3 # ====================================================================
4 # Written by Andy Polyakov <appro@openssl.org> for the OpenSSL
5 # project. The module is, however, dual licensed under OpenSSL and
6 # CRYPTOGAMS licenses depending on where you obtain it. For further
7 # details see http://www.openssl.org/~appro/cryptogams/.
8 # ====================================================================
12 # Companion to x86_64-mont.pl that optimizes cache-timing attack
13 # countermeasures. The subroutines are produced by replacing bp[i]
14 # references in their x86_64-mont.pl counterparts with cache-neutral
15 # references to powers table computed in BN_mod_exp_mont_consttime.
16 # In addition subroutine that scatters elements of the powers table
17 # is implemented, so that scatter-/gathering can be tuned without
18 # bn_exp.c modifications.
22 # Add MULX/AD*X code paths and additional interfaces to optimize for
23 # branch prediction unit. For input lengths that are multiples of 8
24 # the np argument is not just modulus value, but one interleaved
25 # with 0. This is to optimize post-condition...
29 if ($flavour =~ /\./) { $output = $flavour; undef $flavour; }
31 $win64=0; $win64=1 if ($flavour =~ /[nm]asm|mingw64/ || $output =~ /\.asm$/);
33 $0 =~ m/(.*[\/\\])[^\/\\]+$/; $dir=$1;
34 ( $xlate="${dir}x86_64-xlate.pl" and -f $xlate ) or
35 ( $xlate="${dir}../../perlasm/x86_64-xlate.pl" and -f $xlate) or
36 die "can't locate x86_64-xlate.pl";
38 open OUT,"| \"$^X\" $xlate $flavour $output";
41 if (`$ENV{CC} -Wa,-v -c -o /dev/null -x assembler /dev/null 2>&1`
42 =~ /GNU assembler version ([2-9]\.[0-9]+)/) {
46 if (!$addx && $win64 && ($flavour =~ /nasm/ || $ENV{ASM} =~ /nasm/) &&
47 `nasm -v 2>&1` =~ /NASM version ([2-9]\.[0-9]+)/) {
51 if (!$addx && $win64 && ($flavour =~ /masm/ || $ENV{ASM} =~ /ml64/) &&
52 `ml64 2>&1` =~ /Version ([0-9]+)\./) {
56 if (!$addx && `$ENV{CC} -v 2>&1` =~ /(^clang version|based on LLVM) ([3-9])\.([0-9]+)/) {
57 my $ver = $2 + $3/100.0; # 3.1->3.01, 3.10->3.10
61 # int bn_mul_mont_gather5(
62 $rp="%rdi"; # BN_ULONG *rp,
63 $ap="%rsi"; # const BN_ULONG *ap,
64 $bp="%rdx"; # const BN_ULONG *bp,
65 $np="%rcx"; # const BN_ULONG *np,
66 $n0="%r8"; # const BN_ULONG *n0,
67 $num="%r9"; # int num,
68 # int idx); # 0 to 2^5-1, "index" in $bp holding
69 # pre-computed powers of a', interlaced
70 # in such manner that b[0] is $bp[idx],
71 # b[1] is [2^5+idx], etc.
83 .extern OPENSSL_ia32cap_P
85 .globl bn_mul_mont_gather5
86 .type bn_mul_mont_gather5,\@function,6
92 $code.=<<___ if ($addx);
93 mov OPENSSL_ia32cap_P+8(%rip),%r11d
102 mov `($win64?56:8)`(%rsp),%r10d # load 7th argument
110 $code.=<<___ if ($win64);
113 movaps %xmm7,0x10(%rsp)
118 lea (%rsp,%r11,8),%rsp # tp=alloca(8*(num+2))
119 and \$-1024,%rsp # minimize TLB usage
121 mov %rax,8(%rsp,$num,8) # tp[num+1]=%rsp
123 mov $bp,%r12 # reassign $bp
126 $STRIDE=2**5*8; # 5 is "window size"
127 $N=$STRIDE/4; # should match cache line size
130 shr \$`log($N/8)/log(2)`,%r10
133 lea .Lmagic_masks(%rip),%rax
134 and \$`2**5/($N/8)-1`,%r10 # 5 is "window size"
135 lea 96($bp,%r11,8),$bp # pointer within 1st cache line
136 movq 0(%rax,%r10,8),%xmm4 # set of masks denoting which
137 movq 8(%rax,%r10,8),%xmm5 # cache line contains element
138 movq 16(%rax,%r10,8),%xmm6 # denoted by 7th argument
139 movq 24(%rax,%r10,8),%xmm7
141 movq `0*$STRIDE/4-96`($bp),%xmm0
142 movq `1*$STRIDE/4-96`($bp),%xmm1
144 movq `2*$STRIDE/4-96`($bp),%xmm2
146 movq `3*$STRIDE/4-96`($bp),%xmm3
154 movq %xmm0,$m0 # m0=bp[0]
156 mov ($n0),$n0 # pull n0[0] value
162 movq `0*$STRIDE/4-96`($bp),%xmm0
163 movq `1*$STRIDE/4-96`($bp),%xmm1
165 movq `2*$STRIDE/4-96`($bp),%xmm2
169 mulq $m0 # ap[0]*bp[0]
173 movq `3*$STRIDE/4-96`($bp),%xmm3
178 imulq $lo0,$m1 # "tp[0]"*n0
186 add %rax,$lo0 # discarded
199 add $hi0,$hi1 # np[j]*m1+ap[j]*bp[0]
202 mov $hi1,-16(%rsp,$j,8) # tp[j-1]
206 mulq $m0 # ap[j]*bp[0]
217 movq %xmm0,$m0 # bp[1]
220 mov ($ap),%rax # ap[0]
222 add $hi0,$hi1 # np[j]*m1+ap[j]*bp[0]
224 mov $hi1,-16(%rsp,$j,8) # tp[j-1]
231 mov $hi1,-8(%rsp,$num,8)
232 mov %rdx,(%rsp,$num,8) # store upmost overflow bit
242 movq `0*$STRIDE/4-96`($bp),%xmm0
243 movq `1*$STRIDE/4-96`($bp),%xmm1
245 movq `2*$STRIDE/4-96`($bp),%xmm2
248 mulq $m0 # ap[0]*bp[i]
249 add %rax,$lo0 # ap[0]*bp[i]+tp[0]
253 movq `3*$STRIDE/4-96`($bp),%xmm3
258 imulq $lo0,$m1 # tp[0]*n0
266 add %rax,$lo0 # discarded
269 mov 8(%rsp),$lo0 # tp[1]
280 add $lo0,$hi1 # np[j]*m1+ap[j]*bp[i]+tp[j]
283 mov $hi1,-16(%rsp,$j,8) # tp[j-1]
287 mulq $m0 # ap[j]*bp[i]
291 add $hi0,$lo0 # ap[j]*bp[i]+tp[j]
300 movq %xmm0,$m0 # bp[i+1]
303 mov ($ap),%rax # ap[0]
305 add $lo0,$hi1 # np[j]*m1+ap[j]*bp[i]+tp[j]
308 mov $hi1,-16(%rsp,$j,8) # tp[j-1]
314 add $lo0,$hi1 # pull upmost overflow bit
316 mov $hi1,-8(%rsp,$num,8)
317 mov %rdx,(%rsp,$num,8) # store upmost overflow bit
323 xor $i,$i # i=0 and clear CF!
324 mov (%rsp),%rax # tp[0]
325 lea (%rsp),$ap # borrow ap for tp
329 .Lsub: sbb ($np,$i,8),%rax
330 mov %rax,($rp,$i,8) # rp[i]=tp[i]-np[i]
331 mov 8($ap,$i,8),%rax # tp[i+1]
333 dec $j # doesnn't affect CF!
336 sbb \$0,%rax # handle upmost overflow bit
343 or $np,$ap # ap=borrow?tp:rp
345 .Lcopy: # copy or in-place refresh
347 mov $i,(%rsp,$i,8) # zap temporary vector
348 mov %rax,($rp,$i,8) # rp[i]=tp[i]
353 mov 8(%rsp,$num,8),%rsi # restore %rsp
356 $code.=<<___ if ($win64);
357 movaps -88(%rsi),%xmm6
358 movaps -72(%rsi),%xmm7
370 .size bn_mul_mont_gather5,.-bn_mul_mont_gather5
373 my @A=("%r10","%r11");
374 my @N=("%r13","%rdi");
376 .type bn_mul4x_mont_gather5,\@function,6
378 bn_mul4x_mont_gather5:
381 $code.=<<___ if ($addx);
396 $code.=<<___ if ($win64);
399 movaps %xmm7,0x10(%rsp)
405 shl \$3+2,%r10d # 4*$num
408 ##############################################################
409 # ensure that stack frame doesn't alias with $aptr+4*$num
410 # modulo 4096, which covers ret[num], am[num] and n[2*num]
411 # (see bn_exp.c). this is done to allow memory disambiguation
412 # logic do its magic. [excessive frame is allocated in order
413 # to allow bn_from_mont8x to clear it.]
