3 # ====================================================================
4 # Written by Andy Polyakov <appro@openssl.org> for the OpenSSL
5 # project. The module is, however, dual licensed under OpenSSL and
6 # CRYPTOGAMS licenses depending on where you obtain it. For further
7 # details see http://www.openssl.org/~appro/cryptogams/.
8 # ====================================================================
12 # Montgomery multiplication for ARMv4.
14 # Performance improvement naturally varies among CPU implementations
15 # and compilers. The code was observed to provide +65-35% improvement
16 # [depending on key length, less for longer keys] on ARM920T, and
17 # +115-80% on Intel IXP425. This is compared to pre-bn_mul_mont code
18 # base and compiler generated code with in-lined umull and even umlal
19 # instructions. The latter means that this code didn't really have an
20 # "advantage" of utilizing some "secret" instruction.
22 # The code is interoperable with Thumb ISA and is rather compact, less
23 # than 1/2KB. Windows CE port would be trivial, as it's exclusively
24 # about decorations, ABI and instruction syntax are identical.
28 # Add NEON code path, which handles lengths divisible by 8. RSA/DSA
29 # performance improvement on Cortex-A8 is ~45-100% depending on key
30 # length, more for longer keys. On Cortex-A15 the span is ~10-105%.
31 # On Snapdragon S4 improvement was measured to vary from ~70% to
32 # incredible ~380%, yes, 4.8x faster, for RSA4096 sign. But this is
33 # rather because original integer-only code seems to perform
34 # suboptimally on S4. Situation on Cortex-A9 is unfortunately
35 # different. It's being looked into, but the trouble is that
36 # performance for vectors longer than 256 bits is actually couple
37 # of percent worse than for integer-only code. The code is chosen
38 # for execution on all NEON-capable processors, because gain on
39 # others outweighs the marginal loss on Cortex-A9.
41 while (($output=shift) && ($output!~/^\w[\w\-]*\.\w+$/)) {}
42 open STDOUT
,">$output";
44 $num="r0"; # starts as num argument, but holds &tp[num-1]
46 $bp="r2"; $bi="r2"; $rp="r2";
53 ########### # r9 is reserved by ELF as platform specific, e.g. TLS pointer
54 $alo="r10"; # sl, gcc uses it to keep @GOT
57 ########### # r13 is stack pointer
59 ########### # r15 is program counter
61 #### argument block layout relative to &tp[num-1], a.k.a. $num
63 # ap permanently resides in r1
65 # np permanently resides in r3
67 $_num="$num,#15*4"; $_bpend=$_num;
75 #if __ARM_MAX_ARCH__>=7
78 .word OPENSSL_armcap_P
-bn_mul_mont
82 .type bn_mul_mont
,%function
86 ldr ip
,[sp
,#4] @ load num
87 stmdb sp
!,{r0
,r2
} @ sp points at argument block
88 #if __ARM_MAX_ARCH__>=7
92 ldr r2
,.LOPENSSL_armcap
94 tst r0
,#1 @ NEON available?
