1726 sbb $carry,$carry # mov cf,$carry
1729 jnz .Lsqr4x_shift_n_add
1731 lea ($shift,$A0[0],2),$S[0] # t[2*i]<<1 | shift
1734 lea ($j,$A0[1],2),$S[1] # t[2*i+1]<<1 |
1736 or $A0[0],$S[1] # | t[2*i]>>63
1737 mov -16($tptr),$A0[0] # t[2*i+2] # prefetch
1738 mov $A0[1],$shift # shift=t[2*i+1]>>63
1739 mul %rax # a[i]*a[i]
1740 neg $carry # mov $carry,cf
1741 mov -8($tptr),$A0[1] # t[2*i+2+1] # prefetch
1743 mov -8($aptr),%rax # a[i+1] # prefetch
1744 mov $S[0],-32($tptr)
1747 lea ($shift,$A0[0],2),$S[2] # t[2*i]<<1|shift
1748 mov $S[1],-24($tptr)
1749 sbb $carry,$carry # mov cf,$carry
1751 lea ($j,$A0[1],2),$S[3] # t[2*i+1]<<1 |
1753 or $A0[0],$S[3] # | t[2*i]>>63
1754 mul %rax # a[i]*a[i]
1755 neg $carry # mov $carry,cf
1758 mov $S[2],-16($tptr)
1762 ######################################################################
1763 # Montgomery reduction part, "word-by-word" algorithm.
1765 # This new path is inspired by multiple submissions from Intel, by
1766 # Shay Gueron, Vlad Krasnov, Erdinc Ozturk, James Guilford,
1769 my ($nptr,$tptr,$carry,$m0)=("%rbp","%rdi","%rsi","%rbx");
1773 __bn_sqr8x_reduction:
1775 lea ($nptr,$num),%rcx # end of n[]
1776 lea 48+8(%rsp,$num,2),%rdx # end of t[] buffer
1778 lea 48+8(%rsp,$num),$tptr # end of initial t[] window
1781 jmp .L8x_reduction_loop
1784 .L8x_reduction_loop:
1785 lea ($tptr,$num),$tptr # start of current t[] window
1795 mov %rax,(%rdx) # store top-most carry bit
1796 lea 8*8($tptr),$tptr
1800 imulq 32+8(%rsp),$m0 # n0*a[0]
1801 mov 8*0($nptr),%rax # n[0]
1808 mov 8*1($nptr),%rax # n[1]
1818 mov $m0,48-8+8(%rsp,%rcx,8) # put aside n0*a[i]
1827 mov 32+8(%rsp),$carry # pull n0, borrow $carry
1835 imulq %r8,$carry # modulo-scheduled
1865 mov $carry,$m0 # n0*a[i]
1867 mov 8*0($nptr),%rax # n[0]
1876 lea 8*8($nptr),$nptr
1878 mov 8+8(%rsp),%rdx # pull end of t[]
1879 cmp 0+8(%rsp),$nptr # end of n[]?
1891 sbb $carry,$carry # top carry
1893 mov 48+56+8(%rsp),$m0 # pull n0*a[0]
1903 mov %r8,($tptr) # save result
1912 lea 8($tptr),$tptr # $tptr++
1957 mov 48-16+8(%rsp,%rcx,8),$m0# pull n0*a[i]
1961 mov 8*0($nptr),%rax # pull n[0]
1968 lea 8*8($nptr),$nptr
1969 mov 8+8(%rsp),%rdx # pull end of t[]
1970 cmp 0+8(%rsp),$nptr # end of n[]?
1971 jae .L8x_tail_done # break out of loop
1973 mov 48+56+8(%rsp),$m0 # pull n0*a[0]
1975 mov 8*0($nptr),%rax # pull n[0]
1984 sbb $carry,$carry # top carry
1992 add (%rdx),%r8 # can this overflow?
2012 adc \$0,%rax # top-most carry
2013 mov -8($nptr),%rcx # np[num-1]
2016 movq %xmm2,$nptr # restore $nptr
2018 mov %r8,8*0($tptr) # store top 512 bits
2020 movq %xmm3,$num # $num is %r9, can't be moved upwards
2027 lea 8*8($tptr),$tptr
2029 cmp %rdx,$tptr # end of t[]?
2030 jb .L8x_reduction_loop
2032 .size bn_sqr8x_internal,.-bn_sqr8x_internal
2035 ##############################################################
2036 # Post-condition, 4x unrolled
2039 my ($tptr,$nptr)=("%rbx","%rbp");
2041 .type __bn_post4x_internal,\@abi-omnipotent
2043 __bn_post4x_internal:
2045 lea (%rdi,$num),$tptr # %rdi was $tptr above
2047 movq %xmm1,$rptr # restore $rptr
2049 movq %xmm1,$aptr # prepare for back-to-back call
2051 dec %r12 # so that after 'not' we get -n[0]
2056 jmp .Lsqr4x_sub_entry
2065 lea 8*4($nptr),$nptr
2075 neg %r10 # mov %r10,%cf
2081 lea 8*4($tptr),$tptr
2083 sbb %r10,%r10 # mov %cf,%r10
2086 lea 8*4($rptr),$rptr
2091 mov $num,%r10 # prepare for back-to-back call
2092 neg $num # restore $num
2094 .size __bn_post4x_internal,.-__bn_post4x_internal
2099 .globl bn_from_montgomery
2100 .type bn_from_montgomery,\@abi-omnipotent
2103 testl \$7,`($win64?"48(%rsp)":"%r9d")`
2107 .size bn_from_montgomery,.-bn_from_montgomery
2109 .type bn_from_mont8x,\@function,6
2115 .cfi_def_cfa_register %rax
2130 shl \$3,${num}d # convert $num to bytes
2131 lea ($num,$num,2),%r10 # 3*$num in bytes
2135 ##############################################################
2136 # Ensure that stack frame doesn't alias with $rptr+3*$num
2137 # modulo 4096, which covers ret[num], am[num] and n[num]
2138 # (see bn_exp.c). The stack is allocated to aligned with
2139 # bn_power5's frame, and as bn_from_montgomery happens to be
2140 # last operation, we use the opportunity to cleanse it.