415 lea -64(%rsp,$num,2),%r11
420 sub %r11,%rsp # align with $ap
421 lea -64(%rsp,$num,2),%rsp # alloca(128+num*8)
426 lea 4096-64(,$num,2),%r10
427 lea -64(%rsp,$num,2),%rsp # alloca(128+num*8)
441 mov 40(%rsp),%rsi # restore %rsp
444 $code.=<<___ if ($win64);
445 movaps -88(%rsi),%xmm6
446 movaps -72(%rsi),%xmm7
458 .size bn_mul4x_mont_gather5,.-bn_mul4x_mont_gather5
460 .type mul4x_internal,\@abi-omnipotent
464 mov `($win64?56:8)`(%rax),%r10d # load 7th argument
465 lea 256(%rdx,$num),%r13
466 shr \$5,$num # restore $num
469 $STRIDE=2**5*8; # 5 is "window size"
470 $N=$STRIDE/4; # should match cache line size
474 shr \$`log($N/8)/log(2)`,%r10
477 lea .Lmagic_masks(%rip),%rax
478 and \$`2**5/($N/8)-1`,%r10 # 5 is "window size"
479 lea 96(%rdx,%r11,8),$bp # pointer within 1st cache line
480 movq 0(%rax,%r10,8),%xmm4 # set of masks denoting which
481 movq 8(%rax,%r10,8),%xmm5 # cache line contains element
483 movq 16(%rax,%r10,8),%xmm6 # denoted by 7th argument
484 movq 24(%rax,%r10,8),%xmm7
487 movq `0*$STRIDE/4-96`($bp),%xmm0
488 lea $STRIDE($bp),$tp # borrow $tp
489 movq `1*$STRIDE/4-96`($bp),%xmm1
491 movq `2*$STRIDE/4-96`($bp),%xmm2
493 movq `3*$STRIDE/4-96`($bp),%xmm3
497 movq `0*$STRIDE/4-96`($tp),%xmm1
502 movq `1*$STRIDE/4-96`($tp),%xmm2
507 movq `2*$STRIDE/4-96`($tp),%xmm3
509 movq %xmm0,$m0 # m0=bp[0]
510 movq `3*$STRIDE/4-96`($tp),%xmm0
511 mov %r13,16+8(%rsp) # save end of b[num]
512 mov $rp, 56+8(%rsp) # save $rp
514 mov ($n0),$n0 # pull n0[0] value
516 lea ($ap,$num),$ap # end of a[num]
520 mulq $m0 # ap[0]*bp[0]
528 imulq $A[0],$m1 # "tp[0]"*n0
529 ##############################################################
530 # $tp is chosen so that writing to top-most element of the
531 # vector occurs just "above" references to powers table,
532 # "above" modulo cache-line size, which effectively precludes
533 # possibility of memory disambiguation logic failure when
534 # accessing the table.
536 lea 64+8(%rsp,%r11,8),$tp
541 lea 2*$STRIDE($bp),$bp
545 add %rax,$A[0] # discarded
552 mov 16*1($np),%rax # interleaved with 0, therefore 16*n
558 mov 16($ap,$num),%rax
561 lea 4*8($num),$j # j=4
570 mulq $m0 # ap[j]*bp[0]
581 add $A[0],$N[0] # np[j]*m1+ap[j]*bp[0]
583 mov $N[0],-24($tp) # tp[j-1]
586 mulq $m0 # ap[j]*bp[0]
596 add $A[1],$N[1] # np[j]*m1+ap[j]*bp[0]
598 mov $N[1],-16($tp) # tp[j-1]
601 mulq $m0 # ap[j]*bp[0]
611 add $A[0],$N[0] # np[j]*m1+ap[j]*bp[0]
613 mov $N[0],-8($tp) # tp[j-1]
616 mulq $m0 # ap[j]*bp[0]
626 add $A[1],$N[1] # np[j]*m1+ap[j]*bp[0]
629 mov $N[1],($tp) # tp[j-1]
635 mulq $m0 # ap[j]*bp[0]
646 add $A[0],$N[0] # np[j]*m1+ap[j]*bp[0]
648 mov $N[0],-24($tp) # tp[j-1]
651 mulq $m0 # ap[j]*bp[0]
659 mov ($ap,$num),%rax # ap[0]
661 add $A[1],$N[1] # np[j]*m1+ap[j]*bp[0]
663 mov $N[1],-16($tp) # tp[j-1]
666 movq %xmm0,$m0 # bp[1]
667 lea ($np,$num,2),$np # rewind $np
680 mulq $m0 # ap[0]*bp[i]
681 add %rax,$A[0] # ap[0]*bp[i]+tp[0]
685 movq `0*$STRIDE/4-96`($bp),%xmm0
686 movq `1*$STRIDE/4-96`($bp),%xmm1
688 movq `2*$STRIDE/4-96`($bp),%xmm2
690 movq `3*$STRIDE/4-96`($bp),%xmm3
692 imulq $A[0],$m1 # tp[0]*n0
695 mov $N[1],($tp) # store upmost overflow bit
701 lea ($tp,$num),$tp # rewind $tp
706 add %rax,$A[0] # "$N[0]", discarded
711 mulq $m0 # ap[j]*bp[i]
713 mov 16*1($np),%rax # interleaved with 0, therefore 16*n
715 add 8($tp),$A[1] # +tp[1]
721 mov 16($ap,$num),%rax
723 add $A[1],$N[1] # np[j]*m1+ap[j]*bp[i]+tp[j]
724 lea 4*8($num),$j # j=4
732 mulq $m0 # ap[j]*bp[i]
736 add 16($tp),$A[0] # ap[j]*bp[i]+tp[j]
747 mov $N[1],-32($tp) # tp[j-1]
750 mulq $m0 # ap[j]*bp[i]
764 mov $N[0],-24($tp) # tp[j-1]
767 mulq $m0 # ap[j]*bp[i]
771 add ($tp),$A[0] # ap[j]*bp[i]+tp[j]
781 mov $N[1],-16($tp) # tp[j-1]
784 mulq $m0 # ap[j]*bp[i]
799 mov $N[0],-8($tp) # tp[j-1]
805 mulq $m0 # ap[j]*bp[i]
809 add 16($tp),$A[0] # ap[j]*bp[i]+tp[j]
820 mov $N[1],-32($tp) # tp[j-1]
823 mulq $m0 # ap[j]*bp[i]
834 mov ($ap,$num),%rax # ap[0]
838 mov $N[0],-24($tp) # tp[j-1]
841 movq %xmm0,$m0 # bp[i+1]
842 mov $N[1],-16($tp) # tp[j-1]
843 lea ($np,$num,2),$np # rewind $np
848 add ($tp),$N[0] # pull upmost overflow bit
849 adc \$0,$N[1] # upmost overflow bit
857 sub $N[0],$m1 # compare top-most words
858 adc $j,$j # $j is zero
861 lea ($tp,$num),%rbx # tptr in .sqr4x_sub
862 lea ($np,$N[1],8),%rbp # nptr in .sqr4x_sub
864 sar \$3+2,%rcx # cf=0
865 mov 56+8(%rsp),%rdi # rptr in .sqr4x_sub
869 my @ri=("%rax",$bp,$m0,$m1);
873 lea ($tp,$num),$tp # rewind $tp
875 lea ($np,$N[1],8),$np
876 mov 56+8(%rsp),$rp # restore $rp
906 .size mul4x_internal,.-mul4x_internal
910 ######################################################################
912 my $rptr="%rdi"; # BN_ULONG *rptr,
913 my $aptr="%rsi"; # const BN_ULONG *aptr,
914 my $bptr="%rdx"; # const void *table,
915 my $nptr="%rcx"; # const BN_ULONG *nptr,
916 my $n0 ="%r8"; # const BN_ULONG *n0);
917 my $num ="%r9"; # int num, has to be divisible by 8
920 my ($i,$j,$tptr)=("%rbp","%rcx",$rptr);
921 my @A0=("%r10","%r11");
922 my @A1=("%r12","%r13");
923 my ($a0,$a1,$ai)=("%r14","%r15","%rbx");
927 .type bn_power5,\@function,6
931 $code.=<<___ if ($addx);
932 mov OPENSSL_ia32cap_P+8(%rip),%r11d
946 $code.=<<___ if ($win64);
949 movaps %xmm7,0x10(%rsp)
953 shl \$3,${num}d # convert $num to bytes
954 shl \$3+2,%r10d # 4*$num
958 ##############################################################
959 # ensure that stack frame doesn't alias with $aptr+4*$num
960 # modulo 4096, which covers ret[num], am[num] and n[2*num]
961 # (see bn_exp.c). this is done to allow memory disambiguation
962 # logic do its magic.