103 mov
$num,ip @ load num
108 stmdb sp
!,{r4
-r12
,lr
} @ save
10 registers
110 mov
$num,$num,lsl
#2 @ rescale $num for byte count
111 sub sp
,sp
,$num @ alloca
(4*num
)
112 sub sp
,sp
,#4 @ +extra dword
113 sub $num,$num,#4 @ "num=num-1"
114 add
$tp,$bp,$num @
&bp
[num
-1]
116 add
$num,sp
,$num @
$num to point at
&tp
[num
-1]
118 ldr
$bi,[$bp] @ bp
[0]
119 ldr
$aj,[$ap],#4 @ ap[0],ap++
120 ldr
$nj,[$np],#4 @ np[0],np++
122 str
$tp,[$_bpend] @ save
&bp
[num
]
124 umull
$alo,$ahi,$aj,$bi @ ap
[0]*bp
[0]
125 str
$n0,[$_n0] @ save n0 value
126 mul
$n0,$alo,$n0 @
"tp[0]"*n0
128 umlal
$alo,$nlo,$nj,$n0 @ np
[0]*n0
+"t[0]"
132 ldr
$aj,[$ap],#4 @ ap[j],ap++
134 ldr
$nj,[$np],#4 @ np[j],np++
136 umlal
$alo,$ahi,$aj,$bi @ ap
[j
]*bp
[0]
138 umlal
$nlo,$nhi,$nj,$n0 @ np
[j
]*n0
140 str
$nlo,[$tp],#4 @ tp[j-1]=,tp++
146 ldr
$tp,[$_bp] @ restore bp
148 ldr
$n0,[$_n0] @ restore n0
150 str
$nlo,[$num] @ tp
[num
-1]=
151 str
$nhi,[$num,#4] @ tp[num]=
154 sub $tj,$num,sp @
"original" $num-1 value
155 sub $ap,$ap,$tj @
"rewind" ap to
&ap
[1]
156 ldr
$bi,[$tp,#4]! @ *(++bp)
157 sub $np,$np,$tj @
"rewind" np to
&np
[1]
158 ldr
$aj,[$ap,#-4] @ ap[0]
159 ldr
$alo,[sp
] @ tp
[0]
160 ldr
$nj,[$np,#-4] @ np[0]
161 ldr
$tj,[sp
,#4] @ tp[1]
164 umlal
$alo,$ahi,$aj,$bi @ ap
[0]*bp
[i
]+tp
[0]
165 str
$tp,[$_bp] @ save bp
168 umlal
$alo,$nlo,$nj,$n0 @ np
[0]*n0
+"tp[0]"
172 ldr
$aj,[$ap],#4 @ ap[j],ap++
173 adds
$alo,$ahi,$tj @
+=tp
[j
]
174 ldr
$nj,[$np],#4 @ np[j],np++
176 umlal
$alo,$ahi,$aj,$bi @ ap
[j
]*bp
[i
]
178 umlal
$nlo,$nhi,$nj,$n0 @ np
[j
]*n0
180 ldr
$tj,[$tp,#8] @ tp[j+1]
182 str
$nlo,[$tp],#4 @ tp[j-1]=,tp++
189 ldr
$tp,[$_bp] @ restore bp
191 ldr
$n0,[$_n0] @ restore n0
193 ldr
$tj,[$_bpend] @ restore
&bp
[num
]
195 str
$nlo,[$num] @ tp
[num
-1]=
196 str
$nhi,[$num,#4] @ tp[num]=
201 ldr
$rp,[$_rp] @ pull rp
202 add
$num,$num,#4 @ $num to point at &tp[num]
203 sub $aj,$num,sp @
"original" num value
204 mov
$tp,sp @
"rewind" $tp
205 mov
$ap,$tp @
"borrow" $ap
206 sub $np,$np,$aj @
"rewind" $np to
&np
[0]
208 subs
$tj,$tj,$tj @
"clear" carry flag
209 .Lsub
: ldr
$tj,[$tp],#4
211 sbcs
$tj,$tj,$nj @ tp
[j
]-np
[j
]
212 str
$tj,[$rp],#4 @ rp[j]=
213 teq
$tp,$num @ preserve carry
215 sbcs
$nhi,$nhi,#0 @ upmost carry
216 mov
$tp,sp @
"rewind" $tp
217 sub $rp,$rp,$aj @
"rewind" $rp
221 orr
$ap,$ap,$np @ ap
=borrow?tp
:rp
223 .Lcopy
: ldr
$tj,[$ap],#4 @ copy or in-place refresh
224 str sp
,[$tp],#4 @ zap tp
229 add sp
,$num,#4 @ skip over tp[num+1]
230 ldmia sp
!,{r4
-r12
,lr
} @ restore registers
231 add sp
,sp
,#2*4 @ skip over {r0,r2}
238 moveq pc
,lr @ be binary compatible with V4
, yet
239 bx lr @ interoperable with Thumb ISA
:-)
241 .size bn_mul_mont
,.-bn_mul_mont
244 sub Dlo
() { shift=~m
|q
([1]?
[0-9])|?
"d".($1*2):""; }
245 sub Dhi
() { shift=~m
|q
([1]?
[0-9])|?