2142 lea -320(%rsp,$num,2),%r11
2148 sub %r11,%rbp # align with $aptr
2149 lea -320(%rbp,$num,2),%rbp # future alloca(frame+2*$num*8+256)
2154 lea 4096-320(,$num,2),%r10
2155 lea -320(%rbp,$num,2),%rbp # future alloca(frame+2*$num*8+256)
2165 lea (%rbp,%r11),%rsp
2169 jmp .Lfrom_page_walk_done
2172 lea -4096(%rsp),%rsp
2176 .Lfrom_page_walk_done:
2181 ##############################################################
2184 # +0 saved $num, used in reduction section
2185 # +8 &t[2*$num], used in reduction section
2191 mov %rax, 40(%rsp) # save original %rsp
2192 .cfi_cfa_expression %rsp+40,deref,+8
2201 movdqu ($aptr),%xmm1
2202 movdqu 16($aptr),%xmm2
2203 movdqu 32($aptr),%xmm3
2204 movdqa %xmm0,(%rax,$num)
2205 movdqu 48($aptr),%xmm4
2206 movdqa %xmm0,16(%rax,$num)
2207 .byte 0x48,0x8d,0xb6,0x40,0x00,0x00,0x00 # lea 64($aptr),$aptr
2209 movdqa %xmm0,32(%rax,$num)
2210 movdqa %xmm2,16(%rax)
2211 movdqa %xmm0,48(%rax,$num)
2212 movdqa %xmm3,32(%rax)
2213 movdqa %xmm4,48(%rax)
2222 movq %r10, %xmm3 # -num
2224 $code.=<<___ if ($addx);
2225 mov OPENSSL_ia32cap_P+8(%rip),%r11d
2227 cmp \$0x80108,%r11d # check for AD*X+BMI2+BMI1
2230 lea (%rax,$num),$rptr
2231 call __bn_sqrx8x_reduction
2232 call __bn_postx4x_internal
2236 jmp .Lfrom_mont_zero
2242 call __bn_sqr8x_reduction
2243 call __bn_post4x_internal
2247 jmp .Lfrom_mont_zero
2251 mov 40(%rsp),%rsi # restore %rsp
2253 movdqa %xmm0,16*0(%rax)
2254 movdqa %xmm0,16*1(%rax)
2255 movdqa %xmm0,16*2(%rax)
2256 movdqa %xmm0,16*3(%rax)
2259 jnz .Lfrom_mont_zero
2275 .cfi_def_cfa_register %rsp
2279 .size bn_from_mont8x,.-bn_from_mont8x
2285 my $bp="%rdx"; # restore original value
2288 .type bn_mulx4x_mont_gather5,\@function,6
2290 bn_mulx4x_mont_gather5:
2293 .cfi_def_cfa_register %rax
2309 shl \$3,${num}d # convert $num to bytes
2310 lea ($num,$num,2),%r10 # 3*$num in bytes
2314 ##############################################################
2315 # Ensure that stack frame doesn't alias with $rptr+3*$num
2316 # modulo 4096, which covers ret[num], am[num] and n[num]
2317 # (see bn_exp.c). This is done to allow memory disambiguation
2318 # logic do its magic. [Extra [num] is allocated in order
2319 # to align with bn_power5's frame, which is cleansed after
2320 # completing exponentiation. Extra 256 bytes is for power mask
2321 # calculated from 7th argument, the index.]
2323 lea -320(%rsp,$num,2),%r11
2329 sub %r11,%rbp # align with $aptr
2330 lea -320(%rbp,$num,2),%rbp # future alloca(frame+2*$num*8+256)
2334 lea 4096-320(,$num,2),%r10
2335 lea -320(%rbp,$num,2),%rbp # future alloca(frame+2*$num*8+256)
2341 and \$-64,%rbp # ensure alignment
2345 lea (%rbp,%r11),%rsp
2348 ja .Lmulx4x_page_walk
2349 jmp .Lmulx4x_page_walk_done
2352 lea -4096(%rsp),%rsp
2355 ja .Lmulx4x_page_walk
2356 .Lmulx4x_page_walk_done:
2358 ##############################################################
2361 # +8 off-loaded &b[i]
2370 mov $n0, 32(%rsp) # save *n0
2371 mov %rax,40(%rsp) # save original %rsp
2372 .cfi_cfa_expression %rsp+40,deref,+8
2374 call mulx4x_internal
2376 mov 40(%rsp),%rsi # restore %rsp
2393 .cfi_def_cfa_register %rsp
2397 .size bn_mulx4x_mont_gather5,.-bn_mulx4x_mont_gather5
2399 .type mulx4x_internal,\@abi-omnipotent
2402 mov $num,8(%rsp) # save -$num (it was in bytes)
2404 neg $num # restore $num
2406 neg %r10 # restore $num
2407 lea 128($bp,$num),%r13 # end of powers table (+size optimization)
2409 movd `($win64?56:8)`(%rax),%xmm5 # load 7th argument
2411 lea .Linc(%rip),%rax
2412 mov %r13,16+8(%rsp) # end of b[num]
2413 mov $num,24+8(%rsp) # inner counter
2414 mov $rp, 56+8(%rsp) # save $rp
2416 my ($aptr, $bptr, $nptr, $tptr, $mi, $bi, $zero, $num)=
2417 ("%rsi","%rdi","%rcx","%rbx","%r8","%r9","%rbp","%rax");
2419 my $STRIDE=2**5*8; # 5 is "window size"
2420 my $N=$STRIDE/4; # should match cache line size
2422 movdqa 0(%rax),%xmm0 # 00000001000000010000000000000000
2423 movdqa 16(%rax),%xmm1 # 00000002000000020000000200000002
2424 lea 88-112(%rsp,%r10),%r10 # place the mask after tp[num+1] (+ICache optimization)
2425 lea 128($bp),$bptr # size optimization
2427 pshufd \$0,%xmm5,%xmm5 # broadcast index
2432 ########################################################################
2433 # calculate mask by comparing 0..31 to index and save result to stack
2438 pcmpeqd %xmm5,%xmm0 # compare to 1,0
2441 for($i=0;$i<$STRIDE/16-4;$i+=4) {
2444 pcmpeqd %xmm5,%xmm1 # compare to 3,2
2445 movdqa %xmm0,`16*($i+0)+112`(%r10)
2449 pcmpeqd %xmm5,%xmm2 # compare to 5,4
2450 movdqa %xmm1,`16*($i+1)+112`(%r10)
2454 pcmpeqd %xmm5,%xmm3 # compare to 7,6
2455 movdqa %xmm2,`16*($i+2)+112`(%r10)
2460 movdqa %xmm3,`16*($i+3)+112`(%r10)
2464 $code.=<<___; # last iteration can be optimized
2468 movdqa %xmm0,`16*($i+0)+112`(%r10)
2472 movdqa %xmm1,`16*($i+1)+112`(%r10)
2475 movdqa %xmm2,`16*($i+2)+112`(%r10)
2477 pand `16*($i+0)-128`($bptr),%xmm0 # while it's still in register
2478 pand `16*($i+1)-128`($bptr),%xmm1
2479 pand `16*($i+2)-128`($bptr),%xmm2
2480 movdqa %xmm3,`16*($i+3)+112`(%r10)
2481 pand `16*($i+3)-128`($bptr),%xmm3
2485 for($i=0;$i<$STRIDE/16-4;$i+=4) {
2487 movdqa `16*($i+0)-128`($bptr),%xmm4
2488 movdqa `16*($i+1)-128`($bptr),%xmm5
2489 movdqa `16*($i+2)-128`($bptr),%xmm2
2490 pand `16*($i+0)+112`(%r10),%xmm4
2491 movdqa `16*($i+3)-128`($bptr),%xmm3
2492 pand `16*($i+1)+112`(%r10),%xmm5
2494 pand `16*($i+2)+112`(%r10),%xmm2
2496 pand `16*($i+3)+112`(%r10),%xmm3
2503 pshufd \$0x4e,%xmm0,%xmm1
2505 lea $STRIDE($bptr),$bptr
2506 movq %xmm0,%rdx # bp[0]
2507 lea 64+8*4+8(%rsp),$tptr
2510 mulx 0*8($aptr),$mi,%rax # a[0]*b[0]
2511 mulx 1*8($aptr),%r11,%r12 # a[1]*b[0]
2513 mulx 2*8($aptr),%rax,%r13 # ...