964 lea -64(%rsp,$num,2),%r11
969 sub %r11,%rsp # align with $aptr
970 lea -64(%rsp,$num,2),%rsp # alloca(frame+2*$num)
975 lea 4096-64(,$num,2),%r10 # 4096-frame-2*$num
976 lea -64(%rsp,$num,2),%rsp # alloca(frame+2*$num)
986 ##############################################################
989 # +0 saved $num, used in reduction section
990 # +8 &t[2*$num], used in reduction section
996 mov %rax, 40(%rsp) # save original %rsp
998 movq $rptr,%xmm1 # save $rptr
999 movq $nptr,%xmm2 # save $nptr
1000 movq %r10, %xmm3 # -$num
1003 call __bn_sqr8x_internal
1004 call __bn_sqr8x_internal
1005 call __bn_sqr8x_internal
1006 call __bn_sqr8x_internal
1007 call __bn_sqr8x_internal
1017 mov 40(%rsp),%rsi # restore %rsp
1028 .size bn_power5,.-bn_power5
1030 .globl bn_sqr8x_internal
1031 .hidden bn_sqr8x_internal
1032 .type bn_sqr8x_internal,\@abi-omnipotent
1035 __bn_sqr8x_internal:
1036 ##############################################################
1039 # a) multiply-n-add everything but a[i]*a[i];
1040 # b) shift result of a) by 1 to the left and accumulate
1041 # a[i]*a[i] products;
1043 ##############################################################
1109 lea 32(%r10),$i # $i=-($num-32)
1110 lea ($aptr,$num),$aptr # end of a[] buffer, ($aptr,$i)=&ap[2]
1112 mov $num,$j # $j=$num
1114 # comments apply to $num==8 case
1115 mov -32($aptr,$i),$a0 # a[0]
1116 lea 48+8(%rsp,$num,2),$tptr # end of tp[] buffer, &tp[2*$num]
1117 mov -24($aptr,$i),%rax # a[1]
1118 lea -32($tptr,$i),$tptr # end of tp[] window, &tp[2*$num-"$i"]
1119 mov -16($aptr,$i),$ai # a[2]
1123 mov %rax,$A0[0] # a[1]*a[0]
1126 mov $A0[0],-24($tptr,$i) # t[1]
1132 mov $A0[1],-16($tptr,$i) # t[2]
1136 mov -8($aptr,$i),$ai # a[3]
1138 mov %rax,$A1[0] # a[2]*a[1]+t[3]
1144 add %rax,$A0[0] # a[3]*a[0]+a[2]*a[1]+t[3]
1150 mov $A0[0],-8($tptr,$j) # t[3]
1155 mov ($aptr,$j),$ai # a[4]
1157 add %rax,$A1[1] # a[3]*a[1]+t[4]
1163 add %rax,$A0[1] # a[4]*a[0]+a[3]*a[1]+t[4]
1165 mov 8($aptr,$j),$ai # a[5]
1173 add %rax,$A1[0] # a[4]*a[3]+t[5]
1175 mov $A0[1],($tptr,$j) # t[4]
1180 add %rax,$A0[0] # a[5]*a[2]+a[4]*a[3]+t[5]
1182 mov 16($aptr,$j),$ai # a[6]
1189 add %rax,$A1[1] # a[5]*a[3]+t[6]
1191 mov $A0[0],8($tptr,$j) # t[5]
1196 add %rax,$A0[1] # a[6]*a[2]+a[5]*a[3]+t[6]
1198 mov 24($aptr,$j),$ai # a[7]
1206 add %rax,$A1[0] # a[6]*a[5]+t[7]
1208 mov $A0[1],16($tptr,$j) # t[6]
1214 add %rax,$A0[0] # a[7]*a[4]+a[6]*a[5]+t[6]
1220 mov $A0[0],-8($tptr,$j) # t[7]
1232 mov $A1[1],($tptr) # t[8]
1234 mov %rdx,8($tptr) # t[9]
1238 .Lsqr4x_outer: # comments apply to $num==6 case
1239 mov -32($aptr,$i),$a0 # a[0]
1240 lea 48+8(%rsp,$num,2),$tptr # end of tp[] buffer, &tp[2*$num]
1241 mov -24($aptr,$i),%rax # a[1]
1242 lea -32($tptr,$i),$tptr # end of tp[] window, &tp[2*$num-"$i"]
1243 mov -16($aptr,$i),$ai # a[2]
1247 mov -24($tptr,$i),$A0[0] # t[1]
1248 add %rax,$A0[0] # a[1]*a[0]+t[1]
1251 mov $A0[0],-24($tptr,$i) # t[1]
1258 add -16($tptr,$i),$A0[1] # a[2]*a[0]+t[2]
1261 mov $A0[1],-16($tptr,$i) # t[2]
1265 mov -8($aptr,$i),$ai # a[3]
1267 add %rax,$A1[0] # a[2]*a[1]+t[3]
1270 add -8($tptr,$i),$A1[0]
1275 add %rax,$A0[0] # a[3]*a[0]+a[2]*a[1]+t[3]
1281 mov $A0[0],-8($tptr,$i) # t[3]
1288 mov ($aptr,$j),$ai # a[4]
1290 add %rax,$A1[1] # a[3]*a[1]+t[4]
1294 add ($tptr,$j),$A1[1]
1299 add %rax,$A0[1] # a[4]*a[0]+a[3]*a[1]+t[4]
1301 mov 8($aptr,$j),$ai # a[5]
1308 add %rax,$A1[0] # a[4]*a[3]+t[5]
1309 mov $A0[1],($tptr,$j) # t[4]
1313 add 8($tptr,$j),$A1[0]
1318 add %rax,$A0[0] # a[5]*a[2]+a[4]*a[3]+t[5]
1324 mov $A0[0],-8($tptr,$j) # t[5], "preloaded t[1]" below
1336 mov $A1[1],($tptr) # t[6], "preloaded t[2]" below
1338 mov %rdx,8($tptr) # t[7], "preloaded t[3]" below
1343 # comments apply to $num==4 case
1344 mov -32($aptr),$a0 # a[0]
1345 lea 48+8(%rsp,$num,2),$tptr # end of tp[] buffer, &tp[2*$num]
1346 mov -24($aptr),%rax # a[1]
1347 lea -32($tptr,$i),$tptr # end of tp[] window, &tp[2*$num-"$i"]
1348 mov -16($aptr),$ai # a[2]
1352 add %rax,$A0[0] # a[1]*a[0]+t[1], preloaded t[1]
1360 mov $A0[0],-24($tptr) # t[1]
1363 add $A1[1],$A0[1] # a[2]*a[0]+t[2], preloaded t[2]
1364 mov -8($aptr),$ai # a[3]
1368 add %rax,$A1[0] # a[2]*a[1]+t[3], preloaded t[3]
1370 mov $A0[1],-16($tptr) # t[2]
1375 add %rax,$A0[0] # a[3]*a[0]+a[2]*a[1]+t[3]
1381 mov $A0[0],-8($tptr) # t[3]
1385 mov -16($aptr),%rax # a[2]
1390 mov $A1[1],($tptr) # t[4]
1392 mov %rdx,8($tptr) # t[5]
1397 my ($shift,$carry)=($a0,$a1);
1398 my @S=(@A1,$ai,$n0);
1402 sub $num,$i # $i=16-$num
1405 add $A1[0],%rax # t[5]
1407 mov %rax,8($tptr) # t[5]
1408 mov %rdx,16($tptr) # t[6]
1409 mov $carry,24($tptr) # t[7]
1411 mov -16($aptr,$i),%rax # a[0]
1412 lea 48+8(%rsp),$tptr
1413 xor $A0[0],$A0[0] # t[0]
1414 mov 8($tptr),$A0[1] # t[1]
1416 lea ($shift,$A0[0],2),$S[0] # t[2*i]<<1 | shift
1418 lea ($j,$A0[1],2),$S[1] # t[2*i+1]<<1 |
1420 or $A0[0],$S[1] # | t[2*i]>>63
1421 mov 16($tptr),$A0[0] # t[2*i+2] # prefetch
1422 mov $A0[1],$shift # shift=t[2*i+1]>>63
1423 mul %rax # a[i]*a[i]
1424 neg $carry # mov $carry,cf
1425 mov 24($tptr),$A0[1] # t[2*i+2+1] # prefetch
1427 mov -8($aptr,$i),%rax # a[i+1] # prefetch
1431 lea ($shift,$A0[0],2),$S[2] # t[2*i]<<1 | shift
1433 sbb $carry,$carry # mov cf,$carry
1435 lea ($j,$A0[1],2),$S[3] # t[2*i+1]<<1 |
1437 or $A0[0],$S[3] # | t[2*i]>>63
1438 mov 32($tptr),$A0[0] # t[2*i+2] # prefetch
1439 mov $A0[1],$shift # shift=t[2*i+1]>>63
1440 mul %rax # a[i]*a[i]
1441 neg $carry # mov $carry,cf
1442 mov 40($tptr),$A0[1] # t[2*i+2+1] # prefetch
1444 mov 0($aptr,$i),%rax # a[i+1] # prefetch
1449 sbb $carry,$carry # mov cf,$carry
1451 jmp .Lsqr4x_shift_n_add
1454 .Lsqr4x_shift_n_add:
1455 lea ($shift,$A0[0],2),$S[0] # t[2*i]<<1 | shift
1457 lea ($j,$A0[1],2),$S[1] # t[2*i+1]<<1 |
1459 or $A0[0],$S[1] # | t[2*i]>>63
1460 mov -16($tptr),$A0[0] # t[2*i+2] # prefetch
1461 mov $A0[1],$shift # shift=t[2*i+1]>>63
1462 mul %rax # a[i]*a[i]
1463 neg $carry # mov $carry,cf
1464 mov -8($tptr),$A0[1] # t[2*i+2+1] # prefetch
1466 mov -8($aptr,$i),%rax # a[i+1] # prefetch
1467 mov $S[0],-32($tptr)
1470 lea ($shift,$A0[0],2),$S[2] # t[2*i]<<1 | shift
1471 mov $S[1],-24($tptr)
1472 sbb $carry,$carry # mov cf,$carry
1474 lea ($j,$A0[1],2),$S[3] # t[2*i+1]<<1 |
1476 or $A0[0],$S[3] # | t[2*i]>>63
1477 mov 0($tptr),$A0[0] # t[2*i+2] # prefetch
1478 mov $A0[1],$shift # shift=t[2*i+1]>>63
1479 mul %rax # a[i]*a[i]
1480 neg $carry # mov $carry,cf
1481 mov 8($tptr),$A0[1] # t[2*i+2+1] # prefetch
1483 mov 0($aptr,$i),%rax # a[i+1] # prefetch
1484 mov $S[2],-16($tptr)
1487 lea ($shift,$A0[0],2),$S[0] # t[2*i]<<1 | shift
1489 sbb $carry,$carry # mov cf,$carry
1491 lea ($j,$A0[1],2),$S[1] # t[2*i+1]<<1 |
1493 or $A0[0],$S[1] # | t[2*i]>>63
1494 mov 16($tptr),$A0[0] # t[2*i+2] # prefetch
1495 mov $A0[1],$shift # shift=t[2*i+1]>>63
1496 mul %rax # a[i]*a[i]
1497 neg $carry # mov $carry,cf
1498 mov 24($tptr),$A0[1] # t[2*i+2+1] # prefetch
1500 mov 8($aptr,$i),%rax # a[i+1] # prefetch
1504 lea ($shift,$A0[0],2),$S[2] # t[2*i]<<1 | shift
1506 sbb $carry,$carry # mov cf,$carry
1508 lea ($j,$A0[1],2),$S[3] # t[2*i+1]<<1 |
1510 or $A0[0],$S[3] # | t[2*i]>>63
1511 mov 32($tptr),$A0[0] # t[2*i+2] # prefetch
1512 mov $A0[1],$shift # shift=t[2*i+1]>>63
1513 mul %rax # a[i]*a[i]
1514 neg $carry # mov $carry,cf
1515 mov 40($tptr),$A0[1] # t[2*i+2+1] # prefetch
1517 mov 16($aptr,$i),%rax # a[i+1] # prefetch
1521 sbb $carry,$carry # mov cf,$carry
1524 jnz .Lsqr4x_shift_n_add
1526 lea ($shift,$A0[0],2),$S[0] # t[2*i]<<1 | shift
1529 lea ($j,$A0[1],2),$S[1] # t[2*i+1]<<1 |
1531 or $A0[0],$S[1] # | t[2*i]>>63
1532 mov -16($tptr),$A0[0] # t[2*i+2] # prefetch
1533 mov $A0[1],$shift # shift=t[2*i+1]>>63
1534 mul %rax # a[i]*a[i]
1535 neg $carry # mov $carry,cf
1536 mov -8($tptr),$A0[1] # t[2*i+2+1] # prefetch
1538 mov -8($aptr),%rax # a[i+1] # prefetch
1539 mov $S[0],-32($tptr)
1542 lea ($shift,$A0[0],2),$S[2] # t[2*i]<<1|shift
1543 mov $S[1],-24($tptr)
1544 sbb $carry,$carry # mov cf,$carry
1546 lea ($j,$A0[1],2),$S[3] # t[2*i+1]<<1 |
1548 or $A0[0],$S[3] # | t[2*i]>>63
1549 mul %rax # a[i]*a[i]
1550 neg $carry # mov $carry,cf
1553 mov $S[2],-16($tptr)
1557 ######################################################################
1558 # Montgomery reduction part, "word-by-word" algorithm.