"d".($1*2+1):""; }
247 my ($A0,$A1,$A2,$A3)=map("d$_",(0..3));
248 my ($N0,$N1,$N2,$N3)=map("d$_",(4..7));
249 my ($Z,$Temp)=("q4","q5");
250 my ($A0xB,$A1xB,$A2xB,$A3xB,$A4xB,$A5xB,$A6xB,$A7xB)=map("q$_",(6..13));
251 my ($Bi,$Ni,$M0)=map("d$_",(28..31));
253 my $temp=&Dlo
($Temp);
255 my ($rptr,$aptr,$bptr,$nptr,$n0,$num)=map("r$_",(0..5));
256 my ($tinptr,$toutptr,$inner,$outer)=map("r$_",(6..9));
259 #if __ARM_MAX_ARCH__>=7
263 .type bn_mul8x_mont_neon
,%function
268 vstmdb sp
!,{d8
-d15
} @ ABI specification says so
269 ldmia ip
,{r4
-r5
} @ load rest of parameter block
272 vld1
.32
{${Bi
}[0]}, [$bptr,:32]!
273 sub $toutptr,$toutptr,$num,lsl
#4
274 vld1
.32
{$A0-$A3}, [$aptr]! @ can
't specify :32 :-(
275 and $toutptr,$toutptr,#-64
276 vld1.32 {${M0}[0]}, [$n0,:32]
277 mov sp,$toutptr @ alloca
278 veor $zero,$zero,$zero
282 vmull.u32 $A0xB,$Bi,${A0}[0]
283 vmull.u32 $A1xB,$Bi,${A0}[1]
284 vmull.u32 $A2xB,$Bi,${A1}[0]
285 vshl.i64 $temp,`&Dhi("$A0xB")`,#16
286 vmull.u32 $A3xB,$Bi,${A1}[1]
288 vadd.u64 $temp,$temp,`&Dlo("$A0xB")`
289 veor $zero,$zero,$zero
290 vmul.u32 $Ni,$temp,$M0
292 vmull.u32 $A4xB,$Bi,${A2}[0]
293 vld1.32 {$N0-$N3}, [$nptr]!
294 vmull.u32 $A5xB,$Bi,${A2}[1]
295 vmull.u32 $A6xB,$Bi,${A3}[0]
297 vmull.u32 $A7xB,$Bi,${A3}[1]
301 @ special case for num=8, everything is in register bank...
303 vmlal.u32 $A0xB,$Ni,${N0}[0]
305 vmlal.u32 $A1xB,$Ni,${N0}[1]
306 vmlal.u32 $A2xB,$Ni,${N1}[0]
307 vmlal.u32 $A3xB,$Ni,${N1}[1]
309 vmlal.u32 $A4xB,$Ni,${N2}[0]
311 vmlal.u32 $A5xB,$Ni,${N2}[1]
313 vmlal.u32 $A6xB,$Ni,${N3}[0]
315 vmlal.u32 $A7xB,$Ni,${N3}[1]
318 vshr.u64 $temp,$temp,#16
321 vadd.u64 $temp,$temp,`&Dhi("$Temp")`
324 vshr.u64 $temp,$temp,#16
330 vld1.32 {${Bi}[0]}, [$bptr,:32]!