2516 mulx 3*8($aptr),%rax,%r14
2519 imulq 32+8(%rsp),$mi # "t[0]"*n0
2520 xor $zero,$zero # cf=0, of=0
2523 mov $bptr,8+8(%rsp) # off-load &b[i]
2525 lea 4*8($aptr),$aptr
2527 adcx $zero,%r14 # cf=0
2529 mulx 0*8($nptr),%rax,%r10
2530 adcx %rax,%r15 # discarded
2532 mulx 1*8($nptr),%rax,%r11
2535 mulx 2*8($nptr),%rax,%r12
2536 mov 24+8(%rsp),$bptr # counter value
2537 mov %r10,-8*4($tptr)
2540 mulx 3*8($nptr),%rax,%r15
2542 mov %r11,-8*3($tptr)
2544 adox $zero,%r15 # of=0
2545 lea 4*8($nptr),$nptr
2546 mov %r12,-8*2($tptr)
2551 adcx $zero,%r15 # cf=0, modulo-scheduled
2552 mulx 0*8($aptr),%r10,%rax # a[4]*b[0]
2554 mulx 1*8($aptr),%r11,%r14 # a[5]*b[0]
2556 mulx 2*8($aptr),%r12,%rax # ...
2558 mulx 3*8($aptr),%r13,%r14
2562 adcx $zero,%r14 # cf=0
2563 lea 4*8($aptr),$aptr
2564 lea 4*8($tptr),$tptr
2567 mulx 0*8($nptr),%rax,%r15
2570 mulx 1*8($nptr),%rax,%r15
2573 mulx 2*8($nptr),%rax,%r15
2574 mov %r10,-5*8($tptr)
2576 mov %r11,-4*8($tptr)
2578 mulx 3*8($nptr),%rax,%r15
2580 mov %r12,-3*8($tptr)
2583 lea 4*8($nptr),$nptr
2584 mov %r13,-2*8($tptr)
2586 dec $bptr # of=0, pass cf
2589 mov 8(%rsp),$num # load -num
2590 adc $zero,%r15 # modulo-scheduled
2591 lea ($aptr,$num),$aptr # rewind $aptr
2593 mov 8+8(%rsp),$bptr # re-load &b[i]
2594 adc $zero,$zero # top-most carry
2595 mov %r14,-1*8($tptr)
2600 lea 16-256($tptr),%r10 # where 256-byte mask is (+density control)
2605 for($i=0;$i<$STRIDE/16;$i+=4) {
2607 movdqa `16*($i+0)-128`($bptr),%xmm0
2608 movdqa `16*($i+1)-128`($bptr),%xmm1
2609 movdqa `16*($i+2)-128`($bptr),%xmm2
2610 pand `16*($i+0)+256`(%r10),%xmm0
2611 movdqa `16*($i+3)-128`($bptr),%xmm3
2612 pand `16*($i+1)+256`(%r10),%xmm1
2614 pand `16*($i+2)+256`(%r10),%xmm2
2616 pand `16*($i+3)+256`(%r10),%xmm3
2623 pshufd \$0x4e,%xmm4,%xmm0
2625 lea $STRIDE($bptr),$bptr
2626 movq %xmm0,%rdx # m0=bp[i]
2628 mov $zero,($tptr) # save top-most carry
2629 lea 4*8($tptr,$num),$tptr # rewind $tptr
2630 mulx 0*8($aptr),$mi,%r11 # a[0]*b[i]
2631 xor $zero,$zero # cf=0, of=0
2633 mulx 1*8($aptr),%r14,%r12 # a[1]*b[i]
2634 adox -4*8($tptr),$mi # +t[0]
2636 mulx 2*8($aptr),%r15,%r13 # ...
2637 adox -3*8($tptr),%r11
2639 mulx 3*8($aptr),%rdx,%r14
2640 adox -2*8($tptr),%r12
2642 lea ($nptr,$num),$nptr # rewind $nptr
2643 lea 4*8($aptr),$aptr
2644 adox -1*8($tptr),%r13
2649 imulq 32+8(%rsp),$mi # "t[0]"*n0
2652 xor $zero,$zero # cf=0, of=0
2653 mov $bptr,8+8(%rsp) # off-load &b[i]
2655 mulx 0*8($nptr),%rax,%r10
2656 adcx %rax,%r15 # discarded
2658 mulx 1*8($nptr),%rax,%r11
2661 mulx 2*8($nptr),%rax,%r12
2664 mulx 3*8($nptr),%rax,%r15
2666 mov 24+8(%rsp),$bptr # counter value
2667 mov %r10,-8*4($tptr)
2669 mov %r11,-8*3($tptr)
2670 adox $zero,%r15 # of=0
2671 mov %r12,-8*2($tptr)
2672 lea 4*8($nptr),$nptr
2677 mulx 0*8($aptr),%r10,%rax # a[4]*b[i]
2678 adcx $zero,%r15 # cf=0, modulo-scheduled
2680 mulx 1*8($aptr),%r11,%r14 # a[5]*b[i]
2681 adcx 0*8($tptr),%r10
2683 mulx 2*8($aptr),%r12,%rax # ...