1560 # This new path is inspired by multiple submissions from Intel, by
1561 # Shay Gueron, Vlad Krasnov, Erdinc Ozturk, James Guilford,
1564 my ($nptr,$tptr,$carry,$m0)=("%rbp","%rdi","%rsi","%rbx");
1570 lea ($nptr,$num,2),%rcx # end of n[]
1571 lea 48+8(%rsp,$num,2),%rdx # end of t[] buffer
1573 lea 48+8(%rsp,$num),$tptr # end of initial t[] window
1576 jmp .L8x_reduction_loop
1579 .L8x_reduction_loop:
1580 lea ($tptr,$num),$tptr # start of current t[] window
1590 mov %rax,(%rdx) # store top-most carry bit
1591 lea 8*8($tptr),$tptr
1595 imulq 32+8(%rsp),$m0 # n0*a[0]
1596 mov 16*0($nptr),%rax # n[0]
1603 mov 16*1($nptr),%rax # n[1]
1610 mov 16*2($nptr),%rax
1613 mov $m0,48-8+8(%rsp,%rcx,8) # put aside n0*a[i]
1619 mov 16*3($nptr),%rax
1622 mov 32+8(%rsp),$carry # pull n0, borrow $carry
1628 mov 16*4($nptr),%rax
1630 imulq %r8,$carry # modulo-scheduled
1637 mov 16*5($nptr),%rax
1645 mov 16*6($nptr),%rax
1653 mov 16*7($nptr),%rax
1660 mov $carry,$m0 # n0*a[i]
1662 mov 16*0($nptr),%rax # n[0]
1671 lea 16*8($nptr),$nptr
1673 mov 8+8(%rsp),%rdx # pull end of t[]
1674 cmp 0+8(%rsp),$nptr # end of n[]?
1686 sbb $carry,$carry # top carry
1688 mov 48+56+8(%rsp),$m0 # pull n0*a[0]
1690 mov 16*0($nptr),%rax
1697 mov 16*1($nptr),%rax
1698 mov %r8,($tptr) # save result
1704 mov 16*2($nptr),%rax
1707 lea 8($tptr),$tptr # $tptr++
1713 mov 16*3($nptr),%rax
1721 mov 16*4($nptr),%rax
1729 mov 16*5($nptr),%rax
1737 mov 16*6($nptr),%rax
1745 mov 16*7($nptr),%rax
1752 mov 48-16+8(%rsp,%rcx,8),$m0# pull n0*a[i]
1756 mov 16*0($nptr),%rax # pull n[0]
1763 lea 16*8($nptr),$nptr
1764 mov 8+8(%rsp),%rdx # pull end of t[]
1765 cmp 0+8(%rsp),$nptr # end of n[]?
1766 jae .L8x_tail_done # break out of loop
1768 mov 48+56+8(%rsp),$m0 # pull n0*a[0]
1770 mov 8*0($nptr),%rax # pull n[0]
1779 sbb $carry,$carry # top carry
1786 add (%rdx),%r8 # can this overflow?
1799 adc \$0,%rax # top-most carry
1800 mov -16($nptr),%rcx # np[num-1]
1803 movq %xmm2,$nptr # restore $nptr
1805 mov %r8,8*0($tptr) # store top 512 bits
1807 movq %xmm3,$num # $num is %r9, can't be moved upwards
1814 lea 8*8($tptr),$tptr
1816 cmp %rdx,$tptr # end of t[]?
1817 jb .L8x_reduction_loop
1820 ##############################################################
1821 # Post-condition, 4x unrolled
1824 my ($tptr,$nptr)=("%rbx","%rbp");
1826 #xor %rsi,%rsi # %rsi was $carry above
1827 sub %r15,%rcx # compare top-most words
1828 lea (%rdi,$num),$tptr # %rdi was $tptr above
1832 movq %xmm1,$rptr # restore $rptr
1834 movq %xmm1,$aptr # prepare for back-to-back call
1835 lea ($nptr,%rax,8),$nptr
1836 sar \$3+2,%rcx # cf=0
1844 sbb 16*0($nptr),%r12
1846 sbb 16*1($nptr),%r13
1848 lea 8*4($tptr),$tptr
1849 sbb 16*2($nptr),%r14
1851 sbb 16*3($nptr),%r15
1852 lea 16*4($nptr),$nptr
1856 lea 8*4($rptr),$rptr
1863 mov $num,%r10 # prepare for back-to-back call
1864 neg $num # restore $num
1866 .size bn_sqr8x_internal,.-bn_sqr8x_internal
1870 .globl bn_from_montgomery
1871 .type bn_from_montgomery,\@abi-omnipotent
1874 testl \$7,`($win64?"48(%rsp)":"%r9d")`
1878 .size bn_from_montgomery,.-bn_from_montgomery
1880 .type bn_from_mont8x,\@function,6
1892 $code.=<<___ if ($win64);
1893 lea -0x28(%rsp),%rsp
1895 movaps %xmm7,0x10(%rsp)
1900 shl \$3,${num}d # convert $num to bytes
1901 shl \$3+2,%r10d # 4*$num
1905 ##############################################################
1906 # ensure that stack frame doesn't alias with $aptr+4*$num
1907 # modulo 4096, which covers ret[num], am[num] and n[2*num]
1908 # (see bn_exp.c). this is done to allow memory disambiguation
1909 # logic do its magic.
1911 lea -64(%rsp,$num,2),%r11
1916 sub %r11,%rsp # align with $aptr
1917 lea -64(%rsp,$num,2),%rsp # alloca(frame+2*$num)
1922 lea 4096-64(,$num,2),%r10 # 4096-frame-2*$num
1923 lea -64(%rsp,$num,2),%rsp # alloca(frame+2*$num)
1933 ##############################################################
1936 # +0 saved $num, used in reduction section
1937 # +8 &t[2*$num], used in reduction section
1943 mov %rax, 40(%rsp) # save original %rsp
1952 movdqu ($aptr),%xmm1
1953 movdqu 16($aptr),%xmm2
1954 movdqu 32($aptr),%xmm3
1955 movdqa %xmm0,(%rax,$num)
1956 movdqu 48($aptr),%xmm4
1957 movdqa %xmm0,16(%rax,$num)
1958 .byte 0x48,0x8d,0xb6,0x40,0x00,0x00,0x00 # lea 64($aptr),$aptr
1960 movdqa %xmm0,32(%rax,$num)
1961 movdqa %xmm2,16(%rax)
1962 movdqa %xmm0,48(%rax,$num)
1963 movdqa %xmm3,32(%rax)
1964 movdqa %xmm4,48(%rax)
1973 movq %r10, %xmm3 # -num
1975 $code.=<<___ if ($addx);
1976 mov OPENSSL_ia32cap_P+8(%rip),%r11d
1981 lea (%rax,$num),$rptr
1982 call sqrx8x_reduction
1986 mov 40(%rsp),%rsi # restore %rsp
1987 jmp .Lfrom_mont_zero
1993 call sqr8x_reduction
1997 mov 40(%rsp),%rsi # restore %rsp
1998 jmp .Lfrom_mont_zero
2002 movdqa %xmm0,16*0(%rax)
2003 movdqa %xmm0,16*1(%rax)
2004 movdqa %xmm0,16*2(%rax)
2005 movdqa %xmm0,16*3(%rax)
2008 jnz .Lfrom_mont_zero
2020 .size bn_from_mont8x,.-bn_from_mont8x
2026 my $bp="%rdx"; # restore original value
2029 .type bn_mulx4x_mont_gather5,\@function,6
2031 bn_mulx4x_mont_gather5:
2042 $code.=<<___ if ($win64);
2043 lea -0x28(%rsp),%rsp
2045 movaps %xmm7,0x10(%rsp)
2050 shl \$3,${num}d # convert $num to bytes
2051 shl \$3+2,%r10d # 4*$num
2055 ##############################################################
2056 # ensure that stack frame doesn't alias with $aptr+4*$num
2057 # modulo 4096, which covers a[num], ret[num] and n[2*num]
2058 # (see bn_exp.c). this is done to allow memory disambiguation
2059 # logic do its magic. [excessive frame is allocated in order
2060 # to allow bn_from_mont8x to clear it.]