331 veor $zero,$zero,$zero
333 vadd.u64 `&Dlo("$A0xB")`,`&Dlo("$A0xB")`,$temp
335 vmlal.u32 $A0xB,$Bi,${A0}[0]
336 vmlal.u32 $A1xB,$Bi,${A0}[1]
337 vmlal.u32 $A2xB,$Bi,${A1}[0]
338 vshl.i64 $temp,`&Dhi("$A0xB")`,#16
339 vmlal.u32 $A3xB,$Bi,${A1}[1]
341 vadd.u64 $temp,$temp,`&Dlo("$A0xB")`
342 veor $zero,$zero,$zero
343 subs $outer,$outer,#1
344 vmul.u32 $Ni,$temp,$M0
346 vmlal.u32 $A4xB,$Bi,${A2}[0]
347 vmlal.u32 $A5xB,$Bi,${A2}[1]
348 vmlal.u32 $A6xB,$Bi,${A3}[0]
350 vmlal.u32 $A7xB,$Bi,${A3}[1]
352 vmlal.u32 $A0xB,$Ni,${N0}[0]
353 vmlal.u32 $A1xB,$Ni,${N0}[1]
354 vmlal.u32 $A2xB,$Ni,${N1}[0]
355 vmlal.u32 $A3xB,$Ni,${N1}[1]
357 vmlal.u32 $A4xB,$Ni,${N2}[0]
359 vmlal.u32 $A5xB,$Ni,${N2}[1]
361 vmlal.u32 $A6xB,$Ni,${N3}[0]
363 vmlal.u32 $A7xB,$Ni,${N3}[1]
366 vshr.u64 $temp,$temp,#16
369 vadd.u64 $temp,$temp,`&Dhi("$Temp")`
372 vshr.u64 $temp,$temp,#16
376 vadd.u64 `&Dlo("$A0xB")`,`&Dlo("$A0xB")`,$temp
378 vshr.u64 $temp,`&Dlo("$A0xB")`,#16
380 vadd.u64 `&Dhi("$A0xB")`,`&Dhi("$A0xB")`,$temp
382 vshr.u64 $temp,`&Dhi("$A0xB")`,#16
383 vzip.16 `&Dlo("$A0xB")`,`&Dhi("$A0xB")`
389 vmlal.u32 $A0xB,$Ni,${N0}[0]
390 vld1.32 {$A0-$A3}, [$aptr]!
391 vmlal.u32 $A1xB,$Ni,${N0}[1]
392 subs $inner,$inner,#8
393 vmlal.u32 $A2xB,$Ni,${N1}[0]
394 vmlal.u32 $A3xB,$Ni,${N1}[1]
396 vmlal.u32 $A4xB,$Ni,${N2}[0]
397 vld1.32 {$N0-$N1}, [$nptr]!
398 vmlal.u32 $A5xB,$Ni,${N2}[1]
399 vst1.64 {$A0xB-$A1xB}, [$toutptr,:256]!
400 vmlal.u32 $A6xB,$Ni,${N3}[0]
401 vmlal.u32 $A7xB,$Ni,${N3}[1]
402 vst1.64 {$A2xB-$A3xB}, [$toutptr,:256]!
404 vmull.u32 $A0xB,$Bi,${A0}[0]
405 vld1.32 {$N2-$N3}, [$nptr]!
406 vmull.u32 $A1xB,$Bi,${A0}[1]
407 vst1.64 {$A4xB-$A5xB}, [$toutptr,:256]!
408 vmull.u32 $A2xB,$Bi,${A1}[0]
409 vmull.u32 $A3xB,$Bi,${A1}[1]
410 vst1.64 {$A6xB-$A7xB}, [$toutptr,:256]!
412 vmull.u32 $A4xB,$Bi,${A2}[0]
413 vmull.u32 $A5xB,$Bi,${A2}[1]
414 vmull.u32 $A6xB,$Bi,${A3}[0]
415 vmull.u32 $A7xB,$Bi,${A3}[1]
419 vmlal.u32 $A0xB,$Ni,${N0}[0]
421 vmlal.u32 $A1xB,$Ni,${N0}[1]
422 sub $aptr,$aptr,$num,lsl#2 @ rewind $aptr
423 vmlal.u32 $A2xB,$Ni,${N1}[0]
424 vld1.64 {$Temp}, [sp,:128]
425 vmlal.u32 $A3xB,$Ni,${N1}[1]
428 vmlal.u32 $A4xB,$Ni,${N2}[0]
429 vst1.64 {$A0xB-$A1xB}, [$toutptr,:256]!
430 vmlal.u32 $A5xB,$Ni,${N2}[1]
431 vshr.u64 $temp,$temp,#16
432 vld1.64 {$A0xB}, [$tinptr, :128]!
433 vmlal.u32 $A6xB,$Ni,${N3}[0]
434 vst1.64 {$A2xB-$A3xB}, [$toutptr,:256]!
435 vmlal.u32 $A7xB,$Ni,${N3}[1]
437 vst1.64 {$A4xB-$A5xB}, [$toutptr,:256]!