2684 adcx 1*8($tptr),%r11
2686 mulx 3*8($aptr),%r13,%r14
2688 adcx 2*8($tptr),%r12
2690 adcx 3*8($tptr),%r13
2691 adox $zero,%r14 # of=0
2692 lea 4*8($aptr),$aptr
2693 lea 4*8($tptr),$tptr
2694 adcx $zero,%r14 # cf=0
2697 mulx 0*8($nptr),%rax,%r15
2700 mulx 1*8($nptr),%rax,%r15
2703 mulx 2*8($nptr),%rax,%r15
2704 mov %r10,-5*8($tptr)
2707 mov %r11,-4*8($tptr)
2708 mulx 3*8($nptr),%rax,%r15
2710 lea 4*8($nptr),$nptr
2711 mov %r12,-3*8($tptr)
2714 mov %r13,-2*8($tptr)
2716 dec $bptr # of=0, pass cf
2719 mov 0+8(%rsp),$num # load -num
2720 adc $zero,%r15 # modulo-scheduled
2721 sub 0*8($tptr),$bptr # pull top-most carry to %cf
2722 mov 8+8(%rsp),$bptr # re-load &b[i]
2725 lea ($aptr,$num),$aptr # rewind $aptr
2726 adc $zero,$zero # top-most carry
2727 mov %r14,-1*8($tptr)
2734 mov ($nptr,$num),%r12
2735 lea ($nptr,$num),%rbp # rewind $nptr
2737 lea ($tptr,$num),%rdi # rewind $tptr
2740 sub %r14,%r10 # compare top-most words
2744 sub %r8,%rax # %rax=-%r8
2745 mov 56+8(%rsp),%rdx # restore rp
2746 dec %r12 # so that after 'not' we get -n[0]
2751 jmp .Lsqrx4x_sub_entry # common post-condition
2752 .size mulx4x_internal,.-mulx4x_internal
2755 ######################################################################
2757 my $rptr="%rdi"; # BN_ULONG *rptr,
2758 my $aptr="%rsi"; # const BN_ULONG *aptr,
2759 my $bptr="%rdx"; # const void *table,
2760 my $nptr="%rcx"; # const BN_ULONG *nptr,
2761 my $n0 ="%r8"; # const BN_ULONG *n0);
2762 my $num ="%r9"; # int num, has to be divisible by 8
2765 my ($i,$j,$tptr)=("%rbp","%rcx",$rptr);
2766 my @A0=("%r10","%r11");
2767 my @A1=("%r12","%r13");
2768 my ($a0,$a1,$ai)=("%r14","%r15","%rbx");
2771 .type bn_powerx5,\@function,6
2776 .cfi_def_cfa_register %rax
2792 shl \$3,${num}d # convert $num to bytes
2793 lea ($num,$num,2),%r10 # 3*$num in bytes
2797 ##############################################################
2798 # Ensure that stack frame doesn't alias with $rptr+3*$num
2799 # modulo 4096, which covers ret[num], am[num] and n[num]
2800 # (see bn_exp.c). This is done to allow memory disambiguation
2801 # logic do its magic. [Extra 256 bytes is for power mask
2802 # calculated from 7th argument, the index.]
2804 lea -320(%rsp,$num,2),%r11
2810 sub %r11,%rbp # align with $aptr
2811 lea -320(%rbp,$num,2),%rbp # future alloca(frame+2*$num*8+256)
2816 lea 4096-320(,$num,2),%r10
2817 lea -320(%rbp,$num,2),%rbp # alloca(frame+2*$num*8+256)
2827 lea (%rbp,%r11),%rsp
2831 jmp .Lpwrx_page_walk_done
2834 lea -4096(%rsp),%rsp
2838 .Lpwrx_page_walk_done:
2843 ##############################################################
2846 # +0 saved $num, used in reduction section
2847 # +8 &t[2*$num], used in reduction section
2848 # +16 intermediate carry bit
2849 # +24 top-most carry bit, used in reduction section
2855 movq $rptr,%xmm1 # save $rptr
2856 movq $nptr,%xmm2 # save $nptr
2857 movq %r10, %xmm3 # -$num
2860 mov %rax, 40(%rsp) # save original %rsp
2861 .cfi_cfa_expression %rsp+40,deref,+8
2864 call __bn_sqrx8x_internal
2865 call __bn_postx4x_internal
2866 call __bn_sqrx8x_internal
2867 call __bn_postx4x_internal
2868 call __bn_sqrx8x_internal
2869 call __bn_postx4x_internal
2870 call __bn_sqrx8x_internal
2871 call __bn_postx4x_internal
2872 call __bn_sqrx8x_internal
2873 call __bn_postx4x_internal
2875 mov %r10,$num # -num
2881 call mulx4x_internal
2883 mov 40(%rsp),%rsi # restore %rsp
2900 .cfi_def_cfa_register %rsp
2904 .size bn_powerx5,.-bn_powerx5
2906 .globl bn_sqrx8x_internal
2907 .hidden bn_sqrx8x_internal
2908 .type bn_sqrx8x_internal,\@abi-omnipotent
2911 __bn_sqrx8x_internal:
2912 ##################################################################
2915 # a) multiply-n-add everything but a[i]*a[i];
2916 # b) shift result of a) by 1 to the left and accumulate
2917 # a[i]*a[i] products;
2919 ##################################################################
2920 # a[7]a[7]a[6]a[6]a[5]a[5]a[4]a[4]a[3]a[3]a[2]a[2]a[1]a[1]a[0]a[0]
2951 # a[7]a[7]a[6]a[6]a[5]a[5]a[4]a[4]a[3]a[3]a[2]a[2]a[1]a[1]a[0]a[0]
2954 my ($zero,$carry)=("%rbp","%rcx");
2957 lea 48+8(%rsp),$tptr
2958 lea ($aptr,$num),$aaptr
2959 mov $num,0+8(%rsp) # save $num
2960 mov $aaptr,8+8(%rsp) # save end of $aptr
2961 jmp .Lsqr8x_zero_start
2964 .byte 0x66,0x66,0x66,0x2e,0x0f,0x1f,0x84,0x00,0x00,0x00,0x00,0x00
2967 movdqa %xmm0,0*8($tptr)
2968 movdqa %xmm0,2*8($tptr)
2969 movdqa %xmm0,4*8($tptr)
2970 movdqa %xmm0,6*8($tptr)
2971 .Lsqr8x_zero_start: # aligned at 32
2972 movdqa %xmm0,8*8($tptr)
2973 movdqa %xmm0,10*8($tptr)
2974 movdqa %xmm0,12*8($tptr)
2975 movdqa %xmm0,14*8($tptr)
2976 lea 16*8($tptr),$tptr
2980 mov 0*8($aptr),%rdx # a[0], modulo-scheduled
2981 #xor %r9,%r9 # t[1], ex-$num, zero already
2988 lea 48+8(%rsp),$tptr
2989 xor $zero,$zero # cf=0, cf=0
2990 jmp .Lsqrx8x_outer_loop
2993 .Lsqrx8x_outer_loop:
2994 mulx 1*8($aptr),%r8,%rax # a[1]*a[0]
2995 adcx %r9,%r8 # a[1]*a[0]+=t[1]
2997 mulx 2*8($aptr),%r9,%rax # a[2]*a[0]
3000 .byte 0xc4,0xe2,0xab,0xf6,0x86,0x18,0x00,0x00,0x00 # mulx 3*8($aptr),%r10,%rax # ...