2062 lea -64(%rsp,$num,2),%r11
2067 sub %r11,%rsp # align with $aptr
2068 lea -64(%rsp,$num,2),%rsp # alloca(frame+$num)
2073 lea 4096-64(,$num,2),%r10 # 4096-frame-$num
2074 lea -64(%rsp,$num,2),%rsp # alloca(frame+$num)
2080 and \$-64,%rsp # ensure alignment
2081 ##############################################################
2084 # +8 off-loaded &b[i]
2093 mov $n0, 32(%rsp) # save *n0
2094 mov %rax,40(%rsp) # save original %rsp
2096 call mulx4x_internal
2098 mov 40(%rsp),%rsi # restore %rsp
2101 $code.=<<___ if ($win64);
2102 movaps -88(%rsi),%xmm6
2103 movaps -72(%rsi),%xmm7
2115 .size bn_mulx4x_mont_gather5,.-bn_mulx4x_mont_gather5
2117 .type mulx4x_internal,\@abi-omnipotent
2120 .byte 0x4c,0x89,0x8c,0x24,0x08,0x00,0x00,0x00 # mov $num,8(%rsp) # save -$num
2122 neg $num # restore $num
2124 lea 256($bp,$num),%r13
2126 mov `($win64?56:8)`(%rax),%r10d # load 7th argument
2128 mov %r13,16+8(%rsp) # end of b[num]
2129 mov $num,24+8(%rsp) # inner counter
2130 mov $rp, 56+8(%rsp) # save $rp
2132 my ($aptr, $bptr, $nptr, $tptr, $mi, $bi, $zero, $num)=
2133 ("%rsi","%rdi","%rcx","%rbx","%r8","%r9","%rbp","%rax");
2135 my $STRIDE=2**5*8; # 5 is "window size"
2136 my $N=$STRIDE/4; # should match cache line size
2139 shr \$`log($N/8)/log(2)`,%r10
2142 lea .Lmagic_masks(%rip),%rax
2143 and \$`2**5/($N/8)-1`,%r10 # 5 is "window size"
2144 lea 96($bp,%r11,8),$bptr # pointer within 1st cache line
2145 movq 0(%rax,%r10,8),%xmm4 # set of masks denoting which
2146 movq 8(%rax,%r10,8),%xmm5 # cache line contains element
2148 movq 16(%rax,%r10,8),%xmm6 # denoted by 7th argument
2149 movq 24(%rax,%r10,8),%xmm7
2152 movq `0*$STRIDE/4-96`($bptr),%xmm0
2153 lea $STRIDE($bptr),$tptr # borrow $tptr
2154 movq `1*$STRIDE/4-96`($bptr),%xmm1
2156 movq `2*$STRIDE/4-96`($bptr),%xmm2
2158 movq `3*$STRIDE/4-96`($bptr),%xmm3
2161 movq `0*$STRIDE/4-96`($tptr),%xmm1
2164 movq `1*$STRIDE/4-96`($tptr),%xmm2
2168 movq `2*$STRIDE/4-96`($tptr),%xmm3
2170 movq %xmm0,%rdx # bp[0]
2171 movq `3*$STRIDE/4-96`($tptr),%xmm0
2172 lea 2*$STRIDE($bptr),$bptr # next &b[i]
2176 ##############################################################
2177 # $tptr is chosen so that writing to top-most element of the
2178 # vector occurs just "above" references to powers table,
2179 # "above" modulo cache-line size, which effectively precludes
2180 # possibility of memory disambiguation logic failure when
2181 # accessing the table.
2183 lea 64+8*4+8(%rsp,%r11,8),$tptr
2186 mulx 0*8($aptr),$mi,%rax # a[0]*b[0]
2187 mulx 1*8($aptr),%r11,%r12 # a[1]*b[0]
2189 mulx 2*8($aptr),%rax,%r13 # ...
2192 mulx 3*8($aptr),%rax,%r14
2195 imulq 32+8(%rsp),$mi # "t[0]"*n0
2196 xor $zero,$zero # cf=0, of=0
2202 mov $bptr,8+8(%rsp) # off-load &b[i]
2205 .byte 0x48,0x8d,0xb6,0x20,0x00,0x00,0x00 # lea 4*8($aptr),$aptr
2207 adcx $zero,%r14 # cf=0
2209 mulx 0*16($nptr),%rax,%r10
2210 adcx %rax,%r15 # discarded
2212 mulx 1*16($nptr),%rax,%r11
2215 mulx 2*16($nptr),%rax,%r12
2216 mov 24+8(%rsp),$bptr # counter value
2218 mov %r10,-8*4($tptr)
2221 mulx 3*16($nptr),%rax,%r15
2224 mov %r11,-8*3($tptr)
2226 adox $zero,%r15 # of=0
2227 .byte 0x48,0x8d,0x89,0x40,0x00,0x00,0x00 # lea 4*16($nptr),$nptr
2228 mov %r12,-8*2($tptr)
2233 adcx $zero,%r15 # cf=0, modulo-scheduled
2234 mulx 0*8($aptr),%r10,%rax # a[4]*b[0]
2236 mulx 1*8($aptr),%r11,%r14 # a[5]*b[0]
2238 mulx 2*8($aptr),%r12,%rax # ...
2240 mulx 3*8($aptr),%r13,%r14
2244 adcx $zero,%r14 # cf=0
2245 lea 4*8($aptr),$aptr
2246 lea 4*8($tptr),$tptr
2249 mulx 0*16($nptr),%rax,%r15
2252 mulx 1*16($nptr),%rax,%r15
2255 mulx 2*16($nptr),%rax,%r15
2256 mov %r10,-5*8($tptr)
2258 mov %r11,-4*8($tptr)
2260 mulx 3*16($nptr),%rax,%r15
2262 mov %r12,-3*8($tptr)
2265 lea 4*16($nptr),$nptr
2266 mov %r13,-2*8($tptr)
2268 dec $bptr # of=0, pass cf
2271 mov 8(%rsp),$num # load -num
2272 movq %xmm0,%rdx # bp[1]
2273 adc $zero,%r15 # modulo-scheduled
2274 lea ($aptr,$num),$aptr # rewind $aptr
2276 mov 8+8(%rsp),$bptr # re-load &b[i]
2277 adc $zero,$zero # top-most carry
2278 mov %r14,-1*8($tptr)
2283 mov $zero,($tptr) # save top-most carry
2284 lea 4*8($tptr,$num),$tptr # rewind $tptr
2285 mulx 0*8($aptr),$mi,%r11 # a[0]*b[i]
2286 xor $zero,$zero # cf=0, of=0
2288 mulx 1*8($aptr),%r14,%r12 # a[1]*b[i]
2289 adox -4*8($tptr),$mi # +t[0]
2291 mulx 2*8($aptr),%r15,%r13 # ...
2292 adox -3*8($tptr),%r11
2294 mulx 3*8($aptr),%rdx,%r14
2295 adox -2*8($tptr),%r12
2297 lea ($nptr,$num,2),$nptr # rewind $nptr
2298 lea 4*8($aptr),$aptr
2299 adox -1*8($tptr),%r13
2305 imulq 32+8(%rsp),$mi # "t[0]"*n0
2307 movq `0*$STRIDE/4-96`($bptr),%xmm0
2310 movq `1*$STRIDE/4-96`($bptr),%xmm1
2313 movq `2*$STRIDE/4-96`($bptr),%xmm2
2316 movq `3*$STRIDE/4-96`($bptr),%xmm3
2317 add \$$STRIDE,$bptr # next &b[i]
2322 xor $zero,$zero # cf=0, of=0
2323 mov $bptr,8+8(%rsp) # off-load &b[i]
2325 mulx 0*16($nptr),%rax,%r10
2326 adcx %rax,%r15 # discarded
2328 mulx 1*16($nptr),%rax,%r11
2331 mulx 2*16($nptr),%rax,%r12
2334 mulx 3*16($nptr),%rax,%r15
2337 mov 24+8(%rsp),$bptr # counter value
2338 mov %r10,-8*4($tptr)
2341 mov %r11,-8*3($tptr)
2342 adox $zero,%r15 # of=0
2343 mov %r12,-8*2($tptr)
2344 lea 4*16($nptr),$nptr
2349 mulx 0*8($aptr),%r10,%rax # a[4]*b[i]
2350 adcx $zero,%r15 # cf=0, modulo-scheduled
2352 mulx 1*8($aptr),%r11,%r14 # a[5]*b[i]
2353 adcx 0*8($tptr),%r10
2355 mulx 2*8($aptr),%r12,%rax # ...