438 vadd.u64 $temp,$temp,`&Dhi("$Temp")`
440 vst1.64 {$A6xB-$A7xB}, [$toutptr,:256]!
441 vld1.64 {$A1xB-$A2xB}, [$tinptr, :256]!
442 vst1.64 {$Z}, [$toutptr,:128]
443 vshr.u64 $temp,$temp,#16
449 vld1.32 {${Bi}[0]}, [$bptr,:32]!
450 sub $nptr,$nptr,$num,lsl#2 @ rewind $nptr
451 vld1.32 {$A0-$A3}, [$aptr]!
452 veor $zero,$zero,$zero
456 vadd.u64 `&Dlo("$A0xB")`,`&Dlo("$A0xB")`,$temp
458 vmlal.u32 $A0xB,$Bi,${A0}[0]
459 vld1.64 {$A3xB-$A4xB},[$tinptr,:256]!
460 vmlal.u32 $A1xB,$Bi,${A0}[1]
461 vmlal.u32 $A2xB,$Bi,${A1}[0]
462 vld1.64 {$A5xB-$A6xB},[$tinptr,:256]!
463 vmlal.u32 $A3xB,$Bi,${A1}[1]
465 vshl.i64 $temp,`&Dhi("$A0xB")`,#16
466 veor $zero,$zero,$zero
467 vadd.u64 $temp,$temp,`&Dlo("$A0xB")`
468 vld1.64 {$A7xB},[$tinptr,:128]!
469 vmul.u32 $Ni,$temp,$M0
471 vmlal.u32 $A4xB,$Bi,${A2}[0]
472 vld1.32 {$N0-$N3}, [$nptr]!
473 vmlal.u32 $A5xB,$Bi,${A2}[1]
474 vmlal.u32 $A6xB,$Bi,${A3}[0]
476 vmlal.u32 $A7xB,$Bi,${A3}[1]
479 vmlal.u32 $A0xB,$Ni,${N0}[0]
480 vld1.32 {$A0-$A3}, [$aptr]!
481 vmlal.u32 $A1xB,$Ni,${N0}[1]
482 subs $inner,$inner,#8
483 vmlal.u32 $A2xB,$Ni,${N1}[0]
484 vmlal.u32 $A3xB,$Ni,${N1}[1]
485 vst1.64 {$A0xB-$A1xB}, [$toutptr,:256]!
487 vmlal.u32 $A4xB,$Ni,${N2}[0]
488 vld1.64 {$A0xB}, [$tinptr, :128]!
489 vmlal.u32 $A5xB,$Ni,${N2}[1]
490 vst1.64 {$A2xB-$A3xB}, [$toutptr,:256]!
491 vmlal.u32 $A6xB,$Ni,${N3}[0]
492 vld1.64 {$A1xB-$A2xB}, [$tinptr, :256]!
493 vmlal.u32 $A7xB,$Ni,${N3}[1]
494 vst1.64 {$A4xB-$A5xB}, [$toutptr,:256]!
496 vmlal.u32 $A0xB,$Bi,${A0}[0]
497 vld1.64 {$A3xB-$A4xB}, [$tinptr, :256]!
498 vmlal.u32 $A1xB,$Bi,${A0}[1]
499 vst1.64 {$A6xB-$A7xB}, [$toutptr,:256]!
500 vmlal.u32 $A2xB,$Bi,${A1}[0]
501 vld1.64 {$A5xB-$A6xB}, [$tinptr, :256]!
502 vmlal.u32 $A3xB,$Bi,${A1}[1]
503 vld1.32 {$N0-$N3}, [$nptr]!
505 vmlal.u32 $A4xB,$Bi,${A2}[0]
506 vld1.64 {$A7xB}, [$tinptr, :128]!