3003 .byte 0xc4,0xe2,0xa3,0xf6,0x86,0x20,0x00,0x00,0x00 # mulx 4*8($aptr),%r11,%rax
3006 mulx 5*8($aptr),%r12,%rax
3009 mulx 6*8($aptr),%r13,%rax
3012 mulx 7*8($aptr),%r14,%r15
3013 mov 1*8($aptr),%rdx # a[1]
3017 mov %r8,1*8($tptr) # t[1]
3018 mov %r9,2*8($tptr) # t[2]
3019 sbb $carry,$carry # mov %cf,$carry
3020 xor $zero,$zero # cf=0, of=0
3023 mulx 2*8($aptr),%r8,%rbx # a[2]*a[1]
3024 mulx 3*8($aptr),%r9,%rax # a[3]*a[1]
3027 mulx 4*8($aptr),%r10,%rbx # ...
3030 .byte 0xc4,0xe2,0xa3,0xf6,0x86,0x28,0x00,0x00,0x00 # mulx 5*8($aptr),%r11,%rax
3033 .byte 0xc4,0xe2,0x9b,0xf6,0x9e,0x30,0x00,0x00,0x00 # mulx 6*8($aptr),%r12,%rbx
3036 .byte 0xc4,0x62,0x93,0xf6,0xb6,0x38,0x00,0x00,0x00 # mulx 7*8($aptr),%r13,%r14
3037 mov 2*8($aptr),%rdx # a[2]
3041 adox $zero,%r14 # of=0
3042 adcx $zero,%r14 # cf=0
3044 mov %r8,3*8($tptr) # t[3]
3045 mov %r9,4*8($tptr) # t[4]
3047 mulx 3*8($aptr),%r8,%rbx # a[3]*a[2]
3048 mulx 4*8($aptr),%r9,%rax # a[4]*a[2]
3051 mulx 5*8($aptr),%r10,%rbx # ...
3054 .byte 0xc4,0xe2,0xa3,0xf6,0x86,0x30,0x00,0x00,0x00 # mulx 6*8($aptr),%r11,%rax
3057 .byte 0xc4,0x62,0x9b,0xf6,0xae,0x38,0x00,0x00,0x00 # mulx 7*8($aptr),%r12,%r13
3059 mov 3*8($aptr),%rdx # a[3]
3063 mov %r8,5*8($tptr) # t[5]
3064 mov %r9,6*8($tptr) # t[6]
3065 mulx 4*8($aptr),%r8,%rax # a[4]*a[3]
3066 adox $zero,%r13 # of=0
3067 adcx $zero,%r13 # cf=0
3069 mulx 5*8($aptr),%r9,%rbx # a[5]*a[3]
3072 mulx 6*8($aptr),%r10,%rax # ...
3075 mulx 7*8($aptr),%r11,%r12
3076 mov 4*8($aptr),%rdx # a[4]
3077 mov 5*8($aptr),%r14 # a[5]
3080 mov 6*8($aptr),%r15 # a[6]
3082 adox $zero,%r12 # of=0
3083 adcx $zero,%r12 # cf=0
3085 mov %r8,7*8($tptr) # t[7]
3086 mov %r9,8*8($tptr) # t[8]
3088 mulx %r14,%r9,%rax # a[5]*a[4]
3089 mov 7*8($aptr),%r8 # a[7]
3091 mulx %r15,%r10,%rbx # a[6]*a[4]
3094 mulx %r8,%r11,%rax # a[7]*a[4]
3095 mov %r14,%rdx # a[5]
3098 #adox $zero,%rax # of=0
3099 adcx $zero,%rax # cf=0
3101 mulx %r15,%r14,%rbx # a[6]*a[5]
3102 mulx %r8,%r12,%r13 # a[7]*a[5]
3103 mov %r15,%rdx # a[6]
3104 lea 8*8($aptr),$aptr
3111 mulx %r8,%r8,%r14 # a[7]*a[6]
3116 je .Lsqrx8x_outer_break
3118 neg $carry # mov $carry,%cf
3122 adcx 9*8($tptr),%r9 # +=t[9]
3123 adcx 10*8($tptr),%r10 # ...
3124 adcx 11*8($tptr),%r11
3125 adc 12*8($tptr),%r12
3126 adc 13*8($tptr),%r13
3127 adc 14*8($tptr),%r14
3128 adc 15*8($tptr),%r15
3130 lea 2*64($tptr),$tptr
3131 sbb %rax,%rax # mov %cf,$carry
3133 mov -64($aptr),%rdx # a[0]
3134 mov %rax,16+8(%rsp) # offload $carry
3135 mov $tptr,24+8(%rsp)
3137 #lea 8*8($tptr),$tptr # see 2*8*8($tptr) above
3138 xor %eax,%eax # cf=0, of=0
3144 mulx 0*8($aaptr),%rax,%r8 # a[8]*a[i]
3145 adcx %rax,%rbx # +=t[8]
3148 mulx 1*8($aaptr),%rax,%r9 # ...