2356 adcx 1*8($tptr),%r11
2358 mulx 3*8($aptr),%r13,%r14
2360 adcx 2*8($tptr),%r12
2362 adcx 3*8($tptr),%r13
2363 adox $zero,%r14 # of=0
2364 lea 4*8($aptr),$aptr
2365 lea 4*8($tptr),$tptr
2366 adcx $zero,%r14 # cf=0
2369 mulx 0*16($nptr),%rax,%r15
2372 mulx 1*16($nptr),%rax,%r15
2375 mulx 2*16($nptr),%rax,%r15
2376 mov %r10,-5*8($tptr)
2379 mov %r11,-4*8($tptr)
2380 mulx 3*16($nptr),%rax,%r15
2382 lea 4*16($nptr),$nptr
2383 mov %r12,-3*8($tptr)
2386 mov %r13,-2*8($tptr)
2388 dec $bptr # of=0, pass cf
2391 mov 0+8(%rsp),$num # load -num
2392 movq %xmm0,%rdx # bp[i+1]
2393 adc $zero,%r15 # modulo-scheduled
2394 sub 0*8($tptr),$bptr # pull top-most carry to %cf
2395 mov 8+8(%rsp),$bptr # re-load &b[i]
2398 lea ($aptr,$num),$aptr # rewind $aptr
2399 adc $zero,$zero # top-most carry
2400 mov %r14,-1*8($tptr)
2407 sub %r14,%r10 # compare top-most words
2411 lea ($tptr,$num),%rdi # rewind $tptr
2412 lea ($nptr,$num,2),$nptr # rewind $nptr
2414 sar \$3+2,$num # cf=0
2415 lea ($nptr,$zero,8),%rbp
2416 mov 56+8(%rsp),%rdx # restore rp
2418 jmp .Lsqrx4x_sub # common post-condition
2419 .size mulx4x_internal,.-mulx4x_internal
2422 ######################################################################
2424 my $rptr="%rdi"; # BN_ULONG *rptr,
2425 my $aptr="%rsi"; # const BN_ULONG *aptr,
2426 my $bptr="%rdx"; # const void *table,
2427 my $nptr="%rcx"; # const BN_ULONG *nptr,
2428 my $n0 ="%r8"; # const BN_ULONG *n0);
2429 my $num ="%r9"; # int num, has to be divisible by 8
2432 my ($i,$j,$tptr)=("%rbp","%rcx",$rptr);
2433 my @A0=("%r10","%r11");
2434 my @A1=("%r12","%r13");
2435 my ($a0,$a1,$ai)=("%r14","%r15","%rbx");
2438 .type bn_powerx5,\@function,6
2451 $code.=<<___ if ($win64);
2452 lea -0x28(%rsp),%rsp
2454 movaps %xmm7,0x10(%rsp)
2459 shl \$3,${num}d # convert $num to bytes
2460 shl \$3+2,%r10d # 4*$num
2464 ##############################################################
2465 # ensure that stack frame doesn't alias with $aptr+4*$num
2466 # modulo 4096, which covers ret[num], am[num] and n[2*num]
2467 # (see bn_exp.c). this is done to allow memory disambiguation
2468 # logic do its magic.
2470 lea -64(%rsp,$num,2),%r11
2475 sub %r11,%rsp # align with $aptr
2476 lea -64(%rsp,$num,2),%rsp # alloca(frame+2*$num)
2481 lea 4096-64(,$num,2),%r10 # 4096-frame-2*$num
2482 lea -64(%rsp,$num,2),%rsp # alloca(frame+2*$num)
2492 ##############################################################
2495 # +0 saved $num, used in reduction section
2496 # +8 &t[2*$num], used in reduction section
2497 # +16 intermediate carry bit
2498 # +24 top-most carry bit, used in reduction section
2504 movq $rptr,%xmm1 # save $rptr
2505 movq $nptr,%xmm2 # save $nptr
2506 movq %r10, %xmm3 # -$num
2509 mov %rax, 40(%rsp) # save original %rsp
2512 call __bn_sqrx8x_internal
2513 call __bn_sqrx8x_internal
2514 call __bn_sqrx8x_internal
2515 call __bn_sqrx8x_internal
2516 call __bn_sqrx8x_internal
2518 mov %r10,$num # -num
2524 call mulx4x_internal
2526 mov 40(%rsp),%rsi # restore %rsp
2529 $code.=<<___ if ($win64);
2530 movaps -88(%rsi),%xmm6
2531 movaps -72(%rsi),%xmm7
2543 .size bn_powerx5,.-bn_powerx5
2545 .globl bn_sqrx8x_internal
2546 .hidden bn_sqrx8x_internal
2547 .type bn_sqrx8x_internal,\@abi-omnipotent
2550 __bn_sqrx8x_internal:
2551 ##################################################################
2554 # a) multiply-n-add everything but a[i]*a[i];
2555 # b) shift result of a) by 1 to the left and accumulate
2556 # a[i]*a[i] products;
2558 ##################################################################
2559 # a[7]a[7]a[6]a[6]a[5]a[5]a[4]a[4]a[3]a[3]a[2]a[2]a[1]a[1]a[0]a[0]
2590 # a[7]a[7]a[6]a[6]a[5]a[5]a[4]a[4]a[3]a[3]a[2]a[2]a[1]a[1]a[0]a[0]
2593 my ($zero,$carry)=("%rbp","%rcx");
2596 lea 48+8(%rsp),$tptr
2597 lea ($aptr,$num),$aaptr
2598 mov $num,0+8(%rsp) # save $num
2599 mov $aaptr,8+8(%rsp) # save end of $aptr
2600 jmp .Lsqr8x_zero_start
2603 .byte 0x66,0x66,0x66,0x2e,0x0f,0x1f,0x84,0x00,0x00,0x00,0x00,0x00
2606 movdqa %xmm0,0*8($tptr)
2607 movdqa %xmm0,2*8($tptr)
2608 movdqa %xmm0,4*8($tptr)
2609 movdqa %xmm0,6*8($tptr)
2610 .Lsqr8x_zero_start: # aligned at 32
2611 movdqa %xmm0,8*8($tptr)
2612 movdqa %xmm0,10*8($tptr)
2613 movdqa %xmm0,12*8($tptr)
2614 movdqa %xmm0,14*8($tptr)
2615 lea 16*8($tptr),$tptr
2619 mov 0*8($aptr),%rdx # a[0], modulo-scheduled
2620 #xor %r9,%r9 # t[1], ex-$num, zero already
2627 lea 48+8(%rsp),$tptr
2628 xor $zero,$zero # cf=0, cf=0
2629 jmp .Lsqrx8x_outer_loop
2632 .Lsqrx8x_outer_loop:
2633 mulx 1*8($aptr),%r8,%rax # a[1]*a[0]
2634 adcx %r9,%r8 # a[1]*a[0]+=t[1]
2636 mulx 2*8($aptr),%r9,%rax # a[2]*a[0]
2639 .byte 0xc4,0xe2,0xab,0xf6,0x86,0x18,0x00,0x00,0x00 # mulx 3*8($aptr),%r10,%rax # ...
2642 .byte 0xc4,0xe2,0xa3,0xf6,0x86,0x20,0x00,0x00,0x00 # mulx 4*8($aptr),%r11,%rax
2645 mulx 5*8($aptr),%r12,%rax
2648 mulx 6*8($aptr),%r13,%rax
2651 mulx 7*8($aptr),%r14,%r15
2652 mov 1*8($aptr),%rdx # a[1]
2656 mov %r8,1*8($tptr) # t[1]
2657 mov %r9,2*8($tptr) # t[2]
2658 sbb $carry,$carry # mov %cf,$carry
2659 xor $zero,$zero # cf=0, of=0
2662 mulx 2*8($aptr),%r8,%rbx # a[2]*a[1]
2663 mulx 3*8($aptr),%r9,%rax # a[3]*a[1]
2666 mulx 4*8($aptr),%r10,%rbx # ...
2669 .byte 0xc4,0xe2,0xa3,0xf6,0x86,0x28,0x00,0x00,0x00 # mulx 5*8($aptr),%r11,%rax
2672 .byte 0xc4,0xe2,0x9b,0xf6,0x9e,0x30,0x00,0x00,0x00 # mulx 6*8($aptr),%r12,%rbx
2675 .byte 0xc4,0x62,0x93,0xf6,0xb6,0x38,0x00,0x00,0x00 # mulx 7*8($aptr),%r13,%r14
2676 mov 2*8($aptr),%rdx # a[2]
2680 adox $zero,%r14 # of=0
2681 adcx $zero,%r14 # cf=0
2683 mov %r8,3*8($tptr) # t[3]
2684 mov %r9,4*8($tptr) # t[4]
2686 mulx 3*8($aptr),%r8,%rbx # a[3]*a[2]
2687 mulx 4*8($aptr),%r9,%rax # a[4]*a[2]
2690 mulx 5*8($aptr),%r10,%rbx # ...
2693 .byte 0xc4,0xe2,0xa3,0xf6,0x86,0x30,0x00,0x00,0x00 # mulx 6*8($aptr),%r11,%rax
2696 .byte 0xc4,0x62,0x9b,0xf6,0xae,0x38,0x00,0x00,0x00 # mulx 7*8($aptr),%r12,%r13
2698 mov 3*8($aptr),%rdx # a[3]
2702 mov %r8,5*8($tptr) # t[5]
2703 mov %r9,6*8($tptr) # t[6]
2704 mulx 4*8($aptr),%r8,%rax # a[4]*a[3]
2705 adox $zero,%r13 # of=0
2706 adcx $zero,%r13 # cf=0
2708 mulx 5*8($aptr),%r9,%rbx # a[5]*a[3]
2711 mulx 6*8($aptr),%r10,%rax # ...
2714 mulx 7*8($aptr),%r11,%r12
2715 mov 4*8($aptr),%rdx # a[4]
2716 mov 5*8($aptr),%r14 # a[5]
2719 mov 6*8($aptr),%r15 # a[6]
2721 adox $zero,%r12 # of=0
2722 adcx $zero,%r12 # cf=0
2724 mov %r8,7*8($tptr) # t[7]
2725 mov %r9,8*8($tptr) # t[8]
2727 mulx %r14,%r9,%rax # a[5]*a[4]
2728 mov 7*8($aptr),%r8 # a[7]
2730 mulx %r15,%r10,%rbx # a[6]*a[4]
2733 mulx %r8,%r11,%rax # a[7]*a[4]
2734 mov %r14,%rdx # a[5]
2737 #adox $zero,%rax # of=0
2738 adcx $zero,%rax # cf=0
2740 mulx %r15,%r14,%rbx # a[6]*a[5]
2741 mulx %r8,%r12,%r13 # a[7]*a[5]
2742 mov %r15,%rdx # a[6]
2743 lea 8*8($aptr),$aptr
2750 mulx %r8,%r8,%r14 # a[7]*a[6]
2755 je .Lsqrx8x_outer_break
2757 neg $carry # mov $carry,%cf
2761 adcx 9*8($tptr),%r9 # +=t[9]
2762 adcx 10*8($tptr),%r10 # ...