507 vmlal.u32 $A5xB,$Bi,${A2}[1]
508 vmlal.u32 $A6xB,$Bi,${A3}[0]
509 vmlal.u32 $A7xB,$Bi,${A3}[1]
513 vmlal.u32 $A0xB,$Ni,${N0}[0]
515 vmlal.u32 $A1xB,$Ni,${N0}[1]
516 sub $aptr,$aptr,$num,lsl#2 @ rewind $aptr
517 vmlal.u32 $A2xB,$Ni,${N1}[0]
518 vld1.64 {$Temp}, [sp,:128]
519 vmlal.u32 $A3xB,$Ni,${N1}[1]
520 subs $outer,$outer,#1
522 vmlal.u32 $A4xB,$Ni,${N2}[0]
523 vst1.64 {$A0xB-$A1xB}, [$toutptr,:256]!
524 vmlal.u32 $A5xB,$Ni,${N2}[1]
525 vld1.64 {$A0xB}, [$tinptr, :128]!
526 vshr.u64 $temp,$temp,#16
527 vst1.64 {$A2xB-$A3xB}, [$toutptr,:256]!
528 vmlal.u32 $A6xB,$Ni,${N3}[0]
529 vld1.64 {$A1xB-$A2xB}, [$tinptr, :256]!
530 vmlal.u32 $A7xB,$Ni,${N3}[1]
532 vst1.64 {$A4xB-$A5xB}, [$toutptr,:256]!
533 vadd.u64 $temp,$temp,`&Dhi("$Temp")`
534 vst1.64 {$A6xB-$A7xB}, [$toutptr,:256]!
535 vshr.u64 $temp,$temp,#16
543 vadd.u64 `&Dlo("$A0xB")`,`&Dlo("$A0xB")`,$temp
544 vld1.64 {$A3xB-$A4xB}, [$tinptr, :256]!
545 vshr.u64 $temp,`&Dlo("$A0xB")`,#16
546 vadd.u64 `&Dhi("$A0xB")`,`&Dhi("$A0xB")`,$temp
547 vld1.64 {$A5xB-$A6xB}, [$tinptr, :256]!
548 vshr.u64 $temp,`&Dhi("$A0xB")`,#16
549 vld1.64 {$A7xB}, [$tinptr, :128]!
550 vzip.16 `&Dlo("$A0xB")`,`&Dhi("$A0xB")`
553 vadd.u64 `&Dlo("$A1xB")`,`&Dlo("$A1xB")`,$temp
554 vst1.32 {`&Dlo("$A0xB")`[0]}, [$toutptr, :32]!
555 vshr.u64 $temp,`&Dlo("$A1xB")`,#16
556 vadd.u64 `&Dhi("$A1xB")`,`&Dhi("$A1xB")`,$temp
557 vshr.u64 $temp,`&Dhi("$A1xB")`,#16
558 vzip.16 `&Dlo("$A1xB")`,`&Dhi("$A1xB")`
560 vadd.u64 `&Dlo("$A2xB")`,`&Dlo("$A2xB")`,$temp
561 vst1.32 {`&Dlo("$A1xB")`[0]}, [$toutptr, :32]!
562 vshr.u64 $temp,`&Dlo("$A2xB")`,#16
563 vadd.u64 `&Dhi("$A2xB")`,`&Dhi("$A2xB")`,$temp
564 vshr.u64 $temp,`&Dhi("$A2xB")`,#16
565 vzip.16 `&Dlo("$A2xB")`,`&Dhi("$A2xB")`
567 vadd.u64 `&Dlo("$A3xB")`,`&Dlo("$A3xB")`,$temp
568 vst1.32 {`&Dlo("$A2xB")`[0]}, [$toutptr, :32]!
569 vshr.u64 $temp,`&Dlo("$A3xB")`,#16
570 vadd.u64 `&Dhi("$A3xB")`,`&Dhi("$A3xB")`,$temp
571 vshr.u64 $temp,`&Dhi("$A3xB")`,#16
572 vzip.16 `&Dlo("$A3xB")`,`&Dhi("$A3xB")`
574 vadd.u64 `&Dlo("$A4xB")`,`&Dlo("$A4xB")`,$temp
575 vst1.32 {`&Dlo("$A3xB")`[0]}, [$toutptr, :32]!