3152 mulx 2*8($aaptr),%rax,%r10
3156 mulx 3*8($aaptr),%rax,%r11
3160 .byte 0xc4,0x62,0xfb,0xf6,0xa5,0x20,0x00,0x00,0x00 # mulx 4*8($aaptr),%rax,%r12
3164 mulx 5*8($aaptr),%rax,%r13
3168 mulx 6*8($aaptr),%rax,%r14
3169 mov %rbx,($tptr,%rcx,8) # store t[8+i]
3174 .byte 0xc4,0x62,0xfb,0xf6,0xbd,0x38,0x00,0x00,0x00 # mulx 7*8($aaptr),%rax,%r15
3175 mov 8($aptr,%rcx,8),%rdx # a[i]
3177 adox %rbx,%r15 # %rbx is 0, of=0
3178 adcx %rbx,%r15 # cf=0
3184 lea 8*8($aaptr),$aaptr
3186 cmp 8+8(%rsp),$aaptr # done?
3189 sub 16+8(%rsp),%rbx # mov 16(%rsp),%cf
3200 lea 8*8($tptr),$tptr
3202 sbb %rax,%rax # mov %cf,%rax
3203 xor %ebx,%ebx # cf=0, of=0
3204 mov %rax,16+8(%rsp) # offload carry
3210 sub 16+8(%rsp),%rbx # mov 16(%rsp),%cf
3212 mov 24+8(%rsp),$carry # initial $tptr, borrow $carry
3214 mov 0*8($aptr),%rdx # a[8], modulo-scheduled
3222 cmp $carry,$tptr # cf=0, of=0
3223 je .Lsqrx8x_outer_loop
3228 mov 2*8($carry),%r10
3230 mov 3*8($carry),%r11
3232 mov 4*8($carry),%r12
3234 mov 5*8($carry),%r13
3236 mov 6*8($carry),%r14
3238 mov 7*8($carry),%r15
3240 jmp .Lsqrx8x_outer_loop
3243 .Lsqrx8x_outer_break:
3244 mov %r9,9*8($tptr) # t[9]
3245 movq %xmm3,%rcx # -$num
3246 mov %r10,10*8($tptr) # ...
3247 mov %r11,11*8($tptr)
3248 mov %r12,12*8($tptr)
3249 mov %r13,13*8($tptr)
3250 mov %r14,14*8($tptr)
3255 lea 48+8(%rsp),$tptr
3256 mov ($aptr,$i),%rdx # a[0]
3258 mov 8($tptr),$A0[1] # t[1]
3259 xor $A0[0],$A0[0] # t[0], of=0, cf=0
3260 mov 0+8(%rsp),$num # restore $num
3262 mov 16($tptr),$A1[0] # t[2] # prefetch
3263 mov 24($tptr),$A1[1] # t[3] # prefetch
3264 #jmp .Lsqrx4x_shift_n_add # happens to be aligned
3267 .Lsqrx4x_shift_n_add:
3271 .byte 0x48,0x8b,0x94,0x0e,0x08,0x00,0x00,0x00 # mov 8($aptr,$i),%rdx # a[i+1] # prefetch
3272 .byte 0x4c,0x8b,0x97,0x20,0x00,0x00,0x00 # mov 32($tptr),$A0[0] # t[2*i+4] # prefetch
3275 mov 40($tptr),$A0[1] # t[2*i+4+1] # prefetch
3282 mov 16($aptr,$i),%rdx # a[i+2] # prefetch
3283 mov 48($tptr),$A1[0] # t[2*i+6] # prefetch
3286 mov 56($tptr),$A1[1] # t[2*i+6+1] # prefetch
3293 mov 24($aptr,$i),%rdx # a[i+3] # prefetch
3295 mov 64($tptr),$A0[0] # t[2*i+8] # prefetch
3298 mov 72($tptr),$A0[1] # t[2*i+8+1] # prefetch
3305 jrcxz .Lsqrx4x_shift_n_add_break
3306 .byte 0x48,0x8b,0x94,0x0e,0x00,0x00,0x00,0x00 # mov 0($aptr,$i),%rdx # a[i+4] # prefetch
3309 mov 80($tptr),$A1[0] # t[2*i+10] # prefetch
3310 mov 88($tptr),$A1[1] # t[2*i+10+1] # prefetch
3315 jmp .Lsqrx4x_shift_n_add
3318 .Lsqrx4x_shift_n_add_break:
3322 lea 64($tptr),$tptr # end of t[] buffer
3325 ######################################################################
3326 # Montgomery reduction part, "word-by-word" algorithm.
3328 # This new path is inspired by multiple submissions from Intel, by
3329 # Shay Gueron, Vlad Krasnov, Erdinc Ozturk, James Guilford,
3332 my ($nptr,$carry,$m0)=("%rbp","%rsi","%rdx");
3336 __bn_sqrx8x_reduction:
3337 xor %eax,%eax # initial top-most carry bit
3338 mov 32+8(%rsp),%rbx # n0
3339 mov 48+8(%rsp),%rdx # "%r8", 8*0($tptr)
3340 lea -8*8($nptr,$num),%rcx # end of n[]
3341 #lea 48+8(%rsp,$num,2),$tptr # end of t[] buffer
3342 mov %rcx, 0+8(%rsp) # save end of n[]
3343 mov $tptr,8+8(%rsp) # save end of t[]
3345 lea 48+8(%rsp),$tptr # initial t[] window
3346 jmp .Lsqrx8x_reduction_loop
3349 .Lsqrx8x_reduction_loop:
3355 imulq %rbx,%rdx # n0*a[i]
3359 mov %rax,24+8(%rsp) # store top-most carry bit
3361 lea 8*8($tptr),$tptr
3362 xor $carry,$carry # cf=0,of=0
3369 mulx 8*0($nptr),%rax,%r8 # n[0]
3370 adcx %rbx,%rax # discarded
3373 mulx 8*1($nptr),%rbx,%r9 # n[1]
3377 mulx 8*2($nptr),%rbx,%r10
3381 mulx 8*3($nptr),%rbx,%r11
3385 .byte 0xc4,0x62,0xe3,0xf6,0xa5,0x20,0x00,0x00,0x00 # mulx 8*4($nptr),%rbx,%r12
3391 mulx 32+8(%rsp),%rbx,%rdx # %rdx discarded
3393 mov %rax,64+48+8(%rsp,%rcx,8) # put aside n0*a[i]
3395 mulx 8*5($nptr),%rax,%r13
3399 mulx 8*6($nptr),%rax,%r14
3403 mulx 8*7($nptr),%rax,%r15
3406 adox $carry,%r15 # $carry is 0
3407 adcx $carry,%r15 # cf=0
3409 .byte 0x67,0x67,0x67
3413 mov $carry,%rax # xor %rax,%rax
3414 cmp 0+8(%rsp),$nptr # end of n[]?