2763 adcx 11*8($tptr),%r11
2764 adc 12*8($tptr),%r12
2765 adc 13*8($tptr),%r13
2766 adc 14*8($tptr),%r14
2767 adc 15*8($tptr),%r15
2769 lea 2*64($tptr),$tptr
2770 sbb %rax,%rax # mov %cf,$carry
2772 mov -64($aptr),%rdx # a[0]
2773 mov %rax,16+8(%rsp) # offload $carry
2774 mov $tptr,24+8(%rsp)
2776 #lea 8*8($tptr),$tptr # see 2*8*8($tptr) above
2777 xor %eax,%eax # cf=0, of=0
2783 mulx 0*8($aaptr),%rax,%r8 # a[8]*a[i]
2784 adcx %rax,%rbx # +=t[8]
2787 mulx 1*8($aaptr),%rax,%r9 # ...
2791 mulx 2*8($aaptr),%rax,%r10
2795 mulx 3*8($aaptr),%rax,%r11
2799 .byte 0xc4,0x62,0xfb,0xf6,0xa5,0x20,0x00,0x00,0x00 # mulx 4*8($aaptr),%rax,%r12
2803 mulx 5*8($aaptr),%rax,%r13
2807 mulx 6*8($aaptr),%rax,%r14
2808 mov %rbx,($tptr,%rcx,8) # store t[8+i]
2813 .byte 0xc4,0x62,0xfb,0xf6,0xbd,0x38,0x00,0x00,0x00 # mulx 7*8($aaptr),%rax,%r15
2814 mov 8($aptr,%rcx,8),%rdx # a[i]
2816 adox %rbx,%r15 # %rbx is 0, of=0
2817 adcx %rbx,%r15 # cf=0
2823 lea 8*8($aaptr),$aaptr
2825 cmp 8+8(%rsp),$aaptr # done?
2828 sub 16+8(%rsp),%rbx # mov 16(%rsp),%cf
2839 lea 8*8($tptr),$tptr
2841 sbb %rax,%rax # mov %cf,%rax
2842 xor %ebx,%ebx # cf=0, of=0
2843 mov %rax,16+8(%rsp) # offload carry
2848 sub 16+8(%rsp),%r8 # consume last carry
2849 mov 24+8(%rsp),$carry # initial $tptr, borrow $carry
2850 mov 0*8($aptr),%rdx # a[8], modulo-scheduled
2851 xor %ebp,%ebp # xor $zero,$zero
2853 cmp $carry,$tptr # cf=0, of=0
2854 je .Lsqrx8x_outer_loop
2859 mov 2*8($carry),%r10
2861 mov 3*8($carry),%r11
2863 mov 4*8($carry),%r12
2865 mov 5*8($carry),%r13
2867 mov 6*8($carry),%r14
2869 mov 7*8($carry),%r15
2871 jmp .Lsqrx8x_outer_loop
2874 .Lsqrx8x_outer_break:
2875 mov %r9,9*8($tptr) # t[9]
2876 movq %xmm3,%rcx # -$num
2877 mov %r10,10*8($tptr) # ...
2878 mov %r11,11*8($tptr)
2879 mov %r12,12*8($tptr)
2880 mov %r13,13*8($tptr)
2881 mov %r14,14*8($tptr)
2886 lea 48+8(%rsp),$tptr
2887 mov ($aptr,$i),%rdx # a[0]
2889 mov 8($tptr),$A0[1] # t[1]
2890 xor $A0[0],$A0[0] # t[0], of=0, cf=0
2891 mov 0+8(%rsp),$num # restore $num
2893 mov 16($tptr),$A1[0] # t[2] # prefetch
2894 mov 24($tptr),$A1[1] # t[3] # prefetch
2895 #jmp .Lsqrx4x_shift_n_add # happens to be aligned
2898 .Lsqrx4x_shift_n_add:
2902 .byte 0x48,0x8b,0x94,0x0e,0x08,0x00,0x00,0x00 # mov 8($aptr,$i),%rdx # a[i+1] # prefetch
2903 .byte 0x4c,0x8b,0x97,0x20,0x00,0x00,0x00 # mov 32($tptr),$A0[0] # t[2*i+4] # prefetch
2906 mov 40($tptr),$A0[1] # t[2*i+4+1] # prefetch
2913 mov 16($aptr,$i),%rdx # a[i+2] # prefetch
2914 mov 48($tptr),$A1[0] # t[2*i+6] # prefetch
2917 mov 56($tptr),$A1[1] # t[2*i+6+1] # prefetch
2924 mov 24($aptr,$i),%rdx # a[i+3] # prefetch
2926 mov 64($tptr),$A0[0] # t[2*i+8] # prefetch
2929 mov 72($tptr),$A0[1] # t[2*i+8+1] # prefetch
2936 jrcxz .Lsqrx4x_shift_n_add_break
2937 .byte 0x48,0x8b,0x94,0x0e,0x00,0x00,0x00,0x00 # mov 0($aptr,$i),%rdx # a[i+4] # prefetch
2940 mov 80($tptr),$A1[0] # t[2*i+10] # prefetch
2941 mov 88($tptr),$A1[1] # t[2*i+10+1] # prefetch
2946 jmp .Lsqrx4x_shift_n_add
2949 .Lsqrx4x_shift_n_add_break:
2953 lea 64($tptr),$tptr # end of t[] buffer
2956 ######################################################################
2957 # Montgomery reduction part, "word-by-word" algorithm.
2959 # This new path is inspired by multiple submissions from Intel, by
2960 # Shay Gueron, Vlad Krasnov, Erdinc Ozturk, James Guilford,
2963 my ($nptr,$carry,$m0)=("%rbp","%rsi","%rdx");
2968 xor %eax,%eax # initial top-most carry bit
2969 mov 32+8(%rsp),%rbx # n0
2970 mov 48+8(%rsp),%rdx # "%r8", 8*0($tptr)
2971 lea -128($nptr,$num,2),%rcx # end of n[]
2972 #lea 48+8(%rsp,$num,2),$tptr # end of t[] buffer
2973 mov %rcx, 0+8(%rsp) # save end of n[]
2974 mov $tptr,8+8(%rsp) # save end of t[]
2976 lea 48+8(%rsp),$tptr # initial t[] window
2977 jmp .Lsqrx8x_reduction_loop
2980 .Lsqrx8x_reduction_loop:
2986 imulq %rbx,%rdx # n0*a[i]
2990 mov %rax,24+8(%rsp) # store top-most carry bit
2992 lea 8*8($tptr),$tptr
2993 xor $carry,$carry # cf=0,of=0
3000 mulx 16*0($nptr),%rax,%r8 # n[0]
3001 adcx %rbx,%rax # discarded
3004 mulx 16*1($nptr),%rbx,%r9 # n[1]
3008 mulx 16*2($nptr),%rbx,%r10
3012 mulx 16*3($nptr),%rbx,%r11
3016 .byte 0xc4,0x62,0xe3,0xf6,0xa5,0x40,0x00,0x00,0x00 # mulx 16*4($nptr),%rbx,%r12
3022 mulx 32+8(%rsp),%rbx,%rdx # %rdx discarded
3024 mov %rax,64+48+8(%rsp,%rcx,8) # put aside n0*a[i]
3026 mulx 16*5($nptr),%rax,%r13
3030 mulx 16*6($nptr),%rax,%r14
3034 mulx 16*7($nptr),%rax,%r15
3037 adox $carry,%r15 # $carry is 0
3038 adcx $carry,%r15 # cf=0
3040 .byte 0x67,0x67,0x67
3044 mov $carry,%rax # xor %rax,%rax
3045 cmp 0+8(%rsp),$nptr # end of n[]?
3046 jae .Lsqrx8x_no_tail
3048 mov 48+8(%rsp),%rdx # pull n0*a[0]
3050 lea 16*8($nptr),$nptr
3053 adcx 8*2($tptr),%r10
3059 lea 8*8($tptr),$tptr
3060 sbb %rax,%rax # top carry
3062 xor $carry,$carry # of=0, cf=0
3069 mulx 16*0($nptr),%rax,%r8
3073 mulx 16*1($nptr),%rax,%r9
3077 mulx 16*2($nptr),%rax,%r10
3081 mulx 16*3($nptr),%rax,%r11
3085 .byte 0xc4,0x62,0xfb,0xf6,0xa5,0x40,0x00,0x00,0x00 # mulx 16*4($nptr),%rax,%r12
3089 mulx 16*5($nptr),%rax,%r13
3093 mulx 16*6($nptr),%rax,%r14
3097 mulx 16*7($nptr),%rax,%r15
3098 mov 72+48+8(%rsp,%rcx,8),%rdx # pull n0*a[i]
3101 mov %rbx,($tptr,%rcx,8) # save result
3103 adcx $carry,%r15 # cf=0
3108 cmp 0+8(%rsp),$nptr # end of n[]?
3109 jae .Lsqrx8x_tail_done # break out of loop
3111 sub 16+8(%rsp),$carry # mov 16(%rsp),%cf
3112 mov 48+8(%rsp),%rdx # pull n0*a[0]
3113 lea 16*8($nptr),$nptr
3122 lea 8*8($tptr),$tptr
3124 sub \$8,%rcx # mov \$-8,%rcx
3126 xor $carry,$carry # of=0, cf=0
3132 add 24+8(%rsp),%r8 # can this overflow?
3133 mov $carry,%rax # xor %rax,%rax
3135 sub 16+8(%rsp),$carry # mov 16(%rsp),%cf
3136 .Lsqrx8x_no_tail: # %cf is 0 if jumped here
3140 mov 16*7($nptr),$carry
3141 movq %xmm2,$nptr # restore $nptr
3148 adc %rax,%rax # top-most carry
3150 mov 32+8(%rsp),%rbx # n0
3151 mov 8*8($tptr,%rcx),%rdx # modulo-scheduled "%r8"
3153 mov %r8,8*0($tptr) # store top 512 bits
3154 lea 8*8($tptr),%r8 # borrow %r8
3163 lea 8*8($tptr,%rcx),$tptr # start of current t[] window
3164 cmp 8+8(%rsp),%r8 # end of t[]?