576 vshr.u64 $temp,`&Dlo("$A4xB")`,#16
577 vadd.u64 `&Dhi("$A4xB")`,`&Dhi("$A4xB")`,$temp
578 vshr.u64 $temp,`&Dhi("$A4xB")`,#16
579 vzip.16 `&Dlo("$A4xB")`,`&Dhi("$A4xB")`
581 vadd.u64 `&Dlo("$A5xB")`,`&Dlo("$A5xB")`,$temp
582 vst1.32 {`&Dlo("$A4xB")`[0]}, [$toutptr, :32]!
583 vshr.u64 $temp,`&Dlo("$A5xB")`,#16
584 vadd.u64 `&Dhi("$A5xB")`,`&Dhi("$A5xB")`,$temp
585 vshr.u64 $temp,`&Dhi("$A5xB")`,#16
586 vzip.16 `&Dlo("$A5xB")`,`&Dhi("$A5xB")`
588 vadd.u64 `&Dlo("$A6xB")`,`&Dlo("$A6xB")`,$temp
589 vst1.32 {`&Dlo("$A5xB")`[0]}, [$toutptr, :32]!
590 vshr.u64 $temp,`&Dlo("$A6xB")`,#16
591 vadd.u64 `&Dhi("$A6xB")`,`&Dhi("$A6xB")`,$temp
592 vld1.64 {$A0xB}, [$tinptr, :128]!
593 vshr.u64 $temp,`&Dhi("$A6xB")`,#16
594 vzip.16 `&Dlo("$A6xB")`,`&Dhi("$A6xB")`
596 vadd.u64 `&Dlo("$A7xB")`,`&Dlo("$A7xB")`,$temp
597 vst1.32 {`&Dlo("$A6xB")`[0]}, [$toutptr, :32]!
598 vshr.u64 $temp,`&Dlo("$A7xB")`,#16
599 vadd.u64 `&Dhi("$A7xB")`,`&Dhi("$A7xB")`,$temp
600 vld1.64 {$A1xB-$A2xB}, [$tinptr, :256]!
601 vshr.u64 $temp,`&Dhi("$A7xB")`,#16
602 vzip.16 `&Dlo("$A7xB")`,`&Dhi("$A7xB")`
603 subs $inner,$inner,#8
604 vst1.32 {`&Dlo("$A7xB")`[0]}, [$toutptr, :32]!
608 vst1.32 {${temp}[0]}, [$toutptr, :32] @ top-most bit
609 sub $nptr,$nptr,$num,lsl#2 @ rewind $nptr
610 subs $aptr,sp,#0 @ clear carry flag
611 add $bptr,sp,$num,lsl#2
614 ldmia $aptr!, {r4-r7}
615 ldmia $nptr!, {r8-r11}
620 teq $aptr,$bptr @ preserves carry
621 stmia $rptr!, {r8-r11}
624 ldr r10, [$aptr] @ load top-most bit
626 sub r11,$bptr,sp @ this is num*4
629 sub $rptr,$rptr,r11 @ rewind $rptr
630 mov $nptr,$bptr @ second 3/4th of frame
631 sbcs r10,r10,#0 @ result is carry flag
634 ldmia $aptr!, {r4-r7}
635 ldmia $rptr, {r8-r11}
637 vst1.64 {q0-q1}, [$nptr,:256]! @ wipe
640 vst1.64 {q0-q1}, [$nptr,:256]! @ wipe
643 stmia $rptr!, {r8-r11}
645 ldmia $rptr, {r8-r11}
647 vst1.64 {q0-q1}, [$aptr,:256]! @ wipe
650 vst1.64 {q0-q1}, [$nptr,:256]! @ wipe
652 teq $aptr,$bptr @ preserves carry
653 stmia $rptr!, {r8-r11}
654 bne .LNEON_copy_n_zap
660 .size bn_mul8x_mont_neon,.-bn_mul8x_mont_neon
665 .asciz "Montgomery multiplication for ARMv4/NEON, CRYPTOGAMS by <appro\@openssl.org>"
667 #if __ARM_MAX_ARCH__>=7
668 .comm OPENSSL_armcap_P,4,4
672 $code =~ s/\`([^\`]*)\`/eval $1/gem;
673 $code =~ s/\bbx\s+lr\b/.word\t0xe12fff1e/gm; # make it possible to compile with -march=armv4
674 $code =~ s/\bret\b/bx lr/gm;