3415 jae .Lsqrx8x_no_tail
3417 mov 48+8(%rsp),%rdx # pull n0*a[0]
3419 lea 8*8($nptr),$nptr
3422 adcx 8*2($tptr),%r10
3428 lea 8*8($tptr),$tptr
3429 sbb %rax,%rax # top carry
3431 xor $carry,$carry # of=0, cf=0
3438 mulx 8*0($nptr),%rax,%r8
3442 mulx 8*1($nptr),%rax,%r9
3446 mulx 8*2($nptr),%rax,%r10
3450 mulx 8*3($nptr),%rax,%r11
3454 .byte 0xc4,0x62,0xfb,0xf6,0xa5,0x20,0x00,0x00,0x00 # mulx 8*4($nptr),%rax,%r12
3458 mulx 8*5($nptr),%rax,%r13
3462 mulx 8*6($nptr),%rax,%r14
3466 mulx 8*7($nptr),%rax,%r15
3467 mov 72+48+8(%rsp,%rcx,8),%rdx # pull n0*a[i]
3470 mov %rbx,($tptr,%rcx,8) # save result
3472 adcx $carry,%r15 # cf=0
3477 cmp 0+8(%rsp),$nptr # end of n[]?
3478 jae .Lsqrx8x_tail_done # break out of loop
3480 sub 16+8(%rsp),$carry # mov 16(%rsp),%cf
3481 mov 48+8(%rsp),%rdx # pull n0*a[0]
3482 lea 8*8($nptr),$nptr
3491 lea 8*8($tptr),$tptr
3493 sub \$8,%rcx # mov \$-8,%rcx
3495 xor $carry,$carry # of=0, cf=0
3502 add 24+8(%rsp),%r8 # can this overflow?
3512 sub 16+8(%rsp),$carry # mov 16(%rsp),%cf
3513 .Lsqrx8x_no_tail: # %cf is 0 if jumped here
3517 mov 8*7($nptr),$carry
3518 movq %xmm2,$nptr # restore $nptr
3525 adc \$0,%rax # top-most carry
3527 mov 32+8(%rsp),%rbx # n0
3528 mov 8*8($tptr,%rcx),%rdx # modulo-scheduled "%r8"
3530 mov %r8,8*0($tptr) # store top 512 bits
3531 lea 8*8($tptr),%r8 # borrow %r8
3540 lea 8*8($tptr,%rcx),$tptr # start of current t[] window
3541 cmp 8+8(%rsp),%r8 # end of t[]?
3542 jb .Lsqrx8x_reduction_loop
3544 .size bn_sqrx8x_internal,.-bn_sqrx8x_internal
3547 ##############################################################
3548 # Post-condition, 4x unrolled
3551 my ($rptr,$nptr)=("%rdx","%rbp");
3554 __bn_postx4x_internal:
3556 mov %rcx,%r10 # -$num
3557 mov %rcx,%r9 # -$num
3560 #lea 48+8(%rsp,%r9),$tptr
3561 movq %xmm1,$rptr # restore $rptr
3562 movq %xmm1,$aptr # prepare for back-to-back call
3563 dec %r12 # so that after 'not' we get -n[0]
3568 jmp .Lsqrx4x_sub_entry
3578 lea 8*4($nptr),$nptr
3583 neg %r8 # mov %r8,%cf
3589 lea 8*4($tptr),$tptr
3591 sbb %r8,%r8 # mov %cf,%r8
3594 lea 8*4($rptr),$rptr
3599 neg %r9 # restore $num
3602 .size __bn_postx4x_internal,.-__bn_postx4x_internal
3607 my ($inp,$num,$tbl,$idx)=$win64?("%rcx","%edx","%r8", "%r9d") : # Win64 order
3608 ("%rdi","%esi","%rdx","%ecx"); # Unix order
3615 .type bn_get_bits5,\@abi-omnipotent
3627 movzw (%r10,$num,2),%eax
3631 .size bn_get_bits5,.-bn_get_bits5
3634 .type bn_scatter5,\@abi-omnipotent
3638 jz .Lscatter_epilogue
3639 lea ($tbl,$idx,8),$tbl
3649 .size bn_scatter5,.-bn_scatter5
3652 .type bn_gather5,\@abi-omnipotent
3655 .LSEH_begin_bn_gather5: # Win64 thing, but harmless in other cases
3656 # I can't trust assembler to use specific encoding:-(
3657 .byte 0x4c,0x8d,0x14,0x24 #lea (%rsp),%r10
3658 .byte 0x48,0x81,0xec,0x08,0x01,0x00,0x00 #sub $0x108,%rsp
3659 lea .Linc(%rip),%rax
3660 and \$-16,%rsp # shouldn't be formally required
3663 movdqa 0(%rax),%xmm0 # 00000001000000010000000000000000
3664 movdqa 16(%rax),%xmm1 # 00000002000000020000000200000002
3665 lea 128($tbl),%r11 # size optimization
3666 lea 128(%rsp),%rax # size optimization
3668 pshufd \$0,%xmm5,%xmm5 # broadcast $idx
3672 ########################################################################
3673 # calculate mask by comparing 0..31 to $idx and save result to stack
3675 for($i=0;$i<$STRIDE/16;$i+=4) {
3678 pcmpeqd %xmm5,%xmm0 # compare to 1,0
3680 $code.=<<___ if ($i);
3681 movdqa %xmm3,`16*($i-1)-128`(%rax)
3687 pcmpeqd %xmm5,%xmm1 # compare to 3,2
3688 movdqa %xmm0,`16*($i+0)-128`(%rax)
3692 pcmpeqd %xmm5,%xmm2 # compare to 5,4
3693 movdqa %xmm1,`16*($i+1)-128`(%rax)
3697 pcmpeqd %xmm5,%xmm3 # compare to 7,6
3698 movdqa %xmm2,`16*($i+2)-128`(%rax)
3703 movdqa %xmm3,`16*($i-1)-128`(%rax)
3711 for($i=0;$i<$STRIDE/16;$i+=4) {
3713 movdqa `16*($i+0)-128`(%r11),%xmm0
3714 movdqa `16*($i+1)-128`(%r11),%xmm1
3715 movdqa `16*($i+2)-128`(%r11),%xmm2
3716 pand `16*($i+0)-128`(%rax),%xmm0
3717 movdqa `16*($i+3)-128`(%r11),%xmm3
3718 pand `16*($i+1)-128`(%rax),%xmm1
3720 pand `16*($i+2)-128`(%rax),%xmm2
3722 pand `16*($i+3)-128`(%rax),%xmm3
3729 lea $STRIDE(%r11),%r11
3730 pshufd \$0x4e,%xmm4,%xmm0
3732 movq %xmm0,($out) # m0=bp[0]