3165 jb .Lsqrx8x_reduction_loop
3168 ##############################################################
3169 # Post-condition, 4x unrolled
3172 my ($rptr,$nptr)=("%rdx","%rbp");
3173 my @ri=map("%r$_",(10..13));
3174 my @ni=map("%r$_",(14..15));
3177 sub %r15,%rsi # compare top-most words
3179 mov %rcx,%r10 # -$num
3183 mov %rcx,%r9 # -$num
3185 sar \$3+2,%rcx # cf=0
3186 #lea 48+8(%rsp,%r9),$tptr
3187 lea ($nptr,%rax,8),$nptr
3188 movq %xmm1,$rptr # restore $rptr
3189 movq %xmm1,$aptr # prepare for back-to-back call
3197 sbb 16*0($nptr),%r12
3199 sbb 16*1($nptr),%r13
3201 lea 8*4($tptr),$tptr
3202 sbb 16*2($nptr),%r14
3204 sbb 16*3($nptr),%r15
3205 lea 16*4($nptr),$nptr
3209 lea 8*4($rptr),$rptr
3216 neg %r9 # restore $num
3219 .size bn_sqrx8x_internal,.-bn_sqrx8x_internal
3223 my ($inp,$num,$tbl,$idx)=$win64?("%rcx","%edx","%r8", "%r9d") : # Win64 order
3224 ("%rdi","%esi","%rdx","%ecx"); # Unix order
3231 .type bn_get_bits5,\@abi-omnipotent
3237 movzw (%r10,$num),%eax
3242 .size bn_get_bits5,.-bn_get_bits5
3245 .type bn_scatter5,\@abi-omnipotent
3249 jz .Lscatter_epilogue
3250 lea ($tbl,$idx,8),$tbl
3260 .size bn_scatter5,.-bn_scatter5
3263 .type bn_gather5,\@abi-omnipotent
3267 $code.=<<___ if ($win64);
3268 .LSEH_begin_bn_gather5:
3269 # I can't trust assembler to use specific encoding:-(
3270 .byte 0x48,0x83,0xec,0x28 #sub \$0x28,%rsp
3271 .byte 0x0f,0x29,0x34,0x24 #movaps %xmm6,(%rsp)
3272 .byte 0x0f,0x29,0x7c,0x24,0x10 #movdqa %xmm7,0x10(%rsp)
3276 shr \$`log($N/8)/log(2)`,$idx
3279 lea .Lmagic_masks(%rip),%rax
3280 and \$`2**5/($N/8)-1`,$idx # 5 is "window size"
3281 lea 128($tbl,%r11,8),$tbl # pointer within 1st cache line
3282 movq 0(%rax,$idx,8),%xmm4 # set of masks denoting which
3283 movq 8(%rax,$idx,8),%xmm5 # cache line contains element
3284 movq 16(%rax,$idx,8),%xmm6 # denoted by 7th argument
3285 movq 24(%rax,$idx,8),%xmm7
3289 movq `0*$STRIDE/4-128`($tbl),%xmm0
3290 movq `1*$STRIDE/4-128`($tbl),%xmm1
3292 movq `2*$STRIDE/4-128`($tbl),%xmm2
3294 movq `3*$STRIDE/4-128`($tbl),%xmm3
3300 lea $STRIDE($tbl),$tbl
3303 movq %xmm0,($out) # m0=bp[0]
3308 $code.=<<___ if ($win64);
3310 movaps 0x10(%rsp),%xmm7
3315 .LSEH_end_bn_gather5:
3316 .size bn_gather5,.-bn_gather5
3322 .long 0,0, 0,0, 0,0, -1,-1
3323 .long 0,0, 0,0, 0,0, 0,0
3324 .asciz "Montgomery Multiplication with scatter/gather for x86_64, CRYPTOGAMS by <appro\@openssl.org>"
3327 # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame,
3328 # CONTEXT *context,DISPATCHER_CONTEXT *disp)
3336 .extern __imp_RtlVirtualUnwind
3337 .type mul_handler,\@abi-omnipotent
3351 mov 120($context),%rax # pull context->Rax
3352 mov 248($context),%rbx # pull context->Rip
3354 mov 8($disp),%rsi # disp->ImageBase
3355 mov 56($disp),%r11 # disp->HandlerData
3357 mov 0(%r11),%r10d # HandlerData[0]
3358 lea (%rsi,%r10),%r10 # end of prologue label
3359 cmp %r10,%rbx # context->Rip<end of prologue label
3360 jb .Lcommon_seh_tail
3362 mov 152($context),%rax # pull context->Rsp
3364 mov 4(%r11),%r10d # HandlerData[1]
3365 lea (%rsi,%r10),%r10 # epilogue label
3366 cmp %r10,%rbx # context->Rip>=epilogue label
3367 jae .Lcommon_seh_tail
3369 lea .Lmul_epilogue(%rip),%r10
3373 mov 192($context),%r10 # pull $num
3374 mov 8(%rax,%r10,8),%rax # pull saved stack pointer
3378 mov 40(%rax),%rax # pull saved stack pointer
3381 movaps -88(%rax),%xmm0
3382 movaps -72(%rax),%xmm1
3390 mov %rbx,144($context) # restore context->Rbx
3391 mov %rbp,160($context) # restore context->Rbp
3392 mov %r12,216($context) # restore context->R12
3393 mov %r13,224($context) # restore context->R13
3394 mov %r14,232($context) # restore context->R14
3395 mov %r15,240($context) # restore context->R15
3396 movups %xmm0,512($context) # restore context->Xmm6
3397 movups %xmm1,528($context) # restore context->Xmm7
3402 mov %rax,152($context) # restore context->Rsp
3403 mov %rsi,168($context) # restore context->Rsi
3404 mov %rdi,176($context) # restore context->Rdi
3406 mov 40($disp),%rdi # disp->ContextRecord
3407 mov $context,%rsi # context
3408 mov \$154,%ecx # sizeof(CONTEXT)
3409 .long 0xa548f3fc # cld; rep movsq
3412 xor %rcx,%rcx # arg1, UNW_FLAG_NHANDLER
3413 mov 8(%rsi),%rdx # arg2, disp->ImageBase
3414 mov 0(%rsi),%r8 # arg3, disp->ControlPc
3415 mov 16(%rsi),%r9 # arg4, disp->FunctionEntry
3416 mov 40(%rsi),%r10 # disp->ContextRecord
3417 lea 56(%rsi),%r11 # &disp->HandlerData
3418 lea 24(%rsi),%r12 # &disp->EstablisherFrame
3419 mov %r10,32(%rsp) # arg5
3420 mov %r11,40(%rsp) # arg6
3421 mov %r12,48(%rsp) # arg7
3422 mov %rcx,56(%rsp) # arg8, (NULL)
3423 call *__imp_RtlVirtualUnwind(%rip)
3425 mov \$1,%eax # ExceptionContinueSearch
3437 .size mul_handler,.-mul_handler
3441 .rva .LSEH_begin_bn_mul_mont_gather5
3442 .rva .LSEH_end_bn_mul_mont_gather5
3443 .rva .LSEH_info_bn_mul_mont_gather5
3445 .rva .LSEH_begin_bn_mul4x_mont_gather5
3446 .rva .LSEH_end_bn_mul4x_mont_gather5
3447 .rva .LSEH_info_bn_mul4x_mont_gather5
3449 .rva .LSEH_begin_bn_power5
3450 .rva .LSEH_end_bn_power5
3451 .rva .LSEH_info_bn_power5
3453 .rva .LSEH_begin_bn_from_mont8x
3454 .rva .LSEH_end_bn_from_mont8x
3455 .rva .LSEH_info_bn_from_mont8x
3457 $code.=<<___ if ($addx);
3458 .rva .LSEH_begin_bn_mulx4x_mont_gather5
3459 .rva .LSEH_end_bn_mulx4x_mont_gather5
3460 .rva .LSEH_info_bn_mulx4x_mont_gather5
3462 .rva .LSEH_begin_bn_powerx5
3463 .rva .LSEH_end_bn_powerx5
3464 .rva .LSEH_info_bn_powerx5
3467 .rva .LSEH_begin_bn_gather5
3468 .rva .LSEH_end_bn_gather5
3469 .rva .LSEH_info_bn_gather5
3473 .LSEH_info_bn_mul_mont_gather5:
3476 .rva .Lmul_body,.Lmul_epilogue # HandlerData[]
3478 .LSEH_info_bn_mul4x_mont_gather5:
3481 .rva .Lmul4x_body,.Lmul4x_epilogue # HandlerData[]
3483 .LSEH_info_bn_power5:
3486 .rva .Lpower5_body,.Lpower5_epilogue # HandlerData[]
3488 .LSEH_info_bn_from_mont8x:
3491 .rva .Lfrom_body,.Lfrom_epilogue # HandlerData[]
3493 $code.=<<___ if ($addx);
3495 .LSEH_info_bn_mulx4x_mont_gather5:
3498 .rva .Lmulx4x_body,.Lmulx4x_epilogue # HandlerData[]
3500 .LSEH_info_bn_powerx5:
3503 .rva .Lpowerx5_body,.Lpowerx5_epilogue # HandlerData[]
3507 .LSEH_info_bn_gather5:
3508 .byte 0x01,0x0d,0x05,0x00
3509 .byte 0x0d,0x78,0x01,0x00 #movaps 0x10(rsp),xmm7
3510 .byte 0x08,0x68,0x00,0x00 #movaps (rsp),xmm6
3511 .byte 0x04,0x42,0x00,0x00 #sub rsp,0x28
3516 $code =~ s/\`([^\`]*)\`/eval($1)/gem;