3739 .LSEH_end_bn_gather5:
3740 .size bn_gather5,.-bn_gather5
3748 .asciz "Montgomery Multiplication with scatter/gather for x86_64, CRYPTOGAMS by <appro\@openssl.org>"
3751 # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame,
3752 # CONTEXT *context,DISPATCHER_CONTEXT *disp)
3760 .extern __imp_RtlVirtualUnwind
3761 .type mul_handler,\@abi-omnipotent
3775 mov 120($context),%rax # pull context->Rax
3776 mov 248($context),%rbx # pull context->Rip
3778 mov 8($disp),%rsi # disp->ImageBase
3779 mov 56($disp),%r11 # disp->HandlerData
3781 mov 0(%r11),%r10d # HandlerData[0]
3782 lea (%rsi,%r10),%r10 # end of prologue label
3783 cmp %r10,%rbx # context->Rip<end of prologue label
3784 jb .Lcommon_seh_tail
3786 mov 4(%r11),%r10d # HandlerData[1]
3787 lea (%rsi,%r10),%r10 # beginning of body label
3788 cmp %r10,%rbx # context->Rip<body label
3789 jb .Lcommon_pop_regs
3791 mov 152($context),%rax # pull context->Rsp
3793 mov 8(%r11),%r10d # HandlerData[2]
3794 lea (%rsi,%r10),%r10 # epilogue label
3795 cmp %r10,%rbx # context->Rip>=epilogue label
3796 jae .Lcommon_seh_tail
3798 lea .Lmul_epilogue(%rip),%r10
3802 mov 192($context),%r10 # pull $num
3803 mov 8(%rax,%r10,8),%rax # pull saved stack pointer
3805 jmp .Lcommon_pop_regs
3808 mov 40(%rax),%rax # pull saved stack pointer
3816 mov %rbx,144($context) # restore context->Rbx
3817 mov %rbp,160($context) # restore context->Rbp
3818 mov %r12,216($context) # restore context->R12
3819 mov %r13,224($context) # restore context->R13
3820 mov %r14,232($context) # restore context->R14
3821 mov %r15,240($context) # restore context->R15
3826 mov %rax,152($context) # restore context->Rsp
3827 mov %rsi,168($context) # restore context->Rsi
3828 mov %rdi,176($context) # restore context->Rdi
3830 mov 40($disp),%rdi # disp->ContextRecord
3831 mov $context,%rsi # context
3832 mov \$154,%ecx # sizeof(CONTEXT)
3833 .long 0xa548f3fc # cld; rep movsq
3836 xor %rcx,%rcx # arg1, UNW_FLAG_NHANDLER
3837 mov 8(%rsi),%rdx # arg2, disp->ImageBase
3838 mov 0(%rsi),%r8 # arg3, disp->ControlPc
3839 mov 16(%rsi),%r9 # arg4, disp->FunctionEntry
3840 mov 40(%rsi),%r10 # disp->ContextRecord
3841 lea 56(%rsi),%r11 # &disp->HandlerData
3842 lea 24(%rsi),%r12 # &disp->EstablisherFrame
3843 mov %r10,32(%rsp) # arg5
3844 mov %r11,40(%rsp) # arg6
3845 mov %r12,48(%rsp) # arg7
3846 mov %rcx,56(%rsp) # arg8, (NULL)
3847 call *__imp_RtlVirtualUnwind(%rip)
3849 mov \$1,%eax # ExceptionContinueSearch
3861 .size mul_handler,.-mul_handler
3865 .rva .LSEH_begin_bn_mul_mont_gather5
3866 .rva .LSEH_end_bn_mul_mont_gather5
3867 .rva .LSEH_info_bn_mul_mont_gather5
3869 .rva .LSEH_begin_bn_mul4x_mont_gather5
3870 .rva .LSEH_end_bn_mul4x_mont_gather5
3871 .rva .LSEH_info_bn_mul4x_mont_gather5
3873 .rva .LSEH_begin_bn_power5
3874 .rva .LSEH_end_bn_power5
3875 .rva .LSEH_info_bn_power5
3877 .rva .LSEH_begin_bn_from_mont8x
3878 .rva .LSEH_end_bn_from_mont8x
3879 .rva .LSEH_info_bn_from_mont8x
3881 $code.=<<___ if ($addx);
3882 .rva .LSEH_begin_bn_mulx4x_mont_gather5
3883 .rva .LSEH_end_bn_mulx4x_mont_gather5
3884 .rva .LSEH_info_bn_mulx4x_mont_gather5
3886 .rva .LSEH_begin_bn_powerx5
3887 .rva .LSEH_end_bn_powerx5
3888 .rva .LSEH_info_bn_powerx5
3891 .rva .LSEH_begin_bn_gather5
3892 .rva .LSEH_end_bn_gather5
3893 .rva .LSEH_info_bn_gather5
3897 .LSEH_info_bn_mul_mont_gather5:
3900 .rva .Lmul_body,.Lmul_body,.Lmul_epilogue # HandlerData[]
3902 .LSEH_info_bn_mul4x_mont_gather5:
3905 .rva .Lmul4x_prologue,.Lmul4x_body,.Lmul4x_epilogue # HandlerData[]
3907 .LSEH_info_bn_power5:
3910 .rva .Lpower5_prologue,.Lpower5_body,.Lpower5_epilogue # HandlerData[]
3912 .LSEH_info_bn_from_mont8x:
3915 .rva .Lfrom_prologue,.Lfrom_body,.Lfrom_epilogue # HandlerData[]
3917 $code.=<<___ if ($addx);
3919 .LSEH_info_bn_mulx4x_mont_gather5:
3922 .rva .Lmulx4x_prologue,.Lmulx4x_body,.Lmulx4x_epilogue # HandlerData[]
3924 .LSEH_info_bn_powerx5:
3927 .rva .Lpowerx5_prologue,.Lpowerx5_body,.Lpowerx5_epilogue # HandlerData[]
3931 .LSEH_info_bn_gather5:
3932 .byte 0x01,0x0b,0x03,0x0a
3933 .byte 0x0b,0x01,0x21,0x00 # sub rsp,0x108
3934 .byte 0x04,0xa3,0x00,0x00 # lea r10,(rsp)
3939 $code =~ s/\`([^\`]*)\`/eval($1)/gem;